Analysis
- max time kernel
122s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 18:45
Behavioral task
behavioral1
Sample
2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
- Size 948KB
- Sample260728-xd26ssfl4x
- SHA256 111f8fc844bffbb004582ebe22ceb68d0984d0ec1305b5c50b023f0c973cb731
- MD5 616b2f8d3cc4a6b2cdb2212839b93ed2
- SHA1 e14a78c3bef6fab9eec5e5d7e73966ea7013c9b4
- SHA512 0314416842fb51f2b4340734b6e4d303517f0b8f3135fa6a54035863dae3ee1e92d07aad5d06f78a73e1873dd8d341f7e19d29bcb7a3c12a6b2759bd6579cad1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuC:A3mnXoZjzyacNVOE/baEo/owJIUDuC
- TLSH T14C259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/2600-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c51a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2600-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3356-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000189a9-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a83-257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019871-288.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-445.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-514.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-600.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-698.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-735.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-754.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-791.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-804.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-847.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-939.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-977.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-1013.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1089.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1102.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1158.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1190.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1352.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1406.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1408.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c51a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x00040000000189a9-202.dat aspack_v212_v242 behavioral2/files/0x0004000000018a83-257.dat aspack_v212_v242 behavioral2/files/0x0004000000019871-288.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-445.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-494.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-514.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-600.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-631.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-698.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-735.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-754.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-791.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-804.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-847.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-873.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-893.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-900.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-913.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-931.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-939.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-977.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-1013.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-1057.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1089.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1102.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1139.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1158.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1183.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1190.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1227.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1332.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1339.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1352.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1383.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1384.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1391.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1406.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1408.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3356 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2600 2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe 3356 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_616b2f8d3cc4a6b2cdb2212839b93ed2_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2600
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 111f8fc844bffbb004582ebe22ceb68d0984d0ec1305b5c50b023f0c973cb731
- MD5 616b2f8d3cc4a6b2cdb2212839b93ed2
- SHA1 e14a78c3bef6fab9eec5e5d7e73966ea7013c9b4
- SHA512 0314416842fb51f2b4340734b6e4d303517f0b8f3135fa6a54035863dae3ee1e92d07aad5d06f78a73e1873dd8d341f7e19d29bcb7a3c12a6b2759bd6579cad1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuC:A3mnXoZjzyacNVOE/baEo/owJIUDuC
- TLSH T14C259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 b0e6f03b5fea27c1f3cf1589efd2e114b8868d52baa05ac042f01104074c34b0
- MD5 b67ab004ff038b75883dfc7ecbc3e573
- SHA1 4bfb1fa6464191677104be27b830b242b35cac29
- SHA512 4012eb8c07425ea09ab728a1b80b9ca4b16b7901afe4c3d804b72db3bef711746bc7e0eb2dbb182078ece06b2fe902a7c5c8e3aefa2ada9a4c0e65a328f051ef
- SSDEEP 24576:A3mnXoZjzyacNVOE/baEo/owJIUDuC0Le5ji0hmxNrM:A3kMHJIUTPji0Aj
- TLSH T1D5655B27FA744AB1D077C4B9CAD29646EB7234521B3086CB9359C3292F237D19E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 962KB
- SHA256 3b4c554d786626010fa7eb0a51f024e672a19d9da22486d510cae7d8a44a9c03
- MD5 73460e9bf760d32f1025598ddb9e0714
- SHA1 1c3815fc753194fab2c10b46ef43a7043832f2d2
- SHA512 e225f4ef19af5414eecd4c4b69811f46d16562f66ec9c21c051624f343593fc8c3b8abcfacc4ff4c94baf3837aed732e911cb31f3ee06973cbea10d60db3a4e8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuMa:A3mnXoZjzyacNVOE/baEo/owJIUDuMa
- TLSH T140259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 971KB
- SHA256 730ee352e9744e5c50d8f7f13c21d60ee37ce9ad2e7ad2e7116457e0754203ee
- MD5 4cc4609604463dd53d3fe8f6fa50268f
- SHA1 0c460c25c9bce392aab456a2ba00bffb08460c10
- SHA512 c6125a261444eeb3991b285ec760f5f7d37a4a6abcf64043d6841a7bcd37a3710dd56de636d86149335ee6ffdda0d545db7ae3c31fee5d1aa9d3e8fa1723f8d0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuGZ:A3mnXoZjzyacNVOE/baEo/owJIUDuGZ
- TLSH T1CD259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 971KB
- SHA256 7b7a3589f92c21036186997d9a55408e99f2baf74d29877d917ed87a64b13859
- MD5 9263c7f4d28af24f5872b9c91fe0a82e
- SHA1 6452bdae466fda2d0d9b1e4ee48d04e1fae439c9
- SHA512 596d8e8a79c5710549435d5a446c42a59845b0789f0f0efc814afbf478949312c5a7e0d551500374527b16ce31aff1f51b0de37be7d7f8ee7fecfefe91648146
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDux1:A3mnXoZjzyacNVOE/baEo/owJIUDux1
- TLSH T1A8259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 971KB
- SHA256 b3154845705e7be11ff5df3da952e4b65af41a5fb7e47a52d3e973b05f56253e
- MD5 de812a8dfbf8221fbe38e3d03454c7c5
- SHA1 1671f085b8c8d0b79c39d1e8b514f57991333382
- SHA512 85981747f54d5566313fef82a8d930898a216611596ec6d813cfb9da3d55b32d785880f05ea5c6fa11d0f28ba6f47445e19958fc9c953c317680ef0b002479c3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDul6:A3mnXoZjzyacNVOE/baEo/owJIUDul6
- TLSH T1BE259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 971KB
- SHA256 86274ecfe9d9dd98fd5362a52f4759c41dd6ece52222123e9c203c3c9903b30f
- MD5 d77fd608397054c84c569eaeca3a30a9
- SHA1 a3f4b24a5bf474311c4e7c3cc5a709c815f2ea72
- SHA512 5be918b9e6c7515ef5600bac71f3d4b065d488f4c99dff4ceae681d4832e3b461df55aaf9916776e6cd803535abb66ca442fd67e73c38e22727d181a5cd0c8c9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDu7N:A3mnXoZjzyacNVOE/baEo/owJIUDu7N
- TLSH T144259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 971KB
- SHA256 7fbb9da10bcda01b11a5592aa8692b41754aaf92d72badf88a010119ca4c0fb8
- MD5 1a4c6d792e70d2384f969889d927f4a1
- SHA1 a67e52ac8da8cc5a18f2467b3d759f38d11c2666
- SHA512 6f6cf2d523388f6ba2ee5c355e37cebf55cb33c6d25e69a65baa29b4321a6a73814cca9f1395c910fa4537acd36f86c6c8c3d1884dd9e19289deca44c0de51c7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuZf:A3mnXoZjzyacNVOE/baEo/owJIUDuZf
- TLSH T124259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 971KB
- SHA256 617fc6619d1c10799891b83d4e8b31465b65f736cd4ddd915aad72e6ecfc9732
- MD5 50f8bae2aee55dc14639ff93bc6a4403
- SHA1 00cf6381f74048a0c272a0d6300d0513f462d695
- SHA512 869341a3b13c9c4b9249fa1fabaf643154820e4e30ecd549fe2971be91e3e48a159cd4f76b5a560f7c96f34715470cbde600d7a41a037107f485d9081d57cab0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDubo:A3mnXoZjzyacNVOE/baEo/owJIUDubo
- TLSH T1ED259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 971KB
- SHA256 6f77ce1e99c5269a156f066b9632c3ac22a1a0e0544bb6d7740ea8f0a86e0007
- MD5 6c52bdab623b5ec6cbe04a6c8674d8d9
- SHA1 7c8df7402caadb1f2a0001a0b8ccb4aff7ff84b3
- SHA512 16deea292271e56e4933de089d3ad398c11bfc2a4f68572e69926aea51a84c1f6c71e4898e1ffb2483eb09381f7e4ea2a5cdc99edc5d0c5b4dc83e3bfb763e9b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuPu:A3mnXoZjzyacNVOE/baEo/owJIUDuPu
- TLSH T1E1259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 971KB
- SHA256 d1fcf3f89c8bcb3b274cfee7edd044e1f355749603f7664a3c73188a82e6ed7c
- MD5 c936db67639cef93138e7e00abdb0d12
- SHA1 a5cebbecd07d293e43ab9de1bc75e350b0843cbd
- SHA512 af17288443072e6d2d9dbff4a9dd984449669c4d93a9ff211f5917234762a45080dc324aabb90133c60d8dd7fafb14d315823fb5c73643973baa551b4747065d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDud9:A3mnXoZjzyacNVOE/baEo/owJIUDud9
- TLSH T13D259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 971KB
- SHA256 65d0ef2e38f90d6fd190b8d0170f7a56497307a7f7f94d2e584383602ac54b75
- MD5 2bedd6cc49126cff821ad169cf8998af
- SHA1 4f7d22e745e7cb6167a511cd81e679fb72d00dfe
- SHA512 e3a21889d115cdd998c50718d503d684efe3f1517ec7da18e4e5b4321b034af29c22aeee11d178b5a433dc39e32676e2e12d09da75e113978ab7ac77cab5fd81
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDu5c:A3mnXoZjzyacNVOE/baEo/owJIUDu5c
- TLSH T118259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 971KB
- SHA256 01f34b9871819df2a082661e7bfa0f0e6affe743f25a381398de72fd061b0020
- MD5 b4510333fa15d040bebc6a6a06e33aec
- SHA1 96904bdeb991235d247907040cb7e7fc0638ed95
- SHA512 cc07936876e6692e657d11d8695883cc7ee6cb2a0171ddf821488e61ef04bc8e42df5c5445e81b2153f2590f5d36ae07d1c39575887e24acbeaf8ac7bb4f1e60
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuyp:A3mnXoZjzyacNVOE/baEo/owJIUDuyp
- TLSH T1B6259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 971KB
- SHA256 497a76f9cd041acfdc7866463283497f71e0a4e82124a8bff5b410bfb328bf0a
- MD5 31f2f0f6513dab35ccaf272195866a98
- SHA1 7bd949a9f7093c01dd9a73f2f2e0e8a7818e2b45
- SHA512 c9592b831537c8a700cb1aba601a2c4d8b4947d90d324237f798b615642b95539042adc83dea278a770a5b335fa6bbd3330e6cee7307e723bbe3d798591ef777
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuF0a:A3mnXoZjzyacNVOE/baEo/owJIUDuFN
- TLSH T19A259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 971KB
- SHA256 a096acbe110d217bbe7b5ff486dfa84edd1e3604896543fcc8ea846cba12bf6a
- MD5 f00596759ba45b199fbbe79e170d02d2
- SHA1 148358398944b869dcb252b3b46802c96ebdae83
- SHA512 a2c0da2ada42df95e136078b43922dd5eb8261b6519de143841d25527c59aca7ea6a676787309ceb4b8dbca3252ec048127bef49c08f10da7d03f32742365cdb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuXF:A3mnXoZjzyacNVOE/baEo/owJIUDuXF
- TLSH T1EE259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 971KB
- SHA256 7ce07c5e31ce656a1d40dc7a4d2ba0ccbff6749a47ff5bdb7d1b67eae05fdb14
- MD5 bfa7296c25b58904eca670bcb1381f84
- SHA1 5724193dba0f275b08661cc22c3db16b64909648
- SHA512 428d3da8339284c5148d642ada0ec7b2d347a2a6ac0c971ecf6d317f568cfd4274a281d8231c2c37f5b95333943d7ae1b0664cf86f2942faf9e833f260f0488e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuoC:A3mnXoZjzyacNVOE/baEo/owJIUDuoC
- TLSH T1A7259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 971KB
- SHA256 96986ebe7cba03176d6083a17482204d1e2c064bfa98a852626e1a878a040df2
- MD5 c0469320b68cf5f71a869a2afd2b4c95
- SHA1 db91a8eca21cf29562ea422d96ee05e269116db2
- SHA512 38d14c3360f61f8f4ee422f8d25599127f230479469a1fc1bac60d1bc6f7c6c9a8df4d4d74ef1ff2176686a5f08c61397b855bfd9c43d3cc7c6b1b6a19ce1539
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDu7w:A3mnXoZjzyacNVOE/baEo/owJIUDu7w
- TLSH T1ED259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 971KB
- SHA256 23d054151e8dfbb87a9e49807960ca2e262e32789f6db8289f0dc40489d6edf2
- MD5 00ffdb652d76fbc1bec3be2e81201668
- SHA1 8f31bd578fb9c97e801b3d6088b440baf440be5c
- SHA512 f691511c2d0b1b437a74596cc2ec18866474bcbabf81eedf83170954188c88febb44084ffc2d59078fd6f650a68f23a7bd3a7ac202c10290a8c3ff8bcb531acb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuCT:A3mnXoZjzyacNVOE/baEo/owJIUDuCT
- TLSH T140259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 971KB
- SHA256 c52f3ab3ef91f2d7c25c55b4eec13072942006c1cbde5430fd70272340d9c098
- MD5 6e4d32efcd038fcb5ea05fdb1fa4a3de
- SHA1 cdf1969dac8fe681482a6454e275962685c51e93
- SHA512 4281e0f0b4f1e4b10c4b4015b47255dfbd7cb9ce45f1bc5d51fea0a22356887527dd88a5fa5fcb9b9e8e27d67b16366de46e24a2959f3bb7e97c347e5508b79d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuSu:A3mnXoZjzyacNVOE/baEo/owJIUDuSu
- TLSH T13A259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 971KB
- SHA256 3b30ef34bae6f1a696f997129fe081f71881f66ea020194ba9a3f30bb7f239dd
- MD5 a2ba31b0c3935048ce36bfa6de77ec8d
- SHA1 1075f478081468c75f1a2a04c486612ff154e3fe
- SHA512 8ef6569c1e2df01539417b8a3c48315c1916ed31a217daa936d5990b41145114b644a8e0b5e47530ddeeb8a30b32347ebfc7de6758d3880b3c44d0a7ecdcf48a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuMb:A3mnXoZjzyacNVOE/baEo/owJIUDuMb
- TLSH T1A2259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 971KB
- SHA256 fccc1ee8730d64c69e8b9c8d273837355a0569b4b396719700fb27a316d0d01c
- MD5 8ee8991fa46db526ea994a3ef0548a26
- SHA1 0c178f0d76c78e61c366fb559bcffbb8816ffe91
- SHA512 c178f7ba9b577de7e5d791a8e12d8df8dd54185ad7442d74478ec91b081c83789e8b7e60113bd12aec75c989113c6e0199db7906800a5a3fe6f6e8d03e2784ce
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuyf:A3mnXoZjzyacNVOE/baEo/owJIUDuyf
- TLSH T183259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 971KB
- SHA256 8336ac2f7c12cd14945379d47c7bba830cc204614700a547d7d36e70264e122c
- MD5 7b8adc78741716d4f6f0e8cca61d30a5
- SHA1 4b2ca76654567da952988cd7031c56f57f3496e5
- SHA512 2f83f2b15d9a425f02e596dfe6f7dddc67590dbe3557dc343b1f826abc8c20422f64adbe499499ef213e2628b37df5604e64a9b04654e348878ca261f279ba86
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDufK:A3mnXoZjzyacNVOE/baEo/owJIUDufK
- TLSH T148259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 971KB
- SHA256 43ce98a124658248f6be276b8edfd8c24c0d08205707ea72382f9f833c1a7ca9
- MD5 ad227dd2cd4a559722fed47987ef7ec3
- SHA1 ba79e3d33d74072fc5fb4205bb4c26221fd845f8
- SHA512 a3a9a353e69a3f0ce60b680856e692ef2951b8ce662c5e4805eaaeb88ef840db25bb8b5c8e9e752cc895fec90ef69650a5d0b1693bb30b23fe601c553febf8b2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDu4k:A3mnXoZjzyacNVOE/baEo/owJIUDu4k
- TLSH T13D259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 971KB
- SHA256 59a156179700477948fbfc20d3a7568b6380bff8c70f290f4a8b64926bfb8932
- MD5 0ffd2dfc74d78d7e5117fcb73335ec19
- SHA1 cb17be09b3348d8a2dae1f636a8c06163ce6adf4
- SHA512 2225028a4cde815c290f4af03598fee4435caaa37c1f4a28088cc667753c151fbb6ac4770211612f8276f5a97ee2c5d6af9be31876bdf394ea43a8062e0e9b9b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDu50:A3mnXoZjzyacNVOE/baEo/owJIUDu50
- TLSH T11A259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 971KB
- SHA256 47bba532b4b7ac5db73e806602274097b7df87b1d16712a74a522a99aa895df2
- MD5 1a5eca44c57c1733c5774f069d186f74
- SHA1 c36363fa7f5879b9b22bc6fa87f1373c0f1a8de9
- SHA512 dfc33867c4a632c2097b3fe681a60670690b3853eaca2774892b02f04f502f8bf56713c0ce4f2425521cc43e10b5e7f24bc588e4e364951c216b6bad012d0935
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDus70:A3mnXoZjzyacNVOE/baEo/owJIUDusg
- TLSH T115259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 971KB
- SHA256 4ee415adad189e4f149f2edf331f47a4b427767d4770427ce4cd4b763ccbbcd1
- MD5 5e75e97fd8895cd1e9f51e66b07dc1ea
- SHA1 e83fb4f87b1d66b2a5cfbeabceea1b5b69742ad3
- SHA512 ecfbc3634d9d6377f6ecd6e66518566dd4555c1a58a618bd4b874ebbc654b6632763211c3a764970d1bfe3d0dd6bb330b5852d2b7fa21f0880bb847a0c8a60cd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuJr:A3mnXoZjzyacNVOE/baEo/owJIUDuJr
- TLSH T162259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 971KB
- SHA256 07c36ccb862bce19fa3e54b5c708f857a6a1097fef46e268e070c4c4a798e817
- MD5 0a09cc06a01d1a1efe73aeaed1c264b2
- SHA1 ebbb30cd0e4ea687b84170e40161316973c8263e
- SHA512 c6f15800ce624330e8f96a48b962b6822dbfc69166ac7147c97d61c4b1f29a6ddbb05ca65cc45ce9bf7fcca23d8968c80a8766424ed89b6a9cb844c85b77158d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDurn:A3mnXoZjzyacNVOE/baEo/owJIUDurn
- TLSH T1CE259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 971KB
- SHA256 d633bd69e9f9b7d69d6cdb0bb773a8fe03d5192a41522fb954a08048c0cc9399
- MD5 cc74a3aef5b5cccb21e8759395d3831c
- SHA1 3da54a052242197a57b7dacfefa9e8033e8c0ef5
- SHA512 b7a42602dce545011b0ab45e73bcb81bac1f2933da59dc809c175533c3670c9f436cd5e898c160a4f1cf30bbfb6709ecb269d39a9a976b475ddf1df2a98ffa86
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDu3x:A3mnXoZjzyacNVOE/baEo/owJIUDu3x
- TLSH T146259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 971KB
- SHA256 84d809690b358fa57e45ad46ff7c05e17ba89605be7c566dcbc83c2f845699aa
- MD5 beb2a954b901ca9773bb5cb9faf7b063
- SHA1 920a6c35e62c4de836bed89ff0ba63d17e47eb2a
- SHA512 df41b1092e2111921bff9c75e1a86f605bef651a61bf0e031aa9208674386e2aa750bae09766b4f9cd4b26f7f23a26232d870f628153542aa044f956d75338eb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDutA:A3mnXoZjzyacNVOE/baEo/owJIUDutA
- TLSH T1A6259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 971KB
- SHA256 f21d0513f9ea7ab1edc0ddcd005ef308ce5922e7cc37085b57499923b1b0d89f
- MD5 e66825092d2c637ae91b888454f7ac20
- SHA1 83836fd4a50a973b0c15f93fcfc2622972e45f6b
- SHA512 157e02f2d3a4cab8758fd16202df94d44792c75112f26c58712ebe4d0178146e6d2888129c46cdf4c67142fb3c642aefcd94f216a9e3936d9df949b9023db2ee
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDum9Q:A3mnXoZjzyacNVOE/baEo/owJIUDum9Q
- TLSH T138259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 971KB
- SHA256 f0705447fa87607d2a7d21e1048727f78cb3425962f851dbd954f3ba8324bcfd
- MD5 ef98414c9021a18f5c2c5323db2bb43f
- SHA1 dccae3ec5d13c11c773dcff58a804cbb17145831
- SHA512 ffe2fc84ea2369634022a2d888fa63d936220ba55d4e862510a520b42f222f478fbcb583a21605de7de30bced2ef612b44017cc656952d5bde09e794da80cec1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuD4:A3mnXoZjzyacNVOE/baEo/owJIUDuD4
- TLSH T1B5259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 971KB
- SHA256 9aa7f149c1b4e4315fab856320770a1c573f1dd003e3851fa357bb2ecee405b7
- MD5 a4ca6040168c06253ea0720dba246826
- SHA1 a0e56cffcf104a8379666cebe2696e0479db38e9
- SHA512 da070eb91ed6025736978eed54c8547e3ea3fcdcfc14ccac16498c56997fe2bb49b0a83bbff074326ed84b46d63f2d55484c35931df5c5250db7e5445289d98d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuqu:A3mnXoZjzyacNVOE/baEo/owJIUDuqu
- TLSH T19E259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 971KB
- SHA256 aea1897c1c7b2b317c5734e69be6bcd34ef3b4d2fb7467bbad93cf3ff6e7f189
- MD5 242f534fc9c17e7e3c911c010bfb0593
- SHA1 ed73b14abec41e947a8f95ccc749377e55e4ae3f
- SHA512 0d192679c9114a0df5c8671e4a887bad8af3bb0afc1914a1c45d6685d48ad166706e5550c08b75d1096096a1648b55f67c0a259de13c777676a41840a865933c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDu7j:A3mnXoZjzyacNVOE/baEo/owJIUDu7j
- TLSH T1B1259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 971KB
- SHA256 4b25e5489cb10d285922177601d716b00a07ed8abbe36cc88c3f46e6c3fae4fb
- MD5 60c81255f8d49e23c3f16f8ec51a8e3e
- SHA1 5b7c80348e042f1e3c735afdf3d9cbe00e33f5f7
- SHA512 f60c190bcde9e2c71724b9b35e845efa5898b9ba223fdffbd17114f46a6c8508b748e72973869719ecafaee89685677f144cfe30c94e97d21131c6c02bb09396
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuGg:A3mnXoZjzyacNVOE/baEo/owJIUDuGg
- TLSH T1CC259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 971KB
- SHA256 8f14e21159bc1473fb875f74010190a4b828d9c2c1ca10e13289b6d6258d2289
- MD5 d4efe9eff1f138485bde296a78806bb6
- SHA1 d876a2a148a5a05d56355a8bdd8e93361a2a22d1
- SHA512 62a44aa85e1337001d9147b04ffc9ac120e9869a6f876f0b32a5d9ae4113d3d5b157bbe1d00f680e4bc2699db077bb74d8510bd6d127c8a02330fa44931b5a39
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDupI:A3mnXoZjzyacNVOE/baEo/owJIUDupI
- TLSH T1B9259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 971KB
- SHA256 06156893098e36642cbd5ed560325d40768eb5f5ebaa8cdf52475e8b4148488a
- MD5 3e51ff71cda03ef4884855f92c28386d
- SHA1 7da8c1147787a35093ff566231be1f17f36ed626
- SHA512 676db02835af74f78f46df57ef641f8890f9b4b160a34826520392f2e2751676cdb28efd421bee9e5890e812b7c386e49d2098f6495da26b85ed83f51fd08539
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuLo:A3mnXoZjzyacNVOE/baEo/owJIUDuLo
- TLSH T165259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 971KB
- SHA256 00fc4952640c03e27545c71dab4b47aa528dd3362bd9be59574c236575ed505d
- MD5 10ce60e6b08382c23484985efd0e087b
- SHA1 64a21e9a1d905ff3549454512cf06e1afe4b75dc
- SHA512 eaa7cddfdafc5306c17ba08794e77721f885e5324a5a684f9f617b81ee083632859d117c410b99def7b56722a97f868b458c33b79e653a0704211aecf2b7b94b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuw+:A3mnXoZjzyacNVOE/baEo/owJIUDuw+
- TLSH T1CC259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 971KB
- SHA256 e1fc75b5ee214c77eda3fde5bb2cb33f1012c5878898ce06757d521c848c4177
- MD5 a16a408926f3a8d3aea41df57792a7a3
- SHA1 68119534dc700e5301cc224c5f8cc851f4f6ef34
- SHA512 0ccd1b9a98bdc112505ad46619763a78e91ea11b28969d0f800ffce8a123604ef2ec31b4d1f2d2bc993492851d15195a768c0068772257c67147672e52880a8c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuIQ:A3mnXoZjzyacNVOE/baEo/owJIUDuIQ
- TLSH T13A259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 971KB
- SHA256 88d15e940cffc3718c31870a4dcdc90cc8936a934a89652f257c87a068c61517
- MD5 82f74ef7719fc28ede5060ae32d0d00f
- SHA1 c9d5528047e37defd9ea0d780cf9ef7f150bcf1a
- SHA512 2c915ab56b3585ab33aae899b40e6e43012586d88038fe2bc7ad1b33e8aae03017638f1aba3b392fb2b865c74bf7affd7a4c3b899725eebbedcd237292f89edc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuBX:A3mnXoZjzyacNVOE/baEo/owJIUDuBX
- TLSH T164259E27EE646CE1D22A89749AD18601EB717C314B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 971KB
- SHA256 fa0d4ef0ffbce87455d83f5134cede6cacf36b8b15bf49f7ef516ffb6246b800
- MD5 94fc32d83f080727b8190e39acc7593b
- SHA1 f234a8186b15fe7e07a9c8767a0b82b62fe9f58a
- SHA512 32c0e3567128e1dd59f506eb1651f27c6aeb667681de0d1ea5f4cd5d0198e187414b0564d1d97b9be9f93509324b29f60b79063ece03faf173a87cf10f95ce3a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDu7L:A3mnXoZjzyacNVOE/baEo/owJIUDu7L
- TLSH T196259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 971KB
- SHA256 c786c44b44a9c27062661d3bb6855f1fde0ebb73ad96152e9b86a55c32fa39a0
- MD5 3681216db26be01fa0631c4db7de32b6
- SHA1 96d69ac2ef8cd98509f0bb1c2daa3995225a8596
- SHA512 c1888735e7580868e2810a61dedbb7e360d6f238ffee09eb477b13faf159befb3bda98317c740afd9b11ea692afb9afa57a1a0bef3d2a99f5a0784fcc2759c86
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuBFC:A3mnXoZjzyacNVOE/baEo/owJIUDuBM
- TLSH T10E259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 971KB
- SHA256 48f0a83bd91c878af7dffd19f2e821aa52780a9381d1d387bdc6fbf8bf26b344
- MD5 16536b00e8ae35d559f0782f36630e88
- SHA1 3a105e2a2f1f91eab973028d19efe894eda44a6c
- SHA512 69a03d53fa1c27341fa1aa479dd669ac4822b3788995614a2563da0e64fde409679db382b57e40717ae817944b89d803ee0bed60a208d97c3836391bd3ee0b9b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/baEo/oweBNUbTVO86UDuqh:A3mnXoZjzyacNVOE/baEo/owJIUDuqh
- TLSH T1B2259E27EE646CE1D12A89749AD18601EB717C324B61D3CFE368C3195F237D06F3AA64
- MD5 SHA1 SHA512 SSDEEP TLSH