Analysis
- max time kernel
93s - max time network
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/07/2026, 17:12
Behavioral task
behavioral1
Sample
2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
- Size 911KB
- Sample260713-vqsrsaev3x
- SHA256 93074cc96cccc5dd56515fefbdcd23e3f97800f98a53b1b4ba45ac1802358b98
- MD5 bacf39d125e60ab30f691f64387fc18c
- SHA1 21c88593de7d058f99648bf367be49340a677d03
- SHA512 c5728df0f52a5f6d43b2ee030198743847213cb8b8fe98ae8cb66103714d2a74289de388001c59db13db3fa5e8fd8c3755e6407eaa1751a2ea8800e79fe3a4cb
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoc:bHuHNgHg1flT/Vk3HYwLfUjYaoc
- TLSH T1B1157C23DEA498D2D6B648709EA68701D775BD600B2193DFD2A4B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/3148-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c537-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3148-166-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3036-203-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-463.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-585.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb44-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198ef-701.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-782.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-851.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-928.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-947.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1002.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1046.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1096.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1164.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1317.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1393.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c537-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b300-57.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-270.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-463.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-585.dat aspack_v212_v242 behavioral2/files/0x000300000001bb44-616.dat aspack_v212_v242 behavioral2/files/0x00040000000198ef-701.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-782.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-820.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-851.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-870.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-928.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-947.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1002.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1046.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1096.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1133.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1164.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1177.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1208.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1317.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1336.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1361.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1368.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1376.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1390.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1391.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1392.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1393.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3036 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3148 2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe 3036 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_bacf39d125e60ab30f691f64387fc18c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3148
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 911KB
- SHA256 93074cc96cccc5dd56515fefbdcd23e3f97800f98a53b1b4ba45ac1802358b98
- MD5 bacf39d125e60ab30f691f64387fc18c
- SHA1 21c88593de7d058f99648bf367be49340a677d03
- SHA512 c5728df0f52a5f6d43b2ee030198743847213cb8b8fe98ae8cb66103714d2a74289de388001c59db13db3fa5e8fd8c3755e6407eaa1751a2ea8800e79fe3a4cb
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoc:bHuHNgHg1flT/Vk3HYwLfUjYaoc
- TLSH T1B1157C23DEA498D2D6B648709EA68701D775BD600B2193DFD2A4B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 1a365413e54c30bdc070a53a41b53cd292e4ca8a14dee01fb8c62d5f669068c9
- MD5 aaaea1955b6e16fbc28043f044656a30
- SHA1 256d4c04e06cda142fa50563ef0f392db820fdb4
- SHA512 9e81752800a3994648770400cb4d5ef2466957a089b4977511fdb05415fda66ab6ca17c654dade958498b069c80cf4d45b7827368533e3fdfa1cd470959ba6e1
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUjYaok0Le5ji0hmxNrM:T2agnTkLfUxPji0Aj
- TLSH T161656C26FA7486A2D0B3C4B4C9D2974AEA717D510B3086CB9294F32D6E337D19E36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 926KB
- SHA256 77691581a71c13fb0f54d3250f2b6b651563c38ce673e4d548fe1c15b3a6461c
- MD5 9c742a835cded4e522334c6594162f08
- SHA1 b0be15c639b9032c768a163f62c2b4a313836ce8
- SHA512 a747d41673f76423565d098390f4d481642d986ded87c3efecb1536b5cf578d6fedb22f928bc4e5af2350ca266dd296ec44d4a2a9bf61a5590b85d81c9153f45
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoOa:bHuHNgHg1flT/Vk3HYwLfUjYaoOa
- TLSH T1BF157C23DEA498E2D6B648709EA68701D775BD600B1193DFD2A4B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 935KB
- SHA256 78ed3a12a3e200966de294ae4bbe75e6f95061c8b4baf10e7e64e093d462d4ad
- MD5 9da9178a6f922706fd77e71cb25bc997
- SHA1 c55fbe5ffc62285fb0e11c3604d7b1e726cfc437
- SHA512 97227a7dd827ee52ecae4fd5bab1dafc39430ecbe52230625f79b200fc840b3559ac117a4b22ac603dea4b55133e3744e261d2e533872d04de256b0d80625000
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYao/9:bHuHNgHg1flT/Vk3HYwLfUjYao/9
- TLSH T1EB158D23DEA498D2D6A64870DEA68701D735BD610B2193DFD2A4B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 935KB
- SHA256 b6a2d2da1575a5d4ddaef410f96b81e93d6c24b7a010d62b94e7ebda437abf05
- MD5 a43a7e6b0917e9f2d757b0d27ac35c7a
- SHA1 9ddc38d604d948d5324d536cd7142b780c1ad0dd
- SHA512 3f0a7a08cd455f1205a58accddb32bd3ffbd559eba3f4585ea241fdde1f3609949cfbd639f4c9f9b55db01327e63eb7876c6960468131968d6fd4d7b53dc9876
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaobc:bHuHNgHg1flT/Vk3HYwLfUjYaobc
- TLSH T17D158D23DEA458E2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 935KB
- SHA256 62e7d0c8b446945906bafbb0a714c77357d3df02abb0c62b964c2ada013870b8
- MD5 d9d9371008ba2885e3675d62c3bc5e3d
- SHA1 e344133ad3ac302f20a24f34ed4147ea25e30938
- SHA512 f112678fc40c235455bffc099c4ad89f30bb9bc3b581f093164d93db320bcc6ae692f18e76d52e533876991243884ea6d6c9fe301bed5882e2980df10d30a249
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoEp:bHuHNgHg1flT/Vk3HYwLfUjYaoEp
- TLSH T18E157C23DEA498D2D6A64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 935KB
- SHA256 7f0e039235b77fae2fffa4a41138b2dccad45e65f04edef4a345db6ce0e946dc
- MD5 2cbce2b55d9f3e93264d665492749cff
- SHA1 613632248bd8cd3858e70cb8c689a0066ba9d514
- SHA512 c80bcb5522634dba1fe4cf31adcb45e5356aec4ae43c266e0095fc229b7aa79252c0db7f512ca90cffa361362f54e33f3aa51731842232cf517f4e7ec7bec669
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoL0a:bHuHNgHg1flT/Vk3HYwLfUjYaoLN
- TLSH T18E158C23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 935KB
- SHA256 68dd5b7785758201fd5eebbcf2d33075516ee8daf12db03c667ff42252473409
- MD5 975dad18f403c031531ed7be128879df
- SHA1 9f2310bf3423d84d590b1613fe23fea3c5080c40
- SHA512 b436f43a358f5a1fc60be8dcd17ffffb3907c71d395254510d1f026f3f2ad365ee2964571dd849f4ef067374b09dcca4d4296bee7d2d459f02567fd6a011e2ff
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoZF:bHuHNgHg1flT/Vk3HYwLfUjYaoZF
- TLSH T1C8158D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 935KB
- SHA256 2d1c376cde7ad7a17e2f235163ff2c4a8f05a5b2b621af1379fac01d300b591b
- MD5 7f8950196ec744d9a4997f27ae43337e
- SHA1 e36e359d111de1fbd4ad8f5abc239bb5bb4c1b55
- SHA512 c45ec12cd4e215e999b29617d88066219bdbd4d3072346391d4c6c5cc23f9c9a4e3d19e5968bbc4b194f99829326aaa1fc325891223adb0bbb00efe4bb913db1
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoyC:bHuHNgHg1flT/Vk3HYwLfUjYaoyC
- TLSH T1C0157D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 935KB
- SHA256 100f4423be9d52c8af4931b0eaa6156b427ef4853fd34cf9d1b67e4f2a22585a
- MD5 5f199bef4df0f4127d3d10d8daef9ea5
- SHA1 2acf14d524ceb1a00b60b6ee49841a9f5d2d4ab5
- SHA512 19cc2476fa422f1f0bb7d0dad5ed7d2e2745bbfe06c2237fe950969fc9808528a56c29d8b17f9a963b82e6588797b23d048555f3f59f53e8bce5e9b0166e8a2d
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaotw:bHuHNgHg1flT/Vk3HYwLfUjYaotw
- TLSH T1EC158D23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 935KB
- SHA256 7478748a102fb28bf8f3a4f2cd1f26b1e90c48df587ef763efa1ec5b79f58ed0
- MD5 2c1586238ee4ca3d86573ec7d833011c
- SHA1 d2a76969a00c166d187c53c701bf769112918064
- SHA512 2a1512c0b748b88d42b711a73014dee9a641eff691e8c5ed5467610016e760e7227c20eab446e54b1fd88ac5143502dbe1bdf23cda75c06c81aa1f7296c07f81
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaocT:bHuHNgHg1flT/Vk3HYwLfUjYaocT
- TLSH T1CC157C23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 935KB
- SHA256 e9aac82e52f2f3449bcc84d280ff8269a0c9b3db7fa3e38b299575752277da26
- MD5 c60e2a49bb471c8a468a8ccfe5f03fc2
- SHA1 0951b6af9104889ba5c8179ff93fe6c26dd21a6e
- SHA512 9c9b46eef29079802efbb21f60fa9e55e6b4481bac5c96fb9f06106341d84f284f710c7a06b20dc11a50fda7f0822ab05b132e6c38767e85ab2010ac8d04efd9
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaowu:bHuHNgHg1flT/Vk3HYwLfUjYaowu
- TLSH T165158C23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 935KB
- SHA256 b14cefbceae7d6e6ecd7708fe28838f631cbf7be4ea9a1b2523015423d315f36
- MD5 71073549140a411934c0b49e19e7bdae
- SHA1 eceb7fee09f2e41b7e8e3359d19a4e86e3938d50
- SHA512 abc16f66b09adec02782168c88720037d9598f515e2df571fbcc78b9b098e175a07d094c13209d873e088bb59aee3e498b8b46a7f5f0b06c800e9045bf249a85
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoOb:bHuHNgHg1flT/Vk3HYwLfUjYaoOb
- TLSH T17F158C23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 935KB
- SHA256 9e102c8f872f28541e088cdf7e79da10695afcf79b7f6715d4d8ac81a7dba51d
- MD5 0fb4170247346df9b68e71ec9fb1f992
- SHA1 48ce83ee704fb6b72c8bfc688fcde58d6bcfe09e
- SHA512 67957701e1483b02c6025cc9d84a7badca2e75dcb52844bf6a2308ec54e95633264074254a5d97093ff8a984e768a149b6d3c3d52369fe690a0b865a2729cf15
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYao4f:bHuHNgHg1flT/Vk3HYwLfUjYao4f
- TLSH T154157D23DEA458D2D6A64870DEA68701D735BE610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 935KB
- SHA256 b33a741c9301ade9b2ba4f910d2554352106b7056ceb3db045b373c3a3e3de98
- MD5 fb91657ac33d43ea05d23fbba977a46e
- SHA1 87b5569acbd581182f26e84ec52e74f1cef80713
- SHA512 6ee78ecce5fc9281734bd866a8e3349485e54630aa175adbbeb90b7e0a61459a7b04362c9783f4961d593d305fe99d0145077aac5e81b4fbea6f527f591c9db0
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYao1K:bHuHNgHg1flT/Vk3HYwLfUjYao1K
- TLSH T16A158D23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 935KB
- SHA256 a01df7bafab84fd80caaadd13e6a3cd30d0de4ba112404ea7cc08524bbd8f4c9
- MD5 464b5a153aeccccf3afe4fb488ece999
- SHA1 112cc545d6297fc9f2abf0e069d4a58f9ee7e71e
- SHA512 820527880e7e6f07f8f63f4707a7872c31e3f4cb0e1f488b2ec10b0cbfd5ad6180aec61dda025252ba723944732530f974ed261201cd28b5efae2fba7b90808b
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYao2k:bHuHNgHg1flT/Vk3HYwLfUjYao2k
- TLSH T124157C23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 935KB
- SHA256 b75d80482823ea142913a8e751e7afdd0f6e35c893a1a461f88b7e7e18325d8f
- MD5 1da87ccc589bec365f5aeea06e4dc4f4
- SHA1 b11be58b50bba21659ec99aba94e3c84730b5339
- SHA512 ad3457b81da135ca3250d12c4461167ef86a9a0da7f3eb7bd29e943fe9c674c8f0c042f4a20add2b344735512c7fb64af692f0e6ac8138efedf5e73055a50be6
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoT0:bHuHNgHg1flT/Vk3HYwLfUjYaoT0
- TLSH T122158D23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 935KB
- SHA256 5604fb3bfb89d9e133d1d1e2d7816f5bbf0bca53ea37e31531bbfe7f61946bab
- MD5 2c111fabba4459b91a5d2ef35d9ca604
- SHA1 0110b763bb697a0bf7a9e9d3eb9465c5bfdd1f61
- SHA512 c6a3cd2a3f309caf1cf3b59f4e2efcde7fb9d4d987f10940fa0f5c16653787c71718afb15990b0fed42addf69b0beddff4c3dea8b3a7c1e50e89cc77c69990a6
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoi70:bHuHNgHg1flT/Vk3HYwLfUjYaoig
- TLSH T191158D23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 935KB
- SHA256 8808b02e620f91731084fe03951d99f640a44d5a0defd8f947a7cb1ea93ebc46
- MD5 b9f907b2219a5b9a428d522153cc2906
- SHA1 4b52f930f6d5ce3b4a060e94494ae033c151f965
- SHA512 5452de245a220a41f0f139468b278da44e95bde2534be7e89fa0f9ac486b4c0d358ac0287ef9de7285818ab88521aba77e1a5c1cdc0b5d01f868cfdc19dd26c8
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoDr:bHuHNgHg1flT/Vk3HYwLfUjYaoDr
- TLSH T141157C23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 935KB
- SHA256 8366140d1c8cac90a23602df010d6a16d0e5b426869cb6daf840bff15949788f
- MD5 c6c5fe575d69aec9f89d4e8f99f22f4c
- SHA1 382b5a2e8489f0064400b33eb96cc27f7255d928
- SHA512 d562d115d42ca80581802291a93a311afb9bd0a434e60969879b8deb12871835539cf91aeb4813c440d1914ecfc743765dce4f96a3cc0d59b8ac0fa09e6b0bd3
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoln:bHuHNgHg1flT/Vk3HYwLfUjYaoln
- TLSH T193157C23DEA498D2D6A64870DEA68701D735BD610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 935KB
- SHA256 d6972588e25965582ef77377adf4190cab1c4d04503ff12031b082177152f8f5
- MD5 bf7a4deb7a32f87d4b1b049b2ab82563
- SHA1 00fa31e1f6b74ee8f48840f5bec615c1248df950
- SHA512 c431245b7cdec9c575f0fdf9d72bc6cefdb62d410b32c8d80856ef768a0b3e7de301e79f1feb18fa3bf1602aadfd986945270427f000c2a8fcd6a1dddb090489
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoRx:bHuHNgHg1flT/Vk3HYwLfUjYaoRx
- TLSH T111157C23DEA498D2D6A64870DEA68701D735BD610B2193DFD2A4B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 935KB
- SHA256 e80de042eb81d79da37aff6025cae9cc397f4108355a10c6df71d033611397d7
- MD5 73b3e103ede485ff1e05a3eb14d98baf
- SHA1 098793b6f7d83d11cfb1035ab2acb68fff468a41
- SHA512 bf8ddaecfea7349291687d14d4da287645a9d35b1b38d89f573103b7834f7daca172fc2657e38b64f0c7eb523da067caee9bb9f2f63334c5f1c8852044a82bf2
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYao/A:bHuHNgHg1flT/Vk3HYwLfUjYao/A
- TLSH T180158D23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 935KB
- SHA256 afc930274b99a82b586c3e8068061e7e61b92575be035322bba9a3c4860bc5d7
- MD5 78c87549f708383527b6bf9f60d83aa0
- SHA1 67bc9cedb2ad0f4ee0e4842c42ea6f8e239d40a0
- SHA512 06ecfcdc32e27fb5c22492b711f5d200c73bdf6a93537074d7d8b6d189702373e65409355b0d9413685a31b7c7bc1cd520dd85785badd670d3a19881158afad0
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoQ9Q:bHuHNgHg1flT/Vk3HYwLfUjYaoQ9Q
- TLSH T12C158D23DEA498D2D6A64870DEA68701D775BE610B1193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 935KB
- SHA256 62e11549d57c32e793e60ee04c74040e622c4a04f334f38a7b108a3eb3c9d102
- MD5 b475d9f56da35c0066ddf593956b5580
- SHA1 cedc008498465e40903ecd68616d3bda79f5037b
- SHA512 0986b79a61a8b10dc6b78fa8dc8f73a3f7e25f5827c0a03d69407846bc435cb3400ec3b72dd3d992021352b0bf0fa02e42f9edcbb6bbb87d23e38c4b9ff6fb9a
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaox4:bHuHNgHg1flT/Vk3HYwLfUjYaox4
- TLSH T13A157D23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 935KB
- SHA256 4373a2d5a4b3e07aa2b9be7ec633ef6f38a3168f66551fca340abc79dca8746f
- MD5 ff388fa92e8b4338caaf942135528fd1
- SHA1 cb5955d535d493fd774e863d593dca1e88105b4e
- SHA512 a955ff0ca10831cbbf3f0659ce029f855a46b34c20a9b43d9eaee330ebb046ecd20f25ef7f073ec08e2bc9664ce99a04b9f56715254b4c11f0248ce26795848d
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYao0u:bHuHNgHg1flT/Vk3HYwLfUjYao0u
- TLSH T1E3158D23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 935KB
- SHA256 68a02fef6798f50551342bb5dbb90d1a074d2408e0dcdb18eba3995c733cebe6
- MD5 5a6cd3b9c57bf7a1f5321d8525ac53a9
- SHA1 c32b9551604904518d66b4b5d6d4fd48d0408820
- SHA512 364d6f249d40e8445425f324fbfbd8c8355798aa28eb7c58984e7202e7b6b91735dbad874cd436acc13d3cd30981266591b005965a8fc0cbd910ec03439819ab
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoFj:bHuHNgHg1flT/Vk3HYwLfUjYaoFj
- TLSH T189157D23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 935KB
- SHA256 bb5304c681aaab5a1d39f4dfeeda040fd96e8a2e66f67ac572e19c3730d6c14f
- MD5 2a479d006b1445181c982cf327538245
- SHA1 d1bd95c4d47cbf79d22f0d66fe594d111748e4dd
- SHA512 4ccd0b51a17f7bff5172ce5f999b96cfc5804c4b7fcc11a91d0c3886f45d8aef4afdaaa94e7251f9c76a5875b090da7135b56e3d700e8019729a0caa0e566492
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoMg:bHuHNgHg1flT/Vk3HYwLfUjYaoMg
- TLSH T162157C23DEA498D2D6A64870DEA68701D735BD610B2193DFD2A4B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 935KB
- SHA256 e810359ec4091c12f14118c132342b75f70bbb9fd1182113fd363440c09f6e46
- MD5 b8e231627aa6dce0b760ab68838271ce
- SHA1 0f8c5da70e52293f5d6e5f8f00c23d90f8cac5bb
- SHA512 7016d0c9f2ed753bd446c18a5427a049b409e7b411b70da913a99fb1b50740cc38c9254c4c337ffabd83dd75c123f3a4e46cf4381ffaceebcc27a414546ed0bf
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoTI:bHuHNgHg1flT/Vk3HYwLfUjYaoTI
- TLSH T1EB158D23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 935KB
- SHA256 2d30fd040db5a73bdab50db3781d98ef04a12dc6a337dcd5e9a9185bbd9b492a
- MD5 40a44e3aa62aa5e471af12b78ca6c30a
- SHA1 284bc4bd815ade606327da48f2cfed35670ea01b
- SHA512 2230e435c6fbb83dfbb172463fa3506990eff86ef42e093b3518f10eee73ba7c009c0e1baaa90fc00b41fc46eafa14e1767e7648521b1c071b6b35b58d3068b4
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaopo:bHuHNgHg1flT/Vk3HYwLfUjYaopo
- TLSH T114158D23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 935KB
- SHA256 fd64f914b483cd73f84cc70a754839d08ac324a04e83cc3ba646771943995ae7
- MD5 dddbda3fc1252d77a14b7478bda1aad2
- SHA1 a7210831fbc4a1ab42f605e2286531c8e49b8279
- SHA512 dea135160993860fbed57a17ac4acefbe5f37e0a2cdddf3ec8a622190ab65d7b842d7a4c48accdf268d535f4217d5c3bb2e9269a4d06668b427f2b4fb34be719
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoa+:bHuHNgHg1flT/Vk3HYwLfUjYaoa+
- TLSH T17A158D23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 935KB
- SHA256 9ec262556ea51d087871d8259bae1fee5ad292ee9953929b7cd340fbb68e926e
- MD5 605cf8ec2bede01811ecfdf83abcff46
- SHA1 49a37317b157db6dda64e07393b0737a1e7ab97d
- SHA512 abea330cd5e5d0ded9d3b979e0741693036d02f6d37bb40f3ed068430e92144ec74be7646a91bfed6c3034f4b478f3678a20a8a9325de8c6d5323f28ecdb6bbc
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoaQ:bHuHNgHg1flT/Vk3HYwLfUjYaoaQ
- TLSH T141158C23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 935KB
- SHA256 f61ad6698d94324625dd7bcb6d7fa3563817daa48af260624d61c508c6d656d4
- MD5 876184dda2e2d2749a5270cd5d6df1d3
- SHA1 10a17f3034dbda3284472773cf03f99b2b76b79c
- SHA512 8c0ffd04c8b85975c93518ac08776f10a5065278a5f0025ea682b7751c44388f0fa9d64996a29e011681ff355f8b2313119c3c4a5900b2078b6af8bfc3986613
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaorX:bHuHNgHg1flT/Vk3HYwLfUjYaorX
- TLSH T13E157D23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 935KB
- SHA256 9d14cfe15f0134c363454c64c7c60dfaac9ec95de19db1e0306338833f52084c
- MD5 bcd83f1caf13b294d01b12f6bbbf3617
- SHA1 1035ecb66c3b037e9132d3993cb6b109626f6fe5
- SHA512 c1252f40bff7e15cb37c557dd5ab14d75beda3d7890b1a9aef35debba1a6701490f96f19daafea83abc56c9de518bc6c2176ced14a5cda2e46ec52e9efdc9e54
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYao5L:bHuHNgHg1flT/Vk3HYwLfUjYao5L
- TLSH T142157D23DEA498D2D6A64870DEA68701D775BD610B2193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 935KB
- SHA256 d2a0f874d7ad5fb3d767baaa904eafb274540870e9e725670fda484666aee842
- MD5 3a8e59c4da79eca3c71ddffc4f270b2c
- SHA1 f947f838fe65f5192af4c658c3b1c9fa5aa6fcf1
- SHA512 b6eda332f886d39b2bd1f764e584606101382209be6efb7009e67a7f7c98962d4f21f28edaf091c3da601d862cefb3d7ce89de56c711b606af2a88c1ef808611
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaonFC:bHuHNgHg1flT/Vk3HYwLfUjYaonM
- TLSH T156158D23DEA498D2D6B64870DEA68701D735BD610B2193DFD2A4B31A9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 935KB
- SHA256 902df4b00f1bfb4863592c263d366290de8317dea9a21e5b3af42a81e2fd7afd
- MD5 7302f4d12cbacaf0a59cd79cdda6ede4
- SHA1 5dc49ebc0aae3974ddc66db8e4a3d518037a2822
- SHA512 a866b5439050825a82a1d657e3a86dc48540a875a00511e5d3b3267fc254a9a174fef218ef796a718b3a7085b63e1db8042b88e58ac88c10824cee5f9077dff9
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYaoQh:bHuHNgHg1flT/Vk3HYwLfUjYaoQh
- TLSH T108158D23DEA498D2D6A64870DEA68701D735BD610B2193DFD2A4B31E9E337D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH