Analysis
- max time kernel
111s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 15:58
Behavioral task
behavioral1
Sample
2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
- Size 920KB
- Sample260712-telnnaew91
- SHA256 b661f7436beb4816403cf95fac0620ac261e4e28c47cf40d86983b9d79c801da
- MD5 d82162831727905600e0795b52cae438
- SHA1 f7f128880f8e067e4d7e68567d8e215407811674
- SHA512 924f6e3632f958ae71d43121d553b1a5fd7b25b78880bc11fff891f3eeb26e7ab8ae28add72e90b1eb8489d9aba16a930f56fa13a3b4d4352c4875c7641d2544
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqc:bHuHNgHg1flT/Vk3HYwLfU/rqc
- TLSH T13C158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/3412-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c497-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5212-9-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3412-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-42.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8a-61.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188cd-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a59-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-301.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-482.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-635.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-753.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-833.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-928.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-984.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1028.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1072.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1115.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1190.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1349.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1374.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00150000000064cd-2105.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c497-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-12.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-42.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8a-61.dat aspack_v212_v242 behavioral2/files/0x00040000000188cd-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a59-211.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-250.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-264.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-301.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-482.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-598.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-635.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-753.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-833.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-864.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-883.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-928.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-959.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-984.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1028.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1072.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1115.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1146.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1177.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1190.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1227.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1330.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1349.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1374.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1381.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1389.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1403.dat aspack_v212_v242 behavioral2/files/0x00150000000064cd-2105.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5212 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3412 2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe 5212 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_d82162831727905600e0795b52cae438_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3412
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 920KB
- SHA256 b661f7436beb4816403cf95fac0620ac261e4e28c47cf40d86983b9d79c801da
- MD5 d82162831727905600e0795b52cae438
- SHA1 f7f128880f8e067e4d7e68567d8e215407811674
- SHA512 924f6e3632f958ae71d43121d553b1a5fd7b25b78880bc11fff891f3eeb26e7ab8ae28add72e90b1eb8489d9aba16a930f56fa13a3b4d4352c4875c7641d2544
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqc:bHuHNgHg1flT/Vk3HYwLfU/rqc
- TLSH T13C158D23DEA498D2D6A648B0DE968701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 9e48d06a472bd706e2efe3502879a326fea7065b08a5b5f9ae892c3d3f774f9d
- MD5 97416fb605400a2c1840abff54fecd11
- SHA1 3bd5dd37a65335e0fecc7397ad5ed9bf226d6d9c
- SHA512 e2f41d9768ee328d5736b23ae99ba6e57272a9fccba44f8846e614a1a9f3849202595d6a8f006cfd8105c9fcac5931481dbac009633887a1118aec40d914b02c
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU/rqk0Le5ji0hmxNrM:T2agnTkLfU3Pji0Aj
- TLSH T107656C26FA7486A2D0B3C4B4C9D2974AEA717D910B3086CB9294F32D6E337D15E36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 935KB
- SHA256 1295c841397bfa669f341a6be2039724a2d7223269702d67d5fdefa72cee3b15
- MD5 f9b75abef35b457c23a03cda860e17c4
- SHA1 44651341e32baa18c747c58d9f5aa003fec81e06
- SHA512 1e86f5e5c34c1a4b957c4d538bd475f410a8092d961a4520639de2a9041246eeaf37731a006c19ea0d0d996a8a1c43b3f024653409b32cefe67ca44382a208e0
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqOa:bHuHNgHg1flT/Vk3HYwLfU/rqOa
- TLSH T1F4158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 968KB
- SHA256 a43154158dd8a9bb0e229401039fdfb677f15a87e0da3e9264190bf1d279f824
- MD5 e836a8a42483665803c260591963a8d4
- SHA1 0d5172b9f34bb83f0e14916f84846ec804a1477d
- SHA512 b52a3a7c6cd754f0b5dc446da951aa051c761e8366b6d3122e4d1b18acb44a4f3ab338716d92d8243901b31813bb770bdf29d011e2aea2747da144808a729eec
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqNb:bHuHNgHg1flT/Vk3HYwLfU/rqNb
- TLSH T106258D23DEA458D2D6B64970DEA68701D735BE610B2193DFD2A4B31A9E337C03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 944KB
- SHA256 0f1ba0ac9b935ae3aaeca03b56454f097ece6db5f6c8a60f27f0f651fa889269
- MD5 8aa42f3967f094ca95d4b0f09df86e96
- SHA1 fe81725a0df857f6e9183e94ef0f0febd71335bc
- SHA512 eb681d9253f8d733483052a35b8ae96f14a2b04e40acc54e4be238198474b5448ce79d69ef219da5881cce9456f55f59764991219bd2a8a0d045cf91f23f7299
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqQZ:bHuHNgHg1flT/Vk3HYwLfU/rqQZ
- TLSH T1FC258D23DEA498D2D6A64870DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 944KB
- SHA256 b10555e520a76035f44faaaf3a5643b61cc5bb397592bb715627ef16a394bed2
- MD5 652541ca92016036efd795783b515d0e
- SHA1 d9a95375b889eb02cbdce6d7e0148bbe53b5c0a8
- SHA512 95ba1d24e6bc559351effa0b82bf6841370c02557167a54c580ab74a126f65aa03030310ad5a21c922e290a0106116e52e2b50731ee651c88f5bf6540e4f9172
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprq31:bHuHNgHg1flT/Vk3HYwLfU/rq31
- TLSH T135258D23DEA498D2D6B64870DE968701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 944KB
- SHA256 8471d9ecdae784f94727ba59ec2c59e6bd61ddc555ee754c2b88712d2a05e66c
- MD5 ae706285eeb9e78b6e9393de6410382c
- SHA1 e2f2080257db24e276b2146a6354dcbdacfda717
- SHA512 76d02e5a6797bb4d667f6ee7ce7fdea950ae035f2c622685818890104ab5689f7c60fd112d5691f4cf5bf9eb2d3ec43a6d63ff8ee9f5a48d56492e82fc3cad74
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqv6:bHuHNgHg1flT/Vk3HYwLfU/rqv6
- TLSH T1DB258D23DEA458D3D6A64870DE968701D775BE610B2193DFD2A8B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 944KB
- SHA256 96579e023471592971fc79873178360b77ae3020d93db2931c34c053e6da511e
- MD5 53a25fa1778d510b95dedc9a025179df
- SHA1 6950cff4d012ffd5b8150faeac73915f975e985b
- SHA512 6f23c558daa50d3e4b7b0830a67767ef0e0994b786ece1aeccb2133d201750fc1a4c87e4072d24e6a34ea1bdc52647a219a40ee0ca735d94798559320a41f896
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqpo:bHuHNgHg1flT/Vk3HYwLfU/rqpo
- TLSH T1C6258D23DEA498D2D6A64870DE968701D775BE610B1193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 944KB
- SHA256 cd7ee247e4afded62eb2c82d1008819669ae6bbd6c8b0c8fb8b9ffa9fe41804e
- MD5 0789a26bda48137dcacd7d48d43c77be
- SHA1 5d946e426a9bd13ad62aaab43c5ef6e3f8a8734d
- SHA512 527be576eb858a532627cce1c658499fa09cdc3df858316886e18359f41228fb1582f15035d41e0f7fc6e83d0d59459486173b818460a7cf00e7247cad072722
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqZu:bHuHNgHg1flT/Vk3HYwLfU/rqZu
- TLSH T1F0258D23DEA458D2D6A64870DE968701D775BE610B1193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 944KB
- SHA256 dd0d632e19c7d97f367b1720108ae6563f535a82c088859e2d45b0d733eb4849
- MD5 e54b62656cdda1262ebc9bea2f47c86f
- SHA1 9458ad0b972e681e9daaa1a353b3c576724b2561
- SHA512 8c4314ca85ecb190b7e567304ac1cf142a2e92f972e182e8d1c3a8cdfb3518936f232a25e2c1773b331fcc45078751a584d37ef44a51238248b4dbfb0b9ea555
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqL0a:bHuHNgHg1flT/Vk3HYwLfU/rqLN
- TLSH T17C258D23DEA458D2D6A64870DE968701D775BE610B2193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 944KB
- SHA256 fb883298f4022a3345a78582f82a221c0497254e87c149d875fabfa58d627239
- MD5 65d12bc86d00f807181e16929a449331
- SHA1 6612153b2f39f88f566290707d7a5e8137cd3b15
- SHA512 0e7d0ea3189e7b1d017ff107dbb874934a0b319bbfb57949e864833e26676101eb4470f6c2513357b361ebda5d208a06b8c83e6a6f1157411f5779bf242034df
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqZF:bHuHNgHg1flT/Vk3HYwLfU/rqZF
- TLSH T10C258D23DEA498D3D6A64870DE968701D775BD610B2193DFD2A8B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 944KB
- SHA256 92bbe0499b1745fd23b9ef85c7476101c4edb85e36c32a514cbf2216d418f60a
- MD5 ec38e31cb20d3293d92da2512404be97
- SHA1 174b544222176c530cbb8ad605b2f9fe13fd1541
- SHA512 90218813648412c0b934971669d54ed9e19e76c18126d62dc3038f0531a2e6902db5503b09a44e13744f7e65a8d2afa2d78ad74795d5ecd89c85f7ffc7a5abd0
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqyC:bHuHNgHg1flT/Vk3HYwLfU/rqyC
- TLSH T1FB258D23DEA458D2D6A648B0DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 944KB
- SHA256 0d757d576e941ecfe9d6ba9a9a151fe972d57922d95d0cf3d7cc801e3ea3868c
- MD5 2f10f71b6514208c697ba72fd28b5b82
- SHA1 62a6e8cce6471dda13faab7ec4cbafa1ac9a8020
- SHA512 5c9ba3debf56b505f3e96511caeb1af48bcb540851366299dc187a5ab7fdbcf5ac4df6f378b9cf6f4d64e7b4b44603b453cbdc88aeb2262bbd93d19dedc46e8e
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqtw:bHuHNgHg1flT/Vk3HYwLfU/rqtw
- TLSH T183258D23DEA498D2D6A64870DE968701D775BE610B1193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 944KB
- SHA256 a88b5842666d9d931b4cefdbd05d29f371d72045adb014d213691262cfcde923
- MD5 50d50648b9303ec4c7517a070e9d9935
- SHA1 bc3188384070b231e6da7ae8f42179638c73ff64
- SHA512 65c7b74a77e1f7755085f198bb0ef7d9a251181b73ac303e98a05a62c8cefa5ad54e5d840121619f9346b44345825ec52b69d6e00fdac4af57b290771897d5ca
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqcT:bHuHNgHg1flT/Vk3HYwLfU/rqcT
- TLSH T1C5258D23DEA458D2D6A648B0DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 944KB
- SHA256 fe7e6f56dcc4bc8195be384434ba06e41dcacc2a4821ecd83309a6426d142aa9
- MD5 70cca03406457dd3860fcc6731e27597
- SHA1 8f0d1a479f8f7cba608876ab0baf17d17abc5327
- SHA512 30296593f8e9ae2fcacc7baae2052ddf63c43fdcd9d11ef234ac41364f7c70a3951b8b5189b0dfbb733de8403b79f2837ad2ddd67104bc836b747f948c2a6c0b
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqwu:bHuHNgHg1flT/Vk3HYwLfU/rqwu
- TLSH T1CF258D23DEA498D2D6A64870DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 944KB
- SHA256 46d934452e4014612950132e9f0fa8b3a66a31eec0d70a9b233ab43c4386cf9e
- MD5 2783998d96edd7d9923205aa27ed4197
- SHA1 5dd822fddf18b324c4bc83de9f661c93257b84b6
- SHA512 952142714574aa332ea3d6676a8a6a58fdcd0e5b6b274c11bb37a8bf648f0c11337f534a3844af7dda0e16af2597e2ab075cc1b1f3d2e0228dfce4608aa53db3
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqOb:bHuHNgHg1flT/Vk3HYwLfU/rqOb
- TLSH T106258D23DEA498D3D6A64870DE968701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 944KB
- SHA256 50f2dbe7f7592b19e4312a083081c826ce65533856949ec1648104b3f4b4936c
- MD5 c26eeee5f06b7e8d7688bf233b9fd68d
- SHA1 d5e3508a9d685629a72dd003da9a826c0169c2bc
- SHA512 82b7837d68d921251821ba3a220d6771e6f33f81a4efe74449ba6a5dd0664a05da2ea0b6c17d6549a0c61063974136b58dc72978b5e660dbd9a76cda1bfcba55
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprq4f:bHuHNgHg1flT/Vk3HYwLfU/rq4f
- TLSH T1AB258D23DEA498D2D6A64870DE968701D735BE610B2193DFD2A4B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 944KB
- SHA256 d454aa395ec982af1a25ed5b53d78c993c1dfbb352cd5ba8b1eb1cb41bff7d80
- MD5 5e0c7dd793c8f29679b1b14b48178fc1
- SHA1 e9554decea727774b9b6b5c94de55daf8b9e296a
- SHA512 9a520d3de1202ecf592aa43a8e32d42672014aa2519868be06e811d6998f4d5e61261da3b6f71c315df2589ef67096fcce11c135af2787e58b88ae5c46ec857c
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprq1K:bHuHNgHg1flT/Vk3HYwLfU/rq1K
- TLSH T122258D23DEA458D2D6A648B0DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 944KB
- SHA256 9aa55e0054df6921b84d70e88a7a2cc8fcacbfc5c0ad8868f36af77d7dbcc697
- MD5 8a4902509e9f5eca4a18dbbbe5f14fb7
- SHA1 943d82b01b9fda4ba5557e6742c47b7bd25ee044
- SHA512 5ce124fb3d62fb00d901f8d3085cd2f32c64ace09cf6bbed93f6f9bf786e88044e83571fe9352e5b99920396bb9c63b773b7d423617a6ac0b5e44df1f1c08f08
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprq2k:bHuHNgHg1flT/Vk3HYwLfU/rq2k
- TLSH T16C258D23DEA498D3D6A64870DE968701D775BE610B1193DFD2A8B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 944KB
- SHA256 530da56488037e0e9533d9845fec2617081986e6a87d8938eedfa0bea96a3b43
- MD5 55734f7d8574cb949a7a2a20703d4a0a
- SHA1 dc1378d53704c27e844036722a75a4f19ca712da
- SHA512 3aa3ca39f4d20b828cbb07ae3f4bb4ff10330a40c64ef5edac9281c5b650081794aca46cbe71ba5f4059c1eef86f873d819eda2503015b4e8f7a736e2bcec51b
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqT0:bHuHNgHg1flT/Vk3HYwLfU/rqT0
- TLSH T1B3258D23DEA498D3D6A64870DE968701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 944KB
- SHA256 1b0bf7b1f17bc533eef1ac0184a70156d7c6c024a715125145b4ef0f60c11018
- MD5 c90fa2c5afb5d1577c5869b83bdb1575
- SHA1 1a0a32c6774babb4c4128e3bc24d83ff4ce94a4a
- SHA512 dcea42306839d13b27b85cbb32c0f9132c92a6db63982ee02f9aee2ea853aff6b04d1a368b7f32973b05491ea5d4d5e188f7284e4d8ee421e48eeddc6ac374ec
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqi70:bHuHNgHg1flT/Vk3HYwLfU/rqig
- TLSH T18E258D23DEA498D2D6A64870DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 944KB
- SHA256 1d81043d850f0491908716fb8658b1e160545d6eed5dae37d9105aeabede4dfe
- MD5 d15bb389a69e16431d2cbe5169959cf0
- SHA1 b0b0975624351cb34035338be3f20e5c1bd7d543
- SHA512 59408f00b7e0da28fda50d76a960d996fc2bd8e6c09a6556ea66e35bf1ac3e9bb7cc41ff916dbb694c57129a095d40e2b1b3ca015cc195a5025db54e252761bf
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqDr:bHuHNgHg1flT/Vk3HYwLfU/rqDr
- TLSH T16C258D23DEA458D2D6A64870DE968701D775BE610B2193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 944KB
- SHA256 5a978968433f4709fb4f049eb47ed43133a2a2b109736e2fd1b9e20b21527e9b
- MD5 56e253df207f5d080b3d7d4bbb1c229f
- SHA1 99f45b2b48db49d0855762ebbfbdf476179f6feb
- SHA512 9ad111fbd26d2000ad81aba2e30838bdd9dabbd784edbdab3a9f75c677ffefb49a6037a3072cb09aa9c497396dc8d3f9b509c0bad68382f63465c7da3b0743a7
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqln:bHuHNgHg1flT/Vk3HYwLfU/rqln
- TLSH T1F5258D23DEA498D2D6A64870DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 944KB
- SHA256 48043d34943dca2bafa4f96ca821376efa3a1b020bcaf3b8aad01b35957c822d
- MD5 e7a66f155c2819826a5b17068be29043
- SHA1 02e2d3add0eba0705397343bb63262677773362d
- SHA512 85b3df2475e07e7c5728c72b62011a63883b509b9060313dda644d797ec6f730b3056088a9ce9f8790a5ae554d64286352e7a125c6daea6d62a9e93c678e837d
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqRx:bHuHNgHg1flT/Vk3HYwLfU/rqRx
- TLSH T1F8258D23DEA458D2D6A64870DE968701D775BE610B2193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 944KB
- SHA256 145ec389b2f8fac58156380c11eff3f8771d4f6931650dfd5e7a8bc677059618
- MD5 931726eb63f455da01f3e0d51c14254a
- SHA1 29d9240398fc7d590a634ac41be3669c86517c3d
- SHA512 74622415c7526dfe4d4137fcfbc7a603ab0b66713a4cee5512ae9322763bd38102cf39a680d2b618ebe873eeb778bd711d965ec592853f6ac2fa7a8807a45c4b
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprq/A:bHuHNgHg1flT/Vk3HYwLfU/rq/A
- TLSH T170258D23DEA498D3D6A64870DE968701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 944KB
- SHA256 2be1723ffaf520bcbf5a8a6b888bee2505c1b2756f81cff5a2d27c8412e2e97e
- MD5 e03b347c353687360217f6eb9604b1e6
- SHA1 a639fea934f450a5d2c47aa452b194ccf5f05090
- SHA512 6f4ef993b4dcce7de9b3719b95348af80ed079ea035594c66fb417073326a5a2c75b8f50c1f60ee9cafeb0aca4d16b6813e3372d8ed6e8b92dbd236c4bb93d38
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqQ9Q:bHuHNgHg1flT/Vk3HYwLfU/rqQ9Q
- TLSH T1F1258D23DEA458D2D6A648B0DE968701D775BE610B1193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 944KB
- SHA256 f2bde9f933d25945c18a9ec717867a0f6ac0692be3b39e932a136d1772bfddc2
- MD5 5dac6476e75f336d88916991dd7f0db4
- SHA1 0af5e88e9241e1f9684af54764f46334e8d94e4a
- SHA512 b2d26813a90fe790c7a195b0da34fc2de26696f7758d3ccf5361983ba2b66410115a0aadf8e61e64aa30d88130d847e5279bea5d13bd3aef4dfc370e20eabd4c
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqx4:bHuHNgHg1flT/Vk3HYwLfU/rqx4
- TLSH T1F9258D23DEA458D2D6A64870DE968701D735BE610B2193DFD2A8B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 944KB
- SHA256 64147aa6450ad7822caaf584d53d80290c15ab709dfc32479d4201dc176fab16
- MD5 1e274f0dd585358351b8756ce5c60909
- SHA1 7bdd48e399d870e8a3579bd7ba8fc851ac031af2
- SHA512 d7a79e49b9739cec0396e15b0449a476cc517bcadce385ca5c8b663f9c82ec1d0323d2a831336aecc6c2a4f882f1ef23bc641b1e2cb6879dfc32a0510c062296
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprq0u:bHuHNgHg1flT/Vk3HYwLfU/rq0u
- TLSH T173258D23DEA498D2D6A64870DE968701D775BE610B1193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 944KB
- SHA256 881ca136edc2904d25dcdb480c731555a0e48962c11ba9d39213e5fc20a693f1
- MD5 bce0d3b690931687acede272b37ff310
- SHA1 c44d88f540b7ce85050b433509ad855d37021196
- SHA512 3c53be7ab49792d60a83c74d503a6dd3e7b84ce9c2a886600e9d72503d3223445e5ae9d1ccdf055f6c9106342dfb4c93872a30022d0858cc6b34b032dca963ed
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqFj:bHuHNgHg1flT/Vk3HYwLfU/rqFj
- TLSH T19F258D23DEA498D2D6A64870DE968701D775BD610B2193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 944KB
- SHA256 926e94ba23e5e35ddeb71cf02dd2b92fe7ce9daea9391d3674a787b752222b25
- MD5 697ac88f9db594f894824ceaca8d4a0c
- SHA1 3c13c2b947d043e45e26ea5727235da498ed90b0
- SHA512 a855f47020bbf216067740f68c4b5448de67d9bd513d3486b4ffe70ddf8a7c27e09734f5fd582ec212ceea6dc00805e39a1c7b2711996d8c23862785ae4e3985
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqMg:bHuHNgHg1flT/Vk3HYwLfU/rqMg
- TLSH T1EE258D23DEA458D2D6A64870DE968701D775BE610B2193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 944KB
- SHA256 ae98b6914d75da12ee1204266dc742b2c63337d134c8620ee5dac84c5cafd936
- MD5 aefdbd64c33e1f943278da05305ed530
- SHA1 ea2127c003ee5506e2a08fa453c280c10a88d303
- SHA512 a4428f2326a0472969d08fdf44f718443e4643df8de47d8503641dc7bc36de4c56d44a45a67fd71f86d7dcf812020aa588f23ebc72e61c86e94e2595a6a8bb6c
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqTI:bHuHNgHg1flT/Vk3HYwLfU/rqTI
- TLSH T158258D23DEA498D3D6A64870DE968701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 944KB
- SHA256 8c259affa21b4aecd4dfd35d8509764b66b8dd5371113ceb2094925f54e3ff95
- MD5 88f8313babdc43c5e1d9e472d16916d3
- SHA1 395a89256c19409fc64ef768541e0e4327e96239
- SHA512 5354ef1566aec4c3155f9567774bb75b2e0e88e879b6f64139e3bd74ff3f1e19a26ef579ddba1a7cbc39ba0c6aa5e578efc1a8189a08335a1f0f1ae9ad1f72d1
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqpo:bHuHNgHg1flT/Vk3HYwLfU/rqpo
- TLSH T110258D23DEA498D3D6A64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 944KB
- SHA256 23f450b8347b568a14fadc3f64c163301470e4371df60acaafb34c0760664bd6
- MD5 839a1b6274a575fe70338ea3555b1f87
- SHA1 f6691918a84265410a6508842bdb5d43de93ff28
- SHA512 9a66b0c04884ae9054abbc992dc656278b227197ab1233d378f91b8004b75694762b3f3289501aba203cf4e5c2bee84540a10691ce2842548c9a738cb81397fd
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqa+:bHuHNgHg1flT/Vk3HYwLfU/rqa+
- TLSH T177258D23DEA458D3D6A64870DE968701D775BE610B2193DFD2A8B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 944KB
- SHA256 3a03ae434e420c3362fff864e7d1ee8bae3180120b77fabdf6761cc1d622c021
- MD5 59b7dcd2dd64f465a36ab44ba43a85b1
- SHA1 fd0065181eb7c3dc7b24682ba5a31b05493bd03a
- SHA512 26a8c0a423292014e0595f94fb159880e7a99ce60be8094faebcc6e99842e275643594673d3cc1510262f478d8d4f0c9ff0432bb732cd1402899b8bb9b81eb8c
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqaQ:bHuHNgHg1flT/Vk3HYwLfU/rqaQ
- TLSH T1DB258D23DEA498D2D6A64870DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 944KB
- SHA256 95e9645ab0ab1f96128f81334726dd5ad297367cbd13b40f0968d142bb69d5aa
- MD5 d3ca0d9177aa313eee682d907cf0fe21
- SHA1 aa161ae5155f45ae1418adc8a26891843b07d70a
- SHA512 7d926af20348bfc31b5c1162a5620e70cfab05b0b37214279cac3d6063e07758e1213a7ade5845949e687c461995c781bd20c7a4fefce20219ff049e5d97981f
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqrX:bHuHNgHg1flT/Vk3HYwLfU/rqrX
- TLSH T1C9258D23DEA458D2D6A64870DE968701D775BE610B2193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 944KB
- SHA256 ef4f878e390a3adbbe3873cb6abd115635c87aeddca01c8d12b37de23637f7be
- MD5 8aa462ca3a4a23e4d55273b8ecfee933
- SHA1 664333c19ec4758cd5e23d226d2a52be5ae06ad3
- SHA512 40f25ad259d5b796b761feeb6e63a81571f1b4debb2b4ca2fc85eef16f1129a723577b194f4be08b13e43b1065671d3edbe7924a7629a2b342d6c9b65af70ab2
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprq5L:bHuHNgHg1flT/Vk3HYwLfU/rq5L
- TLSH T11D258D23DEA458D2D6A64870DE968701D775BE610B2193DFD2A8B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 944KB
- SHA256 bae2f533ad54ad11e138ee549414bbb2a911a6b014d6935911ae791c1f4a4a54
- MD5 d4400cb1c571b409a0fb807c027b6679
- SHA1 feb4e0dd86c6b21028a328ccc576784537cef4f0
- SHA512 e436490fb24566671c2b9efbb36875560e4b18fa30f8a63a861985b2c86c5ecab6caf163b115b9c23cd0b30b0affeb2fa307e16eb6ee7c0f3e82dedc4dc451bf
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqnFC:bHuHNgHg1flT/Vk3HYwLfU/rqnM
- TLSH T1FD258D23DEA458D3D6A64870DE968701D775BE610B2193DFD2A8B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 944KB
- SHA256 1377a81f56d99f7c839fe56818434d884e8dfb461b4599a428733a487dfed829
- MD5 66db496e8bfe65fd34184f16d60d8a38
- SHA1 b9639071ee9fc5b6eef8f3bac5ce8cbab09028c4
- SHA512 a7660c629e29a814fc13f3e2bd2969e8dfa8960fea1d085f5b1ec8036a999aa09cf566aa1dca80bc7b0991717a81c23330348c8850860d9906a34c18801bd138
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVprqQh:bHuHNgHg1flT/Vk3HYwLfU/rqQh
- TLSH T1EB258D23DEA498D2D6A64870DE968701D775BE610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe
- Size 1.1MB
- SHA256 7653e55f794fcb49bef21deb67ceeb08fceb1d50de797ca739ef2564113ff05a
- MD5 3270c76253c77f3c9baf2ae9683fb2ec
- SHA1 d4d7d0195a19d52bdc011c792af23af226fa9c15
- SHA512 412ec3733f349588b017d48d47eace3e893295badc78c3a82df854d2acd2c7508481e9aa749f23f8dd40af8752ca4be976ad8620e8fc9e970f61abf1815de3b0
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU/rqeV+PAk2hMH3:T2agnTkLfUTi2WH3
- TLSH T156458D32AAA458F3D6B709709EA5C705E735BD610B2182DFD2A4B31E5E337D02E32716
- MD5 SHA1 SHA512 SSDEEP TLSH