80906bc03f1e8e74d47f43a7e5966645eadbdfa398d01c116fdf201224ac383c

Analysis

max time kernel
97s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 854KB
Sample260819-qqatraxtdt
SHA256 80906bc03f1e8e74d47f43a7e5966645eadbdfa398d01c116fdf201224ac383c
MD5 5b995e96b15c7deb391e2a241cf88232
SHA1 aaefaaf3974be99e02a58a41446664608913a670
SHA512 49e4a29a4e6c11a999af4057fce01819ae695d9d7832d1dbe0b21ac06a16263037c8c51ff6a29e9a265f8799408965011ef2d6e7079ec0c41a253b05d35757be
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pM:A3mnXoZjzyaT4aewsAjlq7pM
TLSH
T10B15BF23FB7090B5C27B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5092-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c68d-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-45.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5092-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5748-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-556.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1074.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c68d-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-45.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-228.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-556.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1074.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1142.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1387.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5748	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5092	2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
5748	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_5b995e96b15c7deb391e2a241cf88232_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5092

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 854KB
SHA256 80906bc03f1e8e74d47f43a7e5966645eadbdfa398d01c116fdf201224ac383c
MD5 5b995e96b15c7deb391e2a241cf88232
SHA1 aaefaaf3974be99e02a58a41446664608913a670
SHA512 49e4a29a4e6c11a999af4057fce01819ae695d9d7832d1dbe0b21ac06a16263037c8c51ff6a29e9a265f8799408965011ef2d6e7079ec0c41a253b05d35757be
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pM:A3mnXoZjzyaT4aewsAjlq7pM
TLSH
T10B15BF23FB7090B5C27B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 08c9c1aaa6fc721de546645a42723e749cd05529329adb6c6c8d2bed6459f116
MD5 44a49e152ac5e2ca6827b7038a4d15fc
SHA1 b4147b0cb8e7b613acde3db6227b02ed0e8c6376
SHA512 6c701f610a9012377af7a6e492de501fe3b1c13c010bd23a227ca0d9f23a971061b5a090a8309e382db7923543696f07750c77ba01d70c4b0b450d6aeaab97f6
SSDEEP 24576:A3mnXoZjzyaT4aewsAjlq7pU0Le5ji0hmxNrM:A3kMPljbPji0Aj
TLSH
T1E3658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 86b76f3f04e5c04143d536e399e1783f3668718a893b6bfad87ff1081fb63f5f
MD5 514ddf254a0b85a6864ed43f7c00488e
SHA1 21e20fb58947151ae962407d6dfb0e53b5476f9d
SHA512 df076ee53da5d3c35b049df61fad676c2b34b9de6af94effea916fe43d67de5885d73330326d3d73c3c2c2f360de7eba9e0d2d7a2e539945b7b4a4ef349038c6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pea:A3mnXoZjzyaT4aewsAjlq7pea
TLSH
T11115BF23FB7090B5C27B49715B65C712EB387C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 878KB
SHA256 ccfdefe43210ddd8d7b0e38ba0678a9f243271d6c688276be023295ff916653f
MD5 fd61a4ac26633b06232daa58c423b50c
SHA1 93f83cf59d440bce8852617639ab1cb5e34d2d84
SHA512 6442e46ebf52b91d48c43ae08775ac94269e6299a047a05d6bc2df396cb05b7563c00ce48731769e76038cd33f0c975dd2dae46760dffb3d5eb6baa57c6d5481
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pf6:A3mnXoZjzyaT4aewsAjlq7pf6
TLSH
T11715B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 878KB
SHA256 6275886d10e09be7c0fdcc3a7d717a1be5f2d13c2d1fb09ae7e51f044dea8b98
MD5 a58667d9ebde8a0311e5128b8fffed1f
SHA1 a634e00752b0704a0b36e540f34ee25fee005910
SHA512 fb976271929dbf6b44c17a379fcf35b112536c8275b9bdc734d31a122e600394a9f174ff6f04654c04216e947efc984c180306d0fea1ecdc7d82596c105d572a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pBN:A3mnXoZjzyaT4aewsAjlq7pBN
TLSH
T19015B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 878KB
SHA256 fcf6f7dc8cafcd8291bf56d723400c01a9c7043f9981c4c38886bca9faf2c702
MD5 3198fc1b2fa496248caa93180f44d6a1
SHA1 b37376cbf3c2241112e484226c09d52d12f7cef6
SHA512 eca4db6d55b7e3b085fda2881f49bfd897ea9ddf6f6b27ae2a523c61ba311ce25f1978e0f7c53a3217ccfa311b0ffaa0c62b50eee679249bfefa006bcbb93799
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7p3f:A3mnXoZjzyaT4aewsAjlq7p3f
TLSH
T17115B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 878KB
SHA256 492e136de0629775ccd25b204474631c6c3344435fb09190784e597689ed3a53
MD5 f8b128e1f5eb1f91d14cfc5e64db567d
SHA1 af7a978c1824fe1cf915947292627f25c658ef40
SHA512 502a85e7060e26fc1ecf8c8857151337e40e8ef27b9259e1cf3eaaef2c1ac3b2df1a120c15d2888e582ba9d74a611f560e1096c844112206d46dc73294ed414b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7p5o:A3mnXoZjzyaT4aewsAjlq7p5o
TLSH
T15715B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 878KB
SHA256 053c65832de6c0a7d6e686d0f8b2535e954e075d46ec3cc8dee4954bf811ed23
MD5 39511c8f8e48ad85ad781446e8f48453
SHA1 b56ec8b3d1289250ea36c4b225755a2efc35f473
SHA512 f842334f0d60c27ad8ea0239076d6b3659b28dff8f29a8aa5366f1c6ba74f2ee0bfbe9a25ef1a4b0eb8e5f9bac0a1cd73a458787b9f771f03fe30d71171cc4f5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7ppu:A3mnXoZjzyaT4aewsAjlq7ppu
TLSH
T1EF15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 878KB
SHA256 0b5a676af299e8ae531f96b10e0d1455e9376cfad8b810f6ae0f367b9aaff1bc
MD5 17a35e277bd6ea3b2d58dc1977910449
SHA1 34e6935e4edd94a98128e46209afe5f42e1a2d75
SHA512 0ae5cd33f756d014806af23448af52283ff8c249f0b6ac131a967f15247caa59691b6e783a5b116470e579bf6828cd78fbf4f83c06b47c571a9299911ac64ce7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pP9:A3mnXoZjzyaT4aewsAjlq7pP9
TLSH
T1A715B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 878KB
SHA256 dda8006ffa85f810980b4190ceb2fe027cb04e868d0514bb137d5a807f08ea51
MD5 0689db1e1b3ad8dc5141b3ad9b52587f
SHA1 8b5b51c90fcb954ed30d08f673aa629b22ab5839
SHA512 98c1773c08a9b225514ce0abd55682242868572b5773fe02ca9498fc32bc5996e957421c6dc9e0a2949187b3eb2a691a60aed5db68617cbd1266cbb76e4adf4d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7prc:A3mnXoZjzyaT4aewsAjlq7prc
TLSH
T1A815B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 878KB
SHA256 6dfcbad64ab68c2c82612c8a49386e36845b892bae89db52ad84a7dfbc23f94b
MD5 144f31eb6d2798adc0642440905dbbff
SHA1 0141f027acc58c5b2a075273ef9d003d4db900eb
SHA512 0daa0921a8b6f450cfab0b931ffe10ace6a0a0a8bb626c990b3061bbb4bd59732be63ef3220d8bad6d341ad0c380e5553e79654c0d4d76d4723c3254c8d0109d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pUp:A3mnXoZjzyaT4aewsAjlq7pUp
TLSH
T16B15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 878KB
SHA256 f2567149232615a3ff1456e5cd244e11cf0d292ee1e8000ce06b882b5bd3dbd2
MD5 ffc51c762d992313aeff9a27c70989f0
SHA1 77928f98cabb2b7d18e3ff6887f097a1983b8d36
SHA512 0bbc752f82dbceac32bbd29aa1802b6afce84e2971edb28152252551f295aec36987edae8b885bd68bc8c72e8234c7423e046171bffb388e2418a00500d7d3f3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pb0a:A3mnXoZjzyaT4aewsAjlq7pbN
TLSH
T1AB15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 878KB
SHA256 ef89f37ac87312903a2280b2a1a5960e36f27ba8d7dde5ff9dc9d17197a80b8c
MD5 48c16872b368ec20c7e2d8464600f731
SHA1 f9d4795678a8b941cdb34105af228abd8f776ca8
SHA512 3f33464ce79d8898552d72615798b13ba9637bd590dde0b8a967249951b59fcd4c07436b38b1b0df9da508c298c4b5f45f055a1e5dc71283774a8a3210e26d09
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7ppF:A3mnXoZjzyaT4aewsAjlq7ppF
TLSH
T10B15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 878KB
SHA256 3d330d86cf69b62282ff1ed4aac05ae0ac7e1ad6c85519421685e2abbfa8a507
MD5 51f35035144e6975004974a988129099
SHA1 2ce3e1a256e89e96d68d39900bfc37df6eda9c21
SHA512 1515a4c75a5fc0f5c72cea67b1146a78de82bad5c01c1a1517089702b1551903132ee652a66436e5d5491eb7d643c54ebc4a350ca6639b8fb9a33929a22b1464
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pCC:A3mnXoZjzyaT4aewsAjlq7pCC
TLSH
T18D15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 878KB
SHA256 01274cb2d762c186bd3ec21d256956dcf8a3d103eea93ba32c23ae6631da21bf
MD5 f93ff8d5332ec949f71a86d62e14432c
SHA1 efbf444a936f9520df30ec8be4777f948af4e16c
SHA512 a3882cdc0e1e75eccbd64aaab28c128427c777b9f6efe1ec952bb6fc7c85d5e5eaf7b1af521ff1396573be01a8fb27cfe92c75d5e396686004fe7ab7e090ff67
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pdw:A3mnXoZjzyaT4aewsAjlq7pdw
TLSH
T1C915B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 878KB
SHA256 b9dd12b23422081f07b087fcf95457efd0fe853307e146018a1568473c8c536f
MD5 efabb3c5b2a7387e4ecc6ce8a737df72
SHA1 593404c04e11ace7b9b8c5e32c8581270a4d147f
SHA512 8219914a6e5618f4058d13dd5c286a639782cc9def440cecf13b38f687339e1b7f85f9075c0ffa07ff633714c941bc0b8599eb2af5d1e7497551395912dcafd3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pMT:A3mnXoZjzyaT4aewsAjlq7pMT
TLSH
T16815B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 878KB
SHA256 225a4a4bdade708f2122d71dfce0f3e7538b9b00cd121651cd2058545d0d26b6
MD5 998220facd12feec97d88300a29ccfc0
SHA1 ef4b25fc0a59af1e1acd8d57e10636bea06c00a8
SHA512 42e942c8fb857da520ebc10e7ab9a7beac7451dcb2f27353ee2bb1df180b75f8918d2ecc46a4c0470a096bca1ba009d8a89434584e63e423a50c5de87ef1fe04
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pgu:A3mnXoZjzyaT4aewsAjlq7pgu
TLSH
T1A415B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 878KB
SHA256 e45d14c5432f7b4eee6849ea328a677b9fd780a3dd91ab9108d5794118a40293
MD5 7c2adac16601bebf06b6ac84bb1ac0c0
SHA1 bdccee1305d04a4f894f83933d9b5b997b9cdf1e
SHA512 74541e7027c04b4a0c34acf4e36d7b7c14197e5c3982ae3f517e4f8621c528d19b8d1ada95d46feb2fd6774819815bc53ed2b203c5e373554550bb66dd94649f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7p+b:A3mnXoZjzyaT4aewsAjlq7p+b
TLSH
T15415B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 878KB
SHA256 562fae89ff25ae3b7e94c8600c9fef6547c9b7de53e59d5c3017e14cf0824d7b
MD5 0eab0a406950c5bfb59925ac9b11e894
SHA1 c7dedfdf38d5faee9007d8a09116756ce54d3b01
SHA512 c4469d73a5f375db8c66465f75e8699ca0c1892be6fbbbde1ffdf13ec26bd0197838d3012b004ac4afcb9cb2d0beb1279aa3eb1ccd0c8e01836e016ef9e85aec
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pof:A3mnXoZjzyaT4aewsAjlq7pof
TLSH
T1E415B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 878KB
SHA256 a15bea303fb4256407e06a7d6220ad10e8161cd99bf065c93fa0deab568c54cc
MD5 10ae3135ebacb35aff456cc41041839e
SHA1 cb5ff2c7800636f4d7f552939c62043725ba3286
SHA512 72cf56d813c0ab1c2cebd061e6be30f8ac3ce194f50d36c595e61a4983735d2178bd315537a0600797e0025389e9463ff4adb2c82fdcfda70158d15a2df7e0a4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pFK:A3mnXoZjzyaT4aewsAjlq7pFK
TLSH
T19D15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 878KB
SHA256 2bb7f091fcfa2d1bf5d7b5d0ee2b650c6d3c7533bade97d42d7ca317a91e5d91
MD5 db8c92c7e138b5323c9541fa8177601f
SHA1 8209c5232dac9ea31a1d721515c630ea1944a220
SHA512 5e4f8afe9abb4f9fef4a08c0aed7db7c0f04dbb945c13d808cc1ac9bc105c0c1dcf48819260512bf573715d5b68e78c33ad8fc187c03f15f198e1dc8b4cbe12d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pGk:A3mnXoZjzyaT4aewsAjlq7pGk
TLSH
T1FF15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 878KB
SHA256 f301ba313a1d7457d6539dd8fa9743445d3959d9643fc49f2a7060738ec272e4
MD5 61985152032a1aede8dfe70dcc957087
SHA1 d0bf2b880762ac0892f192f8da1a2bb3c6f71e3a
SHA512 b978e691e3e5f390ad073b30b2a1656d5ecf0839ad2e9b88c7ef3aac43370a473ef6743e299ea57c9e3519400b079b12700daa11599cfddff6f663eace7947ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pD0:A3mnXoZjzyaT4aewsAjlq7pD0
TLSH
T15215B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 878KB
SHA256 6b2a5b2f0c4cd9b703d542715e3078261b4fba35a1ae7ea2a2b11d7dd1458b51
MD5 f73fd9a95caf7f0b7048297ad3a6cfee
SHA1 2e9df2ae270a99954d1e262e9cd4c05a2843eac9
SHA512 f5594404592af726cb3d9410ad6bb614cf251f523a16810f55fb8fefad2fa0c4178aaf39a9816116445c93f3a2a83f57d40f2939df714508b784d8dbaf72d937
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pS70:A3mnXoZjzyaT4aewsAjlq7pSg
TLSH
T1DF15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 878KB
SHA256 4d0d74213f45b070f2e60e36d217936194aaa545d243d294aabbe08d44f83e51
MD5 36055a0a2d672a4fd1bd582a818a612f
SHA1 ca55b043181c6605452b1db612e81a9c691a929c
SHA512 65d1ded2c730cc8ac4067d083f1d5249f781245001ee7f71cc4421a21168b445fe326da28424fa0c55baa64cd7113bd4a1ddb9966fd7a70315ebf2f8d8ef2feb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pzr:A3mnXoZjzyaT4aewsAjlq7pzr
TLSH
T12415B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 878KB
SHA256 9095849831220f95bc5074f630cc1a484d0358a768f9f84f93f3304b3f8edcbd
MD5 19051a0d5e09e77a8159baf2de097378
SHA1 3b1dd93da195e1c71f753881bac6cbb91a0c39ea
SHA512 291ce27b79edc84451825b07afad3161960589e8c38a129831c0101ede903b15ebc4d43e8a71dfe1e274160c9b87eb2a78082077aa8c4bff928b6090c27d83de
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pVn:A3mnXoZjzyaT4aewsAjlq7pVn
TLSH
T14A15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 878KB
SHA256 2248c032cb26d4dc8826bc1f728be3ccfcea144ad7e3fe52327241ab1d58588f
MD5 f9ea4a970aa2fcb4e8de9c0da6cb70c5
SHA1 ed32c34a93c78437361f9decaef82dfd92dfc79f
SHA512 75330114150e731647c112cc0ebdb4a4253e655683eada23232769731b6829c817200fbe364dd0267e317d9fd69aeb87c232a48d91f52f3aa673f45b56d38616
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7phx:A3mnXoZjzyaT4aewsAjlq7phx
TLSH
T1AF15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 878KB
SHA256 4c24e7b2a4caee85045d5726e2c02e3fed9b4406d9e97689f54bc16292e5b999
MD5 c08ec3ab8d47e3ea6f0a4552e3af1675
SHA1 b42704ca27bc36f41b57afabe9ad156134d7ada0
SHA512 435636d524f6c098740c165aa1d6f612755885b7c5911f8f40a2190eeb9b129d93a0aa26dff49e32e6f79d277496b5a578004f44d301298f836a5341b499ddf5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pPA:A3mnXoZjzyaT4aewsAjlq7pPA
TLSH
T1C215B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 878KB
SHA256 9dd862adf2081938d301d63b7a5784db6665a5ca574be212bb6c1d5867c2d2b0
MD5 f02b45ca1925c99885bbdff2e176c106
SHA1 7bc1924c82e83b3471f9d1b9667af1faad2836f7
SHA512 72b8626a5930c859b6f71d72f4f69f39226abac8b90693d570ffc7b63f18fc11835cc7d3fa95def2b537531c4f42c9792570aa81ef55695e537b908c63a0eaea
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pA9Q:A3mnXoZjzyaT4aewsAjlq7pA9Q
TLSH
T1A515B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 878KB
SHA256 862203daf5ca36d85d0bebd5c8c8e47de098b1e84d8857ebfe271d121cdda70b
MD5 372e4a6d859a14f866336188a785c8c5
SHA1 f38be03aa90c66ed1e08ea9a8b6f6953501e21bd
SHA512 622429e6021829dbb41e7cef950c84463f78da0d928ec0db56b2d1f9703cadcc531e667506487b9c99ee6baa5dacc6ed9f6752a4581786b1aaf36ce48c10df6e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pB4:A3mnXoZjzyaT4aewsAjlq7pB4
TLSH
T1BF15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 878KB
SHA256 08155c5f125a756b2fb19be70fa6a99358d96150ffa3e0a0761f45f48428a34c
MD5 f476fab68e1fd96f109220c9e9736ea9
SHA1 c857148d4e110934bbc07e5da5fe65ec9a0cf9fb
SHA512 bb4b1126afa71a6c3ac283245fd8867e19f23ff195cbeaa94e598120eaa94497bcb0782939268adf8deb56807bf9ee07d1e1562a8d62c808a86b43c25cda4d85
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pku:A3mnXoZjzyaT4aewsAjlq7pku
TLSH
T12D15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 878KB
SHA256 07fe523fde61b7a98fc386dab555ff1365c450305b4973c11e822f23495348b1
MD5 2984e1dfa6dbf9dc320a4ce6d256b542
SHA1 1ecb0cc3e47b57fd3ec2cd8c1d765da6c878884d
SHA512 6f4fd4a20080e38b61c7ce446a11578640d21e383673a0a11edd6831c802c597e41d0f42b1bb768c25838a7d60dad64411d67d9ebcbc8dc33fd7392a105e6bba
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pVj:A3mnXoZjzyaT4aewsAjlq7pVj
TLSH
T18D15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 878KB
SHA256 71caea62e98950a09c0e57bae7503d3a7a2c5bda092cd1d718b7cf8d48c47a4d
MD5 9bd4de265950b9faa1ff9dfa6dff7344
SHA1 4cb5ec2ff530362a05ab9a87ce16afb32cca7ef7
SHA512 e68c7e58148ec35e02ce6be4f260e576cd3e945af0e63e0c14057044d499dbf045d87b75275147b89abe6018133f59faec993c47cfcd98fde3cc7c53e6e82765
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7p8g:A3mnXoZjzyaT4aewsAjlq7p8g
TLSH
T1C715B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 878KB
SHA256 825f1ab45c6002472a644150c5747bc698bfe9b71ad1cdc2a071f1b5eff503ed
MD5 1524cecc35b86a68231bc167bc97d25e
SHA1 3a77a7ad9acbf40692d3db62eefea15625e86a3a
SHA512 d9d9a0d5f78e9a580ff72d7906d7b2273874bf518180913d786557d74d8ead89b2399be903ad2f72681e952cc50cae1c599de1a80336da6bfbb71056b0829c3d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pjI:A3mnXoZjzyaT4aewsAjlq7pjI
TLSH
T19915B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 878KB
SHA256 969fa3e296756cdeee4afbe02c92240a72d0203632c87f15425494896fe91f33
MD5 3f2283092c788ebec9a5b1da38a162f5
SHA1 253e176899ef9edc4e4c8db1ed39a139baca62de
SHA512 3ebcb5c64f4ab95484e5f55d2c4a341f8fd807a2c9c28b3cd85fcc5e2baf226b5ab62d806dbbc07f26c4db61250344a818176be65a82bfe4d2f712c0419ae73b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7p5o:A3mnXoZjzyaT4aewsAjlq7p5o
TLSH
T1CF15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 878KB
SHA256 47793d1e668c9c20ac2d03ccb021e97a675d2541a2cec720a010086ffe615d79
MD5 ff7a9783d8ba8e7d0d0ffdcb3bc25eac
SHA1 05c34f59b9a46f68d0d528e21b2d9bb89d8cfb33
SHA512 65f8c4a57a70d69eaa981c8edb5e06d925b8f8c370cbefede039e4b65185b79368e8fb178775f87687a651edf929afe3f067257d190e552f876f3012a904597d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pq+:A3mnXoZjzyaT4aewsAjlq7pq+
TLSH
T1E815B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 878KB
SHA256 ee2191b91911dfc9eeb318d01c1ffa2443fa438666cabb369b38cea14c0a81ff
MD5 4557d763dad7af9cf5a7e3bcc74746cf
SHA1 ac4e319e6db079f5c991a2b24fcb1b78893d41d1
SHA512 bc0ec0cc4ce774dc839751219e648b8b27db1f407f09a4bdc1649c918ab7e23a4b894864b7ec20e18a9b77069baa2de880df2891ba62cf90ba99ec112369a82b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pqQ:A3mnXoZjzyaT4aewsAjlq7pqQ
TLSH
T13915B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 878KB
SHA256 4d40fb44b3f339058925cbbbfb74d2c4f9ba0b366c632c2594a78d12570752f5
MD5 f478ad0072b35fef397f37f0b6e9c7c8
SHA1 220b4f6f0b902204a9111e14280cf4d45ea27b3c
SHA512 1efb0048e86fcffab460907ed841d604adbd26df40cdb1fc6d7fb2682f9b9a1075839ace40a98c9270c427746dd947c3c077d93d3d5e431c7cf177032ae3a0f5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7p7X:A3mnXoZjzyaT4aewsAjlq7p7X
TLSH
T1E815B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 878KB
SHA256 748115628326c69807b560d6c11197e87600ef22cc6b983fddcaeb414079a5e7
MD5 60d9c36cc70726b5868f57b23808e186
SHA1 4cc5b6f76e222807f71dfd9acc772099cca7c82a
SHA512 0d51602a160672502c2ba8ff43e256cf7de9fdb34c1841f488d372317df45c18f23e6fd5c7c7c362b552a14e95989b17a1dd5ec99c2de0fc546adfdcd037fceb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7ppL:A3mnXoZjzyaT4aewsAjlq7ppL
TLSH
T19B15B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 878KB
SHA256 36547193b733ccc6e7e9c6cd16c6cd6e6cd84b14fa0026c5eb4c839dffb04f0f
MD5 8b8ae738a32a4a7e84c22cf494481cb7
SHA1 bee76dd90f945e1500c2f81a1c6acfbf1592c8bd
SHA512 41c2022bf3fa862df2fb2932bb36bad867c37d205856e797de2170acdffc9559838fa56ca75ae3be5aa044bb2d7cc6a12a3e50fb3382398f1f30282f4b7065cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pXFC:A3mnXoZjzyaT4aewsAjlq7pXM
TLSH
T1A715B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 878KB
SHA256 b0578bb099b4361825fe565d11f965652002fb444b8e100ce7c24fca92f179b8
MD5 96532a6dc82c34ec3a3bf0e8378ce140
SHA1 1242f8ee7e3bc9afb242f5282b4fd6d9fed69a2d
SHA512 24ac5780c88cd2aec946079751165154aa67f046c049b50a8299c0082646b1f81dcf615719ea04e85158f5ed515730621c2685f638e0eda2b81537a14538136e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRTq7pgh:A3mnXoZjzyaT4aewsAjlq7pgh
TLSH
T1E015B023FB7090B5C23B49715B65C712EB787C210B6056CBE3A88A592F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5092-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5092-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5748-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads