Analysis
- max time kernel
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 14:55
Behavioral task
behavioral1
Sample
2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
- Size 950KB
- Sample260714-samjqae18m
- SHA256 05d548d0f46b1ebd9603fc3d2a18a3253f4b5db85fb8954b2f05edd59841e441
- MD5 3a129a6a9946462b2f7ce1f05240b631
- SHA1 d887971316829585f4143020abe3d1c79ef07f55
- SHA512 8049e8869acc1a6142d47f060d7df51cdbc3b1c09be6153114929b34fc74ccbb77db503d03169c90e4af62eccb8516ff584ebcd92dcbb441c3ba7478e630dedc
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRa:bHuHNgHg1flT/Vk3HYwLfUJDruRa
- TLSH T1B9257C23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 37 IoCs
resource yara_rule behavioral2/memory/1296-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c513-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5528-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1296-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-442.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-510.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-595.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-693.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-761.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-786.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-823.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-875.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-983.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1083.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1102.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1159.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1325.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1376.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c513-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-272.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-442.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-491.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-510.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-595.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-693.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-730.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-761.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-786.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-823.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-875.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-888.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-983.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1020.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1051.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1083.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1102.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1159.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1222.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1325.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1344.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1369.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1376.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5528 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe - Drops file in Windows directory 54 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1296 2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe 5528 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_3a129a6a9946462b2f7ce1f05240b631_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1296
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5528
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 950KB
- SHA256 05d548d0f46b1ebd9603fc3d2a18a3253f4b5db85fb8954b2f05edd59841e441
- MD5 3a129a6a9946462b2f7ce1f05240b631
- SHA1 d887971316829585f4143020abe3d1c79ef07f55
- SHA512 8049e8869acc1a6142d47f060d7df51cdbc3b1c09be6153114929b34fc74ccbb77db503d03169c90e4af62eccb8516ff584ebcd92dcbb441c3ba7478e630dedc
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRa:bHuHNgHg1flT/Vk3HYwLfUJDruRa
- TLSH T1B9257C23DEA498D2D6B64870DEA68701D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 dd2903776274afd52a586771133797fbf18d87bdbbeedab5c65a4217ad32421c
- MD5 24fe6034558601571951ab9f1d34610e
- SHA1 1a457b99dd2b1a31df20975c554f7cd70a1a34ca
- SHA512 badec70dd8b0ccb5c99b0154db2df6f94770ea030670d0ac481796966f58f7f1444f702e4910dc96a323d83e3a8b937f41e85182d78b7610eecea5fe7bb01537
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUJDruRaP0Le5ji0hmxNrM:T2agnTkLfUNPji0Aj
- TLSH T13D656C26FA7486A2D0B3C4B4C9D2974AEA717D510B3086CB9294F32D6E337D19E36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 974KB
- SHA256 95c880ebb76734502fd398f483f76955df7f91f1e5159ea725b4efb7a8e50789
- MD5 6c25438986c20726b9766d1b451e8475
- SHA1 e13187eb062eb3d5f1dac1f47c2ac56df7299259
- SHA512 4be5e3d51d3d243a0b814eddfaabeb15d867850dd3511ae293eaa1e02ae7def2485e328cf886e3b044926e6d4ddd3a7d24c4e41389774c50d751c854479c1fe0
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRag9:bHuHNgHg1flT/Vk3HYwLfUJDruRag9
- TLSH T176258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 974KB
- SHA256 0e2d4c5de2afa43b0a1725de3ce657e6d39c0122785a328998361b29d5950c53
- MD5 2e406e1ccda8ce3f74119fe6fdd8a2c7
- SHA1 5eb40b6baac45f55e5a7337648b0647cdd0800cd
- SHA512 b6de101c24801cc67ac0eba02563e1ab55e53e771deabed57c83be930eaa403ee0cba55b83cbb97443a1d3e0d37b6f2873d0a11f66bbaf8eccba19eeef697027
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaoc:bHuHNgHg1flT/Vk3HYwLfUJDruRaoc
- TLSH T1E1258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 974KB
- SHA256 bc2b7def98256c94202ef85bd3c1cd30b4a81f7e4a9424216c151ca14dc9d7e9
- MD5 8786b4d593ce5ac0a25aa8d5459d1718
- SHA1 6ff1daf12f1b410f78a3beff47a799138f0cc821
- SHA512 903757302638b088b2a92980e738e6adea181ed32a0fc6106e14ee4757a13d60800bbab14a2fd17e9d38b2bdeeee3edd9d1080a3131a629dfd348799157bc2ff
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaBp:bHuHNgHg1flT/Vk3HYwLfUJDruRaBp
- TLSH T1FD258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 974KB
- SHA256 4a179c75e931e155bcbc58a858a1c82455b6eff492176f94c7c81e437d6bd65f
- MD5 3cff385b5b21dee445e8707c40d33805
- SHA1 d57560a525fec0166bc1a326deccf7f675d3f0c9
- SHA512 bf7d47ced81a372da6dc54c17a45341b9a461bd291edfb38793c2771d7dd116cc92d873e6a2a7b60506445c1a8e9a2bea3b32d2ebb8ecd375a81644769279165
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaW0a:bHuHNgHg1flT/Vk3HYwLfUJDruRaWN
- TLSH T14A258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 974KB
- SHA256 a66117b6842da675450e0a29a97be0155c656feb3a2a19abc2ba97f2d4c3ecee
- MD5 399053349c03b4f15a51d3e0f2287adb
- SHA1 da7a449099f53016fe6fcb832c9c08f89d25975e
- SHA512 7d40f32381f41abb241dace3fbf87fc1e35b98cb23b13e7b5e8e79defc52aed4a4e63ddb8fbd0563ddd44d721d1d0d44c3b69d82bf4e3242051d4996e62b036a
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaaF:bHuHNgHg1flT/Vk3HYwLfUJDruRaaF
- TLSH T103258D23DEA458D2D6B64870DEA68702D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 974KB
- SHA256 4efcd448a432d729015eee01bfb0815aadf183f02eaaec497828f51ffd8a0294
- MD5 af4437d82f782d97de23e2643ffccdb0
- SHA1 cff94820788efe2d954fbcdf1af05c263c1b60c1
- SHA512 50412a7a4009fc6086b5b37084e0862a00869bad9e577f6daee342b87b81da0ef37d27043370dc575da52eee1a30644262bc1ea0ee181dff61ec353854226fc4
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRavC:bHuHNgHg1flT/Vk3HYwLfUJDruRavC
- TLSH T1D6258D23DEA458D2D6A64870DEA68702D775BE610B1193DFD2A4B31E9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 974KB
- SHA256 fce642c1b7ca1e426882aaaca01c88df562c7f46413473cddb244b1021686a9c
- MD5 af930c3ad4fb413e76ad53344161ce6b
- SHA1 e81d2566d7dfccd0dfcbccc5a5ce3e6b8b1736fe
- SHA512 b962e719d4961fcb2a479a501f27f2789b1adb4a77f1f6d0444aca0018d19ac3c8a3b93adab095d81801ae7930ff55c4770527dd92759ccf3e4ef38a5146628e
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaQw:bHuHNgHg1flT/Vk3HYwLfUJDruRaQw
- TLSH T1E2258D23DEA458D2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 974KB
- SHA256 2167857d4f07ef438dda1814558c1deed6c238d81033aac698a3fcfacf5bf4fe
- MD5 0c3909b89f0394502e21e30d264320dc
- SHA1 f381d75ec79f0f988b6458926861249391139951
- SHA512 e06fa9217970a3aa6049b294d8abe4a5a59c6e4dd1e2abdc8449dec8620a1be441f34c1ca2a403fa0c1b18d7cd002545e678d4a186b9e714b720feb68ed9ef7e
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRavT:bHuHNgHg1flT/Vk3HYwLfUJDruRavT
- TLSH T1A4258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 974KB
- SHA256 874005546b88f5a7312aa80fd9c2b0cc9bdd75e04a55674b305e218dcea862ff
- MD5 ed8b03abca0b2526c43e926a47259e0f
- SHA1 1b4d0624f2193c631dcc8e535ceebae50843c57e
- SHA512 53db3a9c0b2234210d8471416e617b2fa37c78a168f2d66351cd67062ddb7c107fdc95e388ff5d0f7623ff427de5ef6d157b09f165c6a4e7a72269e9958dfc10
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRapu:bHuHNgHg1flT/Vk3HYwLfUJDruRapu
- TLSH T18B258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 974KB
- SHA256 e5e7fd4a14561dca8eea2a0e31738b85e75a6d332fdfe3d544955bd38127004e
- MD5 6169a67d5922f8b0f9831c68e45d2cfc
- SHA1 3cb55f28315d84e898c19141e2f402cc1c73af54
- SHA512 97c1a34fc925a9fb32d754160399ccef1ef93312118117890e5271e58a26527b40039cb5c6d52a7f153d9b5ad1eb4aa8646874acb613851956fa9ecc4a55bed4
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRahb:bHuHNgHg1flT/Vk3HYwLfUJDruRahb
- TLSH T1E5258D23DEA458D2D6B64870DEA68702D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 974KB
- SHA256 40010ffa5e0aad195c5e21525cb280ae635504b0fbdf38d35482a55e395d28f5
- MD5 c4dde3b68c8ce53039219dcbccc29e7c
- SHA1 d7b56394a394d4536eefeeb330f934d144695524
- SHA512 1c14e54ecf7d8f6b9df6330150f605d61e198e34f9ada0f01e2c160285649571fcb7dd96c0dbce4a70e8875a10f00ff3b9a865a8580ea7edfbfb979aeb0d33c8
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRapf:bHuHNgHg1flT/Vk3HYwLfUJDruRapf
- TLSH T17A258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 974KB
- SHA256 a000075f6117c437b17f4fc14a4d53969b5f61966f948e0793d3d2297384aa95
- MD5 e22c031d68514121ddfafd62b78b8304
- SHA1 ada9479bfe9e72e24c9aa600e9675230ec22d8e3
- SHA512 1ecf3d6512aa77726b690a13a2ec862b36a1f8123e0563fa5e95101f4c214a21596cb28de18ff5854d9630da33266524ad11ccc21312758327a13b4829be5585
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaSK:bHuHNgHg1flT/Vk3HYwLfUJDruRaSK
- TLSH T182258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 974KB
- SHA256 f75d280b56b8d37d30aeb5875ec55659543133ec5060c38fb57b6494e2a0571c
- MD5 578c5f644658dec4bb30e57b5570c042
- SHA1 3a544d282ceacb9de7e03aaaede982938a4b768d
- SHA512 99df2383b4e961e25bd0fd2528000bc619154d8c38dbdff84a47d7c012e115a1de7470f04970c0d4604b4f33e48a32d7d0efacb26ecc7f9bab95773937a45085
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRa3k:bHuHNgHg1flT/Vk3HYwLfUJDruRa3k
- TLSH T14D258D23DEA458D2D6B64870DEA68702D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 974KB
- SHA256 62fc6e07bc1ba124006621e25c5d0a947975bd0a01511bf8eec56dc46248142b
- MD5 f81a265067e9f8de2bd396bea611ec4a
- SHA1 b4f84fef674fa829e54b17ef8ac9829e90d402a4
- SHA512 6a7bd48a7ed5f73ead1a8a5bd7f90755abfe6cb467fe26172159261d3cb3382879d2e38e3fc233da8c6033f561b93d4ff05de8406ce028ade4191d0a4a342dac
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaA0:bHuHNgHg1flT/Vk3HYwLfUJDruRaA0
- TLSH T1DD258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 974KB
- SHA256 2b5586d5fabece012afcd43cd55e4f84c4fce57b705a40f1fdb15fcc7c2d8efd
- MD5 78a4540676d0901ac46593c1e7be8960
- SHA1 4f8db460fac6300dfa28e4fccd2c7e0e3f7d6c84
- SHA512 f6262eebbebdb9886c19197bad3104f1354f693a8ee82ef3d891cd05e0e7cf767626ce70770e25c84587f87855f03c8a0b0cc8a4decbcd8d1e4b820354c53bba
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRab70:bHuHNgHg1flT/Vk3HYwLfUJDruRabg
- TLSH T14C258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 974KB
- SHA256 f9b4abc39c16d5dc6421efb590973126706bc3bf5ec3d083f2ec7ea8a21555d2
- MD5 7f553e01a111a5423f10e6a174bf4ce6
- SHA1 e905bf48b0cb75d99453aeeb7a5525577b6ecaa6
- SHA512 6b530c660b19ac3cbf8c352d9463d233a1076ea47a2bb3f32037ed922df8f8dc60d0f137a9e2e71188041cf6d831d0ef3a93cdc3be6f6abc4eb9129fe48ebf22
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaWr:bHuHNgHg1flT/Vk3HYwLfUJDruRaWr
- TLSH T1EF258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 974KB
- SHA256 52a90335a323b51efcb85be179eff15d4a5cef80528b2be7eb3c825fe3580c87
- MD5 72bfead6bebfa66aaf84b021b24af58a
- SHA1 b53a2937423c25e08cf00323699d82dbd3bffdf0
- SHA512 138d872160a29d3d31fc5b63322637ec9a8e4fb53628a903f9784d84f8ac1cfe707a03cf7ead5bb154a452237c0cd414c1eb4d8f15b76c74a9bf04e5acb60722
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRa8n:bHuHNgHg1flT/Vk3HYwLfUJDruRa8n
- TLSH T1BC258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 974KB
- SHA256 6992b68f10ee5cc9cac42527c4f403ccbb40fbcf48f7e3f7b8d94811842e34b2
- MD5 b47e7c3741c1bec03b66dd71c35406e6
- SHA1 f1cbfeb595579e57e977383e37ba9d31b968d48c
- SHA512 2062d7b23a3bf6aa45ad9e499d2542127ece5f97aa5b9f7c774277e334b00adbd510f699ddfa2cd094142237f673cfe434e4bc787dd4dac8a002f8d5ac82f9bf
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRa6x:bHuHNgHg1flT/Vk3HYwLfUJDruRa6x
- TLSH T189258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 974KB
- SHA256 da12d88825ce7ab9d67c7176c11098f638eb6d933fc1649784d22277a7d44604
- MD5 60c542984ceb7f975bf9bc6deaf46fd2
- SHA1 48eeb783a98ea381edd7d35218a4e330e72826e0
- SHA512 0de40670365ef2885979b5e825df5e6e9e251b93479df9664db6ce61cf0419b5618d4997ee9ba96cc4a75f6aa24c797abaf20161d15293c8d40d5b5fc64c4300
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRa8A:bHuHNgHg1flT/Vk3HYwLfUJDruRa8A
- TLSH T175258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 974KB
- SHA256 36c23ea2c71b9e2049b5c23102626615b6af09b1f8f489df0b77465118a76357
- MD5 0a1bad1a63fad216e601403a3230f26c
- SHA1 24e854f8d864eeffaca43393aaa81f6a660e6599
- SHA512 8e47757fd6bb487f677f866a8c3d154eaebd47e87ef28feacdd85fc7c4e20ada9d94b444975f7646edfd37f685014065756a44225798f0066abe5d276739e156
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRal9Q:bHuHNgHg1flT/Vk3HYwLfUJDruRal9Q
- TLSH T171258D23DEA458D2D6B64870DEA68702D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 974KB
- SHA256 4e8f9e6818185afeac7f9aa8a8666e7a84c8097bcee11060bbe9e8e185b4481f
- MD5 2704b1c36dc335dbb9de3ae97209af9f
- SHA1 f8d9838b4b9d84dc50224c978b62023eb48fc515
- SHA512 85fc0dd358d39d90304191bd9b11299cb72ec28ccf3a1ed164c2870817f834e85aa47852ce57c5ebb2bcbefaa28f1ec11d81d158ac17671fe2001c5210fec7f4
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaQ4:bHuHNgHg1flT/Vk3HYwLfUJDruRaQ4
- TLSH T11C258D23DEA458D2D6B64870DEA68702D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 974KB
- SHA256 6681e007f07072f142eb374236552a52475a013b0a75147158018727f81813dd
- MD5 acdaf0c8a2f777e37f3e2cbd2d7be32d
- SHA1 cf964cdc0d45442ce2bc541c5eb524af0f93c29e
- SHA512 af26fc6a4716fde397065564173074d2c784d5a5ff4b9a10018ecf5f5c899241cd8991c67ff77b87807c6dd87c042bf0392036b33b5b3057ee8d0f628b8eb410
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaTu:bHuHNgHg1flT/Vk3HYwLfUJDruRaTu
- TLSH T1A5258D23DEA458D2D6B64870DEA68701D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 974KB
- SHA256 fc88865d31d8907057f073ac66b8f5c317a383c261f14c119dde6273221e8f0e
- MD5 401b0bbecff564e1e49ef135b8728077
- SHA1 daa87eb4abc474df0f0a36d4d40f3d5f6ec584c9
- SHA512 d18387e4f645a2eace2f128585e020394486e2d39cf2d08c90cebcb68b3c3aba63d6d350a60e3ed764ec63ed114a013dbd907a49329413e4a4038d32b17a377e
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaOj:bHuHNgHg1flT/Vk3HYwLfUJDruRaOj
- TLSH T139258D23DEA458D2D6B64870DEA68702D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 974KB
- SHA256 23c21268450d84ee15104b8543bd4bcaab780c903ac2043736620d761ac64fc5
- MD5 60952ce8b125e192076672bad8ccdf08
- SHA1 efa3287828b9566e70f7135f4dc019eea6f1cc1f
- SHA512 6584290a9359f5d1a83ccddece1b3b9233fc4845c065b332b31548a94bbfac8318cad2f34164283719f0df0d3092997e89cf1fcd3f62cfb2549ee47195a9716f
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRa7g:bHuHNgHg1flT/Vk3HYwLfUJDruRa7g
- TLSH T12E258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 974KB
- SHA256 9a64f947d432f7df6161b321e374ca7b96c7b0d471d3285efa603bec9a2b4878
- MD5 717fd8972c10c74d55764ce51ae94032
- SHA1 402ee039818b071dbb910cfcc90b7ba4b2c1b85b
- SHA512 f36f7764f531d0d6111b235cc950fd352b5e314e67f85c7787e952ae872151ec0c57460675b65029395f749e753e4a5b891ff362357373a1bc83c270a2dbb362
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRamI:bHuHNgHg1flT/Vk3HYwLfUJDruRamI
- TLSH T1BA258D23DEA458D2D6B64870DEA68702D775BD610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 974KB
- SHA256 762df3b2e97b95b0dd9d6f7dcb4ad7d09bfe92baabf00b2e6c6d23230ea65c95
- MD5 6f668dda39d9a29b781f32e596ac4263
- SHA1 bc93efd37438794dc6ab5b675d046d5e42e23905
- SHA512 0bb2aba22331c737a59b62d035396b00f57cac27b97dc3a4f9210b88a04d94bf15bcd9b429b53a64057b8763b7ebaeb6c67468845bd9a2fab97378f426b058ab
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaUo:bHuHNgHg1flT/Vk3HYwLfUJDruRaUo
- TLSH T1BC258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 974KB
- SHA256 1c8983fcea511d3c2fdeb3ae263bd04676eff72663985d91bad8780b4e515da3
- MD5 9018abf1b5bef3ec113a8ea75403a9a1
- SHA1 d1deb0d4383876b948ddf35d84060351bd04c24d
- SHA512 8e0d2d7f38d92944769d23370648af47449799cc83e469c8db1a5ee718d4e50ecc92aa0cc368e9e6b053758f0a218c31c803b736e9471dab40fc4c2be33fd241
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRa3+:bHuHNgHg1flT/Vk3HYwLfUJDruRa3+
- TLSH T1F2258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 974KB
- SHA256 167b0f436ed931edac87dcc79a66fd4f769cbde26b8a1afb5ab5eb77a52d4085
- MD5 bf236fdb846fbe88e8dd197e35ee2323
- SHA1 668fdc6765fd53f97ae1356cbe8afb5c1025c0fc
- SHA512 8e1bff57423f891c7a59bfc10cf1b01e5ec7a824161e1f5934bd2d16647c1e9bdbfd8100f81eec668a67d01f41cea75d0a747fe7c64169c52fbeca6daa2987d6
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaNQ:bHuHNgHg1flT/Vk3HYwLfUJDruRaNQ
- TLSH T16A258D23DEA458D2D6B64870DEA68702D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 974KB
- SHA256 5ca0444715c7b10b62d2d590075b790ae4280452d674c3beb57f1defa8151304
- MD5 c49cc75815c559b0253d17faf3b2a630
- SHA1 1d96996e08f954d8826fe38db40c5441fc4447dc
- SHA512 f734ef6984b185c2487217f22cb54b8278e5bb39f59afd76543a0f20ca64e8c0270f829057037f16a3c3e634e1c79bb4d567dc7bd7b9d418538fa03f702f707c
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaCX:bHuHNgHg1flT/Vk3HYwLfUJDruRaCX
- TLSH T1AF258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 974KB
- SHA256 3ab970e0cd32ed799b544b76c49f5853a2e96e455fd4536016372fef71985662
- MD5 feb16b444431cd6b9ce8790fa69943ca
- SHA1 2e7241f5c556b8b8b0bd2972b3463bc1d82c567b
- SHA512 a371214a676e13b71088896885109a996c4b4b04f115931a7f2e9767a36dd3412c625ed29226e8fd6b4f05e50d74a254b6129a4364cce9c245cd4085f2d7827e
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRakL:bHuHNgHg1flT/Vk3HYwLfUJDruRakL
- TLSH T1A0258D23DEA458D2D6B64870DEA68702D775BE610B1193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 974KB
- SHA256 c980c3acabf77c0e72a875d000707458692777ce1dc30d9225ce346af2a4c14b
- MD5 0685a954043c72ce072fb2aa227235ac
- SHA1 b3e4ec8bf351aa88ca6d8deb95410b900bec78c4
- SHA512 80037b50777a207fef94e59f723a597b70218273a5889872d882bb59b7481023b83f857149a8abcce9cdee377d792a0042a038768fe17f5e00e469b9412c5ed1
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRaAFC:bHuHNgHg1flT/Vk3HYwLfUJDruRaAM
- TLSH T193258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 974KB
- SHA256 2ff39053e4020b097fe89c757da7fd0adf553918112720104e8e2e821aa76ae6
- MD5 af0145ea95eb366dc7de7d3c8cf8af34
- SHA1 bef118848355f1e855def60482adc37a32188d96
- SHA512 da0584aca877e730fccc7ac74ef4e9d78b16aaa64b241b1cd7c7b8a77f11cf7fa57349b68007bee0d4f286c7aa747935fcec0ac3d34170ce2db0c5f13f82f48a
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVvDruRahh:bHuHNgHg1flT/Vk3HYwLfUJDruRahh
- TLSH T13A258D23DEA458D2D6B64870DEA68701D775BE610B2193DFD2A4B31A9E333D03E32719
- MD5 SHA1 SHA512 SSDEEP TLSH