e01e4f1c7689d5bd3223110d553b3132cbb229d9cf4b2b789640afde083211b3

Analysis

max time kernel
89s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 917KB
Sample260707-fxwppaav5w
SHA256 e01e4f1c7689d5bd3223110d553b3132cbb229d9cf4b2b789640afde083211b3
MD5 1490812f179f647c4223887ec941d22d
SHA1 cef235fc03ecec8dbc6a2cb058add75a137034f4
SHA512 abc34fc7e8a1f7dd4d17fa1d47f6de0d734c394d9b91552ee26dad2e282d4eb64e8dde91ecb7d8670372ed18b2d4e2e63b3c02685d1a54d0c0c6e8f7165868ac
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguif:A3mnXoZjzyaTjBaewsAjmEguif
TLSH
T15715BF23FBB090B5C27B45705B658713E739BC210B605ACBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5800-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c656-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2ff-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5800-184-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985f-239.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5128-252-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-283.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-470.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a71-592.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-714.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bb2e-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198fa-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1089.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1164.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c656-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2ff-57.dat	aspack_v212_v242
behavioral2/files/0x000400000001985f-239.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-283.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-470.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a71-592.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-714.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-739.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-819.dat	aspack_v212_v242
behavioral2/files/0x000300000001bb2e-851.dat	aspack_v212_v242
behavioral2/files/0x00040000000198fa-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-929.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-972.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1003.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1046.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1089.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1132.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1164.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1179.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1319.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1338.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1363.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1390.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5128	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8D765FE5-66FD-458B-8914-BB4A967D051A}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5800	2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
5128	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_1490812f179f647c4223887ec941d22d_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5800

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 917KB
SHA256 e01e4f1c7689d5bd3223110d553b3132cbb229d9cf4b2b789640afde083211b3
MD5 1490812f179f647c4223887ec941d22d
SHA1 cef235fc03ecec8dbc6a2cb058add75a137034f4
SHA512 abc34fc7e8a1f7dd4d17fa1d47f6de0d734c394d9b91552ee26dad2e282d4eb64e8dde91ecb7d8670372ed18b2d4e2e63b3c02685d1a54d0c0c6e8f7165868ac
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguif:A3mnXoZjzyaTjBaewsAjmEguif
TLSH
T15715BF23FBB090B5C27B45705B658713E739BC210B605ACBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c20e2efffc9ee4c218e1bcb217b1639faa9a817639d37a246b34a52b103971ac
MD5 397fbaaddf34c0ae1ed1cf683e94f3ef
SHA1 fc97b30fc1b939ae85ecd51db688b23862b43c14
SHA512 e87768c301653d4b1f7575359df5e749dbbdd94a977ce1912684afaae9504d2a424dc70d64080769fa6cb5c5d1d2217c841f0476ffcf0e58c80a88d6af553aca
SSDEEP 24576:A3mnXoZjzyaTjBaewsAjmEguiL0Le5ji0hmxNrM:A3kM0ljiPji0Aj
TLSH
T14D658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76D2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 931KB
SHA256 b8cc56bfc28b7d7a7007d20eefead03cdb63966b5d4f0a046714629f50177d04
MD5 5ad22f9343b7423ffdb3173bbe9fe7e6
SHA1 7078cdb86fbe02d45824fcad1b605ca017ce9b98
SHA512 23b681a8845a089014dfa2b4106df8e965b6551581b6781d0786498791f3df3cf8c33a578b14eec616b6a2fae14b69f8d240853837f7746af750aee78ec497d4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiNa:A3mnXoZjzyaTjBaewsAjmEguiNa
TLSH
T19915B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 940KB
SHA256 1b5ea638693f6f80f1de631c2453a0d4f13444b3f9a2382981f58e76ce50c082
MD5 3a86f994b04a8af2dd657916b486e53e
SHA1 d6176923072adc00d7e09bef728259ad0280733d
SHA512 349159475fd147769a0b2e102a518820f8c331da0740bb479cfe062cda4dc8f5aec800c864fceba2c5a598df4aba8b524ac617b0fe789800dfa2f40c62fa1726
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiE6:A3mnXoZjzyaTjBaewsAjmEguiE6
TLSH
T17425B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 940KB
SHA256 260c413d464d5c3bee5a27c138f0ffaf8d9091e51795d0496b1fc3d005518e5c
MD5 a03dde2abc28260e72cb7503a3a1f8c2
SHA1 560953cfe8962a7d1ec87772dbabf07230f0f304
SHA512 df0e4559f76bce21990b9ec20d82b7fc8a7c25fb37d91f297e4771dc1dc9d6684b6d6e3e5b16ad47d38215f14e2fae79b7e04f17ee6a058fcfcba0397f31bb02
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguigN:A3mnXoZjzyaTjBaewsAjmEguigN
TLSH
T16325B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 940KB
SHA256 9cc9b1cb08d92fc3f668c7b20ba2f07f4c5d9ecc6430a9fe2339d671298cb44b
MD5 b82dbdb2872bacf21484bfb592d65dc8
SHA1 25a8fd46d8f51543233a8c97e3096629cbf816da
SHA512 c8c22233dbee16439dde23c9281adc709c443f74a7f85b1f61a2d32da241ffe7727ed527d5e9b7bc08dd04af47bf444106f4a262b74ca0e703b7c45f9e04b68a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiOf:A3mnXoZjzyaTjBaewsAjmEguiOf
TLSH
T1E025B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 940KB
SHA256 46411b51cc1780f0a7ca4d4d7a0c5c8b638693ebc9d03fe5087b008494085b77
MD5 a478218467bc6d8e4c7d37910d4b863f
SHA1 b0960fbfd740f931432cedb3f27303ee43951ae1
SHA512 59b74100d00b69d6b999a26dc9fd5a10dee897643eece99422bdad2221ab40fdd59627e2d9ccf216514d42d9745510b55f807a52c2af22ff29943c1a49d2672b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEgui4o:A3mnXoZjzyaTjBaewsAjmEgui4o
TLSH
T18825B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 940KB
SHA256 27fde8eaffa20b953489fc5b390b3a200deb9dd1e0733e5ba06edadf23505128
MD5 bea333a9927d73983314b4b99f84b3cb
SHA1 4e3775e4ccf87bb796de2ca5eb9e550584de380b
SHA512 762acac929d6605297269f5c31e14c15b3c48eb580d22a38d3e9ce1e90a798dc330ed44c6ce17b1dacb47e79bca1a4960cd40dbfb026adc58d852a7e4c6462dd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiIu:A3mnXoZjzyaTjBaewsAjmEguiIu
TLSH
T1DA25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 940KB
SHA256 5f79d8438d7d9697a765e7512277cca6bffd375c798b61e60c9abe7b1781fa0d
MD5 719b114beafe137ea5062a71b3720d2f
SHA1 e2766255faeecf8c285836a692fc0e2fceb52671
SHA512 4d8bddf537ff04331d09fa11e36c52554d358369fd2c45069691709d63ecdcec874e2986efb611b3cc79490388e8db25e2fb001d19f3ea2c24fee46edbec2a43
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguic9:A3mnXoZjzyaTjBaewsAjmEguic9
TLSH
T15725B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 940KB
SHA256 8a3843f6301dec8a80668e511dfa9c933a3a259541820e817c2b641317265da3
MD5 6501696c18fe621bc4b2582fc10d4820
SHA1 c50f98797dbe2ec0fd8e7d51c038584127a6697f
SHA512 91a4a726c09e722ce45f4f849d78130c14241533e8a29f3e8236b6c0a211f805f112becdce85683102e9bc19a31efcb7c75b0c9941ec96eba5ca4c04955899ff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiEc:A3mnXoZjzyaTjBaewsAjmEguiEc
TLSH
T15B25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 940KB
SHA256 6236a0126c890d8596e7a0346523b371991d11f4367515e81800d54009eb9029
MD5 ae410aa6a280dc18a8cc12a7fd63167e
SHA1 de0013c2bb0eedf63e1cd971752ca776393ca726
SHA512 16e8543e42fb65a7b4da773911740739e83988fe2ebf1ed8fc8ec2cebd1a4df821693b20a7a940d946a153bb52a2cf61b2f259623a4f034067fd57f37705d1a3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguidp:A3mnXoZjzyaTjBaewsAjmEguidp
TLSH
T1B325B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 940KB
SHA256 b7391999dd6058f7b4d81f3cb65f38da5ebcd9bba6843c48d10d953d54807e53
MD5 1318e2ba0063f465ff4e73dfe8cb63ba
SHA1 f6ccd5be256f039aaeb105473ae85f90c31b23cc
SHA512 7b818ba65afca4d0471ffaa6d0f91a818e73b3000b6e28a793421edba7b65c372e9b86a58e02301ffe61898292664ca4b177ca1dbaf31ac427594ee1d58c95ab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguii0a:A3mnXoZjzyaTjBaewsAjmEguiiN
TLSH
T1FB25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 940KB
SHA256 5eda85f582f1de7cb25c438417924079f52a1cbe0c4a6e033397ff42f22f8400
MD5 01b302f508b66126b31108985057c3a6
SHA1 53379fed2e03475687141f0fe44b99e30dd6e889
SHA512 6afa45d92e143a86bcc14ce7a00379893a21c6e3396d7ebc28ac03581bb8fb49e82f71ef5f06c55b1d522a90e7c651cc03c51cc0ee186938ad0875e39c4604c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiGF:A3mnXoZjzyaTjBaewsAjmEguiGF
TLSH
T14A25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 940KB
SHA256 c2b001abc95727bc8a0bb037835858db5d3020a4f23013ce762adf1c8827b2d9
MD5 87476b49ba51a08b69f6d51061ed16e5
SHA1 d74280e66f8f5dfd2e82c5e69767c237cfed26bc
SHA512 0bf7ce2b7e238a56d54b6b47b4e0fea625442324da8b45f0d9584a412c8940ab6db094dfc0515f5b004f67f76614237a061a95c4bf1612f0c5b21fa05f967ebb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiTC:A3mnXoZjzyaTjBaewsAjmEguiTC
TLSH
T15425B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 940KB
SHA256 9ee1c72df14c29af98b98f71a7b9c80750085249c8fc6f77f4ec31027f6bc95a
MD5 9403d08f1f002e219799d850f022c944
SHA1 108ff2633aa1d9854e7f37c7d819597e52e119e3
SHA512 fe787c441d975dfae78cf6c0d29f8fcd2fe1f75dbddd5255b27fc3caaaaecf17371133050cf0632b2d55f95727f47703e33c407405e4ef3a7ccad92f4c54e2fe
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguicw:A3mnXoZjzyaTjBaewsAjmEguicw
TLSH
T19625B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 940KB
SHA256 a39bef82036418e17416c2a1e983a024fc701868045f02ba8a54c7f9ce79b808
MD5 7e9f34e5907994a22720841108393c99
SHA1 48f2a80cf47aa414ae06be6968e6b6e866b16b58
SHA512 6486f800c11a1b80fce03b10a70fd508fbf446fc1a681202bd7c5f4f37453e810d6d2abfc5012a2a823ce97f738013e30ee0ab79db981e1a149e34aa19ee97bc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiTT:A3mnXoZjzyaTjBaewsAjmEguiTT
TLSH
T13025B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 940KB
SHA256 6dc77dae3236e260f3c715fa344d99e02a1a9310b35fca30040adce23c6184ef
MD5 daf3b0397308924e5482b9481ce09878
SHA1 9bfe6d24c1a73af673fa328df711b235558600ce
SHA512 4452372af05fd944a93295029981a1dbb1826af30a1f0eb741d8634cd608cfa1236aa078dd26dcd7020d805c7041751454778eab5eeddbb72029476386b06272
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguilu:A3mnXoZjzyaTjBaewsAjmEguilu
TLSH
T1F825B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 940KB
SHA256 903328b0381a82c900907a68272dc4ab6bd1017dd7d14d9a570e9614703cb426
MD5 5701bb2fd00b87714411faa5ea5d3737
SHA1 897039d4feac2e23480855dd4f6c34297c2ec17e
SHA512 994360d6c26bc654def3394c7a84a18b055cbd3c731acc128700a013939bad689543db7ead8686a7021efda2947f792781ad9678c0edad4a8edf41dedf93b850
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguitb:A3mnXoZjzyaTjBaewsAjmEguitb
TLSH
T1B625B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 940KB
SHA256 1115bde19733c3cb46e500a207d646e28d1bbaa98374b758c09072368a5b4419
MD5 64a5d589d81e9bf06fb125c02d42c0a1
SHA1 b4aa32534bbefd7549ff7f5c693352e0400279c0
SHA512 245a252a0b57feb23794fc6e2ae0675e5e438c5e12d963404f3fc15bccac4e3a0c9d96108b6803d39b018557e2d8cf252f39139ffcc1983e59802342bafaa2bb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguidf:A3mnXoZjzyaTjBaewsAjmEguidf
TLSH
T1D225B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 940KB
SHA256 2c19cfb9a684a9b040eccd1718c932bfd20e4da4a60f4bfb4297abcbf7f2ccf9
MD5 10971fc37fb2b6e37e1867fa18126a52
SHA1 a4d56f87a30e263c9513fe8b583f7a86c5072402
SHA512 d5ccf180b54dc742c8dd6778cba2a42f9e2e9e4b1b653486dedff6472e565b69508ebea449533b7c8a1d8adb16862e1dd759b3d24e30e3a2f2b713554a041546
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiGK:A3mnXoZjzyaTjBaewsAjmEguiGK
TLSH
T11625B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 940KB
SHA256 eeffd3fc897246a0c610e39cdb28713cbb6954a2bb4faafddf1e332337394850
MD5 1338bdca56f8911a538cafe85084b261
SHA1 12634c59900b05bd0d1ce8a1019b89f23e31188a
SHA512 77b0b86fdba7a0739834a93d8c67e2a3e26a6fd704c8ad405a175cbff2506602bdb619cf78b343893e43f8da36ead8b44ffcfa128507780c19f6d98781a7b464
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguizk:A3mnXoZjzyaTjBaewsAjmEguizk
TLSH
T10225B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 940KB
SHA256 4062a8b17d3b4919f54c998a3db1228f995b24efcc56f52551677efc50c6b519
MD5 3b6cb078d8663d219d5f6ef671bce32d
SHA1 c363ff7785ec73cbcae3904d5799c6ec7e3d275d
SHA512 bf34e745f0c84ccf99c906d5bbd86a2bbe2d6dad16f93afc90eb952c4b0c8f0a693f157f393c3418a761b8520be1a30531cdbf75ab914e5712e5086bd74f8d7a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiE0:A3mnXoZjzyaTjBaewsAjmEguiE0
TLSH
T1E825B023FBB090B5D27B45705B658713EB39BC210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 940KB
SHA256 c9490ec564186117b389dd86464c5b459a65979c965a439325f6c2020e68e257
MD5 cc2bdc935cf44a6f70b84807c78e6852
SHA1 ebc8696c2a12fba38af9cac92877545db2b2774b
SHA512 419751d09c32df1ce214f4123ae91fabaa6877ed876a5240d12ac87ab59324707910416f445ca0a91137d7e41b50f4f6c11e82756cadde11ce70f007920ec838
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEgui/70:A3mnXoZjzyaTjBaewsAjmEgui/g
TLSH
T1D625B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 940KB
SHA256 e67386aeda9b5d7758c37e3b640e087cd416ed3b51382982b6af1b906f19e26e
MD5 9bbce44c7547365b05e6c9279265abc4
SHA1 19fbf5b0f288855fb1e7172b2e85e793756fab63
SHA512 5e03d6d1e10e78801c32d4ef791dfbd89512943cf41b179c53dbfb069adc4a674c2a068acd41701469171b3e6cc07051cf17cd794892abbd2f99b1b3fa794bbf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiSr:A3mnXoZjzyaTjBaewsAjmEguiSr
TLSH
T19125B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 940KB
SHA256 5a4f563691a0121727c1911d098a68aa40c785a37b4a525f0ca651a9f7c5b6b3
MD5 cf585063c0704ca116fba2f378e3f1a4
SHA1 b9402b0c432e0e613616fdfde5f236aada4fb38f
SHA512 e53181c74b7bd6eeba99ad76a3beeca3f8b7c9834b3076327f7a7940fc011e8ec2ffe61d1b5efe03f2253b87f413f589d95dd60be6da8c34f811d436bccb668c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiwn:A3mnXoZjzyaTjBaewsAjmEguiwn
TLSH
T13525B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 940KB
SHA256 d6253514e6cf3954fef281aeb3c914cfea630d72cd2d1dc1cc69bb2a992d0770
MD5 cbf964fe66976872b4a0797a31101cdd
SHA1 f6d3f9a4ee8f8da95376df8d0a6340ad251b56f4
SHA512 15ab2b7ce026889b33a4a3b7beb74d1be39090886a02045efbb404e4b4dafaa67705a890b57fbf1353446a3caf078d9ad10b2dcbece1d919442f470692d7b1c0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiOx:A3mnXoZjzyaTjBaewsAjmEguiOx
TLSH
T17425B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 940KB
SHA256 787190a20314facdf784b02d77d77e3c5110aadad8d806f389319fa8096dfb83
MD5 3610491287c053c40bca99c327d43749
SHA1 b191fdfc5d1911786ba9e8eac83a228cee9e31ec
SHA512 8387801c444e4c0de617a33e292a89235259ed51902c3ccd27eb4e6d565a828a03a98d959ec7548ec26c1d576d35400459553baa0857ab383149c1794ccb488c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguioA:A3mnXoZjzyaTjBaewsAjmEguioA
TLSH
T1E025B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 940KB
SHA256 b7587e8138497889120b5a317fdfe9fac8ef447528c02e0cabf64deb2bfaf8c5
MD5 794ded6f413151009945f47469d222d1
SHA1 6372122c8ad192a1bc9e8e7597513e49857e268a
SHA512 284a93a31f8e598eaae4a1a0d6abfbd04dc9b6202cf48a8da51db758c132ba634b2abf6fe52f6eb87a1b694f7148ca7796a0e86d75b050e4ca0e867242c9ea61
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiB9Q:A3mnXoZjzyaTjBaewsAjmEguiB9Q
TLSH
T12325B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 940KB
SHA256 9226834d2191b287667e1694946d0e834771edf5a0f4f9db061804b1541bc925
MD5 be93a2b890b2a88e41a05f80b525d860
SHA1 4f17d085a879783a0d22c897e00dc4bcd0100a56
SHA512 75659ee8bdb2ca4a15e63b2d04022f4c996c5c321859b95c9e764ce3d9b154863ad6ca952e2dcf60aaf75aa520b79b62a7a161a5a7fbada4622e5708b8a79c98
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEgui04:A3mnXoZjzyaTjBaewsAjmEgui04
TLSH
T1E225B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 940KB
SHA256 efeef9ef00e2489216440a7e021c405310bc04afb7dadb13d58c7ea227fb91d5
MD5 5fce8d72b8cb09bc3c37b4c4a2802fee
SHA1 5ce253aebe567d1354791627cd0305ddbeca8e07
SHA512 36c324bc6e4b4ff9cb88aaf9a2686aeb3d1377dd1da7ac82707d4e57d2c42ca01eb21355883e11d7b83df60419e2a4ef24165291c6fda228ec6dce9dcbde5101
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguifu:A3mnXoZjzyaTjBaewsAjmEguifu
TLSH
T1DF25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 940KB
SHA256 ad178e0c5de2b407a1ec752a516e1ca3b851ffd54af52e269361f0fc58910352
MD5 d85b4fb6f1cd785bd755c988b046c6d9
SHA1 414c62127d277d45151ab585175a0f4f1a212fe2
SHA512 1193a259336122b87190285da0a2f4f40fb05c36c709ad574b5868a923a073b1bb6231625cb95b5361dd57db14087e96a8b4dcc374b025510866b1bb5a976308
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEgui6j:A3mnXoZjzyaTjBaewsAjmEgui6j
TLSH
T1DA25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 940KB
SHA256 67ae34114161d019dcdd584510faab5345580f4639677ccc9f408891202a040d
MD5 c3bd28b3ba6729282aae868558cd945d
SHA1 21f3f938920717630f0e16749c2091c0a41178a7
SHA512 22352f9c44612c755d2cc10519593136c189fb49340ee25f7e409e7a2c3efe6a9f96d810f02aad5466e6377ccab40788425becf2d5d1b279697db67f9c7aa551
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguing:A3mnXoZjzyaTjBaewsAjmEguing
TLSH
T1A825B023FBB090B5D27B45705B658713EB39BC210B605ACBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 940KB
SHA256 534d85cce337e5b79725cabcf746470eff3917f4dac0efe8a1d8b53f0e9a0894
MD5 149778bf1c6119bd4e8d2060f005a754
SHA1 be5d3ff04003e435afeb9c1e079d63ebc6724d99
SHA512 72deac6546b1d4469d4c5c7fb0482081bb588950025e6a66bccf5d9b69d903b52bef9bce6ff64db55a63dca236cd4c0e4a94048af0bf8f256f664086d0ef6d92
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEgui6I:A3mnXoZjzyaTjBaewsAjmEgui6I
TLSH
T14C25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 940KB
SHA256 dfca2f49efd20e1d7977b9077a5c3497ffbe6dc10dda55632d1e925aa0273b25
MD5 5fa1c4aae7c24c4c7dc3c23991b200d8
SHA1 bf4efbaf90cb2ec4dabf8109221545ca62c1fe6f
SHA512 53b59d369528335bcfe88928f8cebcf2160f24ff298c46f0dc8e57d8a02f41884e7e4d6ce9c0f2c3fc95864a807f82d0d853877223080be6791599102c3b92d1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEgui4o:A3mnXoZjzyaTjBaewsAjmEgui4o
TLSH
T13625B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 940KB
SHA256 6b1046ab734516dd2184bd6aae663fadce5d25ddc0be969e48e14743966af8d4
MD5 2412d6deb79e0f612bfe72e50add93d0
SHA1 57793bdcbb81ad98abde0c1d1430b6be6a282cb4
SHA512 4bd9e973793aebdecfd8a06f463988a9beb483629118789c38f38ee4b507495a2b83c92b251be4c7d77b0335d30b71e18c7cf715fd2663324517e967d1cf57f9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiL+:A3mnXoZjzyaTjBaewsAjmEguiL+
TLSH
T15525B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 940KB
SHA256 940942762b6534453a3eb8160ee0d140e742d97845dc2537be7831fab0075b67
MD5 4bdf59693d5f277860ded177d84c4507
SHA1 866d00a7739f6a71be9422ea058a05148d644ed0
SHA512 366602ef934bf0cf28ed8511a5022d7a72a825c4283e43ab3acb24b01fd712e4bee1595c66442c80bf757ab83d8d9e07671f8460b279282283e61a44e848475f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiBQ:A3mnXoZjzyaTjBaewsAjmEguiBQ
TLSH
T11D25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 940KB
SHA256 aa991a5cef20a3c01127d72a0504823a757fc7dd1ac2f2935df7296fade2ea74
MD5 1352b41bc849dee966a5fb4b2f5a99f2
SHA1 5642c3fe1d078af9796bd51bb31ede01d4f3faf4
SHA512 280dddbc403e3c23e32f90ea1b3b4e7bef3d1cddcda1610ad09795882c08f11d62bf532bfa623de88ac32508261fcb4ced51aa0cef9ae0c0bb6f15f30efe9e86
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiGX:A3mnXoZjzyaTjBaewsAjmEguiGX
TLSH
T10A25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 940KB
SHA256 acaa8bc55ee98bcc8fb0c9e103687e275bf459f7f5b0aafd3601e2844a228ce0
MD5 cc39700be7d2fd163fa920813eca3dcf
SHA1 65eb6e68efb17ca648754bbbb39fff45dee87bb5
SHA512 384c66c3f066184ee4d4e893f813851181db7a2d60266d6bb30b210f0360d512bda15d75f239fdda77da2ddddca31b19d411bb67ecc1186e09d0fcac98da74d4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguiAL:A3mnXoZjzyaTjBaewsAjmEguiAL
TLSH
T1F825B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 940KB
SHA256 c06acb2413db1997ea787d1131573c2a3784acb4b4c231ae27c12556414718bb
MD5 2234c38393899b8e9b0baa0955a0d117
SHA1 1726ed24f19c55ec886cd9e052493947fe2d8fd1
SHA512 eb5ec9fac579a18d7d106b472f5ef00ffe585d1c4446540654deca0223f67855ca59c9d7cb05bf41723072641620dbc707f2def352d5d903a4d798e6f4030e58
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguisFC:A3mnXoZjzyaTjBaewsAjmEguisM
TLSH
T10C25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 940KB
SHA256 a00d1e0738d14cb1ca0349fd460405a04816b485a9a9e56b7a60e0f3d9bfbc73
MD5 a70bf8869d08d7ded618075c089579ce
SHA1 f823da5927a25ce915a7e6275f594febd41934f7
SHA512 d9c2ff463499af60c41c7c5414ab3cd954a279aa06a098d4623a9b2d8ccc44163c42a370a9b8ad6684394706d7d9e28f251981d8f7175bba9f40a010c86eb6ac
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEgui1h:A3mnXoZjzyaTjBaewsAjmEgui1h
TLSH
T12625B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5128-252-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5800-184-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5800-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads