27d501d4654bc4d7879a5aab7aab9cea251a4e525d453bffc0d633074a24fe8c

Analysis

max time kernel
95s
max time network
94s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 937KB
Sample260714-dcdl9se13t
SHA256 27d501d4654bc4d7879a5aab7aab9cea251a4e525d453bffc0d633074a24fe8c
MD5 e317265db3f48360e4b47a6cb009083f
SHA1 54d3ab6ef0dfc79b9e211b6e1ddd37df80043d32
SHA512 80e3806726a566925636131e2b12132262fe34c1b8e64846d7780b719fbbb708e30d37831d76a7d8e631c10dffb33f84690afbc60eab14bc5b7a7234d767ac57
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6o:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6o
TLSH
T16A15B023EB7090B5D27B49705B758713E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6028-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c68c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6028-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/240-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-637.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c68c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-222.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-568.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-637.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-724.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1128.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1385.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
240	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6028	2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
240	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e317265db3f48360e4b47a6cb009083f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6028

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 937KB
SHA256 27d501d4654bc4d7879a5aab7aab9cea251a4e525d453bffc0d633074a24fe8c
MD5 e317265db3f48360e4b47a6cb009083f
SHA1 54d3ab6ef0dfc79b9e211b6e1ddd37df80043d32
SHA512 80e3806726a566925636131e2b12132262fe34c1b8e64846d7780b719fbbb708e30d37831d76a7d8e631c10dffb33f84690afbc60eab14bc5b7a7234d767ac57
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6o:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6o
TLSH
T16A15B023EB7090B5D27B49705B758713E7397C210B605ACBE3A88A591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 e0ffbf44e43b1109167418b4f2d89ddff982ba6177bce73ea6a2b77782939b5a
MD5 3c03cb14590071b449e9a56d028276bb
SHA1 524949124f270415cbf807d70756b19df7b84ed1
SHA512 e9cb180066cb09cf297f1288b082294b8fa99a30ea1eb70f13022d31f117238c9a6f1fe9b2a96f81b89d2fac469aca71e1c30cd199a067e28b2b324d11db30a6
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6w0Le5ji0hmxNrM:A3kM8ljsPji0Aj
TLSH
T190658E22FA748275D077C475CAE2975AEA7138510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 951KB
SHA256 97d585f6bf29b6f0fbde2c326e60a7b7bca67791c8b30bd870576e2f8b2abda9
MD5 651f0b1a478edc906a39813ef5f65d2d
SHA1 90d05804dfda0e3615a775b41496bb29658376f5
SHA512 bf3c28dce31d6139ac19946a374c79af2786438fffef0e61f6d0b6ed51e5437436ccdc92c0ec6a3cff38afd59e9935a8c49ce348447027ac8dca303883c9d467
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Ka:A3kM8lj
TLSH
T10025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 960KB
SHA256 8fed6e11c60a22550a0221703773462d212d68cd0d5b4fdf9f49fafe1ee2c0c8
MD5 d3657e2461f2c46bea512723e00cb5ab
SHA1 99ed89fb87bae2c24c0541c6785843f2ed758fad
SHA512 fd9d63e6e456832cc8b9fadadbf2c1c1f5620abdc1f317dac639e9f5238fca60cf2e80c5f1f941a738e2cc3ec7564db213f5a9ba273a968355101c172b854bc1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l676:A3mnXoZjzyaEFoHaewsAjYaEpHa8l676
TLSH
T11325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 960KB
SHA256 d612b418cb165c5c779c6bdd187324def2d99742ab543789d88a673f15a41982
MD5 eb46c9b0a69486449db737adcf11f83c
SHA1 ff16505d45591d9b1853037549795b36eea03a00
SHA512 1bfece683892ad726cbd88a534ccbcc3fcd2387272987db17c844311801d495fa99bba7470620ffa533a85bcb0c549dd1ed5f5680a27bc65f17cd57bf3a9c16a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6lN:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6lN
TLSH
T16A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 960KB
SHA256 dcc400dcc688fb2cf04dfc2e11da3bc02411ad7a052c7c3749f71ac3a6bc1980
MD5 31fb34fd2211b89d3f70ae9580210078
SHA1 c3cb0785415647738ce678b6ff5e5c293888b6b1
SHA512 bdb176cd4efa76a7f4a38c0458f4fc536b1fb22dbbe66dc8493229de0b0da10600412c65f3345d208304bc7528f181166020d210a4d7c43d0bbd1c861f273bcd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6jf:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6jf
TLSH
T1DA25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 960KB
SHA256 d39e77289094c9d0e3af9b9ab1fd22bedf257226093a30395a49ae7b1af6c5dd
MD5 2c3ea77c67ad48fb4c87435765fe3152
SHA1 c6aa5dc9c26e282cb34832ef089aceed29f6223a
SHA512 5729e56f6cfb646933aae2985ec715c531457986f34b6812d79fdedfe795d85bc8b98e472d82af3299a2656c4800065f008324318efc5867ea8c344ea47186c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l61o:A3mnXoZjzyaEFoHaewsAjYaEpHa8l61o
TLSH
T17425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 960KB
SHA256 7f8a422de1fd6d314010691bd5445d049f32f889078063184b53578fe426158b
MD5 b04280ce6dbd236a4d155c9c17b28fbf
SHA1 7277790895c77547ddaa30ebab378027ca1786ed
SHA512 d01add6488f226b6f46afdcd7f6c41849a5c8473e5306e25c17da8b20b57330388da22fc83c464a08cb4afa6f0fba55b6974f3d85aca4ce6e6a11372cd81cd2c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l61u:A3mnXoZjzyaEFoHaewsAjYaEpHa8l61u
TLSH
T15D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 960KB
SHA256 abc10377825d6495de3facecc5980d09488c899e5a1ef83bb643b33c425c65bf
MD5 552ea279feb9f61572886c0ca7961c4c
SHA1 c40f1e729a67ff88467150073652058d64b2c759
SHA512 5170887e7c0a1dac27f9d7a0835672cd74e102dda90046429c1e5e739c2c03dd808fddf3477103f0f2130770405e14ca09cd9487c7da35d2cc303aabb5a2c65b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6r9:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6r9
TLSH
T13025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 960KB
SHA256 ccdbbacc76e75469394f765c08c3f586f6cc262aaaa62fbc1d56adc535c190ac
MD5 9107664b9d5cd94d1622137430062726
SHA1 168d8bf75e2d6bb32f524483140f8080c6351319
SHA512 85011c74af0ebeda690167b17eb1783e20fe9fb9c8ed46c3214789958ec4543cf72713aa5697ad81072ef6d142bc32b89ce27d2a2909f9b1d3f5caa2244ed428
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l63c:A3mnXoZjzyaEFoHaewsAjYaEpHa8l63c
TLSH
T16325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 960KB
SHA256 7d989a203835165322642f88a8afabe56ba888e0369d41bfc174b7babeb5f879
MD5 2c54c7e7bf76974d4660b8d17b09e653
SHA1 47cebf2e7c546c4172878e29587e248b79c98adf
SHA512 5d44a2a8a4e61e0a2dbf68ad37b63c643bee322c351ad0fac5d05673ddae7ac98b6c3fe0b1f7940e930589cc0bca51b0ef096e95df07d11c064c5168ed8d9a96
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Ap:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Ap
TLSH
T16325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 960KB
SHA256 4621f86e9dbdce654d69560f8d3a6c9425723e1c2f476ebb2fb05e05d6d33171
MD5 d16d2d1b02f1dad3372c1f4f331d35b6
SHA1 7bbc78e18b048f52d93b70b39ff8ac781999d192
SHA512 5162bd342de81c32075017c4ed3b8de4b29780c6b50cfd1d30ce3b9157b5c952c747e88fd75c429a131401168d46a704e391f2bde1e8af14a9c1409a9a449853
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6H0a:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6HN
TLSH
T1C525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 960KB
SHA256 c05d1505cf7d8fa98cb13339b128efa7a9b0d01f569c34bac9eb25fbd99de392
MD5 47e2fc15832ed4b0a4a3d4759fb2f78b
SHA1 93933b8219f136992b2e9cd1627ef19baa006a16
SHA512 a83fbf124bac2ea87843a31ce4b41bd881b58a39e25117ccd1d7917e39ad9aea9ae3d5874719f15c5dc9686d421ab3132fde0717de5eef8bb223bf5eda888979
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6lF:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6lF
TLSH
T10825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 960KB
SHA256 634d8e990774e7014d656d3d39fb9c9d904b8724fe1293ff73f4e55336f6fb0f
MD5 7e073d881c2f6294c7e57f38e070e3a6
SHA1 0a5e8b85d8abdcd80e939a128762f07be878b953
SHA512 07b711e8ea193c56cf3fa0db2ed7f3589a0774f3d8e36a3b8485094bf0cb5f8d3f749d2e27013bf3a7570b464867c4ab6a2ba99ed3fea8d16f143f0f5ac2d425
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6GC:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6GC
TLSH
T1CD25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 960KB
SHA256 fa556f1c5f67a718a04d8c0e0f4fe463bf44674a92b5bcc9d10eb8fe332889cb
MD5 d2a0cc6e1dab2aa83f4773aee78f8404
SHA1 db0cde1681c9acc2c1698b6b8f92f7ed0470f7cd
SHA512 fdb2f6607ea63447f07f80416a901ce62e99631790dfe7309191d777c21045c55f207f64d068b9ca01818e52eaaf741a8ca0e2e1da22b2e98f14c3246f94042f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Jw:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Jw
TLSH
T11C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 960KB
SHA256 624696ed8c186bbe741e54c683db83dde5dc0b45cdc3b53023984f1704614ab2
MD5 3ef5027b91f76b603a398adc72c30412
SHA1 114ac16e136939b3dc2602b0042c257927ecade9
SHA512 e5aee539c87002ff1b6c20ca9738a8ffb0e7ad1638b47300ed91d6ec7f864927d49bf077433ba321ce549210ed33f92c2b12c2133c17aaf3028278a835328ead
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6QT:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6QT
TLSH
T12A25B023EB7090B5D27B49705BB58713EB397C210B605ACBE36886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 960KB
SHA256 a57d7f4a3fd6582ef4e8e705a8b78d74bea82b134f0317305e3f1c05b2376b8d
MD5 b8f54daa819aa557e235d0e55f4c9e2a
SHA1 f65694ed6535cee546d18bffe2b488795ff8726d
SHA512 730c3e6c3f372dc5db912f2e51f7881907ab3177d9d7694a5ec5457e2ff7858ba50f8511b3a93902498d88f6b9b7d6c1c3aa0c6d4f257468722663f8de32ba42
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l68u:A3mnXoZjzyaEFoHaewsAjYaEpHa8l68u
TLSH
T1FE25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 960KB
SHA256 00e08782de63e350bc7bb7ae2ab70cc0141786c17c277a5c5caf6475fbfe301e
MD5 7b2f62c87a9b99e8df5914c54f53762f
SHA1 b1eb783d375c42f4292fbb84dc3c7b299a216ada
SHA512 e9f7c5d686e2d5f8b62e452222854592ec8ec6b165410e4ff847b002bdd79209999ea18b6187ccf4b519fc128e66cd115f5b99700f72a44ee61e4cfd6442481d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6ab:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6ab
TLSH
T1C025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 960KB
SHA256 f12d5e314ec795cf86a2f398cd8920b5529af3647cb69bfb4c2dec668053dd3d
MD5 8c427905baac88793d33419e3c546c9d
SHA1 b02bbe538998bc95cd3d37eab396761d77d1a0f9
SHA512 819188641b8797e4ce571f4b9d0c69a83f1b53ebec082926ff54e2cbc277d44a0e8fe5798e84698503d393be172b85dc84b1c56b23cc2b8176580c3bbe82a4c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6cf:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6cf
TLSH
T1CB25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 960KB
SHA256 856f5bf1ff2802ab5b9a37a6f6fb075441adcdb76120fffec63c6a3ff743b27e
MD5 ac030604f8864c10810e58f59adc9a72
SHA1 ba0bc64f47bb3ca097faf805bed26ad5acfcab21
SHA512 a29a76b48102ef474361abaa1efe4fa960f986a5238509e6e54b6e400237f2914b1b325e86d1b352ce3bd6c5f2e303a9f1091a7f4a13ac8370442742ed97a5e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l65K:A3mnXoZjzyaEFoHaewsAjYaEpHa8l65K
TLSH
T18925C023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 960KB
SHA256 885cc80922b80fee660bf402c0fd94f86cc16375b278db71f58ef3294af66732
MD5 a6351b18262d79a9b8a0840de738d33e
SHA1 11d5af34e5dd3cd9bb09f37ddbdd571ebaf6b195
SHA512 aa29c179e5ca1689a027f40340e774ec699d3c0ab2fe2b267be6f9528d2f9b70f0668bf2823571f2e97d46912abd589eb22836fc02501b93ceab88a2cc256e52
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6ik:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6ik
TLSH
T13125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 960KB
SHA256 4633ce75e3a6286abfeec996a09d7a9156592769a0bede225cf2562c28a4b7f3
MD5 bec4c5fa0bf9e53088c66e9c98db8049
SHA1 8990b2f17797e2cf96e460b439afff6a4a94c082
SHA512 8561214685b5dbc26fca74b4edc29fb3c33bdbad080905a73b4d91a0f9030f0c644b153a5b982eed1aa890f33a20634c2fcb71ac9a613190c6be9f23cfff2a1e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l630:A3mnXoZjzyaEFoHaewsAjYaEpHa8l630
TLSH
T1D125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 960KB
SHA256 c17010f86f312a8393d82d0032200cdc2c49d575cf02a5b7c97c816fe505d75b
MD5 7a9b8e03248047980426dfbe28fbdf4a
SHA1 ba04492060342682ce0e34f9780f127f9db671b9
SHA512 6234ce700d669c904444fcce687819708e954daa75abb11045824b1e6b694bd5fd27dd6bb25b899bd676c412235085da7b0fc9830f69315e327ce032422985a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6m70:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6mg
TLSH
T18825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 960KB
SHA256 6ccc787713aea3c8c0152384ac10c4443a1cd6d228bd369b16273d6ceee81510
MD5 1af87c2130a8a6e1396927f9de232e44
SHA1 b1246da5a26fba9b70082eee31c276510af2e500
SHA512 e48fc310501ea244c37e01b383fa404339e2be2f012a6e9b4ee6ac496fbeae26457e66c9422ae27762d3d36fc11d04cc7e4f86506e60835b754d39f7be28eaa7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6vr:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6vr
TLSH
T15825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 960KB
SHA256 56d96d678d6694c1793b993cf14b9bff51f479fa3c723370fcf9284657778b49
MD5 b39ad0780c9b05b49c1a2f8425e02ceb
SHA1 d9b4c7657757c93dab889afe1f080749abafec77
SHA512 e82fe73086943c2f0790af9ea07d58ab94398eae4008afb385eb1726e056eed789cb8913b64343bf19aa7722723646e8b233d64a2404b2daec8ae40c54d0e9ef
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l65n:A3mnXoZjzyaEFoHaewsAjYaEpHa8l65n
TLSH
T15525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 960KB
SHA256 97da1154d074431f122fbf791df68f562ccef821fb83fc9c891543a018bcc680
MD5 208945b90ac67ded9c419e0726d00b7c
SHA1 562b94d61c26cdc0f66a60954c29cd76056f665a
SHA512 f299bf2a2bbcb021e1ed4fada03ea131ed258a0db271ff70019c5832e2cedff526e9ca847b6499e1aabc116788b392078edb40cee8051e8468a1d9b54911e980
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Vx:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Vx
TLSH
T1E925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 960KB
SHA256 571b4e77b26114a876aeb03ad0c3e22fe06e64069bc05755c2b3064175a70e5b
MD5 3327f206e8a19103c7194490b5c1506f
SHA1 8e88c010e960a3feab0573c7b48fab0c52d5b6a1
SHA512 b4adf338605b7a197c373f373b23bcf7d867ab6e6ff97ec1b7a8a1cc7acbb5967733723ab525a73b26a6f3d2c9a5b9de74b3c5d550d49a81a2bd02a46ab990da
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6LA:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6LA
TLSH
T1C125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 960KB
SHA256 99c6e18cdbe0c93df45884a930f7f4b6c653ad68bfb739ae7858a36993bba20e
MD5 82e11924e161a5e011d47382f15088c7
SHA1 1e82cc1fa6385289292ab7b6e18d7202ac60c0c0
SHA512 e93cd41acdd6d85db08f18cc989b6428b936d3f3ee4e66c7a49f55cdc380a75ed2e2ec8292a3dd62e0530d42f5dce7a80f084105f72b7dc0acba5529679ab124
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6c9Q:A3kM8ljp
TLSH
T15A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 960KB
SHA256 352e415e66d73f1813606a680f9c47914be2c277f32e7ae7969078d336621c63
MD5 013be47449aed2e68d6ecd541c083f6f
SHA1 2b13255e05e9ad52a18535667c2986639825b27f
SHA512 5241c2a2751032dd1a48480935e4f133d6762c4fef023054e0b4f19e119912b50f4eaeacf4a5cdc9bb6655043ffecfee35821e31ad2599c619d2697d19dc8b31
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6F4:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6F4
TLSH
T1D325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 960KB
SHA256 e518879ef6dae8840cfc66cf78b195d075f30ed6e89301768eef16f5fb8c9aba
MD5 9e25e414b12d0987863efc7eb3a6f820
SHA1 a4de3d006bac54d7bf3e7bc7a3826464d1aac0e7
SHA512 9dd514b59e7890b26d6cffd24181207034a4a0bd725daab8337f8ac7415d2cef59d954583411419bd6885219dd4442babc53b7107e98e52edc20ac3c7c0fb54c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Qu:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Qu
TLSH
T15E25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 960KB
SHA256 82e2ccedb21e30bb17aa621181bdb61681a7ea2f01c815a586ff57551091e300
MD5 4b489dcda5ce1e87486bf606cf81dd8a
SHA1 78f7c750d881ee253ea964d0c957b6322760b8b3
SHA512 6380bf4d616b9461fca9d29f36844f74e88be50b24610ac71558f310f9b97071baf77fc83d18e9faabe3c6585dc414d5b7e641ec7ab5ff6786d7728c3847be2f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Rj:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Rj
TLSH
T14625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 960KB
SHA256 8c923f4cd48e87b98b5f9ef9fbb360eae102f693489fd305fbd093af7cf9405c
MD5 f692cfad12151dd8de1427b1808e62ac
SHA1 37288272ea9f6368bcc81dcb83185b6cd436f46e
SHA512 76a6414cfa3e39088e47cb4fe299a0d774d97e29255105134f4d9473552e795e4758c257a95176488fd7ab58663315797e5c24652df244568192c1aaac86b173
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l64g:A3mnXoZjzyaEFoHaewsAjYaEpHa8l64g
TLSH
T17325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 960KB
SHA256 23391a203084514f9148e9b927e504b83a8a9e0b7c524bb1d30bdf3479b6a88e
MD5 6fe5f5b7cfdca9406c73fee1808f0992
SHA1 9768351f5705322c32bf3ece500ef85deb113f92
SHA512 fdf962b39c4975e1dc5b7a49b3973562f9b283e94f99c4a8be265b9c51d886e8bc6ce64eef11a3d60a88af1afa99dddcd8c3ae73be6509bf85e55e93738e9afd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6XI:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6XI
TLSH
T17D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 960KB
SHA256 e8dd6c63340204f1e4db2ad2be09cdab00f32226e2260c7304f7c8af5b55ec79
MD5 d13e08c0f44ae913233e79789f9b9116
SHA1 a985425e6b31c19ea231b2c21cee1b126ed7e1e1
SHA512 93a568feae549fe9da0c53a3cebb51467bba1c10f1f851de0c9f95c7f0a180dd6b67af0ad035dc652a71e32e83556685a6ea36f12cba940832ee6378895a1fd6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6do:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6do
TLSH
T17F25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 960KB
SHA256 dd38a763038e16bd2eb721b25b0a149fa9f056965c2e4025def24a76c006300d
MD5 7fb3a1c4e07dbd31e264ad1dc06b42ee
SHA1 271ad9ed9ca912aafc09b3c6f31bd15fc1424a66
SHA512 9b611c16b2699193b8d4e24aa3bbe2b292aaca8fb98f5d5450e728b556acffd71c7a4764d1ead0fe5361244d6e94ebec291a187a6acbf8ce0160299396b54d47
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6O+:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6O+
TLSH
T13925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 960KB
SHA256 8ed014b860397e7d6be433c193715eb1e149effbb5b714cc96d5201a57790495
MD5 85de692765cd0357e84592ae7bcae16c
SHA1 ad6ebe099a6ceb927dc3865093896313008f3215
SHA512 6e77259e52aff82018f0eaf4ad8b48991610f644f1bd703840778d24a73d959631d7caf4d291a5f49f85554c774de72ea2828d2395dcfec8e5483e97f19c4a08
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6OQ:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6OQ
TLSH
T1A725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 960KB
SHA256 567d4ece8564780583f21617cca382bd26d9ce6e6e1107641fc42378f73362a3
MD5 7146efa406015c66871a5f22e9d9ea6b
SHA1 4887f37cffa288072daa81e8ffedd92fd3dca868
SHA512 8ef0467118ee91173d6b116908a775b87e22ff33b56a986adc1bc92b7d6baad44476f12839de2bcc3e34d41f444589af9e7b0623e26ad261503fff10e8ce6a58
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6vX:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6vX
TLSH
T1B325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 960KB
SHA256 7ddc768fd53df40247c78ef65898406f3af5ceafe128bfcde43668d576d24261
MD5 64f21c3507616fd59de8b5c4108322a6
SHA1 9742f8a59a80876806a9a48a34fa3a9f2d640245
SHA512 c35b7b35479def4a366a6e4c0e987bc4d6a10c0ab10f37b9cc500f37f7db829e335ec8f64af2e377df4e5d2f8ed20ef619680dff03105183b71f26722637c72e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6lL:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6lL
TLSH
T17425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 960KB
SHA256 2e474815a8f7fb524002da6dcad27a28ab55678b33328a0344429eab3db75039
MD5 6874d60455234b12ab87ec12c5eb40c7
SHA1 0dd66c154f08de435b61deb128a578f1a3629952
SHA512 4c68ab3ca3ef1922b6a21c597416752ebb223863d840bf1d11495780ae7215416e0c0250f94841478b12a2067007ab551928c4ef3b74c8c4dc6a9bf8a004c219
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6DFC:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6DM
TLSH
T15D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 960KB
SHA256 e4c82c9ac4e6aebfb0fe63f3676c2524b11dfe9afa0af521dc1eefe8630bbb3d
MD5 d419cc639c21cc7106a62e2866ff3a0b
SHA1 94f7c465c1d83abe30394a5a877888c1f24505f4
SHA512 468031b2ab36e12debc710d31957bf77962bd22843b72b4bab9a1735a450d1c9c948c5ea75d5ef1e2fc9761f28a883ffc4f398da5cf52a1e662460df3b6cce51
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa8l6Eh:A3mnXoZjzyaEFoHaewsAjYaEpHa8l6Eh
TLSH
T14F25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6028-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6028-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads