b621eb99ad0e8e68eaabd1355c41e0e72954d741ff7d452f0046c816ba006574

Analysis

max time kernel
91s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 937KB
Sample260703-pphyasd16l
SHA256 b621eb99ad0e8e68eaabd1355c41e0e72954d741ff7d452f0046c816ba006574
MD5 7b7dc6e17ea399ec75ca24a3b82141f2
SHA1 6cb6f26749991aa49febbaa8e5322be0fd733690
SHA512 49748c395730ef1f37b5260f232edae8b90f3b9a4f0cd510eada584f7478e2f5c82bc310067f81f460b9182ec516cc552f044adf951f693dbf5c206986879aa8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6N:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6N
TLSH
T12015B023EB7090B5D27B49705B758713E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3792-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00050000000187cb-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cd-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3792-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1144-215-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001984b-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a5d-581.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-678.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1103.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b8d9-2144.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00050000000187cb-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cd-57.dat	aspack_v212_v242
behavioral2/files/0x000400000001984b-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a5d-581.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-678.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1015.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1059.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1103.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1165.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1203.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1398.dat	aspack_v212_v242
behavioral2/files/0x000200000001b8d9-2144.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1144	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3792	2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
1144	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_7b7dc6e17ea399ec75ca24a3b82141f2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3792

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 937KB
SHA256 b621eb99ad0e8e68eaabd1355c41e0e72954d741ff7d452f0046c816ba006574
MD5 7b7dc6e17ea399ec75ca24a3b82141f2
SHA1 6cb6f26749991aa49febbaa8e5322be0fd733690
SHA512 49748c395730ef1f37b5260f232edae8b90f3b9a4f0cd510eada584f7478e2f5c82bc310067f81f460b9182ec516cc552f044adf951f693dbf5c206986879aa8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6N:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6N
TLSH
T12015B023EB7090B5D27B49705B758713E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 3091ff95bcb0ff09ae1fbaf92d8ef7d3de88a2bf09c16ea3756bb40f86fa8fde
MD5 2275866ae3cc6ecb50a724996dc11033
SHA1 d2d1198030dcce22548dfdac64e2e5de91ff55ba
SHA512 eefe2a680283052e50fd56a63634282b31476ecb84bb525ba97636145cb3f2fcb265934ed00c2735ed2548b6a08959ead5fc447093b9baefb7377c0ee29d535a
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Z0Le5ji0hmxNrM:A3kM8ljdPji0Aj
TLSH
T104658E22FA748275D077C475CAE2975AEA7138510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 951KB
SHA256 060032a56eb68b5a446656b7899292543fa25495135d398b238a03d9f74fab4f
MD5 c5f4fde7565dc07938ab749b2895a8f8
SHA1 cd85f7e3bb28652ae3c3ccf79e29d0f504f76f6f
SHA512 a7e13935d076734bf1040d58497e392f9b81545044825b206dbbfdabe09d056fd44cb8586068a55576db2f79013aa0d950e9c1d3fb75b0abf05281b6d3c50bb0
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6La:A3kM8lj
TLSH
T1E125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 960KB
SHA256 165dc1e29a2dbe8c1fd68d747673c26b97441c3acc00d6031bfaf8534d3c608a
MD5 c792e054b79a06f13e9aecce47b5b761
SHA1 c25c698e32cddf04cbf01d97fdea22c8f89c18f6
SHA512 6d184d9f67352ec0b58f2aa35ba595bf4c78b35a9594cc8b1e5a19d2a8bd964bf4b97f23368a556661e07211fd486bd5d440b50163ff994136e6a8e3ea57f8a9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6K6:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6K6
TLSH
T13D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 960KB
SHA256 94df476bb97f26db11c87128e4210833f06585bca3e8bb4cb35ea0b041285840
MD5 c1d4bb42f2318e2aa5aaca9f37e9f1af
SHA1 e7108567eb10a5a718f1abee50c6c186b0d7e5b2
SHA512 95ef4504f414c57e4d0c8084e2861b518bbe20f07de7d83113f9865bde52b1ea5376a6676daa5938cd70d9da1f1e176148023776cdae296ff39f25c050d9a3da
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6iN:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6iN
TLSH
T1EA25B023EB7090B5D27B49705BB58713EB397C210B605ACBE3A886591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 960KB
SHA256 de533463a1dea65e36cfc2536b4602c6da28568a621d7968afa56ff1200c3248
MD5 0da3eb006776d6e71aec194a76e2bb59
SHA1 0f8c40a33f90c2de56ec6bae4f41f118dca23086
SHA512 19533644b3373a9227420670f9aff48bfa25a658491fca988aadba472b609981d98081f3355c85d3ea0bda17485555a0c5ba0212795dd4408948f0f2796ec0af
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Yf:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Yf
TLSH
T17C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 960KB
SHA256 73d0a019b55addcef3fed46b3831f74571273e30ee1612340fc4c17132c1e292
MD5 42e7c73d4c22a601befbfc0c040d1c65
SHA1 ec23e426779bc7606fb56fbaa2b6074cee417f44
SHA512 97d10b7dab32111391478d4cce1b10f09eba980aa7907db7bfcac8dd7be2f4ada665c95051430eb61ccdfd42ebc5baddae71200a603cb3cd59c97b841b26980e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6yo:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6yo
TLSH
T11425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 960KB
SHA256 22ac79ea6b3f52db56a2698bd8fea3d9f552f2c19ddcaf3ef2de22562e9c8ff8
MD5 32fe5141f3dc8aa41278d1e1a77ce5c9
SHA1 fe53415049004953eca8f0bafd8a38bc6dd697f2
SHA512 acb00e7bc659c5d0d32f4230051c0bb8b1e8352e02c49d7fc07bdd5d27f68bb6c6132dedb16ea22ca577953f0b288209b3bc0bed4b978d7508fa35317a44dca1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6mu:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6mu
TLSH
T16D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 960KB
SHA256 e21bcf597446c4a87a139dc6fde3f0223154d2a594e280a1ff74479374cd22be
MD5 20f395bc3092a7cabdce9b7fbc1824f7
SHA1 6172856e7cb4eac6f4a131adcd7a80790bb2daec
SHA512 05c5ec353aa5af2ef43e0d50b1b89ee9bcf763faccab3ea74f0638ebfd9d031c11a4df274109e247ec1e601f05f6011a9f6ed238b8b5bd61a2d59d1def7e1008
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6a9:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6a9
TLSH
T11A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 960KB
SHA256 dab77027a678c74c5c9f80218001d7a2f1b51c6b2a62653d273afa41e5193364
MD5 2adc2fae3f63f7f170a650cad69d8675
SHA1 38b4a83c3c01e62b3cc418cd08cf409e5b1e965a
SHA512 afd6e87a72e0095b9272f2326610033f1d565ae90fbf7c39375065a06b15422b0602cc3b4c7447a3a2bf4e3f3cea6747c9b809aa6dca3dc0e0198c918e9558a0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6ac:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6ac
TLSH
T14025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 960KB
SHA256 4acbbf22a2dfaf52067beec9bf85e1e760ea0d80b06484ec827fbe53844bec1f
MD5 7ecf10b89bd7e26d0a3d41269f959688
SHA1 0b724bd64b622f4c14a38e0209f1ed560e3d7def
SHA512 7dd13a9a65dbc42bad56824c03fbd62b885575e4d7a15a54635541ab71fbeeabcb134f3a6cf827a8f093dee6c226079d852f5a51e1849551efde35a14be4bceb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Tp:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Tp
TLSH
T19C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 960KB
SHA256 b6b968eb45282cec3d0d3de4145ea1453e37243526884905c70036654dc523b3
MD5 5898a48bbed95bcdf584f5fef0ede794
SHA1 9ce00d48a822e0d00b05de8b6120148affc50fcc
SHA512 586051a19207c0fba5c260894ea4719703bea39a523fd727ee4ca65958acc561dadf8b53a25d27a214aa2840d872fda77ad859b38149324c8452244b0601bd47
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l600a:A3mnXoZjzyaEFoHaewsAjYaEpHa8l60N
TLSH
T1CB25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 960KB
SHA256 dcd894372e1600bd4aee76e273434104ebc256bde27c287d299e5013e7c62432
MD5 d180adcb7c0d88caf94859e714726373
SHA1 cefa4e963f7f5d4b92f910f6d4105bc6dab70c85
SHA512 c4c128e0fd681a56d0599868ce047c9c17d5df47bf43ec7c9b11d9ed4b7f17115712d0bdf9229f5b13ef81a757b014da729bd75ec176222586793a6eabcd8ee4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6cF:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6cF
TLSH
T11B25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 960KB
SHA256 81655ea5a8e1f0d539a9997e686758790bdd0cf59005a696e0e98625471ef397
MD5 b138b03c7a8f5d1c5ae11dd6eaaf2484
SHA1 4290e80ee1829cc5ec87620137fa34e719b28fd7
SHA512 fd1fb98dc847347c1a0a4b89f0bbd3eb59aaa1250edb3e0de7c8293cfc468d04e88c83e0ce3806292cac0a841764446df3200f6c40d74b8fcbb53880888dc062
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6JC:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6JC
TLSH
T11725B023EB7090B5D27B49705BB58713EB397C210B605ACBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 960KB
SHA256 889df1fea2ced17bd756c2262feb923e7531cf3baaac9ac536cf1b3111c8adc7
MD5 b472f6d81cbbbc371771a32fd3daffe8
SHA1 76b1d384b5ea438affb7a289209154a59fc8ce3e
SHA512 92ef1cd205bffd7d47f10946b6d0dc6f121ab0257eaaf94a3a6def8ffefafce67aa8c709abd0b46674803d278132adb87b72291c9ac166313a71a531a1836635
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6qw:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6qw
TLSH
T15C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 960KB
SHA256 05fb6f88295d6c54019e1cc0c0f2439d70c42f83b8ccb86267f49e302560226d
MD5 a6688282d523df29238de1e111279f7f
SHA1 a6eb60515a0f514b162247abdd2a4313efae952f
SHA512 726e93928ba720dc7fec6ccb6b12135c41405a0fedb52cee61031990cdd2f7324bfba193a951d9665e581cec8aeb467e79d0dfd674ac8b1b84dd9074a10fcc59
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6xT:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6xT
TLSH
T15B25B023EB7090B5D27B49705BB58713EB397C210B605ACBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 960KB
SHA256 8d748b589aeb04dff750eb54fb806ae19fb05bd358cd1cbe5e629bbac9c98c2b
MD5 58a9431f70d3ceed2fe7a0a04abf388e
SHA1 8371c2c414373dca2a7377ae5d3e27b2c94dc22e
SHA512 d8915847057989c246d1291b636c6ff2d46d0bf882774b15b6f5f850606304a2a45bbfe5438eb7df0b97262498a852c1858307118f330e0a302e64ccb288cd3b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6fu:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6fu
TLSH
T13725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 960KB
SHA256 aa19dabd144b2d729bd75ac19e936ccc7594eba18735f8d323dbf5bed4ab8af0
MD5 917d5a519bfca4420b2a78a6bbf41044
SHA1 f779724d80661a53a1da808cb9a2d88263510401
SHA512 c27f63d8bbdb4b92511f8f4ea580962710a3e7518c93f281f751b7b3e0d71f31ed6cd54b7fe2227bfdaea599781515b362c073c6cdaaa8040247790e73cef991
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Db:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Db
TLSH
T18A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 960KB
SHA256 6b5034aa36372dec9fcb45c2574d1737e0ac85ac10973bf2aeab9da3770a0c0a
MD5 6540bf14e8b674cea59c9883a978d3fc
SHA1 d72a9759eabe29637c629ca461911d318b671748
SHA512 2a2dc748b428cabd7891effbd21656d01a21dde4befc1de49fd08422c9dcb9d7a40ed50c885abd953369168f24f6ea502b95693a6095ae2d279671eaed5a6902
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Xf:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Xf
TLSH
T1D625B023EB7090B5D27B49705BB58713E7397C210B605ACBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 960KB
SHA256 f8f3712a007480536ce832d06265a8dca4e63129a1624f5dafc216fa4ad53526
MD5 18260bf08907a14dbff731006f0e294a
SHA1 d21d7e355cfabc9413455b893a02156714de0cfe
SHA512 ce5fe16d7cea4579fe337c00832eeb08f266dae00a0824ac75922d83b6254c73b47d7fb1218a67c225e16164f15761615189157966fe765e55afb63f50cb4dba
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6gK:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6gK
TLSH
T10C25C023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 960KB
SHA256 bcd3f931b71a3bf6e74f92a8210a72b4ee14b9f8f1319815e65feea45362c3b5
MD5 dd8e11081c0cb589549590b577c4ecf3
SHA1 b4bca8ead3b9c4ba3e96d3af1ab4dbed696ff0e3
SHA512 8e1983180c6c7b6cc6f420c19ae22367b6cfee56013b23c17329b11d6c03b72001ff07543935609fbbe201363217ba3601343e47e8a8404f44b3adb7b6e059a2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6dk:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6dk
TLSH
T1B025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 960KB
SHA256 74dbfa22cf5e7a76f530d6fe97603b23c541e8de1297d055213dd27a8350bb90
MD5 a92e6ebfabfb043c4761923665c8fcec
SHA1 f9dad3d188ae4ff8001b48a6e53fdb12257de54c
SHA512 d2705ef0560e92f4dbb4a1e5c899d3135c8c5c54f877d8acb5df2d221fe5e64de3f31aeef4c4783ef1b40eaea50e9ee7aea2d2020e8656f41bc240f1416384d6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6C0:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6C0
TLSH
T14A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 960KB
SHA256 fbbb67f436c7c99e37a5e9e425b9ce3f0c8912b865f246e987cdbcd6659c5795
MD5 772aacfe9298244d4f33ab2806d34b9f
SHA1 b60a7e0e084fa7bc54ed71f87a1f2be49b821f69
SHA512 b1c5142a6c4f821819b631de1ff0f2701e020ce76186ca4383e588a0d80c75fd51e60f83b705f8d3d7ef99a289b17bf4808cd1a57231faba739aaa534a4cbcaa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6R70:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Rg
TLSH
T11A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 960KB
SHA256 a250f23cd9fc1f1dff2150a8bc311bc0166213a1f601b61172d3c6b7f5865187
MD5 26b7292613a9cb99067147ed64a40393
SHA1 4b4df184f6d6f7c0185e5013da3165e069cff2da
SHA512 58bdeaba5b15e805e56ab83a3c735ab2e8580f11611ecc3a4f9fd73967468657be89386d9fc202d0640e84cbe8357a350e61f797f3f8a71ad6738ae2493a8685
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l64r:A3mnXoZjzyaEFoHaewsAjYaEpHa8l64r
TLSH
T1A125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 960KB
SHA256 9f675a0f38c53df1b4bd2781427b64ff27d0b9ac8c348215e010aa7c8c30f36b
MD5 5de53ed034d8f1daca415b0322413fe1
SHA1 0483240645a1aeefd79c721651dcfc0e60f442bf
SHA512 bad9d8396648b0d90974ffd121fc1a06293e06eef85673e0b73c2a25b1037c9c279b6eb82dc88b42083ec1bf9d2ccd8f9e84aec8deddc762c084edf81f4062d3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Wn:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Wn
TLSH
T1CB25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 960KB
SHA256 5460c2be9464b6a0a684db5aa0d40e5d3b5aa22cac5ae27e44e7240fc517eca1
MD5 16a2779fba94b707ed2f224ab6fb1faf
SHA1 5e576a90fa43894bf668d7bb9ee02b24ceac9272
SHA512 742af9cefffe987e30e21dab0f526f45537ed5bb9d900b4a4acd02ba98a9ee261010016b460d02abe2826d0e63c5dec28b35fc96e81cc346283b03ea3baadc4d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l68x:A3mnXoZjzyaEFoHaewsAjYaEpHa8l68x
TLSH
T16625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 960KB
SHA256 612abfbd63971dc1900ae255219dba690188ead1b68fd88336c149505a9e42ca
MD5 287e6b25b3666ff40614781d9b4fa1da
SHA1 21775268c08f94b7bc19c1f942f9d098b1ee2139
SHA512 71f06e37116cc54bef34d2673d70d6fa1c5eaa2d49e6f7c41b9d29297185d4d539ced4389e9ce4167d2f0f722227d927239ed4e2812a1eb780833d31142e872f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l62A:A3mnXoZjzyaEFoHaewsAjYaEpHa8l62A
TLSH
T19425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 960KB
SHA256 79d913f8df943245cb3ee8a115f7dd3b0a367842c89d46e2844c632ba6203df3
MD5 fddab69fe9db19e7a0f92255f1728635
SHA1 1de73ba5f1461ddec0b04721fec552bac40f542e
SHA512 acf4c5a7b11043401e59aaee09341524913c9dab69fa1c36f63a032f7afab8547b7ddb86a5b9c9988adfe1f5c4374b79846fb0cf960734e4af098d98e58767a4
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6v9Q:A3kM8ljW
TLSH
T1DB25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 960KB
SHA256 1b2631e0534078823228e1c8ede047da01afb48b711a6ef794b3819bb0ede10e
MD5 02427fd4a025f53f1e68f2f4a03bf522
SHA1 4dac368974a7a455d33089f5d91b377cdc297f90
SHA512 d6dc23bd6b935752c0d4e1ea10e4fad1bfcf2982e33952087b3f9aeac58005dae9288afe22b3afe15f056841e35c5fba6a23f8fc4039459928419b2007f40e24
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6G4:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6G4
TLSH
T15525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 960KB
SHA256 aaaab7c3c54bed55d0970d1ab5fb393301b82940cbb471fdcc62d1f21b03efe9
MD5 8f1ee88fb14f7d860095ffd50ed80d10
SHA1 e01e4d0a1a6d0e033b1af06f7566398b3669df5f
SHA512 0c4826d771210632e431fc14de45585e4c070c9278daf641a7a63e2dd782c9671c6430545183ed3db75875aa813a84895f38742aee0a256521e20c858ef1d7f4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Vu:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Vu
TLSH
T19D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 960KB
SHA256 1b52e0cb0bcc946348a1c51a94c0bbf5fa76c1dacee71abb189a590c207edcbd
MD5 6b7c7030aab7f5a66230e0efec457171
SHA1 893f01433cca422f0feaa4eaa4522fcd92bb32f4
SHA512 ab09570f13c3ccab0efe1ac03ff858ab67db74b9f4f6b05cce12cf6018bef2e3b2f258cf922a87604aeb31fdb457a2b7b1a57c0e87af69d6bd0f1d7efc3c9bc5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Ij:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Ij
TLSH
T11D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 960KB
SHA256 d3ee33825995f976b4eed02ea3f0a2236ded772f3b67016d7c53790ec98abd36
MD5 18860f0c0d8683e4315fed4286304c29
SHA1 2d42f54af4f00c65dee84bb75e51d193d7af7266
SHA512 eac2e2ff82fe07b30bde9dd94f628b6c3b908a4b7bae3178d8edd2d42df48b97b2dee83298da4ec6c4dbd5bf1b4fa74fc2107ca41cb86c40607c0a33f868c21f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l65g:A3mnXoZjzyaEFoHaewsAjYaEpHa8l65g
TLSH
T1B725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 960KB
SHA256 71b782d9ad52f5d14571711f6ba6c050e7e9df920bb88ece93a8472cac200611
MD5 ddb07555c20579bd20f930334c42c202
SHA1 98caf5be16bf0a84259c6f6268ff3e1c73e74738
SHA512 65972395f4217f29e55eb43d3b947416b7abda84dc62229fc39b0561245a9e95d7612cb720c91cc890c1008eab0c0ac5b1bc380b0ca262f01747616c608c3413
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6gI:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6gI
TLSH
T16625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 960KB
SHA256 eb94716e2913e7c33bbada7c25b59e26cc269ad0cfa2c45a1f9871359822ef11
MD5 198db17e57fac8d21754cbc7b6d411ba
SHA1 9cc48e1d1a5ae4dc5a9a5ebdeea31ede943da6c9
SHA512 8de963d736a05b73f6571607487f1a8c190684748097e8c944b91b0677887830660dfedd342441cacf3376dab51ab21c2b061ea0e2696cbaa9816a699b84a115
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6io:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6io
TLSH
T11825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 960KB
SHA256 79205219231b6a0408ec567862797141a209b4f97b6b8506003569421e13d24c
MD5 24a07e51732f5bbd81d14849bbb9d264
SHA1 2bb64240e81c7199505cb134a8db478994bf1381
SHA512 bea3bc960bdd4d4ede03543ada9e6a8b3fd96709c136830908687289b387f12baa71361ddf9d678d27cf20439e4090ca7dac14fa4d564a98ac14679be738a371
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Z+:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Z+
TLSH
T10C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 960KB
SHA256 09d10b16242f4d738f0086e40409c246a94e0a0d99ca8ae4eec16e4d1524f802
MD5 2eb4e6ec3fbad6b2906d94391c38826f
SHA1 79f0ae25e12c41df15469c26c9ac5fb197dbf7a3
SHA512 602afe40146b828ce117253d6be404441877ebadae3f24ae1d1796a490f3aa9abcdf1cca22a1853b7d6b7f064e29b961aa3bf1560ab9b15c605c24b4960e62d1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6HQ:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6HQ
TLSH
T12925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 960KB
SHA256 a563122376fb4b1abb8f178e67c89f1a0b0689718c551230a373ed4347b45999
MD5 5bb93550494958468c9714c486c58cd1
SHA1 30c434c77d063ef1adecdd6321e30d2d2490916c
SHA512 64d9509ce45dc72576cc74189e2a073eb6551bca3833045b551debf70005be535fc00d8925df1c58601b3ebf7f5a2bce4737c7133bb4357c4336277254e1af00
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6cX:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6cX
TLSH
T19B25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 960KB
SHA256 b4ab6e6637cc0c6961f0e3ad25a3b9dfa4f7f075cac5e00104d2b8286f5b6a32
MD5 57b21daff04dbaa6d28b9b8b8b294997
SHA1 28619859bd337def56e1e8bb6b80cade1575a7c6
SHA512 fe28f6856450b95bb02354212c3058a10c27c37ae0d38252c4df717b1ca802ba741bc5559489ff754e307423b5e2563fb3b9a1eec81ca32ae2f623e44057f246
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6aL:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6aL
TLSH
T13625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 960KB
SHA256 204d165c7574247f3a0fd7b1ade24faa0b7c2264b95390627841d144a7e5a69a
MD5 e48c3a9288239b82793670b619b18760
SHA1 fd441ac10ccfe7b48638fa12f25236cd576520f6
SHA512 73780ec97ee92493a87c5e04704bedce3ce41e9bc04a109dbb62039eefb66ba92a4bb7918ff11ef5457c136e3d35bfd54ffb897f3976ba380df35f9dc9d0a017
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6+FC:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6+M
TLSH
T1BA25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 960KB
SHA256 5017033f8f67c0040e64f60b7550c76571e1f7a7c93712c044f44234481941a5
MD5 3203e18025682716a5a7599a3f4e60e2
SHA1 9bcc7eea7aa6d657e64a0d16d5c42fa4fd37ffb0
SHA512 3fdbc7a57aa4ff40f99d7db14691c48499b28fbac29845d8b4ed02a3783799d9ba0df2000dff52f1599b757c26486eb3343cabeb20f0ce77e30594e0e1dd5835
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6nh:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6nh
TLSH
T10925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMSvcHost.exe

Path C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe
Size 1.0MB
SHA256 c72343ced288267570bfbba2341e3a83abeac8a9a4785bc02e9cb1e2a475cd95
MD5 dd23535be0a1954e736f1b950f1eec47
SHA1 6cbb35869b7b1d2f4f130319230c13be93f17749
SHA512 4ed451500fcbab65a6af755355f7b736d7fc78a660fa4ccb1c135a76115ed1e47ace398f58d65ce99a27f3b6b57d80a9e7059d7dc44e9b4b5c838a95c69c6b9f
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6+ccx2w6:A3kM8ljCccow6
TLSH
T13635B023EBB484B6D37B09705A758712AB39FD110B1097CFA36886591F317C0AF3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-215-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3792-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3792-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads