2f4c8b6bfa67b264504104407c7bb9fc7b9b8d1bc59cb16ca2123211f2b0b65e

Analysis

max time kernel
97s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Size 888KB
Sample260710-y2mlpaa12w
SHA256 2f4c8b6bfa67b264504104407c7bb9fc7b9b8d1bc59cb16ca2123211f2b0b65e
MD5 69be5beaa3bc85de06821945f06d82a3
SHA1 2d626306e7ae15beb6164ae77c70ea7bc7624845
SHA512 77c787e34a428212a696e22254c302ea762455cb1b72fdcc43917317019d5d2eeab94e3e6fe6dfac50da182127c6728e6b8fc83e7c9ccc532fb67e521fb2716c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavC:bHuHNgHg1flT/Vk3HYwLfUwavC
TLSH
T152157C63DEA498D2D6B648708EA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2100-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5bc-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2100-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4504-167-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1204.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5bc-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-568.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-951.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1006.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1049.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1092.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1135.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1166.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1204.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1334.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1365.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1372.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4504	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe

Drops file in Windows directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2100	2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
4504	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_69be5beaa3bc85de06821945f06d82a3_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2100

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 888KB
SHA256 2f4c8b6bfa67b264504104407c7bb9fc7b9b8d1bc59cb16ca2123211f2b0b65e
MD5 69be5beaa3bc85de06821945f06d82a3
SHA1 2d626306e7ae15beb6164ae77c70ea7bc7624845
SHA512 77c787e34a428212a696e22254c302ea762455cb1b72fdcc43917317019d5d2eeab94e3e6fe6dfac50da182127c6728e6b8fc83e7c9ccc532fb67e521fb2716c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavC:bHuHNgHg1flT/Vk3HYwLfUwavC
TLSH
T152157C63DEA498D2D6B648708EA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 568c890e63dd7250c82dc25331c1b7eb5874e61f101761e21812117b003b9207
MD5 e0d558fa0ff326469e86ce7dc08bbd10
SHA1 4d4a6f945f54f86525a68777c1a1b43f631a8692
SHA512 c226328a867e57d85e80a60a8fc6ce76ff73e12f3210535f007e557d6304d4b55444765a6371b874bef1b58c80d2852ad65d8d728c3fec5319b459807d2991b3
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwavC0Le5ji0hmxNrM:T2agnTkLfU+Pji0Aj
TLSH
T1A5656C26FA7486A2D0B3C4B4C9D2974AEA717D510B3086CB8294F36D6E337D19E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 902KB
SHA256 bfab76ab56430df843d2b419e87da2270235376099f5ba5f3b7a37c096d8ab6d
MD5 fe854b1fa245e644e972f88faa6e23c0
SHA1 09f80e806ac81a2ee3a785cc5a94ec904e6448db
SHA512 90f1bd026022a951547a6f161f4a9bf4ca0566896caf4ffc2a3b18bd3deba289b9d2a9e00c4c898120f3032eb21c95aa79f40ff755f391e74d51bb4876fb7ba9
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavMa:bHuHNgHg1flT/Vk3HYwLfUwavMa
TLSH
T10F157C23DEA498D2D6B648709EA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 911KB
SHA256 9c3f5533e6ebefa7ea8e18cd4bc624476b68522d0ecbf88ac8c7c642e8c1b6d0
MD5 7c43feaf316daf8a148ae9faa2a42a09
SHA1 6770999b6d8ed80a7e41d965be85527917390f5f
SHA512 df7ee95fa08e230a1cfefa839b41f4cf4311469031829ba3685af16cef670c374c05890a4d7dd8a430cb560fcadd7a0fc5a8ba253555e46976e4cd95d40e941e
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavl6:bHuHNgHg1flT/Vk3HYwLfUwavl6
TLSH
T1FF157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 911KB
SHA256 eae5d9b3088c1880d0bb3fd9e10c68dbb1e8d7cd3425c32be87907dfab86a916
MD5 c3fd5b5b25a79e0bcd057839984f3f3d
SHA1 b17b464dda81f8b06029e9058b57052fc41003bf
SHA512 3fb3296112fc6aa0c9651c32387a7ac10e25736a8a57b52ae7620c0ed28d4ddb5250b9bb51a59895c322a83062afd6571cb6daeb27dc74ee3c0f94a566543789
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOav7N:bHuHNgHg1flT/Vk3HYwLfUwav7N
TLSH
T147157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 911KB
SHA256 b1cabbfa2c941a238c3300eab4ff01933a1666c4a3f9d75b06b117c8f2898ae8
MD5 bb8913b020575b2cac4decd72bacbf17
SHA1 5077d5f1bd75fb46415ea1a9952ba1c3aa821935
SHA512 daa1a89cb7bb8691fb33196ea537f7bd50803c6563c23a2afc7f884696f1ade0685d44cbc60f449c4a37ff68dca5b2d6a1bda92c586072bfea72ded013766d6d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavZf:bHuHNgHg1flT/Vk3HYwLfUwavZf
TLSH
T172157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 911KB
SHA256 873fe1ce0fe7a6511c3c2795e061f9ea433c97bc93f2c83cef35fbb59a878e7a
MD5 3e7d63e5340498cf8ffb61e6ce7fd9bc
SHA1 c6c18ec08308105cdbcafa0d156b48505aba1256
SHA512 c1c3d4fb4269e08a8f55977f49a136f275d8c966f377c2f65e9b37c0ba95aaf6ea7a82b728504d4d0919ff75bdde6005d1b2377d79b7f8fd857787e456619600
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavbo:bHuHNgHg1flT/Vk3HYwLfUwavbo
TLSH
T18C157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 911KB
SHA256 b50c1dac86b157e374031b03de549ae0feec10abc4fca541295284d082ae7274
MD5 62e554721a7f78a80df1781c370ced98
SHA1 f70d31f303d99fd01e4f553b0aef1ecaba0c8278
SHA512 9d6ac687bd0c4961162bb30a2645b135c05b2501c80f1c162685b274b6853ad78cb0c59706922b4177252f510e76a0d3357c8dda21e369c09bf6b82aa4b8a5e5
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavPu:bHuHNgHg1flT/Vk3HYwLfUwavPu
TLSH
T1C5157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 911KB
SHA256 a862c677e66d8bff7d6903401f64ef810c56573305210ced921806d3f650340c
MD5 63acdb1b63bb2029dab3d654b7484543
SHA1 ed26e1818ede34e21f5f6cb8295d73d25750ee55
SHA512 7114e78f31709ebddbc899f744ab7b5f40caa7abd31108ac65b346750721a77e820a73fbbfc078f043af0f58c006527ae62fd54c48789adde3eb859330b56cf8
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavd9:bHuHNgHg1flT/Vk3HYwLfUwavd9
TLSH
T140157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 911KB
SHA256 9fb15c4259783e8aeea28edf7495eafaddd620c61d470b7209bc5b0871ed72d3
MD5 66f5a8a0652007069c6d6b9ec9b6cadc
SHA1 ff3d932579f692a6cebcdb52e71d9b3106c18978
SHA512 5184bad71e019dd25d8d41e117d576cfc860fe06ddbfacc539e449d3625b36fd6cab4b17d61cf08cde21b913b342bf5f7017b032664daf501751b552f0ab2d39
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOav5c:bHuHNgHg1flT/Vk3HYwLfUwav5c
TLSH
T1ED157C23DEA498D2D6B648709EA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 911KB
SHA256 9452873e9485ae6065e64e8f63aab1e0429c1b0151f0669a747b794b9657cdbc
MD5 b66313c3398d0ba115e3722ec2a337dd
SHA1 239b78e9e7f76bf6bbc89c5fd262e49b18aa58d0
SHA512 0370dba3e24adbdbc53354c8bf8ac7d65f1bb957eeaa1ce664fa071587e3f2e82cc3fdc657cfa189e15cdf4668e9ef546e3f1c2603602ecb0366868ef4f65c53
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavyp:bHuHNgHg1flT/Vk3HYwLfUwavyp
TLSH
T1DB157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 911KB
SHA256 5f79c88839083d8a06a9526e08b073f88778a6975b86a3d2bb73cf6f34ba3eaa
MD5 a48075da29d2816546b827727e12d00d
SHA1 faeb14841adca7b9c8505f70d1a2d2c199f3c316
SHA512 b6a38fe6d0b67a25e79a4f79012142b063b0da6637034039686b0384d34c4a0ac9085dfd4bd76b0225e517fa2a11c64b4c2ea152dd4179094ff543434058fb73
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavF0a:bHuHNgHg1flT/Vk3HYwLfUwavFN
TLSH
T13E157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 911KB
SHA256 df784fdfe88fb4216a2d362356ece307060f8de296911471638d00717bcc0af1
MD5 731e95afaa693d4cc9f74ac97d52c950
SHA1 71311abc20bfb1b386186f63c9b74c7280dcf04c
SHA512 8eb58c6fb536e420135d36641292451ea211e3c03f5693f6f0c49c6f68c9f0ef4da34aab1321b0c4bea2ae2357af119a1350c81c19be0fc6d343e43541184a53
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavXF:bHuHNgHg1flT/Vk3HYwLfUwavXF
TLSH
T1F7157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 911KB
SHA256 fdc4b0d73e6c107a649dd443e18da8ec2811052001a0f11c0222b0dab243b76e
MD5 69da00fa93323c56fc1c988988d22cd6
SHA1 ff4ccb66510fe3051c35f24ebd061d8e22250e4d
SHA512 f1b54c1500e858be200252aa51f0e5e39cec8a3c719a483111a469fa5f50bd7b7099880f569322c95b011c0df44911f56222abac7be9c1291faea0cb2b7985e1
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavoC:bHuHNgHg1flT/Vk3HYwLfUwavoC
TLSH
T14C157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 911KB
SHA256 890f945b65eb19434aceac636236057d6125b4c54012030edb28ae0002aaf716
MD5 1d57a1616d3bb6a788781623ea42fb1c
SHA1 c5f3a7cb3284627d7909ec3ac334d85d31b89023
SHA512 350ac9efbc4a7d5b37feb9b83bb9890de80a78222b575f43a91903b856087f3d1cfa2d732f204691eea542d74d5f0757c22ff090f7d7dca7dae8c84655a1debd
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOav7w:bHuHNgHg1flT/Vk3HYwLfUwav7w
TLSH
T11E157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 911KB
SHA256 4281bced64ac1ff109ffb7c0726ae84cd1311778427f5a6b98ae28b536fbd919
MD5 4c726f7a80c25755fb770d3b7833f95f
SHA1 ec5395a7d6090efc838ed7a85c88405acf655739
SHA512 96deec373db36b3ff8c3ffd094e169b157bd8bbf26f8bd192a26446d1287e8a5732f5a63f1483c2cfa47c4a008dc065864cda9e3c0b934c2d970cd4970ea7459
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavCT:bHuHNgHg1flT/Vk3HYwLfUwavCT
TLSH
T1BF157C23DEA498D2D6A648B0DE968701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 911KB
SHA256 50cc7c013bddf5d57aa5b61fcbcb9451289b7308bbf15f0e3f5ada9df235d608
MD5 cac7ba1b07fb33ee644256e5f5a80c1d
SHA1 fa039498f1ebdfef0e7e34c847d9ef9410ab651b
SHA512 07aa6e7f5a782fa59333b71ce4e3904e7bff67cd6a8ee522e5ab99677600409dc5f6d51cf78fd05718511e834ad87b95ad7dcc3f6760c152017b6b14241bc575
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavSu:bHuHNgHg1flT/Vk3HYwLfUwavSu
TLSH
T1E3157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 911KB
SHA256 9def851a18f6de86cb6bccdad8d098d55359d85f7c760594af5059c83ddf3a24
MD5 40882e2a3931ab535213c06555af1452
SHA1 84c7bc2e19b57d9476be267b1ad617ddbaa4770a
SHA512 607e961c7a63863bc85741bffb15183e96944a9c1c01ebd3731bc5dbe08942178d824cd0ba56fa44a8a654908231c590bbda76efa65b627616a1017f15859307
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavMb:bHuHNgHg1flT/Vk3HYwLfUwavMb
TLSH
T1DB157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 911KB
SHA256 cedf03c29803eac32c6034b7571c72bf1549c9a024a5944aa1861067f4d712ff
MD5 12784085208429a5db7f9ed5c7295875
SHA1 40a6952e0eac144fe87b289766734713695b3d04
SHA512 5fc0f014e9d11e955e2380d2388582d0dff9897f93bc2f35264f2b45c0efa1e6b0c49ba1dbb47cb5239805c5f4f087dc1fc31fb9e13e2028a0c68b99a28b877c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavyf:bHuHNgHg1flT/Vk3HYwLfUwavyf
TLSH
T180157C23DEA498D2D6A64870DE968701D775BE600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 911KB
SHA256 a212857cdc3c2593a111626a5f1415faae46fece74db9959f0750674abec4b8c
MD5 4381d30c4703bd45a37c2dc41b049c09
SHA1 4889e5f3d0b21c54e935d88d89f2389c9abf69a8
SHA512 f27d411078953d5d7c92d77f86419c9fb365bb196c6a0dde9ac5d10a6deadf6a4b7f316dc39db894446141c199fed6cd496640612f616c04e16c1cd9c2f6d23d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavfK:bHuHNgHg1flT/Vk3HYwLfUwavfK
TLSH
T1B8157C23DEA498D2D6B648709EA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 911KB
SHA256 cea5bc0b5aa096eeddae5f96a1a6864288f2053953d64f210810edb146557bfb
MD5 76ddf0c808b27f1f198196c8e5a6f8d8
SHA1 434c9da5d89fc6a1a7d14f78a2d0c86df8689d46
SHA512 91f8f76c8eca564e2db8f38ce446e3b7efba32ca1e7843cc1c6034346d3f2f622606d807d13eb91738092f69170941dcf3e1aed7f54aef4ff7d893c7a1eeb409
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOav4k:bHuHNgHg1flT/Vk3HYwLfUwav4k
TLSH
T114157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 911KB
SHA256 4dea5d09a0dadd1baa62280674a83b49f3e7fe5c6f1f58485bad181c99dbbc3a
MD5 35d9948ee6344d2a2a59bc4266520b41
SHA1 34446f883fc017a0b1a648571e47793762877096
SHA512 d2e64464cb01e591fab64327d2705bb28c95c11d459fca631003639b365b5ad0a4cc4076b9f600f307d87ee6f3e84fdc3ae6f5e5099bbf5e0fa8cfafbe67285c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOav50:bHuHNgHg1flT/Vk3HYwLfUwav50
TLSH
T137157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 911KB
SHA256 e83c4ed995b85c21816bdd79b0174a4827845fba50c1e12a82239f4299823635
MD5 31c6951db95a46ae5b75d9c3bba71227
SHA1 3cfaad085433aa59f95b5ac9511e987b0adddd67
SHA512 a257ac03e0e2bce992433fb3f4a06cd7c5b84ae6062ac254366c2a7e0960a82f9addee9b958e181c9eda7fa59d73c95c44e9bc94cb45eab48566e1c63b5ce76d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavs70:bHuHNgHg1flT/Vk3HYwLfUwavsg
TLSH
T138157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 911KB
SHA256 ad46ab4cb6ea44151481e9f001807a28f78f0dc224d5bd7a081cdcb136d31d48
MD5 100606272dabacb24eebc55acda29e72
SHA1 107edf7f30855d87f300c9368f2a10076a392f3a
SHA512 3244eb65ae9bd63b033722afa704eed8bd77e2a23db48d77963bbe2631717ad94edf6ec3ad783c339398e821779d8a3c3a901d001cde92b1265ed8c9a4cf7f6c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavJr:bHuHNgHg1flT/Vk3HYwLfUwavJr
TLSH
T10C157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 911KB
SHA256 ed0662160c5c4ebfb93d8f5962c3742ccb12dfb636936672f5d081fe9f124db7
MD5 d209df47b3082bc611252212af683f7c
SHA1 46a3d54146eff9ff666c51968d0945a7ce477027
SHA512 6b80c0915b5c8216b28aed3bba7cc3a035790e1f0f9b667d8f30ceb313bf43c888b3bfd6ed97b283b3df2778fb4f79b46e97766c8d9e5c3c70005405e67f6ea0
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavrn:bHuHNgHg1flT/Vk3HYwLfUwavrn
TLSH
T107157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 911KB
SHA256 d419468f2989aa942bcd24ff5564922f20fe1aac9af28ad8355e735db64570a0
MD5 f1525ba7800bc2cc5837c1a022a6f7c5
SHA1 8174e501bf0235588a098627052a644e3c173ee1
SHA512 a5060a0c271534b28c09f716550caf31683a0db3ecedad312fd5621ed0024c4dbf1f8632e1aa4f81963a9ae80cfd1b1c7bec5a3cbcaca4cfa29cfeee02e687e9
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOav3x:bHuHNgHg1flT/Vk3HYwLfUwav3x
TLSH
T163157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 911KB
SHA256 1973d2f2869e65a76c72f721ffb9d110fc5c6d47d03396e96cd3e70d56dc6fe2
MD5 47bb994705fe306db0db3504c2c87411
SHA1 6fa9e6e5274905b74ef026e9ceef1f706e0340b1
SHA512 65a5169f14f009e648b6812213c3f3a4d75d752851d3e44b20f2d3c9f51aa9c8c55546782c65a67ef4a8535646acf79dc0fd757939f8fc73d6cca2255ac87989
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavtA:bHuHNgHg1flT/Vk3HYwLfUwavtA
TLSH
T18D157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 911KB
SHA256 23e5821d15da098204757b2c913dab73ef87a06d8a716f90bb0d4d2429adda59
MD5 433cc12acf40ed294e33655ec644f591
SHA1 d330f0f4fa0cf63606947cc31872ae839522c670
SHA512 bb77fd087328a2d66ab2f8e888d3074ca59da1adc95a8e770882f2cf60c7cdb7a453ebc600ef35fe449083e34a7dc890ac40d45fe562e6b91886b01c28441fd1
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavm9Q:bHuHNgHg1flT/Vk3HYwLfUwavm9Q
TLSH
T1F9157C23DEA498D2D6A648B0DE968701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 911KB
SHA256 abfe8ed148588b27c61f1b6d9c3c1e8e9a5d1a64d364935242a8c40fa462ad13
MD5 3339d27950c9f311687f56607704b3c6
SHA1 7f3c0c50269bf5803b7d94597d2282e20ed932c4
SHA512 5de1a7cdc646d2f8e848c1778f0eea55b015b2262478ea1707d24b2c43b652618bbfc5805f895e43322a5bd19e57c7b7b5a4f4cd397707ae168c4caa0d9a9cbd
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavD4:bHuHNgHg1flT/Vk3HYwLfUwavD4
TLSH
T11F157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 911KB
SHA256 af2095457ad6d39c741ca19de9660a8e8cee8dd742aa78e4d992cca3871e3e60
MD5 152d49a6f2070a4d46f934f740455540
SHA1 0e1500c25ce26c3181508fa701c1b02b601bdb75
SHA512 d7e3fcf2428b403fa37862fbb6bb55c62dcf7b142b9049eb5d5d788408367976108d65e76b1ea44f604aaba3f2fdebce84fa1fafa2be5b3f6109e6a7417cd2e3
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavqu:bHuHNgHg1flT/Vk3HYwLfUwavqu
TLSH
T14C157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 911KB
SHA256 d9b95167aa0c5bc97a9cc118639bd0fd2e3d5291bdd5cb8eac9b8fb118d89d6d
MD5 9b2b3591511aa01af65f0b4a994a78fc
SHA1 fb97bc43a28050cd150ebc7380020476322f4273
SHA512 5d0d27c653b744e328a801f1f57b507c698742c597f9ca96da4e3ca6682baca3dbc635f242e3f634dfe81a7eac3a7810ef72b69a6b492ecd718128f75a4e60bc
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOav7j:bHuHNgHg1flT/Vk3HYwLfUwav7j
TLSH
T14D157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 911KB
SHA256 3472fcbde4552224b5291beda7a88474693755c60178ace101e079c3f17e3fee
MD5 a8eb08625242854936809ca7d78da8f7
SHA1 97a29e47a9cbe8aaceeabaab5654badaf8005af9
SHA512 1caaf2f1cc94428a5a751dcec0829f56eecb131449dd2ac8db807ce749c134ff2b79aa959a9855de685a3f53e87ce9aaf39eb341501b10c928c6b88d5352990a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavGg:bHuHNgHg1flT/Vk3HYwLfUwavGg
TLSH
T130157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 911KB
SHA256 ab393bf05923e0f4d08ddc25a4053b423a0b5f909dfc4e748e60f91d136b156f
MD5 9156ea02ab2e569d5ff896d9a14fe69a
SHA1 3d22ed6283f33b1cbd592aa6285ed6f417750e1b
SHA512 aba57cd89f4be8d977316d67bced162fbe9806f2f5f54f813de943c30c6e1e852c62f7caec72490da91cc41b96bb938f3d66fd38feafbca743e9c06fe6cf4ea2
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavpI:bHuHNgHg1flT/Vk3HYwLfUwavpI
TLSH
T1D2157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 911KB
SHA256 61143da678decab755a7ea6ce252d606dfa22cbcfa643a14913b5b6d8dd54bc8
MD5 d342fcba4302b7a057c7ff5cd8348c01
SHA1 a92fb378054ce9341eb0d954fa6af7ce2faf6136
SHA512 2d365295ff0446585d13ad2a49460781ee339dc15a2b730bb5990710ea61fc627a30f58bad0d49308ad22527338ea8247123ee1610a261ff4d8ecf33450082a8
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavLo:bHuHNgHg1flT/Vk3HYwLfUwavLo
TLSH
T1A9157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 911KB
SHA256 eefcbd866cd5d6fe7c977b4c07675ea0113aab9644892b93420a41aa599d1d42
MD5 34e8dfa402a5dd69f837a45b06a366d1
SHA1 a335ab76f7a41857462892554b8c9060a595cf25
SHA512 1dc90d8f97435ba68517066ba532e963137c5ccd3e5ca8a74a8a12625bb58658c00cb9c2f67dc42987a3dd0c31f07a74a030adf916f96bda062268aed027b18e
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavw+:bHuHNgHg1flT/Vk3HYwLfUwavw+
TLSH
T19A157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 911KB
SHA256 2bc435d0d36c1f94575584e771a2e63a5182966ca33351736c9434e261e628d4
MD5 e66478d75380f3c09b7dba6498cc6646
SHA1 29ac773e28535811d5de2306340e1c0c268edbc4
SHA512 09bc2812128f6d60391a34d2aecf6fa6addf0c4679ed963c0d64056138ea08403b5814c63c4ad8104b633210eb8a70f1657704fd582e795753ea7af2a4abdf3a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavIQ:bHuHNgHg1flT/Vk3HYwLfUwavIQ
TLSH
T125157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 911KB
SHA256 f12fa112f3c851b2130195ba3ef7b5225655ae9e899eed55025aa1f8b6160a04
MD5 11a227fe482157318e86df65d135e9c6
SHA1 1b544b23715bc22183601034823d9d35f2f9360f
SHA512 2c145e26af2a25615d4c2fa94c1919da8cbdd577058e79ed67cc4ab5c662ffae9ab1f994ab0c0fb374ad60cb87024e6fb6566680775cde5d0fda64a2c8e5b080
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavBX:bHuHNgHg1flT/Vk3HYwLfUwavBX
TLSH
T1B7157C23DEA498D2D6B648709EA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 911KB
SHA256 4fafcc6421530015fea3210a5847a453993eae4fcf270561532b674f87bd3dd8
MD5 ff6140ca1b5e1d94450bc748f0e87416
SHA1 f900867896bed156a750b3391c472a2930ce3813
SHA512 3ebec629041b2bfb344dc76e3e7a6eee2ae40e0388cab69fd145878ede55466f4b41a03adb9bdd5ca8e4033580e05ba4d32ac0519240110f460118d5c8ee1033
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOav7L:bHuHNgHg1flT/Vk3HYwLfUwav7L
TLSH
T145157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 911KB
SHA256 45732ec9f50ced377b6bb137a66fd2c6ffbb49a8f48b663880fbf0c798efcf2e
MD5 26db207ff7c9d391db7e3578f98c11c9
SHA1 14e5e3bd4a9af2d76809e2f62d2bdaef75b04bad
SHA512 d5d450881439d075c493ab322e8b56550337a371345f308fb8e7c2361618e8a4598a4665a6ced7e154c30a7362288b3fe9e45e58bbb4fda5602c6b7836e896f8
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavBFC:bHuHNgHg1flT/Vk3HYwLfUwavBM
TLSH
T1A2157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 911KB
SHA256 ea81c2ff494b29243f84711015deba3e5e1cdeaf3eb178553c63831b91e5cf6b
MD5 a0fc5e9a5a5ad2feb215f139a2fed207
SHA1 a314ade36ccc9260bbd1cbb86f54a66566a8a6e5
SHA512 628b2d942698fcd4b1dfad4a96a299db98ea895da5861e3ac6c92d9431b4bee48cf7954126d8af9dafaa99b1c88c6035469f4dfee203826f369f8d9aa3bae00f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVOavqh:bHuHNgHg1flT/Vk3HYwLfUwavqh
TLSH
T15C157C23DEA498D2D6A64870DEA68701D775BD600B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2100-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2100-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4504-167-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads