Analysis
- max time kernel
53s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 11:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
- Size 35.0MB
- Sample260804-nrc96adp2y
- SHA256 a70ff141aee0575f5b0a242b0a6a5940bb000e26275173801c9eab6dd80d13f2
- MD5 641d2da5c3300c02631458fe76f87c34
- SHA1 5573a3291462b747d1ad38c453a6d24a344d3311
- SHA512 f242746536d1f8f2a9e95baab92ec237e8ed26f3cefabcb296b6142be4756437d116bee2dd1926209d00f39271025a981d73f865257a78e61c5f9133cbafc3b8
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI32i:+yZ/K0ttYZT7rE8c23pV2X+T
- TLSH T172875B92B6E443E2E3A6D534C9B182B6EB717C0E1F3196BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\drivers\spo0lve.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe" 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe" 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 3356 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 5128 2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exeC:\Users\Admin\AppData\Local\Temp/2026-08-03_641d2da5c3300c02631458fe76f87c34_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 35.2MB
- SHA256 922c15c6f1693b96ab54a73790939ad608ea08f15209d3ceb7bf0e02c917e670
- MD5 1e038839b0230554b555ce58375a4805
- SHA1 da783bb3be871887f2fb57e5e1914680b4c55b55
- SHA512 17925e811ad8f16dd1068f1e7e814ab4f3be25038763125a061ac56c6fb6a33a8658168168faa11384692c6cc491f3bbed39185b69561c43adda5b77960b31c5
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI32q:+yZ/K0ttYZT7rE8c23pV2X+j
- TLSH T17E875B92B6E483E2E3A6D53489B182B6EB717C0E1F3197BB1139F21E1E376D05D25321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 70.0MB
- SHA256 11f5b1146ac66a998eb32dd28a143775cdfba598c62b40e1cfe8ac957cf269af
- MD5 38cb950e75d0da3dd5bbaeb9bc657d72
- SHA1 8d557477956eaaa5dff3cae7a895180922871100
- SHA512 19a89d414f9b665598885604b52a356822be6bbdb85143603aea0247be6cf5febe503f147be6d48af05f33a94ead7082e810c8d0f09bfc7df688953ff1dcc660
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2Xr:ER8RC
- TLSH T1F6F75B92B6E443E2E3A6D534C9B182B6EB717C0E1F3196BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 74.0MB
- SHA256 dc2863b00ba17b1db48633e72f059ba73466077fd71ab920d69801aa277324e7
- MD5 99651378d115e616eadccda8104dc865
- SHA1 4145bc576a47dfb37c57ea6b312b3fd194e089a1
- SHA512 6d347a7af093c6424ef562c4f512198520b71485661f25f12f3dd27fbd612cf1a35825932506f21f285e2960bd0250916a93d126d50d920341d78a7306a44dd0
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2Xa:ER8RL
- TLSH T183085B52B6E443E2E3A6D53489B282B6EB717C0E1F3197BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 70.3MB
- SHA256 88d4b68404856ecfe42007d337b53cf39db797b30eec49a008fa5ec349c97b76
- MD5 b8e0385db4540e256e72ededcd16b78b
- SHA1 e2794161588f534c2a52bed83febef95c3e44cd6
- SHA512 59230ec6392bda3a4c487d4260ad6f139174cbbe119677e62842713fa531d3b49fb9fec7e10ee700b90d347eb75c30567574243d71e26c6a1e6a6b5442b47e2b
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2XP:ER8R2
- TLSH T1C3F75B92B6E483E2E3A6D534C9B182B6EB717C0E1F3196BB1139F21E1E376D05D25321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 37.1MB
- SHA256 de38504ce4c8d14a5379f3a06e9a2771f2d5a723541a099a4b2cb5c6417a165c
- MD5 e5679bb5e3414cb063ecaca2a5871741
- SHA1 85ee2a82d9b096c322d4c2efbbfe7f8e476b1dbb
- SHA512 27ab97d3535e8e4c6366b6445c65e8b8f8e582e1709d26ec75aabf20ac3895d8aa37d0faec21671aa451c0f216d8ca692d0b00e1f76a668cdb3a93440a285b82
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI32aG:+yZ/K0ttYZT7rE8c23pV2X+u
- TLSH T137875B52B6E483E2E3A6D53489B182B6EB717C0E1F3196BB1139F21E1E376D05D39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 70.0MB
- SHA256 5fd23a73a8a8999d126dfc1eb2eb2e92ef9144a7f53b78c2b17e59b77628b526
- MD5 01ef8ab8140bdad1a2d899563da92d44
- SHA1 c8945622242a4dc6300d0902e8b054e367df0bc8
- SHA512 a73b2e652bbe73325a8fec54a1fc23ed08cea563a0e74cbce26dc04f1d69fe12f7880c0aa3dbf4c35c62ff2484d2c619036ad95ce37a43d8b403499213cb3eee
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2XJ:ER8Rw
- TLSH T10BF75B92B6E443E2E3A6D534C9B182B6EB717C0E1F3196BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 64.6MB
- SHA256 c05ed940bc1af4f73d71a13464d8938766fd89c4c2eb8d4e6de9972df32a9d72
- MD5 44cf2a5f18abd18cb2456d48211314b7
- SHA1 8b757d28a69349cd6e5a45fe42f6cf341bfb9611
- SHA512 6eddcc59ae5a6b830c62b1816db870f54677c475af66f1e96b6cf3efa27e8e17bca6531fb671d10db7b28bd34d4d6e61e4b650108e645ae330eba12d512f5899
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2XZ:ER8Rk
- TLSH T1A5E76A52B6E843E2E2B6D534C9B28272EB727C091F3197AB1175F21E1E376D05E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 65.6MB
- SHA256 d19488590cd0be2086a886725ca5cfce587dc3e5d06de58c26ca6b0c66e437ad
- MD5 7ac5ce60b2944da139a7482f8fe9b38a
- SHA1 9304949333b0aedc1c57f570c1828158ae951cbb
- SHA512 08a582819c6583939e2169becdf8c5b38553e5b655d6c4d2d9531d577ebd1bf1d04570a8cfa832aa34bb69b1baec4eb399a16601935c6fbcbfd0d19460ebdb2b
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2X:ER8R
- TLSH T122E76B52BAE483E2E2B6D534C9B28272EB727C091F3197AB1175F21E1E376D05D39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 71.7MB
- SHA256 55d531b5ad56211de929932e97624a37fdeb5aafc14e9fc5703f02f9d6b61cc6
- MD5 39cb794af46dde6b49894e2345a6d9d9
- SHA1 7a14e9f06e780e7b01fc9564319870fe70182be9
- SHA512 36afa2c8698ff2c254627b04c018ed748bff721f8e43d156a3c0969d410ea7c6608f6097208821259d18957c15f92432b20ae768ae989e96068e7193cfe93292
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2X//:ER8RW
- TLSH T1C3F75B92B6E443E2E3A6D53489B28276EB717C0E1F3197BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 69.5MB
- SHA256 b8c06811cf5eb7b8741d46f47d8359ef5b5fc96ca0bdf8c55c7c671dacc81d11
- MD5 a59d006a4e9d9af0d66ac9dd08dcfd71
- SHA1 fb73848d5f58784f406cabf20799a8efe68299d3
- SHA512 09da4cfb99b801e7a87631b295d8801a32c114756be9307481a873c55a5473ad347be88bcb821b22f4e43535f2f03c3c072f823b02581e0f775ec07735dbe1e2
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2XL:ER8RS
- TLSH T166F75B92B6E443E2E3A6D53489B282B6EB717C0E1F3197BB1135F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 67.6MB
- SHA256 88288ccf4e642d4e1841f2bbc06d199ccec376aeabe93c41843563e160f47c74
- MD5 9d95cd9d86882ba7bb508e1ff2e24386
- SHA1 b856df936a50b1cabca9088a3606c4d6f08fb60e
- SHA512 3ca58777974336644c9a815e825da87887dbf1826e0656e533bbb9cbb547015f7bde0e1522e521e5b63d575613bfc25679d4c6f641e3a0a52e17bcbab9671cbd
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2X:ER8R
- TLSH T194F77B52BAE483E2E2B6D534C9B282B6EB717C091F3193AB1175F21E1E376D05E35321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 64.8MB
- SHA256 2b85af21a9f9db8896c8f1a49df642fab53e2279423c87ce3cccc42d0cdbc2e7
- MD5 96f12731cbb1b4d2605025314225e9d1
- SHA1 9324b0ba330a0ae47412b8cb9d2b1cd0ed06b4ac
- SHA512 2ae862768c6e21bb585f3faea76a5bdadff8e96428312ec9683092e64b7c6a87fba516a6b25251e94c4df43dbd8ed22ce4130914f99bee72f74594599e26db1d
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2XS:ER8R3
- TLSH T10EE76A52B6E843E2E2B6D534C9B28272EB727C091F3197AB1175F21E1E376D05E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 66.1MB
- SHA256 3f96d919c6ea63d03f2d5f6dcc27b01c63bc459a76a39e2b2aabfd235ec526cd
- MD5 040af7b18afac655e69d4955aa72a821
- SHA1 ce2dbfffc7670f8071cf34fa7b7bd4d5c9c344df
- SHA512 11df8b333bbee1453232133e993c126a742b66918880d50eb4167aaed606c17b443d0ad4752ba1d13f4f993667676de14beb7ea99badcfd7da73a7c38ea7b5fb
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2Xm:ER8Rf
- TLSH T15FE76B52BAE483E2E2B6D534C9B28272EB727C091F3197AB1175F21E1E376D05D39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 60.2MB
- SHA256 38da0a80ae72ef590371ffcf928883d3ce5a7a2d04bbb0a7cc93b44dda453efa
- MD5 1326abd4a30f4569b09cbb2911f60ba9
- SHA1 043a94e9697019716475332abd6e7f969c7bb564
- SHA512 edca8e27fc977ad5ee82cd62cc530bbc8424f6b041d2d3abb7f4604a2068b019e9d5b75c6da18f016841f88ef82075ba7c395e4fdee2041f145db93d0a90953b
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2Xa:ER8Rn
- TLSH T1A7D77B52B6E843E2E2B6D534C9B28272EB717C0A1B3197AB0175F25E1F376D05E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 58.9MB
- SHA256 022b54a1549b790f568ba9053acf569b8ca61329e4f6987aeeb59f12f8de52e6
- MD5 285486449a5ca664ff834d9b1a260228
- SHA1 5d5bbf9b85cb96630a13ebc6bb646a452b96d67d
- SHA512 1fabf811fbfc7b817d27de66a1c6f1d0788cbbea90510259b8187126d9d4a3705c0349a0a1d3b728fdb7a166d548881df07033caf0a425ad957b73e0a795b0c7
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2XH:ER8Rm
- TLSH T1B7D76B52B6E443E2E276D434C9B28276EB717C0A1B3196BB0275F25E1F376D06E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 61.0MB
- SHA256 57d64af3b978d85e1fa1a35209aac71b1bfa3eb8db8c6fc313af859fe5f9e7b6
- MD5 d8adb8e7d4ecc5850c56fb17208cd089
- SHA1 e66c4c32cb8f606de78a6acb3dd3ccfa405075a4
- SHA512 25897955b3317533f0cd94b37eb366fd09b0f0c408ac042e77e9b3244153c8751ae4dba2d280d8f150245b104a0a00a3e9802b42afc11dd04148fa362bdce52c
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2Xa:ER8R7
- TLSH T1BFE77B52B6E843E2E2B6D534C9B28272EB717C0A1B3197AB0175F25E1F376D05E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 56.2MB
- SHA256 033fbafd07ddea5ee89b03b3c3120e555c97c52b5fb0cc9536d0b1128379dcf6
- MD5 275d3234e4aa89a78da3976cbbd66dd6
- SHA1 14a3fb69d61f1e58533a10e7d9474321c284fee4
- SHA512 be4f04e70aeb67a061e7bedd8cc394a022021d821654150be8ef024251dc7686d5f9725e21270c4487ed1efa2198409835aa3c69b1bea772ef422635b9a47a8d
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZF:ER8Rr
- TLSH T19FD77B52B6E443E2D276D438C9B28276EB717C0A0B3196BB0275F65E1F376D06E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 55.2MB
- SHA256 012a1d78a7b991ec6603723a9646d334e9037b050bccb1bfe0ddc76ea082ac41
- MD5 8faa5fec6a675d526269fd5bd97e269a
- SHA1 593153f00f6b9928b0fb4e029113bc2372e67266
- SHA512 b5fb1a1c3c573bc3068dc422877414aaa772d4aae4cc824ceb5fb49445f9c7970696d2fc7891565d0ffd4d846f6f6106322867919a0a3638076f755b2fbc7ed1
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2q:ER8RG
- TLSH T135C77B52B6E443E2E276D434C9B28276EB717C0A1B3196BB0275F25E1F376D06E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 55.1MB
- SHA256 0e4a458208ed96a5f4c7d22c41a5b401579dca7e2fe478555863aa4a17b1e30e
- MD5 8c7b9458aa06017a26ac76cd665980a3
- SHA1 f1084fc48cfffdc9a461037d7e69452506d5b299
- SHA512 48c230b53d8035b8a91f5526b2a6ecdf75dfa1acf098fbf57f997d7f50cae3ff4e97124a62d386c8332752a63460a78903ca959cd5fd47c04e26b5b22b1bd3e6
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh29:ER8RR
- TLSH T16CC77B52B6E443E2E266D434C9B28276EB717C0E1B3196BB0275F25E1F376D06E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 50.4MB
- SHA256 b296fdb974212dba1e273b8c88eb945090762c076a441c51fd157d5b718226cd
- MD5 118eb4e5e73f1afe86c5332f673c6620
- SHA1 24cfa3adade88f3bfcd8017f83197e6856ec374c
- SHA512 aeb4082b487befca54afe3873271105ebce8f566fa7f861b2309593833a928b02384dd8ec5ee2ba5a5fab2f98666cf17035605c9b60fefcbd3e0367b059cb86c
- SSDEEP 786432:+yZ/K0ttYZT7rE8c23pV2X+ayZ/K0ttYZT7rEj:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEj
- TLSH T191C76B52B6E443E2D2A6D034C9B28276EB717C0E1B3196BB1275F25E1F376D06E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 50.3MB
- SHA256 5a5dabba5c3e87df2922d41744d10314a5e8821bec4a7133a70857f8411b17d7
- MD5 5dbd14502d9eec96d40d87a8f2d9f0fb
- SHA1 7c11c6bb8d3dd7bf9becbf28c27d3f79b8e1edf8
- SHA512 2cb02ca27792b23a480087967184f6acc57d3c126b1d7e3201ce2e364fed53159199dd8f8f87f0645dc6cc5eb48278dfab6b7fdbeeefe8e72600c810c094d585
- SSDEEP 786432:+yZ/K0ttYZT7rE8c23pV2X+ayZ/K0ttYZT7rEh:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh
- TLSH T194C76B52B6E443E2D2A6D034C9B28276EB717C0E1B3196BB1275F25E1F376D06E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 64KB
- SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
- MD5 071d69befc4545d16c8415ee31c5afdc
- SHA1 98106920c20562db4df0d21c498f51369d927ad9
- SHA512 994fdea351d7be4c5434f4840958dad54941761c7132fb3cdc5aa3821de5c697829bc462ca8428d6341e9076d304a231f945e48f12c618c86ab01045a26eda17
- SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0UeG9ODBZHlsP:2sXDsmJDZzgyQsRDptkar4Vyg/B
- TLSH T14D530EF819C0F18AF8D1D571A0C9B33926EACDE5BB5047DB7C172B429EAE4800397D69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 46.9MB
- SHA256 af28ebf7967ee1bf08073c3e234b3323c878280bc902247418e1dabb9fcded43
- MD5 2807a5a771112dc9ba8ea1e1086c6cf8
- SHA1 0b6dd77b37b5d0915ea0edc04bc245350f327c15
- SHA512 80e685ee5df94b0cf6258da45c277a86d326012f2f135cd93f32ed611a63ad5a0f5b065bdb4bae5e4b52257e3ab3e60e8fc2283cc06f6b90e96953552ed46d52
- SSDEEP 786432:+yZ/K0ttYZT7rE8c23pV2X+ayZ/K0ttYZT7H:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7H
- TLSH T18EB76B52B6E483E2E2A6D134C9B28276EB717C0E1B3196FB1135F25D1E376D06E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 45.7MB
- SHA256 8e9679cf516ac7d05cf9bdae19e1b4f93d73d84cdcac30936be40de530e14220
- MD5 76bfb554c297a0b73e80be408c90ce79
- SHA1 69d633ea2d5f95fb77e895da1a874190935cd746
- SHA512 6495e74879bd9431097c756f32fe5fffa98d5c3420dd28cb661c0a6be489561868860e3323eedcd46c88a9c6d09197e1172b68c71d7803a11c1937a42d76383d
- SSDEEP 786432:+yZ/K0ttYZT7rE8c23pV2X+ayZ/K0ttYZTG:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYRG
- TLSH T1E0B75A52B6E483E2D3A6D434C9B28276EB717C0E1B3196BB1135F25E1E376D06E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 44.6MB
- SHA256 c938cdb269f7c9144695819cb385a211b3a888e6f19e98f911c651600a5b70dc
- MD5 fa8c0753743ddc710cb457d76522c680
- SHA1 5d12cd74912f4367728069e9570d6f54305cab6a
- SHA512 8f92fe36e8c171162dc8ffde4e8bb026780e12832a7f96a58f781db9d67f6c7aae39dc46ed58bcaf1cd4277f54e79f6f3bd2a9dd9d1d3031f4b77b311eced865
- SSDEEP 786432:+yZ/K0ttYZT7rE8c23pV2X+ayZ/K0ttYO:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYO
- TLSH T1C7A76B52B6E483E2E366D43485B28276EB717C0E1B3196FB1279F21E1E376D05E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 42.4MB
- SHA256 c2beb153b1c8db948c43abefbeaa1c8b42f23901a595f6fdb0133681a854eab2
- MD5 39005cbcea9627761e2f6e03808795f1
- SHA1 a62ba33d6dc273d7da893cc44c10f634b23003c4
- SHA512 eea79fef568a5698601c5ab23ce5ae15fb67f7e90869bd7a672d2dc1bf4aedf9f10fef8ba542e5a94a37bfb5b7bcf15034e01985d40bea8122fcb90ec51ca53c
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI323Zd:+yZ/K0ttYZT7rE8c23pV2X+ad
- TLSH T1A5A75A92B6E483E2E3A6D434C5B28276EB717C0E1B3196BB1179F21E1E376D05E35321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 42.9MB
- SHA256 fba10afa8ab0cd63ec306ff28c4c9d831ad6ab100629443d04a0d64bebb54185
- MD5 5b04df3229f9aa901f69fae918126d1a
- SHA1 c71a7a2f5d0b55b2efe02fc61a1589f7055e1a3e
- SHA512 aa77e16d14227c012e6f88db3fc25f01a39e9c3166ee2cbbae99c7cf81f016678d796ad7a7713e0993f274578652a84fafd7ab25754b82bdd329b7161106dec7
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI323Z+:+yZ/K0ttYZT7rE8c23pV2X+a+
- TLSH T19FA75B92B6E483E2E3A6D434C5B28276EB717C0E1B3196BB1179F21E1E376D05E35321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 41.9MB
- SHA256 4d4b71983af54c6d27bd258ea6e7e4b8a6797f5626f36d61922cf62245e5b90e
- MD5 e0ec8b93a2ee2f714bc7b30884f2133b
- SHA1 3c034dcf899d2c52bccd784525b2eab102b5eb0a
- SHA512 f76cdf79925e2497c8295d61db68b0c1356ce64c0e1eac25c5ed57b04bfd7a5941f710177de14b073fec99820ba1b434ca4240ed53a50363849e94271ef36aa9
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI323t:+yZ/K0ttYZT7rE8c23pV2X+g
- TLSH T13DA75A92B6E483E2E3A69534C5B28276EB717C0E1B3197BB1139F21E1E376D05E35321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 30.7MB
- SHA256 b7bcef4e5fa895440ff221d5b49bc0ce2d07384ca22c908fd36fdf85064bf465
- MD5 a98f0e5f7255acb22e34e15bdec160af
- SHA1 8d0f037a6b07bd0529daef76e375d7af9412370e
- SHA512 87e3b8480bac00b4ce09a9a9b74ff8b80706ff4c4b7b02549ba89a618707bfa1fe2284004005a64559843dc49d79d10937ffdbe962b84b967901eb986ca9f72e
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI3:+yZ/K0ttYZT7rE8c23pV2X+
- TLSH T11E676B52BBE482E1E0B6D538C9A68272FBB278410F31979F1255D25E1F376E09E39331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 31.4MB
- SHA256 7f68cbccfc824806b6963c8f158800be365c8a48f7d4801313d7cf243b9b561d
- MD5 de677525da3098d76e0b10c3a1a4504a
- SHA1 c5188a5c582f3967e1725ac6f4ab243d686eb9d1
- SHA512 d670224d78d93637fdbe5456fb4e772cf3ec779ab7f6c9f967cddc484fd7f531cc57d849197d308b86f876a3b7cb8bfbf6e2ab32e43ef0abbbe02240b2d81d85
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI36:+yZ/K0ttYZT7rE8c23pV2X+6
- TLSH T11C776B52BBE482E1E0B6D538C9A68272FBB278410F31979F1255D25E1F376E09E39331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 30.4MB
- SHA256 db23a327a15b5afd11bb63c139113588bc5918948db80f0fe1deb7d131a2c59f
- MD5 b62ab6b368f548f742615fca651e25ce
- SHA1 fd1c711d9dd94a4b5a2f1f9f5cf17c5e1f870ad8
- SHA512 27285689c8cbe26b193b376d9b0dc1543f606844f286bf5b34fc0760d1b7a936585c0e97281599bf79f430762f73fc444374401a501246965aec55e82052bf0a
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI3:+yZ/K0ttYZT7rE8c23pV2X+
- TLSH T1BA676B52BBE482E1E0B6D538C9A68272FBB278410F31979F1255D25E1F376E09E39331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 29.7MB
- SHA256 0f2a1946a010ce3d2a3424236d85ed18e9fc2e2c6e3017da9a6308f86e3f675a
- MD5 19ead3942072d1d5fabb0f820731da2a
- SHA1 eb62bfed4add9bb8ff21b7a91689a11b283801a7
- SHA512 8606b19eecec7b37c3ad85b6e5ffa17dcc20e66b98021983287d638eb7c290fa41abefaea5bdafe450ad277c0053bc23e9ad216bd8944034aa8944bb5bab3492
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI37:+yZ/K0ttYZT7rE8c23pV2X+7
- TLSH T162677B52BBE842E5E0B6D538CAA68272FB7278410F31979F0251D65E1F376E09E39331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 29.8MB
- SHA256 20b84393aaf8b18f2464db4a2f024123603d4408a9bf9fe32b8f20de5ec0815b
- MD5 a5fa8fe33248ecce2d864d322cc199ab
- SHA1 a963bfd60b25c49af642d3874cdf8e039796e18b
- SHA512 30fa19b60c077ba97773651e9654cc52507bd5be9bb91836ea48efca283766a4cb239403e6ef4f48881597538cc326c8e5cf5f9c8c74af3f0a80b1e878a08598
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI3r:+yZ/K0ttYZT7rE8c23pV2X+r
- TLSH T1F6676B52BBE842E5E0B6D538CAA68272FB7278410F31979F0251D65E1F376E09E39331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 30.6MB
- SHA256 9889c63d14296b5bd9ce8df6a6f87a60fd08327240de5e0fb867e94a7466f0e8
- MD5 5dd77e6f2e6cdf44b75e4dd39643f3e4
- SHA1 8ed86b23de164b99e9ec32464f5de27e21123dc0
- SHA512 6de2349657143aeef30e5ae16876bbff99318eb66061eaba31a55b639a2c7e0b8fcb2cc8a3c7827ae353504939b8c081f46e15ad9562d2f517c7fdb6029ef034
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI32:+yZ/K0ttYZT7rE8c23pV2X+2
- TLSH T151676B52BBE482E1E0B6D538C9A68272FBB278410F31979F1255D25E1F376E09E39331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 29.6MB
- SHA256 e274487188569ce0898fd54fdf99c8c83149cb156333bdfa10407034d32bbf15
- MD5 826679beed8dfb2587e80335970abb21
- SHA1 711b13f4ac2e4a778bbfbff96a196f3eefbaa0db
- SHA512 2f32f1397ec4c61dc38db784e0a2b63bcca20e185a937a0595f50eca516a3845776cebd1bc5a1c69933dabea1dc4615d12ae2e893384f9575afc9fd252fb7891
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI3+:+yZ/K0ttYZT7rE8c23pV2X++
- TLSH T1DB677B52BBE842E5E0B7D538CAA68272FB7278410B31979F0251D65E1F376E09E39331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 28.0MB
- SHA256 ccdf65088e5bf2e005ad0571d88bef8a736496b64a6150e5c74d196096d04c0e
- MD5 71e443f49bbc0bcd35b569fb87d0531e
- SHA1 bc0e9d7b80ecfd774a45aca20713ca6ebb48bf7e
- SHA512 37b6a5c150fa779d846640fafa3d541c1c0f88bb3ce7baf7d7568c702697583694014f0692190837605324b7ccce646277da24e0a8f2554cca196d0a411ea2a6
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XI6:+yZ/K0ttYZT7rE8c23pV2Xz
- TLSH T134577B56B7E802E5E0B7D574CAA68232EFB27C410B31979F0251C75A1F37AE09E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 28.5MB
- SHA256 280cdca0ead3aa7184ae8bcbdff5011bd419af85fd24e9b921ac87374ce20994
- MD5 6eb864a9e33a80231d63d46ff4fa0721
- SHA1 bec2061ae44f62c974e97f9f7e1f0dbd5d1ba7c3
- SHA512 4e2216a924fab23df9bb0f773c3e3127faf5021be5be77984fa3296f6f21df6c4cd6413995e89df6d0a8511c9e764b922b6d65e98b677791ad9f17cfe31d986a
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XIs:+yZ/K0ttYZT7rE8c23pV2Xd
- TLSH T15A677C52B7E802E5E0B7D578CAA68632FB727C010B31979F0251D65A1F37AE09E39731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 28.3MB
- SHA256 95c2e1c59aea5f2555d6b860b888a2b7fc23d8cf2b19af9f2ddd911c9aba0c5d
- MD5 2d289aace5f6028c1cf71199b5402a6c
- SHA1 84f0e5079cd77e831e02390b56d5ae8e6b4a3b59
- SHA512 73560cbebe769680e482362ee7b97a2be56d150a0e188c943cdfc8fce3b00e6bf58a8bf5d5eb8440bfe10ac0703e3cb0c0aaed835e8aa88edb1a2416dedec1da
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XIG:+yZ/K0ttYZT7rE8c23pV2Xr
- TLSH T193577C52B7E802E5E0B7D578CAA68232EFB27C410B31979F0251D65A1F376E09E39731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 28.6MB
- SHA256 826165ef7da956eae389abc30bd7e260a2eedd73b80e21f27b20afc8dd0e1313
- MD5 b41c8da3c765e872d8b40911e47ded08
- SHA1 397586f348adc06315a7257d32000366a7c38503
- SHA512 75205f840611b333c0d0940eda009aa0ec05e64e6bf937861ebaafbfee104369371dff92e2f2e64f78b9aa70d05b757b74a7402a27bf586f3228ec2846f8e976
- SSDEEP 393216:YZyZ/K0ttYZT7QUEtQevvqc2W1cpV2XIG:+yZ/K0ttYZT7rE8c23pV2X3
- TLSH T1DF677C52B7E802E5E0B7D578CAA68632FB727C410B31979F0251C65A1F37AE09E39731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 70.1MB
- SHA256 a184954b30b8b0ad5dca55eacdb34dd7c009d44aa1b926df1eb4e0d3f26b1886
- MD5 c85012c29cb638f9e6959b41c7edab10
- SHA1 bbe26937c8c19f025d7281969a7bcb7f408545eb
- SHA512 cd1cdb02b3e9c94fd72621940b48fc3847bcfe91da50703a745aadf3f01801b8789041279d6991fbdd674c91abf73425a6495e36794c005953d6841865b4bab7
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2Xv:ER8RS
- TLSH T11CF76B92B6E443E2E3A6D534C9B182B6EB717C0E1F3196BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
- Size 70.0MB
- SHA256 904aa1ad14e580f2707250af2fdf4942b34fd72f0394ec734265bab02d4b2df9
- MD5 1f0ecf35546e7cb22cbec7489f21fde1
- SHA1 cefd5b64749d69bb972d321dc37d832cf4acbc0d
- SHA512 18e3e9a609ed019c575ee97dbc9ce249818490f7d3f27f74f70b6bfd9d95f35b90348df792993fbd76dc36597f3e2d9764339108741f7a7ad8c51aa8110b84ca
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2Xz:ER8Ri
- TLSH T149F75B92B6E443E2E3A6D534C9B182B6EB717C0E1F3196BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
- Size 70.0MB
- SHA256 b70e9386c4af9b474d11f178cd6c2e606214d8b66bafa167fb7058ee38325f9e
- MD5 5fc95f54ecb988dcdef6f2609ae6da93
- SHA1 e9594da2a9709b04418facaf1dc8e73412810a4c
- SHA512 092033627c191430416d193c24690411cb608e94554b008c646bd0719076c5b7eb7b273de214d8490a87aa4182fcd493efe96b6d516a525b7ce5300587f66802
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2Xt:ER8Rs
- TLSH T10CF75B92B6E443E2E3A6D534C9B182B6EB717C0E1F3196BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 70.0MB
- SHA256 4f29b58f74da104da08b1afde9a688322440c424322f10022e7e3e1d906d2920
- MD5 ab606766ad3f41c6f0aa33d24e940a07
- SHA1 95477ea4cd6a8ee1d1af9a4c42333963b18cef85
- SHA512 96d381637a00d547d770d2c479c0c7c02ac290501ba5fefe58f9439359e581aa7a75342baa99ebf22229b040b382b9dbc8004157c0c8524664b766c16e1335e7
- SSDEEP 1572864:FZ/K0ttYR7rEh2ZV2X0Z/K0ttYR7rEh2ZV2XH:ER8Re
- TLSH T1B2F75B92B6E443E2E3A6D534C9B182B6EB717C0E1F3196BB1139F21E1E376D05D29321
- MD5 SHA1 SHA512 SSDEEP TLSH