Analysis
- max time kernel
142s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 16:47
Behavioral task
behavioral1
Sample
2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 939KB
- Sample260629-vanswsbx4m
- SHA256 0d9b32452bebc2b28e63e998261d8da4a1539bcca61fb50a0a9b26857ce4aa2c
- MD5 3abb16d81e4ee1a69be4937a2412dfb3
- SHA1 44c486769d66565e6c9225b93eb81abe8b0adada
- SHA512 bb20cd57ac08c6b6a33950467fcbd82f474ed29f68582cc569bea79791d28247bc75ed68a5dce491e12332a0701c9e5460de7d68f5890c0fda0706f212022618
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEc:A3mnXoZjzyaT4aewsAjxTc6rbaiEc
- TLSH T1C825B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/6116-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c6a5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bb-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2884-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6116-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-207.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-365.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-409.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-460.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-486.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-505.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-506.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-513.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-514.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-515.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-529.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-571.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-596.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-610.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-644.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-651.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-652.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-653.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-666.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-691.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-754.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-761.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-769.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-777.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-778.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x006800000001849f-810.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a4a2-1032.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c90-1322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018903-1509.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c6a5-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b4-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bb-39.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-200.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-207.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-226.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-245.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-258.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-266.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-279.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-322.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-365.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-409.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-451.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-460.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-485.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-486.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-505.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-506.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-513.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-514.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-515.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-529.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-571.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-596.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-610.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-624.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-631.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-644.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-651.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-652.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-653.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-666.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-691.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-747.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-754.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-761.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-769.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-777.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-778.dat aspack_v212_v242 behavioral2/files/0x006800000001849f-810.dat aspack_v212_v242 behavioral2/files/0x000300000001a4a2-1032.dat aspack_v212_v242 behavioral2/files/0x0003000000019c90-1322.dat aspack_v212_v242 behavioral2/files/0x0008000000018903-1509.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2884 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6116 2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 2884 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_3abb16d81e4ee1a69be4937a2412dfb3_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6116
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2884
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 939KB
- SHA256 0d9b32452bebc2b28e63e998261d8da4a1539bcca61fb50a0a9b26857ce4aa2c
- MD5 3abb16d81e4ee1a69be4937a2412dfb3
- SHA1 44c486769d66565e6c9225b93eb81abe8b0adada
- SHA512 bb20cd57ac08c6b6a33950467fcbd82f474ed29f68582cc569bea79791d28247bc75ed68a5dce491e12332a0701c9e5460de7d68f5890c0fda0706f212022618
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEc:A3mnXoZjzyaT4aewsAjxTc6rbaiEc
- TLSH T1C825B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 968KB
- SHA256 24553349c1cadda50106791a9b8d8c383be9d9292ae4de85a8cccc3844d3b613
- MD5 97eae049fb30af9fa951811e150d1922
- SHA1 efd42b13ebe5d1e81039a79306745684e6bf95d7
- SHA512 5371414c008270b732870135bc9f797dfb1a2e0bb5bf197571fb67d45049ff8961e334a6ce17bd27073f9173dc4c95fd7cde16c22037cbc28a592c1082593157
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEGP:A3mnXoZjzyaT4aewsAjxTc6rbaiEGP
- TLSH T13325B023FBB090B5D23B49705BA5C712EB397D210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 1d9fb1459e2d225e1af59769af3361bd9f37f065e6986bda2c9bccffc9ba3cb2
- MD5 aebf0090ab8485b1dec562060b90dbea
- SHA1 2a12f5a6e14b5be2cafb86aad071c8674d7bd5b1
- SHA512 3fb91e9cd190c7003c904194d1e035cb6d47b6e17cf172b9824ba1c580d247ce99c36299036f92ba7e01347e5df1262eea32183d29822c48a5c36b930fe56b4c
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6rbaiEk0Le5ji0hmxNrM:A3kMPlj3Pji0Aj
- TLSH T1F5658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 954KB
- SHA256 a088074e6dd9c075a8f22eb727fce2f80d9307964620b000a20568507751e1ba
- MD5 a79f5f5d8fd5cd3f085496a76a19256f
- SHA1 de8fccd845789def1b6292e8ed8acb811fe4f4db
- SHA512 2b70f6865d55ab40452ae8bf8ef9b99240719204bdba5437aa524a00a0347a55b98a455fd360aa633fb6ca5e89075502fb9901a95c0707ed7fa9e43b595c4f97
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEOa:A3mnXoZjzyaT4aewsAjxTc6rbaiEOa
- TLSH T13425B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 963KB
- SHA256 a5611a653578b095a55d06bc7254dabfa4353ced4c454c822935933c01a5f49b
- MD5 c67d8ef016e023e7774007bff00d0427
- SHA1 7311e484930ca69a575fe5a626bdedd00d768b78
- SHA512 2e78834f3e60d7efcdf65bfebe92a36b60e15ede99e29ef1d0facdc6afeb70ac99256f8638140d9028b728a41c8e26bcb6d461e361231283077919cee0cd4d7b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEQZ:A3mnXoZjzyaT4aewsAjxTc6rbaiEQZ
- TLSH T15625B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 963KB
- SHA256 24c717f6ca4c818c28604312f9538f622ee001e2e1844628bea528ae930aef9a
- MD5 04eacef076c69100c483bf9474909bdc
- SHA1 fc3faa4fb2a369689c01dde9203a28ba38d577d2
- SHA512 c6ce15b44b9abbc076371c1030ebda180a8099033fa77e430ff3bec759351c28a62e6b357b78120e943266151892fe0aed10f514e9299b0498cfcf6bc2f4724f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE31:A3mnXoZjzyaT4aewsAjxTc6rbaiE31
- TLSH T11125B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 963KB
- SHA256 8ea8ee191ecbdf19dab8808008f8c8615bb5dd2a60d82499e405a78a9aedf105
- MD5 ff79e085ef05092ca101d559e7884790
- SHA1 0073854042fce7ffaba4b176b96c993bfbffc195
- SHA512 859202c3591c467a5a089d4f27d5db930ee2b605f1f3754ab402fb273049ed47bca597b5a61d4bade59182c7a445d1051619b20ace660d82c266df614c664544
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEv6:A3mnXoZjzyaT4aewsAjxTc6rbaiEv6
- TLSH T1B325B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 963KB
- SHA256 c41a5b31708c6cd28cce808793fb8785a84dbeed7f7ca8cb17d0f5119f0fd455
- MD5 641786eeaa3bc0ae852d1133ca42df6a
- SHA1 f13e74675c4efb628a46ba9a9d5fade11228c5e3
- SHA512 89d3577ee8db5a24eeb703e2fa82c00431e2f50637cbec5f210bb431df7d24aad0fe591946b54e7026125633f6f98d23d03080227859be71749213f027e089f6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiExN:A3mnXoZjzyaT4aewsAjxTc6rbaiExN
- TLSH T13025B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 963KB
- SHA256 7f361f77641f726e80e8d3298837dcb6f95920be22eb1b450a12787798199126
- MD5 b48f5346d4c94530f9bcde9b85659fa3
- SHA1 e2e6b608f4d889c5b4ae0f988002ad0c70a9c167
- SHA512 d708bf5dad5bbeea6b4053f903c297ee6d2238f8bd55bf11a0ea30318afbc900859a20ffdb64d7fdec354ba951e0feebc5570d3e4fb7890d3d46d02b33a14c4b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEnf:A3mnXoZjzyaT4aewsAjxTc6rbaiEnf
- TLSH T17625B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 963KB
- SHA256 edb91c26932d6bf2eb2a1733e208a1b46f521110090c9cf4891d190f404e6e0a
- MD5 80460902f37455c4d03de44f36211e7c
- SHA1 b0beac326f9cda83bac1137528bbcccf3c29601e
- SHA512 9a257dc83896448445808896f2c97cce97df52a1e0dceabb264cbbe74b0c491bc39bde525805e9896cd35a789d0bd63514d21f4cc6635d4d8bae240f2b4eb4ed
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEpo:A3mnXoZjzyaT4aewsAjxTc6rbaiEpo
- TLSH T1BE25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 963KB
- SHA256 5bf041e722f3ded5cfdc85e65d4b45854b54991ab20d095bbf174f0f6f5466a5
- MD5 93b96640e8c6a40a9d3893ccfb61e5ab
- SHA1 6c775283a9eea7103716999fb5406fb12e8e36f1
- SHA512 cd3f0918bb8685be3e5008bc28980d091751f8dd1eb90c121713086c4a670e475ab357603cb0076ff770fe7523f066c9be311b9e04edd8c61d77a87553f5b4fe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEZu:A3mnXoZjzyaT4aewsAjxTc6rbaiEZu
- TLSH T14125B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 963KB
- SHA256 e96f356bbe8bb91a4ccadc6d6700325fbb07262700f5f74cbaf1aa3b2bffe1f1
- MD5 b02da6e3617147d4b4d64c731d1daee0
- SHA1 89c3763c84b89f7d9fed74d52b92f06b22ddfb98
- SHA512 41a4a2d33c267648b32e99eda54d33dadb7a519eda1788ec56dfdf78322ce1dc47dbf612e8322d61dfe71e1ca646f4cd1e0d4f3dc29b8ecdda0e1499c960fffe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE/9:A3mnXoZjzyaT4aewsAjxTc6rbaiE/9
- TLSH T15525B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 963KB
- SHA256 82b25badae5c7b02867842d757ddbf49056b12322a3c9ea1d0397ec8fd452db7
- MD5 00eedba3c7ce7a2f298e7159355f0dd0
- SHA1 31e495c40756cc30aa2a300076ca996f56977056
- SHA512 238a02ed06846eeec60b68549f4429ff082971438e04a2f7196bc07bc0e8ace50df0ecf8fbab4e3ad22bd4cfee395070dad0c316b183c3622c1161eb90e5cf65
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEbc:A3mnXoZjzyaT4aewsAjxTc6rbaiEbc
- TLSH T12425B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 963KB
- SHA256 be1c2228031d647f032395c67cdb628ba4cd950d0259f2b1cbfd3e2f206eeb48
- MD5 87973ec2aff5f15e59dfb4ff71c10163
- SHA1 3ce75e3f6a39f63d5b546742c0c51b6da781493e
- SHA512 ed39d3558c8fdd81b1d2670c31b1d587de2f945f8db893874b9f5b6581db50fbf0b5a2ca5b4470584dda26fa2c560b9fc34fbf92eb703540876bd9a2f38b2893
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEEp:A3mnXoZjzyaT4aewsAjxTc6rbaiEEp
- TLSH T10E25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 963KB
- SHA256 8ccea37ed4e5eda088ebb07071557b8dab95c3da91a6e7a11a94fea8ac313ac3
- MD5 5dc135efc29ebbf05c96539b047590f8
- SHA1 097f4170b1d9c0bd418fcbed5190e15b0306a0cb
- SHA512 8425d5794eeddc6be2ad96d6d48f9055513086c319c683a0027c7c60932ca5f9e78f2be41b2c805f2f125892add1aa7d3bc746bea6d5b5cb6460a28ab0000637
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEL0a:A3mnXoZjzyaT4aewsAjxTc6rbaiELN
- TLSH T14825B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 963KB
- SHA256 67e5161d7d675a306f0c43595df62cda8c1e1742c30053e25bd1513941bcaa7b
- MD5 f8e9d5d7ab760f04b4c9c3c87f9d4ae4
- SHA1 93b5f451c0e3342e4999175d1c30d227424f5812
- SHA512 29cf2c370c07bb30318bf7135ae77e11f21b70dce6c92faf1e5f84e6b24a480da4ef1172453a4443c68f93d6ab38a318abee5f0b4602c3ed85f27c7ff760c129
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEZF:A3mnXoZjzyaT4aewsAjxTc6rbaiEZF
- TLSH T16D25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 963KB
- SHA256 193586df286c63d2753ab5a4b64ad15ef42285212ad4bf83afc14f78304017ee
- MD5 378031636f531a48421f66a15483bb77
- SHA1 41b6edad5d1db6bdcbe4504192779afaff0a0eac
- SHA512 88343ea8a2e144553025974e0e825079977533b6866ef81217f0a877ff30923899b8d5184f7d0e02eb3e904e1bdb1418ed8204ea3781523809ae3271a76b2c4a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEyC:A3mnXoZjzyaT4aewsAjxTc6rbaiEyC
- TLSH T13725B023EBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 963KB
- SHA256 25d91387ce8b502f6a66386529b05b9a61fbfb1054cc9e8ef3c5543b9ceb7c43
- MD5 413f8b6ef6f4ba638d3675da6fd2c070
- SHA1 a7d424c8ff064ab9aeafcbd61a750a70313222c5
- SHA512 0a11cf6e60d06653d1642f2957d9707dda92603875f1f9a70943d2a4bc74390d24dd7e0e78a4c893cb0e4a4266da51494f55e1bf5d788870d5e1f0c6345f3834
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEtw:A3mnXoZjzyaT4aewsAjxTc6rbaiEtw
- TLSH T10B25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 963KB
- SHA256 a365f6f4402b3bd69b8ce46ec025d19aad8a5c5f7ba2003efcd8837adcdc3597
- MD5 24bc71087da239baa532d016cb435ce2
- SHA1 67b165d376469b32fb7b1b3ddfc131c66bb116e0
- SHA512 17eb9e94c2b9a34bf747a978a19fff56892a53dcdcf7ae283caae18d314142db6417d98cd96a3bce5d4046b53d57ec40d67f8e115fb1e20c7ae8d70bbf35bbaf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEcT:A3mnXoZjzyaT4aewsAjxTc6rbaiEcT
- TLSH T1CE25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 963KB
- SHA256 794e81f6e0da2c04a5d892ff08d61aab3553410210e084ae43a48f119145a970
- MD5 131bb5fad3bb34a87dc5d0f4eae742a3
- SHA1 154d7a5d9f8989e7fd520cea290e3401960ee17e
- SHA512 0b6229363ca07883cd74cf3c7b0c68bc039c998e1749a67fa401f56fd608ed02f92628391c33e4c2157871ef353399d7097398f81b88dc0b7cb217761a9b320f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEwu:A3mnXoZjzyaT4aewsAjxTc6rbaiEwu
- TLSH T18525B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 963KB
- SHA256 a8a8eebcd4b2c1dcfb5b2c06433dde6bba95ba22d52695f292a9605545cd7867
- MD5 b5b08f382e0c445454fec6ebe199bac7
- SHA1 8707237010d9c3ae3cef015f7ec4a8070dc1de3d
- SHA512 fa636d1d328c5aa99d5f1e67bc911e936748ede36850b463b2064f97926e5a877c34a04036019e62bd13ef91d948a2342514add22017b241b4b3a4560e7c3f25
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEOb:A3mnXoZjzyaT4aewsAjxTc6rbaiEOb
- TLSH T16625B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 963KB
- SHA256 ed9cc518f5fe06b36e9fc1841b43a7fd2b25918a83053d343cdc612155530226
- MD5 e4a8d040073c62445d851af3d0057388
- SHA1 0b8122ecb599c8fa47af8fe0f336f9be09a6bb41
- SHA512 c964bbd798efee7062a5d618341cdf0255c5e65f5cda34b0cc471fcc7e9e9a08699357a7152a4c4d6dcda939f826ac7e52cecb15c78a5ffbe9933d89999fd9ab
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE4f:A3mnXoZjzyaT4aewsAjxTc6rbaiE4f
- TLSH T1DA25B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 963KB
- SHA256 310bb13e056e0d41ee3248dce3b3437b52c33b6d2daaf1d30e286320db639023
- MD5 faaaf9d2c067c0ada6d56e4e973aefd0
- SHA1 7478c5160b21f3c832b6e4b0b6d3e21b18d0879a
- SHA512 98189bffbc85d8be9e2710d56963fb98e5818b4be835d8e4825be8e0e07b0e46f65cb382e61e312bb3404ece1322013e467e9da33606d5179e0aea7e9abda606
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE1K:A3mnXoZjzyaT4aewsAjxTc6rbaiE1K
- TLSH T14E25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 963KB
- SHA256 20b9e3cd8f339e796a891d9af0702f11646e3c8fa129df5b768cb6e6a5bcedbb
- MD5 6c9b8e617f6a9f19e50cf9fde0fc246f
- SHA1 582f3eab866bfde65ea103b3deb58fb3061cf5fc
- SHA512 38273a2a4579cebfb949835ffc7e5401d0158b31fc60333b2e3957e2aebeeca17692d77d5741ffa7dec9717184895ce6aceab8d4779cfee4c947b039899b291b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE2k:A3mnXoZjzyaT4aewsAjxTc6rbaiE2k
- TLSH T1F725B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 963KB
- SHA256 5250e9477ff5532fa458b19f740985c5e8e805f55e6a3843f3dd34aa978ada49
- MD5 d237c82341228471f56609258a59f523
- SHA1 ed76f5e90879462c43d0ad38a61790b66015cfd3
- SHA512 6975491e07de1955f22ebc94fd55800d79027522094c80525e595986774f6777795ec2a2b78771118ccddf98ad349fbff0299deab5bfcaf6eb730f9991183a54
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiET0:A3mnXoZjzyaT4aewsAjxTc6rbaiET0
- TLSH T15825B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 963KB
- SHA256 3ab8e64f1da6502a3fd92847ec7efc9cbbfb9edd8bd079c93eef7b13b85d849a
- MD5 2a41e5f9b5be8a12a1d7e8016e33c1ba
- SHA1 d8273e61ff81b716fedc91d43480893fbc2d72fe
- SHA512 07c8e64d77538a67e4c217ffbe169021ed1c597e8518c4908ac0ead48c407b3f15a7d7ca5020c280cc62801c7ec330fe63098e49e6bb1412db64a013f285229a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEi70:A3mnXoZjzyaT4aewsAjxTc6rbaiEig
- TLSH T18525B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 963KB
- SHA256 5cccc9fa02f17478ff5c5a68188abdc9e38913f46a9b4ba1bf6dd90521fe58ec
- MD5 7dba0988f1e467d8d6bf0881d3c90c61
- SHA1 09dc6c8f8c6ed29aeb4e94177ac2aed5404a1ef9
- SHA512 429b341187b9f40b9c38837a9688feb8a96082b030c0a59c79be58ab5a03373c05ce22259e598f27c58739d0607da1a5dc6eb13dea84a291097ef3e7eb1652a6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEDr:A3mnXoZjzyaT4aewsAjxTc6rbaiEDr
- TLSH T14C25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 963KB
- SHA256 7e1ecb88bdcc7be66f611c8c83739b18ac6f5fc555b47dbab9b258332bff9690
- MD5 85e145b0df6feba54b4ef8b459ea1402
- SHA1 796cd632aeb065bd67dfb97245bf239def7b4847
- SHA512 30b714ff92e0469799edfd6a8a56f6029fff636b4aadef1a6ac523b4a13b2fa0244d2a4f6958822d78e074723618f2da3a32018280bdd5ff1910060cb2aec981
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEln:A3mnXoZjzyaT4aewsAjxTc6rbaiEln
- TLSH T12A25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 963KB
- SHA256 dd0756b3b2ba94ff651027af0612c8914e164b059092ab5465cdbaa223c1cc3a
- MD5 e29bf1f0b3f33749af386bc33ab1a891
- SHA1 b189edba3d283adf2a13bc47742cd87f139d355b
- SHA512 0452ce46a0e549315ed2b412a0315906ee62142bdb4b45d9359588e769e8c0d5f50098438824126170a882b5993c8a6a1bd829627020491c82a8d9ec94cd8cd3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiERx:A3mnXoZjzyaT4aewsAjxTc6rbaiERx
- TLSH T13025B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 963KB
- SHA256 df6f955edd3efdbef11e16d37de83ad32ff95584a506e0a1b6e85ae8d1322d4d
- MD5 b94876c71ac240187bdb69ae56e4aac2
- SHA1 e49f21becb51ffbf5067e56a1477a41b1137d36d
- SHA512 4ddad4aaca9dc3c58f5f7935dcd9edc4c75d63645613fd274fb9534439c79084452b4a5c6f8f1c80afbe2973d7ec257b0de664073d4c7f04a9cc12037b10415d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE/A:A3mnXoZjzyaT4aewsAjxTc6rbaiE/A
- TLSH T15825B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 963KB
- SHA256 86d55c995c6c4e27ef575b9bf0c0996797819fc915f2630d117337c3b3a923f7
- MD5 69de5046d6995273e7ceb207e841d9a0
- SHA1 3b80026851b061d7f24fee20191c8bbda26dbf2e
- SHA512 93b8a0701689c3fabeaf6cc32e0040a20cfe3fbe6f34e220923df8595bb105af699376c483274b6bfa708c65edf63b73b15f18c10ca99d67185468540599bb8f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEQ9Q:A3mnXoZjzyaT4aewsAjxTc6rbaiEQ9Q
- TLSH T1D925B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 963KB
- SHA256 d6884bb505e0e3b77e85c4a4d5c01587f13ee944effc1c362f2624969ec8079a
- MD5 32fc3d91e27f6946597ae7bc6fda474b
- SHA1 fd90ccb53e50b76277c25a98f4cd5ae04f364388
- SHA512 d158b3743e66617a2536cbfc7ddcc09cf53978b188dd36282c422665415347554bdf7f22f9dda0678e78092014e7d738d926b572576bb48ede968abe1bea1a9f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEx4:A3mnXoZjzyaT4aewsAjxTc6rbaiEx4
- TLSH T11D25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 963KB
- SHA256 b7967a3b2a4b630d484359a6480925fd983cd9271de9d69852c4da38913c3189
- MD5 db57db189aef818269cbaa69a2bb9b6c
- SHA1 b83d677c573baa5e3ba53de8855c568c9e2911a3
- SHA512 1c874f1974d81e204c2b9ca83945c2e851420c21dcc2db42d00a75471a5df8ed8172305c57c1de6a3c3aa2613a24a08b6dad1c196e5bcc898f4a7bb5256477bb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE0u:A3mnXoZjzyaT4aewsAjxTc6rbaiE0u
- TLSH T1BB25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 963KB
- SHA256 a124dee0397b4a45f49607bea1494daa55671bfebe53ea614cb7a0aaccc0c03c
- MD5 cfec357cb3d2e68210cde84a8c705c13
- SHA1 58684ac97904f39f8d766017f402c92ac976c0a0
- SHA512 a7b54294b297489b8f9348445d161b887864e196c0f194ae69ce4e194ff1a14f90ac6e7aa3c49580fb7da5d0892444a1aca4e5a9b449c120091f7da30a6180be
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEFj:A3mnXoZjzyaT4aewsAjxTc6rbaiEFj
- TLSH T19725B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 963KB
- SHA256 30a8af477d24b553c826fd223967529c47b70f5a636634ce8d4fddca46a94ecf
- MD5 1ab9f43e94c7e1ca36916076db4efce0
- SHA1 6d6cb03d15a1c9c4e7701fa47780a12ba2080648
- SHA512 06b9014e5e331e2b620a7618e317f14e4c8361b15455fd06aff3bd9a3fa017e8a3635b0351203d993e4a0129f1c41bbcd57e640ad3bdc13304f774f98523e7d0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEMg:A3mnXoZjzyaT4aewsAjxTc6rbaiEMg
- TLSH T12825B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 963KB
- SHA256 bd4b8b3e7dc7a61de8dedd624ae28bcf37383f3dc62a79db83f64bcc39675a5f
- MD5 b06ebfd5a44d6d276d71e4f8e23f027b
- SHA1 cf5750f31cbc45806c66aa5d021572b4d30fb98b
- SHA512 770589376e37b1e14eb9abbcdba03965d0f4db6151dcb6afdeeddf03245aebed24a2a71149b0eb7be0fa183777cf8e2e20b41d1302f45bdde5ffe690d3a32587
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiETI:A3mnXoZjzyaT4aewsAjxTc6rbaiETI
- TLSH T13E25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 963KB
- SHA256 c7ec4c0ba8b81056e00fda3c4b9c0b5a99069fee242d76f58f134737ee26f6ae
- MD5 15325595a5d430c62d95e0a642d0c68e
- SHA1 4758a43242cfd35370c1a2be4040d9c954c4b830
- SHA512 83948c8588f75ba38bda53b6e9eb0018ee51a27d6ee30fbcbcf3abf1c662f88a8d4063c6e8d8d19c71f94365834d2bbe53b5aac795740581426d704cf06395f5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEpo:A3mnXoZjzyaT4aewsAjxTc6rbaiEpo
- TLSH T1B625B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 963KB
- SHA256 5ab0d771125bc04224cbf4730801cdb55ff121510ff25a1a6c11a67000702c3c
- MD5 4172dea18bb6bcd526ad3e9bff825e0c
- SHA1 aea430e8c0dc09216770c0d25ef2d1875916c180
- SHA512 2d56a4c215fa2cff44c3b42fd3019b3fc0edee9600e39740785adaed42ebdc9aa6ed042bf35d856a66c070000f88162f5ecc72887046b4c201eec46cb3cbcff3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEa+:A3mnXoZjzyaT4aewsAjxTc6rbaiEa+
- TLSH T15925B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 963KB
- SHA256 d11ec07720b9119bb7003de853e820c43b1254bb70c6ccbd97ef0af3d6cf40bd
- MD5 20a25994c459409e2b54bd6de29865a4
- SHA1 28a4c3a7f2d306fbeb99126dd003cc6168e0a013
- SHA512 7f8bf3b2f38e9e1ede8fa2c7980c355a03845f83b6e395e337ea033ea05fbddeb3a0395450c32e929ad9983f279e5bab69e443f40fc512db263142bf601a516f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEaQ:A3mnXoZjzyaT4aewsAjxTc6rbaiEaQ
- TLSH T18025B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 963KB
- SHA256 ee2446e86ea2df9cd5eb63492030add8ae8dfc64ec1ec514784d7bf18852ac86
- MD5 9fea438d1fc6966a57fcefc1a3ef8fe9
- SHA1 abf05a64f7be9cec692fdda1225ff3c0fc322d04
- SHA512 6eff6308ed006f541ca73d412ade43e6c7d36fcb5b61796527a812df022b0253b3f15bd541249b337f11205309435a30d8117b857b5a8bb3f1d11e09d7d87ee6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiErX:A3mnXoZjzyaT4aewsAjxTc6rbaiErX
- TLSH T15525B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 963KB
- SHA256 cf8289333812559ac3b88fe1f6b4a129963873a9ecb18f328d1c6616c9ad4fbe
- MD5 f43965634169493e2471dae687ae82ab
- SHA1 01650f8f78c35a4950692636ff2923f290fbe855
- SHA512 b61c16343ea4345a0a0440b6120116ab92e55bc0f18136bcc7b85d1166928d43ebe45c5e2bf31ebaf8c40aa201281e67f028356bc162b029a6b0d054f554a54b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE5L:A3mnXoZjzyaT4aewsAjxTc6rbaiE5L
- TLSH T1D925B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 963KB
- SHA256 c129e208f22a676e0a1eeb10210be472d519ebd6adaa5db8a3c388d1419f3b25
- MD5 44a8584ca5e14288676c50013d5dc594
- SHA1 b7ef058b96cb426a6e846b858ebcfcaffffb75de
- SHA512 5553626e03ced546126a682b8329ce241bf65b65aa6868b0a0c234e97de8db44e032b45996eedb869d1380b70dc33925f08de8664625a57e8cabcffd128c8c37
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEnFC:A3mnXoZjzyaT4aewsAjxTc6rbaiEnM
- TLSH T18225B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 963KB
- SHA256 66ffd35ec35f45ee49329184e2b2ea6f29235c31e0f7b59f6d6a833eafb39707
- MD5 f41f96cd6389598325931e01fae4c83e
- SHA1 b5b37b156102423bd5a220521d776718dc6379bd
- SHA512 6d7edcfd5d5f55ce87305ee14a4cfb83a1d23e090fc31dbd3310c6e071d29b236f8684c726d71dd958ed6f7147de19913479f7664278ff915557df376f509ba6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEQh:A3mnXoZjzyaT4aewsAjxTc6rbaiEQh
- TLSH T1A925B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1019KB
- SHA256 73383df3021e640d8122d5d33f42eb1adac943864e5380c9c0fc35fffe9cf885
- MD5 a0101f5a22e9348aca1c7be6c4da04c7
- SHA1 8d99a2263d5be33291cc9fa156afa9f233769677
- SHA512 0adc9510eabccd7c4221864573ed2c545d0f62e3472b6f590be977a6e9177d11b8647a5d42e884e68ffe3752d1763ec2c19aae3023da05ed26d30cd10b317648
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiE2F:A3mnXoZjzyaT4aewsAjxTc6rbaiE2F
- TLSH T1F525B013EAF090B5C76B04709E65C712EA38BD510B5059EFA368BB691F313C07B3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$
- Size 960KB
- SHA256 67c2ed6773f49474b617aaf599e854aa462ad5e39e6c0d377b5d02cb4611a91c
- MD5 2a4329defa551b9ef3e0eeef485f3505
- SHA1 8715cc6b1ca65139b81c11a4290d74711dcd3866
- SHA512 830c34062ff66fa9fb0010650c3bc9555ca376687617f872fc4327d96efa58b0707c8f39d36404c5aa8b22bc58fa32df68690171731173b4d6cd8c81399733f8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEE:A3mnXoZjzyaT4aewsAjxTc6rbaiEE
- TLSH T12825B023EBB090B5D23B49705BA5C713EB397D210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 973KB
- SHA256 6af2e18006cf215f75152c0a89c145c0a9c17cf7b7ea98b2344e7802d6f059bd
- MD5 9411942f25965f9d55d80e7e393454fc
- SHA1 153bd03781244602941116a11f0e1fe51e29533a
- SHA512 b34296d9bbd8f35dba9e09c98914304aecd34e6485ebca1c8367b99f328e6beda5dcd67de7e3dcc7fcbdb4b3635d47aab5bc9695226ecf48b7dcb11124d9dc39
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaiEF1:A3mnXoZjzyaT4aewsAjxTc6rbaiEF1
- TLSH T10A25BF23EB7090B6D23B49705BA5C713EA397D210B6056CBE3A8C6591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH