b4b06f698e9b2b01093c2ae6665dd559f1808d9a03f0dbc5cc04bd7af7462bb0

Analysis

max time kernel
99s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Size 917KB
Sample260802-wkcdaaycmg
SHA256 b4b06f698e9b2b01093c2ae6665dd559f1808d9a03f0dbc5cc04bd7af7462bb0
MD5 7c303886dd6793a00f7f3e0405cd8eaf
SHA1 24005740636c36f9bb244974a2570727611f30d9
SHA512 2bcff8159b1c7d308ff740ff6b5979c439044045814a182c70737e0a0e6035b019717e7aeae1f9fd78a3445887641ac5718368de17fc656c8734a4774263eaf0
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L87:J/sCv7QExqatgl8beJTTx0yoc4zy7
TLSH
T1CD155B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5976-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-566.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-615.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-646.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-725.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-756.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-793.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-880.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-944.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1073.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5976-2003-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2904-2016-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
2904	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe

Drops file in Windows directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5976	2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
2904	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_7c303886dd6793a00f7f3e0405cd8eaf_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_i.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5976

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 917KB
SHA256 b4b06f698e9b2b01093c2ae6665dd559f1808d9a03f0dbc5cc04bd7af7462bb0
MD5 7c303886dd6793a00f7f3e0405cd8eaf
SHA1 24005740636c36f9bb244974a2570727611f30d9
SHA512 2bcff8159b1c7d308ff740ff6b5979c439044045814a182c70737e0a0e6035b019717e7aeae1f9fd78a3445887641ac5718368de17fc656c8734a4774263eaf0
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L87:J/sCv7QExqatgl8beJTTx0yoc4zy7
TLSH
T1CD155B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 af10d890b3187ad37d62b178d283a6f257673d4b0c95b2146efbeda5ecaf4dae
MD5 5cc9157c1ebaf40305026f5323a03b1e
SHA1 00d18249a07631e9f0e045f4d1d793c7f9f10fda
SHA512 e48c5442cb2be4c021d82a917650a4c6fdc28f9c1f6a6503b9b019571c435e37afa98cd92e71d8c4070de76227425481011ac1d61c650dd09814d9da8b6347a4
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yoc4zyn0Le5ji0hmxNrM:NDqatgl9TK/0Pji0Aj
TLSH
T1E8655A57F66482B2D0228175C4E75686EB71B4461B3086CB13A8D77C2F33BF1AA3A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 931KB
SHA256 ef238bcc58e5ba92a69fd0fa20e18f92fda669c66ba4b374dd6c73350231c479
MD5 7524c122f42640b81870b9867f24004a
SHA1 9a02ca6dde1eca58406a01dfeca13119561bd9e5
SHA512 bb93b1bd2dfe0861252c45ff81a693967e209881a77ff646c5dd93f0c3526a5f341aff10ca260fdf0e14bdd8c51dddcb3a16d655a2ac80e0871cd47455aa50be
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L85a:J/sCv7QExqatgl8beJTTx0yoc4zy5a
TLSH
T14B155B53BB4445E2D416023048AB4652EB71F81A1F21968F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 940KB
SHA256 5779a90f6af7c4647e75c5b756060a977d2422ebe1ab0b032bcc2ab56343a56f
MD5 637c88dd53d371c73eb4008344d374a0
SHA1 7f4135ae4aa8dde08215c7d7c690ed0ad990b457
SHA512 4aa8c28f7600ba68e2b23d32c25e434b3f18a48e48269fb11aec4712c705d5db642c0f8b98a67e69835c47002cfd5c333b4684ec8310ece415cc02bd807d364a
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8w6:J/sCv7QExqatgl8beJTTx0yoc4zyw6
TLSH
T10A255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 940KB
SHA256 ea67cf8794a03322a701af42f559ee39e134551c99ed3cc3fc0907216b18e354
MD5 b6362a25e3901fa4991a3ecb4ac4ac48
SHA1 9685a1623c51732f3574791bcbf7b2215e994a09
SHA512 4d8236811065849d271f7205d817ee415044726a75ef9b8e0387c9cb047a2cc41c213ada40dbe33c56cbd621342a28a29557c7ff8b665af77af601b3185b6a05
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L80N:J/sCv7QExqatgl8beJTTx0yoc4zy0N
TLSH
T111255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 940KB
SHA256 3c4b978de3ee5ab5921b95f4a5f89984dd91502dfb2ef0cdb7bbb3186abfe3a1
MD5 b470bedb30a500a66b5068a3d54131a8
SHA1 ca4b40b69397e3cc239a4d497a728780c0bbea9b
SHA512 3b80db97be3e51abae07c5930fcc0fc1c332124349f86a141dd8d65d020e6e524bfb3405e730ee826f23530f4ad60826cd14f9231e151e2e777e24ee0a9fd2f4
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8af:J/sCv7QExqatgl8beJTTx0yoc4zyaf
TLSH
T170255B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 940KB
SHA256 3b4ccfd23d2f09f2d3224a13fe1f772f8665d8bf1e3a34916161125317c31624
MD5 26bac81fc29e603523eef106bdaf5000
SHA1 dd898b11080675f9807d75c1eb319d7a9733e9ae
SHA512 2bc6e9f74307289cf926111c600e6e6e50bcfaa5dadb7fa13af074eeb9d70fc1691428cf289069dedfe1c34af89af21f0555431b92d598e987143c26bd8bde91
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Uo:J/sCv7QExqatgl8beJTTx0yoc4zyUo
TLSH
T158255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 940KB
SHA256 e67401d88fbe9510e37d5372af81e7e657fb4af9ca4563c2753fec0c5d345335
MD5 c7aab16651c68b404eea2c488667593e
SHA1 035e389def3c549a2daea1d8c8f025a5a96bb613
SHA512 bba9023075990554bb3b8639d2a2f973afb0c438c4a2bb8b499047ed3536c9f3c14521a3c855f06706eb91ae71e61f5c268aa80f5905a06d6e54cacf4d20aa6e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L80u:J/sCv7QExqatgl8beJTTx0yoc4zy0u
TLSH
T1FF255B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 940KB
SHA256 b2c0cbdfb3a7e909641c821e9a6a1fcb8e151b49299d810c6c7bcb8a29a4a3c6
MD5 dcda89b37daaaf3da47633bc1f962e45
SHA1 014f6339494543861fb8562aca5c8ad54233c639
SHA512 60d9863e97fe904314c3755c07c01e4d3bb012d4f3b57589f832385ae21287d31c6c7f5787b9085d97687eed5ac6b5e6de0d71d451d8bac1d78bf9be445ec199
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Y9:J/sCv7QExqatgl8beJTTx0yoc4zyY9
TLSH
T1F2255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 940KB
SHA256 ba262c1be6dd5bdfa6ccf52704388d2486b576ae51a9212807a04fc0dc522326
MD5 c6f6c0a4452c1ce96dedaeeed03cc237
SHA1 129fd7e1381dbf01e9074085f1c927ae15f2dc44
SHA512 a379194c7f8f49190ecf21eee5d10f583bac75a618123aaf749a1bb7095fdc56446017ba270353e10e4fdd6a33d786cb05ec0c609234a3b331114bc96e860410
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Ac:J/sCv7QExqatgl8beJTTx0yoc4zyAc
TLSH
T17F255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 940KB
SHA256 7d2416959bd5c2cee364d0326dd086742d704d71cffa92e34a8956a82ce2d3fa
MD5 a840ca8f6205e12232a9d2d13c22e207
SHA1 e8d4ddc52cd1bbd66f50cd3021f55ccb649bc5ac
SHA512 ce37b652711cf26e02b688347be5ac358477424cdc88d9bd0572a213480cca4f0a198a262cee15345fbbb2c534872b40ffc3c4768995c099929b187dc1593a81
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8pp:J/sCv7QExqatgl8beJTTx0yoc4zypp
TLSH
T14D255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 940KB
SHA256 9d494288f10afa9a6e58bf91ef461932f0f1f28ec8a79340b0a53e3a7a89eaba
MD5 c655988683cac211536d74668ed4e4ee
SHA1 35dc1b6acf9025d86ca9f0ec797768ab49f3862c
SHA512 7df41a28e4eb7a2148d837fea1c73d5b01d929ad091c74c222041b697f23d8f91666a5e686bef77cf02f1d5de47a812701e62317afea06936851b33ac10a5dfa
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8u0a:J/sCv7QExqatgl8beJTTx0yoc4zyuN
TLSH
T1E1255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 940KB
SHA256 3349176e70fb4e4d739affce69d80de5a631ae6629e347e3c212b82b5c877dbb
MD5 b5be6d06ad79e519a60b6349fe74a15a
SHA1 cbd3806f2598f9ac88500e0da84520e6ffff9239
SHA512 189e97f5ebab6bacc1ff40ac7bb312bb6008672a93e355165b4afd795109c75446e5fcb3aca9a4320f009fbed8b457a712f33a0e1d8b5796b3b83dfbfbafdc15
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8SF:J/sCv7QExqatgl8beJTTx0yoc4zySF
TLSH
T1B5255B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 940KB
SHA256 3958204bc51b8731c255b9f84b74f403d3338d3b5b3fcc933abb0e4a14d7a1b5
MD5 45600df6c0633ca6cf44e307a06c870d
SHA1 f13f5c6ce3b270b15d7fd1cedff0b858813d0607
SHA512 7330d733470871e070ca811ab6593c22da1a77af2bf74ce36bbb2a8f1347d8652d073714a14999e839b10278a8500cac8eea64e2b2c8d895a39308c03417ac00
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8XC:J/sCv7QExqatgl8beJTTx0yoc4zyXC
TLSH
T122255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 940KB
SHA256 58d562146908407854cd05f22225515d3d653a1d2ab9013e6bc2c85a2b4bd07a
MD5 7f230339706923eb654b01655365759e
SHA1 b2dbea03ed0596cc40c3641e40f64ad0e86982ed
SHA512 eff269918a5b07d63cbaebff99236034aa5bd3335fc2512b3f40634cef60cfaf8eb8bb69f4780534d306f7cdab77226fd06ce43806d2b51a644ab3d1395587a7
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Yw:J/sCv7QExqatgl8beJTTx0yoc4zyYw
TLSH
T161255B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 940KB
SHA256 99fd6e1be5c738e52ec3fabefc1660cfc31811cae34c1d908396847329848f0c
MD5 4aeeed4352f3d67ca3b9206f1da5da5a
SHA1 d86cc71037486691b65197fad2447a1507fb21bf
SHA512 3a6d7c4942f857526977e43b14647f968d6c8fa819830174f7ececf3d0ef170446743959284fdff6085581ca348fe1fe48ac860b8e2747b8cce8092f068945e3
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L83T:J/sCv7QExqatgl8beJTTx0yoc4zy3T
TLSH
T1E7255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 940KB
SHA256 5ac34efcf90a03bafb3a077390e8db713a48b9708122f46fbdab732adbfa4f8f
MD5 70bf493828afc418d2b69632269178e9
SHA1 06e5d1ef94ed829d92d099d761daffc213ee70e4
SHA512 896a28b82337c42da6e1deed7ce724bfc78bcefa9fe819c0aa6ebd5786f5e767415a5140a5d3b6c0fa4ea252f752e211b28d0c5965aec13eb8ab080b417f7e6f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Bu:J/sCv7QExqatgl8beJTTx0yoc4zyBu
TLSH
T186255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 940KB
SHA256 8f2068f36bbe7494913ed1222290b4b5d29702ec1edf767d3670534d178d3891
MD5 5a06eea960b1d5a93fc8be8c1678295b
SHA1 d2e63be8c876618060c87075f784ee96b072835b
SHA512 e2ca3ac178999e79e5c6110e80cb1811af2fcffab8f51192ca532cd23af4c6a7f7be152f594ee6589bb72532840a3d7bcc151bb69064a2cedc28ff5587fdef29
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8pb:J/sCv7QExqatgl8beJTTx0yoc4zypb
TLSH
T16E255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 940KB
SHA256 cded6e6037de9131cac5e0d4d6951cb94b38f3778218d17c7a75380f04484491
MD5 a45eaabbbee3232a54471bb507d656f6
SHA1 891c02ae0925338112b604374240d3d0cd3156d5
SHA512 54e1df96a3e06061f4b298ac4c6a4165919f7c2f147b674e89cc5d8967cf92663774b3c4eec7e4e9f0db2a4ab4a48a914e4bf4b1049fcca4511c5e3c23d3c98f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Rf:J/sCv7QExqatgl8beJTTx0yoc4zyRf
TLSH
T130255B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 940KB
SHA256 710c542747602e2093fcc5418ac72996bad0359cd7e665276b6579e8cb1d79dd
MD5 e416fe195e966f3c7aa2c962e5a7573e
SHA1 e2b6bfdcacee379dfb6e1aa6086e4e3358ca8c60
SHA512 5465321def2bc7a641105b2b4d8179c0456e7a7087b137290e2c7deec44587c5b9da6b46ea241c5dc2cbc309cf3624d0198c7f466929bd3ddba403549823963e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L86K:J/sCv7QExqatgl8beJTTx0yoc4zy6K
TLSH
T160255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 940KB
SHA256 4699e38cad607abbd3b03e0e7848bb9ad5934a89106ca14d8cb8fcdbb6eb57ea
MD5 25389b2bd6e6530191f2a1987df7f67e
SHA1 92ff9be3bcff3d6bd18385926c4e647da335fae7
SHA512 0f661aaa1079a8d6c086d98a4d1a9e4f3cfba0594819a23e775b5b07c2156f66c9f4b8f1b7c83cc978f6cb432b9489ce94dd88447a9666bc9029dadd2efff4a3
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8vk:J/sCv7QExqatgl8beJTTx0yoc4zyvk
TLSH
T1D8255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 940KB
SHA256 c9f4b2096621bba7a7b5ff4b48cdede66cb5adad261ec3cd8f7a9bbe8cf77629
MD5 8184a4b635d1509054dc83e263c19782
SHA1 84173e5bb82dfb600c0030a311c4fd67f0633170
SHA512 e39b63500546cb321d272b1d3d05ebb13241fc2449031be240bfb1b70a023b34ca4ee602ebe7dbf40084cdfb8b8f2a7ee2541b04de20c71e03c1d575c9317536
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8o0:J/sCv7QExqatgl8beJTTx0yoc4zyo0
TLSH
T1E5255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 940KB
SHA256 1f99249d8f444ea57c57829e672e4cfcb0d9e7c557eaa78e1f8ed371669cf719
MD5 603e722a2c7424e12e623e5def228adb
SHA1 4d589ad3ed5bc09785445b3727e56ee41e029c37
SHA512 53f0b1092a2c0be5e6af262d8f94189eea5d19bbd768a7a791f3a3bc912466eae42afe6b26897489985333da98166614c6eddfe605f7d06cf737c69692e6f061
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8D70:J/sCv7QExqatgl8beJTTx0yoc4zyDg
TLSH
T10E255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 940KB
SHA256 fb7c39b9ab04adae7207042ef03797229b9b226d6ef1e70aa3457c6d113def48
MD5 bc5885525ca819a9b07c04802f7c1e2c
SHA1 6e00138d84d6d48980fff3592e33d0a31d45cf1c
SHA512 434d6e35590d61c58d37bd8a7283812492f9afec1cbbc59daed8d190a5fd58e2e8a0fc79d7d1bfff1601d5dedcab2fd83f14bed60d1e36416eaf27f77cbbed62
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8+r:J/sCv7QExqatgl8beJTTx0yoc4zy+r
TLSH
T190255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 940KB
SHA256 40f3ec9ad6b16943f26f84c671a11edbc2ef73ca63e195d47bf92057caecbcc7
MD5 e67d94e43365fab1d6abb7346281038d
SHA1 599fa8f18a5168d1ea0e6600949021566a9f457d
SHA512 f750a2154f654d1f7a7f320dedd44edbf9044a64e22e8d23af86bb96f3b797a2a9ed37b8e392cbe4e9db5d972bba0ed3a2b361b471a9e30aba684ee9d226357a
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8kn:J/sCv7QExqatgl8beJTTx0yoc4zykn
TLSH
T102255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 940KB
SHA256 9666bc3444919688d8b05c6a65eeb1cecba659a9c6e31998954b3b0131373988
MD5 3376e9714466403d734aba47f7814db7
SHA1 fce384de7362acd80a3c08bd8c496e5e4822d32c
SHA512 215165538a0eba3795e02d5e63dc3b44a1c8b2fefeb9b0f82058c65e1c0e3520f3f74c82e5e47574a5efbf3476c0ceaa2144b2f65f5652ed4a12a221aca4515f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8yx:J/sCv7QExqatgl8beJTTx0yoc4zyyx
TLSH
T1B6255B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 940KB
SHA256 030d7b9af3f74a0b1d34f1769a59898a3a9bfa679d209517ca4503e932e7bd28
MD5 3807ef41494a0f9e794c9ff73e5d4d16
SHA1 0878fde1e3137639fa1dc66a65cc4ae4552640c1
SHA512 2768cea2307d100fa4685eddc954fabdf1186d955c1583ecf4ac8b98983f0070ded2347a50c2a2c583d6222d238a8eb0c6b5fcb07510b74c9df1795b50980bb4
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8EA:J/sCv7QExqatgl8beJTTx0yoc4zyEA
TLSH
T10B255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 940KB
SHA256 1d2898798cc6ed13a1047323c89cfa5c50dd6fc8a9b3e72ddd2138d0c719a3d3
MD5 ffa6ac4abb8a3c9b5dfe4359b04c0ceb
SHA1 76ecb0ec3383e0c81247588ad0041e3872e8aeaf
SHA512 e606054645edb37ebe896539cc9a56ba072844cb69e451bb9f938fad077e2ff1b62ff593c3dcdc8775b1f64ce5849e81060932a821bdb5fe899e41f1869ab59e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8t9Q:J/sCv7QExqatgl8beJTTx0yoc4zyt9Q
TLSH
T19F255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 940KB
SHA256 5aee9cfaede7b9263f04316904ee2d0ff4ee1499b3c710a35e3243b4cf55bb25
MD5 4eb11d64b4864a19bb625ed3cb04f7ae
SHA1 7f798d8ab40d99f4f19716c2cc431bd54ae94f2a
SHA512 9ebe33f22bb289ea95f288b5824ec4be5ef26bd623b0bbac19af20483239844f4ca80d79217cc6af4a93793d1b9edac3d607dbde66682c6a10ecde9e166b3c22
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8I4:J/sCv7QExqatgl8beJTTx0yoc4zyI4
TLSH
T1A0255B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 940KB
SHA256 11c4af9225532cdcdf6e3fd9eba69e8d75fa9a86a0dcee29668f439bae6c8539
MD5 9f07e4c8bceaa4a4d37f32d1c35bf052
SHA1 285fdc9324449be6ee48a0e34932a0441ba32a85
SHA512 75e234cfea0963cdf418f1341f1fa93f18a8d89f46595c6f77581dc18893a29ef70d319039cd8f6b8f5542c88649e283e61fcaf43b5242448b758b9fd2139559
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8bu:J/sCv7QExqatgl8beJTTx0yoc4zybu
TLSH
T128255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 940KB
SHA256 87f65f6316ddd6c5e8470d23b65141bf7d5bcbba23df517d14df3bb9808e1d08
MD5 37d52a1c514533011c73a812dcc264a9
SHA1 6c8be687cfbc61d50380500af28b179723c147b8
SHA512 6dd7a632839e58f0a7c9852eda32a51f41016b6070243135c8dfe969acbc3f8605ca0fe8ac98f0698c3dfe04920e8add56f6c8d1a6648bf45bc16612bfd26e19
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Wj:J/sCv7QExqatgl8beJTTx0yoc4zyWj
TLSH
T1FA255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 940KB
SHA256 2850b0867f3877b8dfd3e49a3f1c49396f1091a0ea8f64d96c6b30d6b2f9b2d6
MD5 7961a26a8a4e4746025a603d8a9868c5
SHA1 0ce22b7954edb48c31b3eada859de39b4a7a8336
SHA512 6acbd670973466444fa23f3611c09274bec9527d8f82f5383d8ef439518fc00e1df7b959141234e17cc0756f5c775db9d9a227857a4a61a055b3d26b3fc737be
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Dg:J/sCv7QExqatgl8beJTTx0yoc4zyDg
TLSH
T19D255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 940KB
SHA256 304497093c5b17e3216f94ddc7a4a53b7337305dc7207799509e53973ce6e809
MD5 7f04d3c04d10883ebdd71e55608e2717
SHA1 568ad187e28161e5cad60a9c962934f1d76e1577
SHA512 978563a86a18b03e2677b599d370d4fdd27458045751a8558a9af224afbccfdc8b87f2cde8146f1873a185f34bf7e4de466d157e20d792b057736ae92383ff1b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8+I:J/sCv7QExqatgl8beJTTx0yoc4zy+I
TLSH
T1E6255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 940KB
SHA256 680fb346b1f6a2708ee115a348fddc70200423efcdffb20f4208b9a18d06ca99
MD5 b3aba1a73bd0285d4eb6c59799a3c01c
SHA1 1fb5fbf24248681919f726a4da910cc645ce7ecd
SHA512 7fe81e9904809f07e31e7e5ec9c10e93bf6fc3d1ac7b0a39b6b094aa303d9d71fd32dba1971e4570cf58483ccd86fd03dfe8a7888df6e43dd2a9f1554e6f4efa
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8Mo:J/sCv7QExqatgl8beJTTx0yoc4zyMo
TLSH
T1E7255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 940KB
SHA256 04f6ac7be402f691d8bcfb8f438fa4b75fc71693ce4a9b82aaab4c08b9d8427e
MD5 ff499e9830c4568e2e9718f10f1e6fcd
SHA1 8724791d6360618654ea848602a2332860984cb0
SHA512 4a71a3624d119f89469d7cd36c657c8226ae1c70c2024aebc67c68bf8529500bf5f0d8a476325c5bd0abaeebcf47efdd870c6cf92caab8b1d3d7c40c50f21400
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8P+:J/sCv7QExqatgl8beJTTx0yoc4zyP+
TLSH
T16E255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 940KB
SHA256 ececff8ebf15d39bb0f858871c9f0f3212750f966d932fda5ee43fab622b4279
MD5 78b05da9bccb9b1597ae340856b4e1a3
SHA1 82c51016e83d01aeb27253201f2b3659fd0d5dbf
SHA512 45c8f209758b9b1cff74f2f5be64cd0b9d78379d6b04e924cb8605d7f842b8d0bdb3c25821a344db11f10d0c77e146d0692bcea6196f1e3afc50ea14ab2c5abe
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8lQ:J/sCv7QExqatgl8beJTTx0yoc4zylQ
TLSH
T16C255B53BA4445E2D416023048AB4652EB71F81A1F21978F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 940KB
SHA256 80ed9f2131acba7a37d7a323862bef562b3e22dd86afaa1cf8ad3498e302f3f9
MD5 191b298b0a90e43ffaaebba1f643cf71
SHA1 37a5daa5b5f1b3774b1dc56d89139b68bc9440af
SHA512 40cc1011c7ce7c6afb683bb37331f851bb81a52921cf7dd41c64931bf5af5efac8bc6e9432e35bb133313e63b0df781f28189582a78fdec13f8b220997d82e90
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8qX:J/sCv7QExqatgl8beJTTx0yoc4zyqX
TLSH
T106255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 940KB
SHA256 ef29783b3d447125dc277e254f2200c840149f34b2e971540802f11b5f2af0a8
MD5 0f014bfb257763316cf465459dd8330c
SHA1 c9071fcdb9ad1e0e5546c2e08613053def9c9c01
SHA512 1c36d1c3acd5aa0435c6297c86faaff143ba7256c3214dd9fe1f71d8cc5d56aad0e23fc7492d3b071acfb82685c18f96e0ed8fa9ce6a50cc674c5fc9f04795e9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8ML:J/sCv7QExqatgl8beJTTx0yoc4zyML
TLSH
T194255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 940KB
SHA256 57060be1b50fbc314cda8f13753a508f553bae3ea989522a026c1eaf4eca06b4
MD5 c020ee29c71d13f7fc4f9175c8e1209a
SHA1 173667dc129309c2c0852eaa192a99059768ee48
SHA512 feb652a879be9c10c6171c8b02406ccf07dc279cb9a702067cfaef15f1b2bf1f27e548dd1d1399d0449084846d7bc966f802fca9a262a7d788897d37486926ba
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8IFC:J/sCv7QExqatgl8beJTTx0yoc4zyIM
TLSH
T1D8255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 940KB
SHA256 8ea3cd83dbec98d3d1b5f340bd949c18caf5fffce8cbe0aad0a7dba9a7cce2de
MD5 45ebf87c6be91843de3a289d3153e0c0
SHA1 7381fe88c4257fcb2ccc64095610e2434d228a6a
SHA512 b3b1cfc0dbe57d579506c1a0b9a8e8a2bf42b7e3a8a28a6b4118551fa69b943f725a6a8eb036d0e897f8fe678993d3938a68008d79884a2bceb53a08dc5aa39c
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoc5yPz5L8ph:J/sCv7QExqatgl8beJTTx0yoc4zyph
TLSH
T11E255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2904-2016-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5976-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5976-2003-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads