Analysis
- max time kernel
123s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:17
Behavioral task
behavioral1
Sample
2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 969KB
- Sample260809-ww622abp2s
- SHA256 7f25b5d8076d35ee0464fc31d66b32136cf6f9c697385c9e79c127e199d47dda
- MD5 b4fd7314f51db5a2438f31adbaf7efce
- SHA1 e5394f12407b32ac1b37050506d437b1a6de9370
- SHA512 0188bcd9de454fbf5edb45c1abd325f5386d728093c16d6a56b30c5d3a8a5b4acea66cdff56f068a7fc8925bc857cfcbb8273f3074de40d812d785236c3ce3f7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpm63bgN:A3mnXoZjzyaEFoHaewsAjYaEpm63bgN
- TLSH T13725B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2820-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c46a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2820-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/796-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb2b-242.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-454.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998a-560.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a52-1463.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c46a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000300000001bb2b-242.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-244.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-364.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-454.dat aspack_v212_v242 behavioral2/files/0x000300000001998a-560.dat aspack_v212_v242 behavioral2/files/0x0006000000018a52-1463.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 796 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2820 2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 796 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b4fd7314f51db5a2438f31adbaf7efce_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2820
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:796
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 969KB
- SHA256 7f25b5d8076d35ee0464fc31d66b32136cf6f9c697385c9e79c127e199d47dda
- MD5 b4fd7314f51db5a2438f31adbaf7efce
- SHA1 e5394f12407b32ac1b37050506d437b1a6de9370
- SHA512 0188bcd9de454fbf5edb45c1abd325f5386d728093c16d6a56b30c5d3a8a5b4acea66cdff56f068a7fc8925bc857cfcbb8273f3074de40d812d785236c3ce3f7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpm63bgN:A3mnXoZjzyaEFoHaewsAjYaEpm63bgN
- TLSH T13725B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- Size 1.1MB
- SHA256 09bfc1d01bdf54d9c33f87a99226b80d8f031f8446ab28b67503495a38506ccd
- MD5 d05fbdf248cf3d4b88c244422a67f2cc
- SHA1 95c648d29d5ce48423e5f84d76da3f838357e324
- SHA512 c0d58278c7fbffedcb52e3520ed1681c209038d860944ceaa5042d7e8eba42b0321477059e02f37e74c0146e9e575e0d90db6dfe1162847a4fbec3632431d194
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm63bgWqU:A3kM8ljA
- TLSH T11D35CF23FBB090B5D26B05712BB99712EB79BC310B6055CBF36886591F313C06B3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 9c0c6d74640a7cb890c2a4548578a518a194fd9f223e50ed3f99c36440f6d917
- MD5 e26d55020240476ee50c34a15c645ace
- SHA1 f84cf2d130dfa5f14caf71a374182e210da5af2b
- SHA512 b3c8ab81ebe7efc2b4ca9783c4fd7af5b108dd8cbdfe33aef303e1e7b84db2c51306db1f7002e723be1e401ebecd0c72988ccd8db1fc94de182e9842b5720ac3
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm63bgZ0Le5ji0hmxNrM:A3kM8ljHPji0Aj
- TLSH T124758E22FA748275D077C475CAE2975AEA7138510B308ACB9398C76C2F637D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 993KB
- SHA256 a58cfb229892bf3b2fedb18d3d707897cc3f8f42f679b509747b1e39f9f9b123
- MD5 72e66eff9ac912fe865fb393fc8bc68f
- SHA1 3aa77eb30f826fdea4459e1e57334575395b9920
- SHA512 f79902f5a22b8f823912f62782d5a3dce73d055973bb36e6c25d937ad0bd2e033a1b07ff9f58966771ed52e0a210d25174b8b4737a834f042a9f9e2476d5abf9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpm63bgmu:A3mnXoZjzyaEFoHaewsAjYaEpm63bgmu
- TLSH T19525C023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe$
- Size 993KB
- SHA256 1ca758a43f0b57914fb2cdd5617dd75c8f110eb4f752e52e4ce35b5bb92d15d4
- MD5 d74e062e6084103076cc4a2b8f1cb1b6
- SHA1 6081221fae11d0aafffade6472d3f40ad58a612c
- SHA512 da7e990c941815a79062d6e3f3874645419baa1be6e78514175ada5b29e535f4677f7d87f27d50d59e8d6be384928a56435062c1a82460268c85a0a9da337b0a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpm63bgyo:A3mnXoZjzyaEFoHaewsAjYaEpm63bgyo
- TLSH T17125C023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 993KB
- SHA256 77b9f23b572c02f6982bf4c7f5704ba5eb90b6b277437d37651fd3b22127c669
- MD5 596b750b67e18cedf8865a7b3f574f7a
- SHA1 5ef79fc44230112074edb85061955c14f0498aa0
- SHA512 5e2edf33ade3e378662adc4f3f4317b9ad9c58fafe772583355adbfff96c12c953fef5d3cd7a5ce72cc7c4e1483f705207e02bc07f280170d0518a4619a88877
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpm63bgR70:A3mnXoZjzyaEFoHaewsAjYaEpm63bgRg
- TLSH T1A825C023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 993KB
- SHA256 547f748819f3b4d514863364477d74761c438f9ab80c2b6578ea89de9186f937
- MD5 f21e86dbd3ef42a27407cf57b7815a4f
- SHA1 302af3341cdf176c675be190fdb5427615d3623d
- SHA512 cd4f1180ecf02a84bc288200db9ac466b98ebe19e232573a0a9fb0f5beacd729117c5365947e76939e07e37e608f1d1174f0ed724011378d55d406dd6b34600d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpm63bgcX:A3mnXoZjzyaEFoHaewsAjYaEpm63bgcX
- TLSH T17625C023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 993KB
- SHA256 56a020612ace503c0f86d3999a4615c2083e5a2efee1f09a4ddd555138df9ec6
- MD5 635e500204e238c421eafe08eafac5ab
- SHA1 eee258fdc598bead31fe57e41636540c8292a4ba
- SHA512 7c8b84f6028018a1c83c4031f5cf3d18215a83401278e36f231b115ae7209755225033fd41d52dfd005ccada955777b003c817e0bdc299f5791de34225503c62
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpm63bgKW:A3mnXoZjzyaEFoHaewsAjYaEpm63bgKW
- TLSH T1CC25C023EBB090B5D23B49705BA58713EB787C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH