bc228a20713bd0dbffd17a5f7db9984f4c1bf0cfbd22b0756590d3d74fdbcaca

Analysis

max time kernel
98s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 901KB
Sample260805-wfyeysda28
SHA256 bc228a20713bd0dbffd17a5f7db9984f4c1bf0cfbd22b0756590d3d74fdbcaca
MD5 9c75dfd9974dcb5b785a78d877ed47aa
SHA1 bfc6eedf84161157cf06cffacf9c440b8a732ee0
SHA512 9183b109191cab1cfcdc4a5352e510ab757673c9006678654f76733aa17458615dc4ec1e6d8ced8497b5f005cc87b4e45bb8ddaec1b55c80940890d835f7e749
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOu:A3mnXoZjzyaT4aewsAjxTcgGOu
TLSH
T1BE15B023FBB090B5C23B49715B65C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5312-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5312-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4036-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-532.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1098.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1303.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c614-2157.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f5-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-489.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-532.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1098.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1303.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1354.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c614-2157.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4036	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\SaveSelect.exe$	patcher.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5312	2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
4036	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_9c75dfd9974dcb5b785a78d877ed47aa_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5312

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 901KB
SHA256 bc228a20713bd0dbffd17a5f7db9984f4c1bf0cfbd22b0756590d3d74fdbcaca
MD5 9c75dfd9974dcb5b785a78d877ed47aa
SHA1 bfc6eedf84161157cf06cffacf9c440b8a732ee0
SHA512 9183b109191cab1cfcdc4a5352e510ab757673c9006678654f76733aa17458615dc4ec1e6d8ced8497b5f005cc87b4e45bb8ddaec1b55c80940890d835f7e749
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOu:A3mnXoZjzyaT4aewsAjxTcgGOu
TLSH
T1BE15B023FBB090B5C23B49715B65C712EB787C210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 da0911e189f65634c3663b4dc72e6a3cd87e56c2780aad8a189b69b0d350a714
MD5 94e853f3f495d7e247ad1678fa9fcb54
SHA1 fb7ff7f4816dce5ac6d055100b689486c2caf5b2
SHA512 89dcaccc360f57710f2cc7255eb8b654d3992c562030555bc984dc1373b06a47a69d1d6320ed5b0003a43f5d9d32edb9926e65863032736f3f53df84f1d8327c
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcgGOe0Le5ji0hmxNrM:A3kMPljUPji0Aj
TLSH
T1BC658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 916KB
SHA256 80c36fe651666484b4bf8936714ae2a9cf33813d09ef24e25c2280b10420ba26
MD5 558e17fbcfe401bd8322745e63f636e6
SHA1 e83a68cbf0d4a9f446a099b4f184a88d51d6656c
SHA512 61392f3fd3f3e763e162b1bb98cc62f08220f74ad191f6f29e224cea863a37147bea9ab581efeb65b6392eed0b58332e494b9da58bdd5c816a4b671d09b308ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOYa:A3mnXoZjzyaT4aewsAjxTcgGOYa
TLSH
T12B15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 925KB
SHA256 92ce462f50fdae301ddee1b7aacdab3616dc3554229b74a8780cb08ccad7489f
MD5 b2d1490eab293fe3cecb561d1dc6d2a0
SHA1 7324d305191d59f071d34862f80cf7d98a738fb5
SHA512 1f42f7b520752dbba84f5f2cece0017560b4481de08024f5b8518836a4f143165164a32453ef44abd35d8a051d184dc9d9383d3a3e236776b129c2548b6e8308
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOx6:A3mnXoZjzyaT4aewsAjxTcgGOx6
TLSH
T14E15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 925KB
SHA256 b43455ca05c49682b4fc45d93a6dc2834374638877b1a4eb138dd4eb375730b4
MD5 e1d40826aa110c8effa3151cedb8b793
SHA1 4bc94149f4c1b597c5085baf437809811eb9ad86
SHA512 29fe4e52e73dfbf78b6408dcc38a6ab03f84c5ae9025ea51618b7df151ad5168240a8d59b08a6f7087e9df3534b61a1f9ef2207ca26acffdea4c773a3e5691f5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOvN:A3mnXoZjzyaT4aewsAjxTcgGOvN
TLSH
T18A15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 925KB
SHA256 3e194a592ad547b95e3c25f879c37ba5cfad431b90969c418104f1831ceb18e6
MD5 2ca9437493ce460d798c360fefba0a02
SHA1 dec6f7eeb107036031d13400c4c6975db2c3b31d
SHA512 a6057cd4322e77ce922b5e5e7e679eef6a6c1eb0bde4e5793561176064a4420bc24a60e069d3b792cea79404a19c9ce718f0bd5355bad3889343667c9c07f7d5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOVf:A3mnXoZjzyaT4aewsAjxTcgGOVf
TLSH
T11015B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 925KB
SHA256 2a1f1d39ea218ee7586b26ce3e6d1f3808ab46ed26c2114669b2d05e32e44555
MD5 3475021d85684c43a4b3cf1bdc3f41c2
SHA1 f8927e3954b89c403fb885d2760abf015b92b160
SHA512 322b686a134f710a4050ce90256415a83ef18b0884d52585c186b33e7143dde682f52cf2aa67bbde9f808402ea502a4fb7bd19d574b2f8a9a46d2982818351c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOXo:A3mnXoZjzyaT4aewsAjxTcgGOXo
TLSH
T12415B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 925KB
SHA256 383b1ae158145bfe3fa80b57ad4b0d53d7547b2377d4a05b49a8b5e3f3890f31
MD5 c6c290a2eab71066878831a13fe0cf92
SHA1 1e04c75aa9362f0c97ca9882cdb0dac3260b90fc
SHA512 5464bdc3cbd2a5931de75ddd73c32cf3e67207deea90f9c598d4bd530f3f2d6ce3947406d1f94259dd7051da277a6fbd73c490d81b63cfaa0494be5d9bec681c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGObu:A3mnXoZjzyaT4aewsAjxTcgGObu
TLSH
T17315B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 925KB
SHA256 4d0697f3ff09c87981ba093b22db4c51c6273eba2f936e67b5ef4c778330eece
MD5 f9a23f53e1e8d081927b7ae75b8530ab
SHA1 b656a9bb6418231cc78915c4c13f3873071e4d49
SHA512 4d008754a75ba96b4d31ce157ca508ec91b7fcbe58b1171ea644c8f56631becbc5ac5da5dbd5646adf64594e7b2c2feacb6fb810025176ff356d30acb8b54c98
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOJ9:A3mnXoZjzyaT4aewsAjxTcgGOJ9
TLSH
T12515B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 925KB
SHA256 b8b6de6352950b267bce2a6d9da016cd0bfb62a1ba11de73e97b8e720a6ec85b
MD5 46d055f6a06790ae3c964a8b808e03f0
SHA1 90365b033b5a72872181c6ff5f91ca3892265606
SHA512 504cb8661a53f32731cd4fa245fb83df2e7c9b6b582e23feec37c4f6b50b5a26a93530c37797f65f24e79a169a3e1cf94b49a19d89f4a98ec98cfcdfc6401046
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOlc:A3mnXoZjzyaT4aewsAjxTcgGOlc
TLSH
T1B715B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 925KB
SHA256 882948413efde5399f68423952a7f357d07277c5c609b53911f93bdceb8dd8fd
MD5 10fc2b91c370691aaa94412303e77426
SHA1 992df8423fcb186af087e23f5d173854aef5ae14
SHA512 977ca2c5b7d53ebe8d96ca930d0aa4281b60a0518e8634971ae48bbd800be572dab6e712e16f0b0364059986065965d02e5d483756bd2b18968349e1e3641bc0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOep:A3mnXoZjzyaT4aewsAjxTcgGOep
TLSH
T1F215B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 925KB
SHA256 d529aa999f6d24468020fc472ede3410f8abeffa25e7a508abd8df7ef399adc1
MD5 d54e42ebf367ef14960582358efdf34c
SHA1 123b82c7193e2cb96fd92839491bb54f952d2b7a
SHA512 bbe2d47958c280048799ebd46d8aece475eef48c2903f0e3eebb114aebe10817f86d097aeb95246d92de76d5df9ba6da8a9283bbd787fffd6ca9329d5fd80e6e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOR0a:A3mnXoZjzyaT4aewsAjxTcgGORN
TLSH
T13415B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 925KB
SHA256 6f31a7529eb10bf5a369b09981cc3542aec8c260b6bda3c475bc890d41d073be
MD5 42a4e9e646123efe6f1c784f0ed525ca
SHA1 f4204da6e8a17a4068df75480cc57ecf6d6a3482
SHA512 d718dde532d5d0280f05dcaaefdddaf4f967a1c6b927cdda3fe3dd155d8be6db0ec9510dba447d3a3a1a420880cc050ba7f07e09d29c605919f975f9bfd2d4a1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOzF:A3mnXoZjzyaT4aewsAjxTcgGOzF
TLSH
T19615B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 925KB
SHA256 777daf3e165642badc82a5511d2edb9024e7cb2e313803542b234a72c82e8d0c
MD5 a0ee5c70793fcf18b02584f36144ca8e
SHA1 3909ba3995fe610dfcf2a7fcede71919a21572ab
SHA512 1a993a81b0a2ab4848802eb9f164c133c83503bd711500c510ec17032665c97bfb37a85f78058fc279343ba6e37c736587184c3e462f4dad8f1028face4f7196
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOcC:A3mnXoZjzyaT4aewsAjxTcgGOcC
TLSH
T1F415B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 925KB
SHA256 ccd4603669eba0835754d18e3eb1d937dee7243900dbb2eca9e557aaecf8d7a6
MD5 97f0e2f8600d4a12552fa2e188a3ecbc
SHA1 08beb5c9a64c89895d8ea3cedf0da5c1bb076f3f
SHA512 5c46d4dba476f79057c389cebe55e542da7e17f4dc3428bd4503e66adbfdf28f4a10fce8fd9af2d6e00de5650f47dc15222be1e1ff87ddd89b9f8d329ee4faa0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGO3w:A3mnXoZjzyaT4aewsAjxTcgGO3w
TLSH
T17E15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 925KB
SHA256 9d1d4c535ad0343ff9537627a78c841a4a76a5dedaa10978c8bcb172dc50ddb0
MD5 6786181b1b444083e1c09285d9b289a9
SHA1 ee55d124363e484c13ee27203e2b05d2cfe337f0
SHA512 782e0768a40169d21e0a493c6d48460d0a66be51e83877b3dfb53b8336453d744cdabb8f365d40e14fe4bed3922e4e93f2ddbf3b32e3b7560963fba308eefe07
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOmT:A3mnXoZjzyaT4aewsAjxTcgGOmT
TLSH
T19B15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 925KB
SHA256 9250e9cda53f31505fed63a32696a2b1d06e5796f039fc14269d6ff047044c1e
MD5 2cd0034fafb6d11feb1dd9ce29848cc3
SHA1 11b1c668e9aec1d8f1a73bbbed8c9e682a8de02a
SHA512 06a9a231f5de55617157decc1ecdb6ccb3b869eac95df7e3f79a15143fb44b8b67dad0a042370a5859afab2ccf1fc24d3a3753ddc6ea08d963474addf093de37
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOeu:A3mnXoZjzyaT4aewsAjxTcgGOeu
TLSH
T1EE15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 925KB
SHA256 3df1cdc3afccd0b60fa564e60cc093b91bbe2511bd24f4701d3f087ece784883
MD5 f0baf2666e3b37fd77349875281402c1
SHA1 2083eaf91285459454fa53a3501d576e6b62644f
SHA512 87a56f3f1594b1addb9d2be033dd01110eb1c74bc0915da300b3c39450268ccd36ceeb1a725ee6b1d7ef29c3aa6e80224150f4a544f710a632b64a2e27491dab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOYb:A3mnXoZjzyaT4aewsAjxTcgGOYb
TLSH
T1C215B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 925KB
SHA256 2cf79e5444a4f6e4496bbd8fc9f683a9a20b421321215c488ae19658348cdd2a
MD5 5d32acccac5200efc8c7caef23a8f3f5
SHA1 64dadd35183a816cf1ac3ea9ddef71a553538f87
SHA512 f38cbe8c104bde1a05b54bf80f9b18ac23ba3b0418294c5f3612e3c6560f42a2205c7d8bce26fbdc13d164ce674ca2f4d04eb24ffce64a573e07dbe20109b866
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOGf:A3mnXoZjzyaT4aewsAjxTcgGOGf
TLSH
T16C15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 925KB
SHA256 44ac91acf8906038780644e0b7f49df9d366ee03223accef03daeb6f5627f7aa
MD5 213a8168b5b44619a767cb66cd2abef9
SHA1 555d1ce81e5dde3fedcc7f0c901d9437ae455692
SHA512 58ab88d1173854cc5ce20c3a3913400a039c7ace4d647bc1bc3b17f9a7db8e4908ae0008b44f6b9da763565e6663c3279d154d776a064a587813dfab9bbc171e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGODK:A3mnXoZjzyaT4aewsAjxTcgGODK
TLSH
T18C15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 925KB
SHA256 717f7836b4d2db2e6c81bc3e897db40e08917523830b523cc8c0215496858a50
MD5 b1202a8faa542a5e7ec3fb75e6b092ce
SHA1 958ee1322578cca07407a820efea4a057329cf58
SHA512 1b60775c0e25b605066e2df704dde2bbb3d847419758a7a4241d0e1d0e28b5160bf45fe7bbf51f8e3c7e53f81a6b76e5d056259ab1cf0cd5ee4b9c493faa7aab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOkk:A3mnXoZjzyaT4aewsAjxTcgGOkk
TLSH
T1FA15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 925KB
SHA256 392e0672bb93387466378be7062db447a561c8dacd069d66ce06ae2f571c8f15
MD5 722dfc8024c4e606c5766ddf8fbe664e
SHA1 e7dd5cf1b06d2c6da852f7d8ad8684af6b55b102
SHA512 cd31cb0c0e1383e85b060bf8f426e64b56317f3247828d553470608a832e45362ff3f3ffc09980ac1b1cb3f7e0a4775bf77cf12c3743a8efbe28908b3672957c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOt0:A3mnXoZjzyaT4aewsAjxTcgGOt0
TLSH
T1AF15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 925KB
SHA256 a57c7cfbee4ac65bdc7df6e74a0a7fd4d9acabe5747bfb77eb4722e2fc1b366c
MD5 65d4e325b839febe0f8dc0751ab44e7f
SHA1 94038be0c48576200b7d67426826beabce7849b9
SHA512 0e186b3859deaf9d999ea8270cd7c6a31e450204b13bbc3c03f03bfd397f0ad72e184e5912db8371aec6e3d6cbc074425d63e71d3064fa4127d18e17ddf505c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOw70:A3mnXoZjzyaT4aewsAjxTcgGOwg
TLSH
T13D15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 925KB
SHA256 c734d36795ba489db7c95303f34a8c2235f798f195a57a018143d6a976f1eb08
MD5 f988e417cc1dbf09fbef1e96d4f9c87a
SHA1 06228a13a9bae67772466405757de015c01c5b1c
SHA512 a2e6bf3365e4676867b12679d47647dc118b9c2d29b9a01df86db44617c3591f666f594a506395d0551d47d52fdb9d73f61e9db082c6c52670c883f4a226cb26
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOFr:A3mnXoZjzyaT4aewsAjxTcgGOFr
TLSH
T19D15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 925KB
SHA256 696761868d73eeef9096c3dafaf92a703adda5ede71460da0febf286a71338c7
MD5 2ffa7976e205955400e32bb24531776e
SHA1 61ebb38bb1b7524e9e72173c37b10e819f461ffb
SHA512 621fff45bb7a03eed3d3173ea3e157843537f48e8dbb908ad699dcc321a8e6a215f7bcf323f5d9eeaa1297239484dcb12ec58708cfb2ca9b3848c55ef9cc2ca4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOPn:A3mnXoZjzyaT4aewsAjxTcgGOPn
TLSH
T10B15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 925KB
SHA256 419772ff51c0843e81d0e659cf65bfc8355fe7c74486c18558864741b86cdc53
MD5 e710ce81412432e5c3aa9ebedce00fff
SHA1 af17541637afd2f33dd1d194f7c05fae6bbe49c0
SHA512 1ea6b091bbc5f8eb3d87f7d1968bf3bd4b70e2b0e95dfc0b40e196336851c5b00ce5c5642fd468c758ffb411feb1f6d8cd1009c27652d39941c86d81546e5e57
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGO7x:A3mnXoZjzyaT4aewsAjxTcgGO7x
TLSH
T15415B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 925KB
SHA256 f643b6e6e51948d54b5083bbb02f46cacf4a10e479d0eb14302c83a8ed768b65
MD5 880f9ea6beece2e1ddc670e5ef457442
SHA1 198900ae117a30dce55e3d89744c12a03a4ec4ce
SHA512 af779e65f5e535720631a28f45e9d5c698a6cae8392434c013440762eacb2afc268ffcec1c35d058321a10a493ebe5be4f1793b20142373a268fee6dcd2590b5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOpA:A3mnXoZjzyaT4aewsAjxTcgGOpA
TLSH
T1A315B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 925KB
SHA256 afee484f47f6b870826c8df70602ac1a8c736308ed8abd7b11c176f6428e9be7
MD5 5fa1ffb9b3c4f4632d66c0c221abd359
SHA1 8f67c7b66063f892ff0defdd45d1e2d4cfb4cd30
SHA512 a9cb479b99c4af9ba01511457ade14d7a227433eda88cc6d052cc1ecc3a7ab49fd83c46a8edf2b17cd668077d7aab68e2dd91d17ee4f27284c8199ebeb4bfbf6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOi9Q:A3mnXoZjzyaT4aewsAjxTcgGOi9Q
TLSH
T1CC15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 925KB
SHA256 a3216e69a7771590e4beab7130dd183722a51df8e9e35c4dc02bdacb32eb41f9
MD5 7cd8c33fee5997a7f9a77637ce28e9e1
SHA1 af4f7a552deddad4ebef7e1bcf2a87b2338b360b
SHA512 6f576bb43e84c5aa614affe069199d045ac4018062b832c596bc80ee83f2173083702ec995b21d6f3d24fc56468bf6cdd1e5d51593178070ea8764b89532ca65
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOH4:A3mnXoZjzyaT4aewsAjxTcgGOH4
TLSH
T1CE15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 925KB
SHA256 5b3659fe3fc1e45f01fc085d269e40e414520bb32238219263289f4776201c88
MD5 6762f08c6e81c42cba2a0a735c3d6408
SHA1 c76e8aefd3a3162bacd90bb493148400fcd531cf
SHA512 c72fd12df70fd921f90ef7f1f5e6ab246aab2d70783b4d649c19ded6839ebaa48d5bb9680649b5167a598e8d1782977cfde9c047cc179fe0bf7cde660caf4191
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOmu:A3mnXoZjzyaT4aewsAjxTcgGOmu
TLSH
T14615B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 925KB
SHA256 ddfe840334d3bd7473bc857e703ef2d91cc225f150e58ad5c9e24f0d559a2b06
MD5 303ad1c452f2e09c2e6c6edb8048dd76
SHA1 f08e037e280f1250549c959b040ab152ea9dc0b7
SHA512 bb81f8235815ce6fe2a4eece8315658e20d542240c4679403743c2f71d07d3f4a1688f599f0de6ab20e7bacaa4359047b2ba74925f5e0271c392eb9fc6988b25
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOXj:A3mnXoZjzyaT4aewsAjxTcgGOXj
TLSH
T1C115B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 925KB
SHA256 6d531ba0e8e39bada28ca6fef4049a7ff92dd59ae3e98b7b3d81dfee65a88d59
MD5 4c70616bd58cc4b80158a5a20f09b525
SHA1 27773a310753a46d7ee869216fdcc14accb41364
SHA512 34c1886678a0bf4946d17b4c5c104f22b682f4516f4c6d6bc3732f303cb72d4b8a33c52cc398ba4fa8ec6811e0b32f05713ea4018ed3c8afc28aad9c54dffb68
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOCg:A3mnXoZjzyaT4aewsAjxTcgGOCg
TLSH
T1C015B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 925KB
SHA256 c79511ac2e20a7f9a66e6b8436c634246bc1a2b16c5640d22bf8c09284b39dbf
MD5 9fbccb05815fae8d98c4ebc4ca6e4ffd
SHA1 85a301ba5effc1e4e551112a7f7c5b469554f1ce
SHA512 33e00a644a306f9774ee363903d084c065bbfe235e9706aad42a998b80c6a29ee1afe771582d85b4b13ec5f2bb8f165bb5f846ef573a6c29afa193f266cb5ff4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGO9I:A3mnXoZjzyaT4aewsAjxTcgGO9I
TLSH
T19515B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 925KB
SHA256 c00496e66d139efcdc1808f52546e0d39dd7fb1359241c7d62e415790d21d1d5
MD5 960fcee39a9abaf3cea1fd1101824964
SHA1 2e45b2b81d1da083deeab383fe788618360ca961
SHA512 680687c1100b499e272b35ea3c7974f50b0735cf04a7d9dbcfb4d171c7efac8336936c1ecca489ea7b3f07e5b3bb1ab8ff76130a60057bba182a44b651b94c0e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOvo:A3mnXoZjzyaT4aewsAjxTcgGOvo
TLSH
T16D15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 925KB
SHA256 ad92c6a4a83293bf16e7628338cf9734952e334d833bd0c4a6cd69e084424c4b
MD5 b195b6caa491b6c768a62d16c618e266
SHA1 bb1f0d30320bcf6fdf91c200af5d482db43cfd3d
SHA512 afad60cb9788f51df4404d1664303e51cc63cf9631ae4f2373cdd2c85cd7d7754ccc86167d17cd0e07045bfeb1cb64aa5c685e06bd8f1a27467d9b8ab4ded681
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGO0+:A3mnXoZjzyaT4aewsAjxTcgGO0+
TLSH
T17015B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 925KB
SHA256 f247711cb20d3a20c8a6318a2cbcf40ddd06435d444517c0a6e29232a24919ff
MD5 f94df7c5b85e54453a878bf61721305a
SHA1 b7cbbd91e5c4fa20365894d4328390cd8459f13b
SHA512 34eb12a7d13544067e0e5bd133cb919303d928331d5711a42973d9f0e1b5f59777e52db2dff8d6b1d7a85f69fd6e16da08c31f29cb31a867b72562c93f4a16b9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGO8Q:A3mnXoZjzyaT4aewsAjxTcgGO8Q
TLSH
T19115B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 925KB
SHA256 2642f56e897ec33e92882216f6467a3a66d6dbcb3e9fd4671cd94b86b370e24f
MD5 7808447fdb283827ae24591d799d3008
SHA1 e4c250b2dc5eb7d2b0299f99f20bdbfe7e02888e
SHA512 88de2e07f4d503bae6aeaef0a1472587f83c499eb8486db159ebd81f6262aba6aa1939678448124d570882e94657984b0ac703519fd2db8436522027c5499a12
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOlX:A3mnXoZjzyaT4aewsAjxTcgGOlX
TLSH
T14A15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 925KB
SHA256 060f3fc58a46e164ede7d058d4e0d194fb3ffceb9e4ce342057fcf7b06577d64
MD5 ec669e1d741f144f530a115260229465
SHA1 512f5268e56488b6531e33fd6ac7e01087a4e11b
SHA512 6e05bda19c94b8d6967831d42c37178d9d0804b98afa8c60f32e0447502b81b1d9e1f3a6cd6468d6cde97bf8a87498a06d124ccceca5dae129dd031b726f5ffb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOHL:A3mnXoZjzyaT4aewsAjxTcgGOHL
TLSH
T16115B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 925KB
SHA256 1ad559222cf2385546eadaba3e18f318d3af58b48d00131780e9768aa29a0cf4
MD5 5f7a8676b660cb90dfe78f630e866f29
SHA1 17f126f067168b486a93263d323162da2279e31b
SHA512 14b1ed66cfd852bc87bbf1fd6562a432c8d81c8e543279657647fb3ff7104bccf5cf9f9c45fc4727705d46807e973186f66fd91989736f525d91a9bb7420094e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGO9FC:A3mnXoZjzyaT4aewsAjxTcgGO9M
TLSH
T14915B023FB7090B5D23B49705BA58712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 925KB
SHA256 105c668b4a5a1ef2818d4104c547ec4a8f4405c993c825b0c0e251215b12c813
MD5 8b7132a6d76250936e716c61519d68ea
SHA1 2646074c97332029886a01aef7db1abcf5bc7717
SHA512 f919f85e335973bee2cc5985148d96bcd7ac816cd7ab2c66b2603d4c2e2c7271f2ba0f66ad89d10e9a063614534190bd4b7abf2da5f239fba0efd6b6704b6976
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGOuh:A3mnXoZjzyaT4aewsAjxTcgGOuh
TLSH
T1E115B023FB7090B5D23B49705BA58712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfsvc.exe

Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
Size 906KB
SHA256 162e122e1dd54f7bf5097e2cb9cae77bedf1983ae395a34c7e82833b7871e3ff
MD5 02e1f6f60ae0c0992eab54205048a17e
SHA1 8f5b2660f1be97e6186335c9eab45e9783212158
SHA512 d614c20041d3b0bd361a782d857a76d1ea0374216c0e88ca242bb70c42b9ba90d12d48a4f3fb83deabba313f729e795b0fc227cec94a6147b26f48631fdc15e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGON+l:A3mnXoZjzyaT4aewsAjxTcgGON+l
TLSH
T1BF15B023FBB090B5C23B49705B65C712EB787D210B6056CBE3A886592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4036-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5312-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5312-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads