Analysis
- max time kernel
114s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 14:53
Behavioral task
behavioral1
Sample
2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 889KB
- Sample260706-r9tlmsgw6y
- SHA256 317edfd8b5ef15c28b715fcf279688b30f8820b5ada7595aac199d93cee89336
- MD5 b74d9603c985d69aeeac4abede1b3dbc
- SHA1 534e3abf1d77fc8c6ef5abc6581efebfda709bb3
- SHA512 987c6c5c88d99a4f16a02e432bf6d60c25543a5ddf001c61094a6e312df66b60941bc9762d8a48eef734e44675dfdcc7b98d76dbb81cee0bddbf88cf38d0e5db
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3d:A3mnXoZjzyaT4aewsAjl5SaRaRaE3d
- TLSH T1FD15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral2/memory/6032-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5d5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c5-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6032-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4880-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c82-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018973-180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018977-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018979-268.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001897b-419.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a02-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a58-505.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019845-590.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a55-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-809.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-944.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-963.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1112.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1162.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1233.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1356.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1409.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1410.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1412.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001891d-1494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018923-1543.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5d5-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c5-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e6-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c82-60.dat aspack_v212_v242 behavioral2/files/0x0005000000018973-180.dat aspack_v212_v242 behavioral2/files/0x0004000000018977-249.dat aspack_v212_v242 behavioral2/files/0x0004000000018979-268.dat aspack_v212_v242 behavioral2/files/0x000400000001897b-419.dat aspack_v212_v242 behavioral2/files/0x0004000000018a02-480.dat aspack_v212_v242 behavioral2/files/0x0005000000018a58-505.dat aspack_v212_v242 behavioral2/files/0x0004000000019845-590.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-616.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-647.dat aspack_v212_v242 behavioral2/files/0x0004000000018a55-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-809.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-858.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-944.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-963.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1018.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1074.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1099.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1112.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1149.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1162.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1187.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1195.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1233.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1318.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1343.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1356.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1381.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1388.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1389.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1409.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1410.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1412.dat aspack_v212_v242 behavioral2/files/0x000300000001891d-1494.dat aspack_v212_v242 behavioral2/files/0x0008000000018923-1543.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4880 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6032 2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4880 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_b74d9603c985d69aeeac4abede1b3dbc_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6032
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 889KB
- SHA256 317edfd8b5ef15c28b715fcf279688b30f8820b5ada7595aac199d93cee89336
- MD5 b74d9603c985d69aeeac4abede1b3dbc
- SHA1 534e3abf1d77fc8c6ef5abc6581efebfda709bb3
- SHA512 987c6c5c88d99a4f16a02e432bf6d60c25543a5ddf001c61094a6e312df66b60941bc9762d8a48eef734e44675dfdcc7b98d76dbb81cee0bddbf88cf38d0e5db
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3d:A3mnXoZjzyaT4aewsAjl5SaRaRaE3d
- TLSH T1FD15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 974KB
- SHA256 f69dfe72092b081c03c3179b3f6fbef2dfcc5bdaae3b7b3758e92b5103c274fc
- MD5 ba6657c56f340c7a8e5a641cebfb878a
- SHA1 47098c32dde8893b0fa4d71de78ab5b9636c4d1b
- SHA512 b48ea8608add3a56ddc4ddc74d81cd81b4ef870d03d3052599ac1351513717211b5eb9f21dc75198e620481e67f2f9452699e26eb4f332dce808d8f20eb44a60
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE38YmIjE72:A3mnXoZjzyaT4aewsAjl5SaRaRaE3M72
- TLSH T19925AF23FB7090B5D27B49705B65C712EB397C210B605ACBE3A88A5D1F317D0AB3A716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 941KB
- SHA256 2254b3f3bdb44352bc74545762f9c97ebc12a1f157ce1d472cb7ba994da092bc
- MD5 d13cc5867536b70063680769313d5aaa
- SHA1 0248423c8152390be80ccba5aeeb8bf8498ee163
- SHA512 ffb8e3a15324260749569c1a316c64dcc28506d633a44781c2ee04ca7bb47fe26ee2dc345180e94167978ff3f36decfff5ae854430e85fe9d96d97aef6367a55
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3WFfj:A3mnXoZjzyaT4aewsAjl5SaRaRaE3cfj
- TLSH T1AC25B023FB7090B5D27B49715B758712E679BC200B605ACBE3A88A5D1F317C06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 09f9d1afc022f416981ebd49ca0483fb82a384d5da03b4c853e3a9bd6804b133
- MD5 a84d1b79ee6dafb98de88e683749a5fc
- SHA1 ef67a99c3847db2042fcdd0db24b1d88f63b9ca2
- SHA512 f72036ca3c5bab5e5c399f50363fe3b258c25f0eb2d12cd02a6e0e9f1ee9c201a7b3e5f7762615487cfe622bbfe85fc437b1d72d4ec727f14ed121eb238b5807
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjl5SaRaRaE3p0Le5ji0hmxNrM:A3kMPljoPji0Aj
- TLSH T17C658D22FA748275D077C4B5CAE2975AEA7138510B308ACB9394C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 903KB
- SHA256 2bd8f9c9f45431213955ebdb3b41b8d30899797f21817b34272f2600c804d4ed
- MD5 81bcfe347be2f5e73d1bf1d36159e1b6
- SHA1 91aaf482bc3b0240cfc1d7040f01227ba8d2297b
- SHA512 0c970b0caabc2cf65e6b254f3af2a19ecb7839c0277526eb724f5834a96a36d15fb740c3e73e467ff3446f11381f98eda6e9fa844385a49171136ddd16fa785b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE37a:A3mnXoZjzyaT4aewsAjl5SaRaRaE37a
- TLSH T17A15BF23EB7090B5D27B49705B758713E7397C200B605ACBE3A89A5D1F317C0AB3AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 937KB
- SHA256 04970dc1e6725bff2a42b462e24cbb45cbfe239d9d5f36c7086eb00491d8893f
- MD5 bb21a22ddb123cb8ba6af75ccd44681d
- SHA1 35e8ebffd926724c66729535b033a314f33a3bcf
- SHA512 ec026dd1ca1692e89ca10e3bd045fbd7c5259819c77cab0cb557719727ceb62050bc371d64b9e223c69a5b8735a759da4f05d053e1205426e45daacf9c5f460a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Yb:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Yb
- TLSH T19515B023FB7090B5D27B49705B75C713A7397C210B605ACBE3A89A591F317C06B3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$
- Size 912KB
- SHA256 5cfcbad78ffbe2578968ab8d5fac8befadf1936a8f3cae5d00cd471061962566
- MD5 11086e24ad77fd3fb448c4a657ff619d
- SHA1 0cb6c478e073a6a35e0e6cc0d01dbaacb56de318
- SHA512 b654231eb438a016abafcf2a6b792972d098e602fb2a4edb0043d105ecb625f7a0f5f3699bbbee980fabb25c52592c6ee24ff8a2af7b68dd6007c9382df92ddf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Gx:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Gx
- TLSH T16515BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 912KB
- SHA256 83e5802686a58e6e9d01ee2fefbe355a9ab556329b4704fdad3c22cea66c3782
- MD5 9e0e4741c6142774d1669cb7dd704280
- SHA1 80063482a48ff056d9b0ce14cef4f6310e62ce38
- SHA512 40121124375105ba11264a87d296ca53985e275f484feb7d01a2ae25c954006f88f5f6fffead5e701ffe298b06b9e2d39f99f3685f8952e579ffdeca28276fbe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3ks:A3mnXoZjzyaT4aewsAjl5SaRaRaE3ks
- TLSH T18F15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 933KB
- SHA256 94ecc76df54ea0a32094f91d11a0ed25f84f840b69c8c1dbc3490256e99ef9e5
- MD5 f8f5e90b760e1647cdc614cdcc396ad3
- SHA1 854553e571562e8829b3d979d14c863fb2bfb7b8
- SHA512 8e39e6592ae00ed038280c39f55e7b8098cfc800dc0995a55214cf5d01f1dabd6484d3fecfc66afcc997f79943f4d6f8c1c058ec3e27f0105fdcf3013579b4a1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3pVc:A3mnXoZjzyaT4aewsAjl5SaRaRaE3w
- TLSH T1CE15BF23EB7090B5D27B45705BB58712E7797C210B605ACBE3A88A5D1F313C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 912KB
- SHA256 4c2b1c8323ea68b354fb7b42fadb9fbb9f86812e672057f00a180ca6faec1e8c
- MD5 6c9a0389b8119397b5ea6fc94afcc345
- SHA1 2e8876a7c846cde230574c49f85a5e2118e3bf24
- SHA512 76c54bf0baeba9d2ff74e6df1bf1fe4697fd13ef59e3964ca513de6c579d5f261907e3410329621f7d6b5be3cafae252277a29a80a5682100df269e46151dedf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3DZ:A3mnXoZjzyaT4aewsAjl5SaRaRaE3DZ
- TLSH T11215B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 912KB
- SHA256 706b9355da92ce218739c0f4e0a35d0f037fa64f3f4208dd8daec269d0cd834d
- MD5 de564d32da29016bbd95db432212c0e8
- SHA1 9b2879dae26a3ffbdb9132f6af8ab8725a4d6c42
- SHA512 0959fcb8be0461352b023ecfb2378020b3d8d5b2507531e75334313acd8edadc95bd63e0c4a8f9ff30a3fefa3910ea660ae558141357e99bc551608680a9074c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE341:A3mnXoZjzyaT4aewsAjl5SaRaRaE341
- TLSH T19015BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 912KB
- SHA256 96ff9a352e45879a4c0dce451f429bf9317f2573140c7c3ba042f3a24b7f95c0
- MD5 bbc944c69d7c2c9d2fa32e5d8c10cb38
- SHA1 bbf4474449207ff19a42357ab5d26d78f5e20bb1
- SHA512 576fbea5acca8202309a04d3f99c9347966c4cf8df98c164a8c61a763ffae43a2824756e5cfecdc169d59f7d8c7038f27a5141d85bf0885cf62d26567192cd7e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3a6:A3mnXoZjzyaT4aewsAjl5SaRaRaE3a6
- TLSH T13E15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 912KB
- SHA256 e0fb50e5e215667e1c7fdd7ab377603a4a8b2687c9cef9b7950772963e262986
- MD5 dadb35e1b537dcc42c8f696e2b1c628d
- SHA1 2c79a9f0c7c158e3ff9523589f1154bee0b23ddc
- SHA512 f423f4da4daec0201357d6d06d272828025c923f294b244881af18063253779552e6dbd0a7fa3728c012c6a9f072a07739bd85d77338f7041a5404c7f461db86
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3SN:A3mnXoZjzyaT4aewsAjl5SaRaRaE3SN
- TLSH T17115B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 912KB
- SHA256 f56fc622ce0df19b14a8f736d4402c60e6f1ad57efe3650b951490d31905f0e7
- MD5 c111bfe125ff0bed245178f4949fb766
- SHA1 a26c75dbda97802387714f499da0be3e7e0dd355
- SHA512 3e0ccdbc217b743732eb4aba115e74400ce18604175f6fd959c8a1f259191e514ea33434f81885d2535ac00227fab2575467147ff29db62d11054b585510bfbe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3If:A3mnXoZjzyaT4aewsAjl5SaRaRaE3If
- TLSH T1CC15B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 912KB
- SHA256 a1f9d0ae8b2c1075108c341a3a8f04a14cf22cbc1ef42a312ad42cf626066307
- MD5 d30d21ab98d02a1c99e1223c10415a00
- SHA1 bc3dbb74f9880ba8b22a85dcfc241903dde2f3f7
- SHA512 ea2621a1358978f9a9adec492ad6de463790d9f19bca2cd7dc673a47e6725d3ba0b17ab15914491271421b02ba3af47548a0c3c695395372dd0e4751b9b39066
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3io:A3mnXoZjzyaT4aewsAjl5SaRaRaE3io
- TLSH T17B15B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 912KB
- SHA256 40b397f053176d1ede3dac310a879cb16e5417d8d233d4086aff9c1cbcb7fd05
- MD5 5893e5aefd90679abe35febc811d00d1
- SHA1 5a3888ed267e4c41e44fe1bc3bccd49a2c9f8aa8
- SHA512 6c5d6419f478eb59b6dd3ae819810bf5cdfdffb825077b82d4b6fdb92e1292d7c6b0b6551d2169e862d16efd5419840d31b11d42f7621a95f919174e45315057
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Wu:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Wu
- TLSH T1F515BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 912KB
- SHA256 60f6a03f015ab5d24f00eee40882a786533bdd76b68ce1181a386805ffffbcf5
- MD5 78b585c2dac957e23e9140f561ada047
- SHA1 d178b65b6eb5b5fb3e86dfe050eb57c22c6b2497
- SHA512 f5827cede842e172d283491a775c86e0c1d4284d1935f6472bac2e0e712e4c43be9abc1da933b7bcf39e707264c11fbbaffa714ab9c2f891d985c005e196b8b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3K9:A3mnXoZjzyaT4aewsAjl5SaRaRaE3K9
- TLSH T16315B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 912KB
- SHA256 a033b522e9303edf8394d6933e4793f13737efe13b5e026414dff192c2cb7834
- MD5 e6a3038cc15374a8d209b78b6e5239ed
- SHA1 6301389de9e1cf0772005607d34d87129e4265e4
- SHA512 b2219c4d4587607cdecc2a8c48c62e257631a50ad59dc0dd5cd19cc5c44a6bf75579948318122867bc5d1b129abc6a241c31c927b0fcbfa0e0aebd8b04fb2677
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Kc:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Kc
- TLSH T10D15B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 912KB
- SHA256 1f508ab96a786183bb5b3c45350aee66ee077697e0ed21f5edf185d825c1e192
- MD5 097881a5b55084b0161c327409b78d54
- SHA1 f6767df9b0a0ee4c2de0ad14af71f75ec2c4c552
- SHA512 78ada655fa3a33b458289de7f4edb11aedb989ed9aa01b18df70cd78fc27607802efa30443da75b7a36758994b02a30f6fae2ce24acc06911f9080674e78dc08
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Dp:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Dp
- TLSH T1BB15B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 912KB
- SHA256 1ea508ad48cadf8f53e535d27dece11e5b3612c209584a83962cb8a03541b998
- MD5 1971d410ebfc16c2a348c090865b5917
- SHA1 f5d5fa21fb1f97c81ea235fa801f87100c58dd2a
- SHA512 3eb0b47397964e2dc72c3a8376bcaa769e53435b00df58c791e3fb545ec2dd3d1ad2e4f27ae2d33331862e92e649381f1460df17af0fffdd6f4f9fea9d48f037
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3k0a:A3mnXoZjzyaT4aewsAjl5SaRaRaE3kN
- TLSH T11915B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 912KB
- SHA256 e77a24ef96d34b79e8ee22a4c06d943250b7a65bbdcaa70f828a35e64da40798
- MD5 0b10cad9bf50224a2bca691495168821
- SHA1 8e6a57942c25a3051770dfb2b582852da4adec0e
- SHA512 9b24e9323044646f88928f3dae822c309ebab661c4a1d433d5e33c44c9a450e609f0ca4438e0802c1b2847a9b1ed134e8cd4cc8b61670dc814a652e4414e2f3c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3MF:A3mnXoZjzyaT4aewsAjl5SaRaRaE3MF
- TLSH T1B715BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 912KB
- SHA256 32549c22aa3f91a13958930d45c68c3f0649a8407845ff4778ef3eb71282a8ed
- MD5 9f02d838f5729e00b46bec270c1e8a17
- SHA1 6db50cc24739e86858f2e605f4e1e389b4671d02
- SHA512 c2e26aa151698892765bdb7f03644bc07b081407047ac24ae82807b72a4473462ea200ca07b143e0477d3d3547912468b515a4e3a447c6db10996cfa50869d1d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE35C:A3mnXoZjzyaT4aewsAjl5SaRaRaE35C
- TLSH T19315B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 912KB
- SHA256 06280b074ee79842be900cdb834596a4094c061c4fdfca3d4001f607bb37c0a7
- MD5 0a6292fe94bbaa3dd4d992fb20a95c34
- SHA1 419e13c73c546262d7a00ffa2ee23bb88bbf85f0
- SHA512 97fbc0028feada1ef1c7dd24166286de09412bdf7b20784bb67fac25b924db777976db9eb475c75377be7c27a1e9facae98389f079e495195f45cc2a833ced74
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE36w:A3mnXoZjzyaT4aewsAjl5SaRaRaE36w
- TLSH T1C415B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 912KB
- SHA256 133f578919110964821bbd8b8d4cd6569c6971ebd8b92484acf888b8ea9bd8bc
- MD5 2d3e56481db925f1e625e057d30ab6f9
- SHA1 dff641e98b2603c68e3788858ec5d039de028358
- SHA512 666bdfef6ed12d4600dc5d40f3b4edd10cdd3527065c518eebafc50b228dd1063d58bc045cdd24002ac69b117240055be46fd9752acdcc52701a3ab7d9bf2083
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3BT:A3mnXoZjzyaT4aewsAjl5SaRaRaE3BT
- TLSH T16615B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 912KB
- SHA256 a7bf42514d7d2aedaa328c4622c43e2a581c815c3a82818478185174463f300e
- MD5 ed2c2dc642d7c64f05c8aefebee72a09
- SHA1 76362c7e6b2fe708b958a751f3b357eefd553856
- SHA512 68b3c1717fb27be1cd5bb8f9cfa5cf9b2afd54168bb54743db0dad20d5a883a61f40518032f0e6bf95222613fd47374753c0430cd4a5005244f3b9649354d639
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3vu:A3mnXoZjzyaT4aewsAjl5SaRaRaE3vu
- TLSH T13D15B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 912KB
- SHA256 1351af4b5dfdb6fffd53536a2f651ad6375d852eb6979426fb098b91d935d067
- MD5 fcd4972b93a37e0439d3da2158c939c3
- SHA1 7102cd311ab834002ce2e0ca25014191cdae4d78
- SHA512 780992534e0c692fe9ef0c64646767ec115ba7d5d7d79b2900ce40ae4dc522070e3674846e8392bd990e4fa142c699aaa1fe60cf2e9ce96cee59474c983d3d94
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Tb:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Tb
- TLSH T1B315B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 912KB
- SHA256 9c172b3e0d8c044d35a9f02979bd45e2aaceb96140cb25f01d1e38335d25fbf3
- MD5 dfc07f66fad404f3e42c20e1ade05e0e
- SHA1 f9a95e88c2acc6a7a5926195965bd8ecdadba018
- SHA512 3ff8478e957936413f3274fdc11c0bcdf1af47e477413e0ae4e642568d2ff2e4ba49faf92afe29553aa4c19daab013a6c86214d158bcc122ec922e19a94ec3d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3nf:A3mnXoZjzyaT4aewsAjl5SaRaRaE3nf
- TLSH T16715B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 912KB
- SHA256 0b1a09c9bdc1e6c3309fa11178d4c085e06ecad38049fef10c633e598bc01cea
- MD5 e5e4245b178fb45c06e1c6ccb20a54ef
- SHA1 da30fab576f07ac367c5e1587092885a7b205b90
- SHA512 16f52e22ab9c225102ea3b7091f448b0fb5da1b6b512ceb0ed1384a5cacf1c34b504d55095cc310c7377ae2a163e522a339f150d627900e778fd73d66f3051de
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3QK:A3mnXoZjzyaT4aewsAjl5SaRaRaE3QK
- TLSH T1A415B023EB7090B5D27B49705BA58713E7397C210B605ACBE3A88A5D1F317C06F3AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 912KB
- SHA256 d9bb171428d0fe5b00cd85e28b95313f5b28da027a9737a85810f5c71f5feed9
- MD5 ac9911a7330653e9e41dd478a38b6951
- SHA1 afa3a13d39e43c5ed4ba9b51816a04c8e2dda786
- SHA512 93b054c51e00e912f575a2960badfa77180f671c2ede9ece9b33a381751278f787146a71bab770dbb788b864cf0f3ddf91c742c2e9a591c1ab03317242d9b989
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Nk:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Nk
- TLSH T1B115B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 912KB
- SHA256 df0479628fc0e661919c847d466114f11c8e59cde102cff129707e3eca1fbbd6
- MD5 f16729546d3cefaaada7237424724ba2
- SHA1 80de58c8a629f30d426557ce5b2a16a839dd8b8e
- SHA512 480b8f508d655289dd11c3728e9ab3d3154ec86ce248b9a3529b34f2a933ae6a5f4e3f86943f2fe9e3e884620ec0584f4d4b9364a5ac11b9653f1c81444f1408
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3S0:A3mnXoZjzyaT4aewsAjl5SaRaRaE3S0
- TLSH T19815BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 912KB
- SHA256 d9ed655a7c8e7fdae3b308370e130f769d2baf64241894fe1174fa2cda8d16f0
- MD5 110986b0d59660c74909aad5d7dd5203
- SHA1 8486f241f682d455f1d2630db5b15b3f30fce73e
- SHA512 c5506bc2e470eb8758902672c33582a7d708af6ad99aad0e64b117eecf41d477cc69c97463617f9a85696a3468b0cc9c40224513778b5dbeb3440bcdeb5014a4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3h70:A3mnXoZjzyaT4aewsAjl5SaRaRaE3hg
- TLSH T16D15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 912KB
- SHA256 bfb534735f58ff10bd3873e1be808ccc13303030a0d72f43bb75c743c4752cfc
- MD5 1bbc1936dde18c3c4ae9da7218962ee1
- SHA1 5c6d719e4ebf9defb60013a6e5278a07b29e4b03
- SHA512 98ee03b68de756031a17d46972133d4d0b9af26a0af9786dc76119a8856d8824bc21d22255f88cc2f9dc46fb99bdc7352e337abbd77ab72509e41874a9660e0c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Ir:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Ir
- TLSH T1E515BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 912KB
- SHA256 4e45bb0eaba90ea1d1835ac08f10f3409c55559273b2ab052a8813c3162fb9e5
- MD5 1799bd5306ed12995883dd9efb951753
- SHA1 a5f0216f0b1c25053930a0ef76b3929ce66e7198
- SHA512 5411e67dd548b674d77623f99ccb90885e473482c1b3230d2fea881cd3df1a8c24f65a5451ef5467104bad839061d3f17328a980eaad419019de8a39c05e6ae4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3mn:A3mnXoZjzyaT4aewsAjl5SaRaRaE3mn
- TLSH T18F15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 912KB
- SHA256 d3716238e7bda035af08536ce4eb956e0908860e9752197bb4caeeb794b368aa
- MD5 81b5921f528dd7abd4f7ac10bf15f594
- SHA1 94be738907cbc51ab10dbe4bf4947b2ae86c9da7
- SHA512 5b04f1bbcca97c6152a2a184c33132b81e6c262679c1e11d97494c4e3ba684e653375366dcb2cd2256070114d9c9591b112348c13887a407c27c4230d1cc2438
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3sx:A3mnXoZjzyaT4aewsAjl5SaRaRaE3sx
- TLSH T18F15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 912KB
- SHA256 8a1a61b968c0ce8521bdc6115bcb0c20eddd9037eadda6d7de901bc930a82367
- MD5 61c78df37c8694401c8ade47fc97041b
- SHA1 4b2ac75110bd7b5ea3301632b031c438ed525ed0
- SHA512 6eda1f596196fc9817cff5408baa39bf80e196cc32924c2dde072fd393ef9fccfb661c77d2e2ed5b939b0761ee8c827fb3db9f6c5bf8897c88199da17483971e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3mA:A3mnXoZjzyaT4aewsAjl5SaRaRaE3mA
- TLSH T1C515BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 912KB
- SHA256 2fbf51990dca6c676c809a6034ca801b605187d963a70746629d450c3da1eeb1
- MD5 982ff9a7b2da2ac47c0d44fa1b93571f
- SHA1 c125dd6b6da8e7d4fb1dc7016f00ec0f2a805669
- SHA512 1182ac35be823598463b3344c3f8d2ada5a47663a687dad6c4cbf349367c6a57e6a0443e94c814f976bff634f02f083430e2ff1cf78ffc8053e0c9e5edcd1a3c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3/9Q:A3mnXoZjzyaT4aewsAjl5SaRaRaE3/9Q
- TLSH T13215B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 912KB
- SHA256 33ac46dd4935f51ebb5d3eb94864d9600733b9dfcc552e399002f82fcbe0d5e6
- MD5 3e7b98d8b30102d6739a616fdcbb8362
- SHA1 da6560e7c35ebee63d22cd298ece75867df27752
- SHA512 476dfa7e6af753e57424666238d2a503bbd9d3cc7b13164a93670a4c5b50ef5c5316784b2d18f68139e341d99328f68e4908ea8c5fcc87dea96b168063d5571e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE324:A3mnXoZjzyaT4aewsAjl5SaRaRaE324
- TLSH T12315B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 912KB
- SHA256 317f11c7011767876bae4c30fec3571d6d84d490553ba9624299b683d9ff125a
- MD5 53fd06ccc77c1685ac2971856e8740ba
- SHA1 5487bdab8cc4976aeeae2bcc94c9f843102a653b
- SHA512 f067da78df68d67d8f9f4673ad77e7b1d3825611c900f3ceec59c64d711033313e0099a6c590232b3360cd2cdbdbb63d88732e4b0b92dc969c13acffe70dbbaa
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3lu:A3mnXoZjzyaT4aewsAjl5SaRaRaE3lu
- TLSH T14D15B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 912KB
- SHA256 c389f126f83efb32f95a99f3f6da5d9ba73ac84eb49f34c9cfcb1740ee843ac3
- MD5 d3720baa51cd114220cb23f76ad62316
- SHA1 2e0c583bae875fcb02234dd34a609f065ec4ac0d
- SHA512 04d1c64e81de524dbb48f97f7999a3ccc10fe3fa8f2dc533ead9a8384622c111ca06e9e43e3205fb92460b414a55f20bd918a302a7bb9490b5373aec0e21e8b8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE34j:A3mnXoZjzyaT4aewsAjl5SaRaRaE34j
- TLSH T1DC15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 912KB
- SHA256 61151141733db0e26cb24e5c70482dfd9af9348a6b56881ce13579b76fa4cf0d
- MD5 feef5880090f3c320df975d27d4df5bb
- SHA1 51e3674491f93446d10c65618959444d5a723e4f
- SHA512 02fd0d5ee6e18d56017fcd802fe0313a7fb28dcb5232d2dc7a5f19e8743a3cbbddd0d3a15780017524f8b6e0f5883e19f198e9632670d735e7a99eab37608333
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Jg:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Jg
- TLSH T1C415BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 912KB
- SHA256 f8a6a60a2bac4a370b836dfbad7985c689bb37f2cd42af7144f0ed1220d35789
- MD5 1c02b7885f9e7612b954a7e7cd0cfb3f
- SHA1 927f5b7e7b650ae558ed1f0f9c9027ccf89f4a2c
- SHA512 faaa1d65c636ed11ce8b079fc7b5d6828ce3d30479e684dc907ab7b5cacadb8413bb3dea52deac630b4e54da7d886624e46e1afc0d3f2bae5a7092ea679f0090
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3QI:A3mnXoZjzyaT4aewsAjl5SaRaRaE3QI
- TLSH T1C015B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 912KB
- SHA256 d21f5e654211a422f136e02025c220e3a50423913ce945e2b19b53dfedee1562
- MD5 6d3f4cd00ef4906aa4d50adb59527e4f
- SHA1 63985899888dc4562eecac66bc32bce005b24bcc
- SHA512 30e3f738269f7b57de2bd5ab68ebd224501257696b35d1b91b567351e1489cda099e2362aada708efce7b2b82b25c9c09bed66f1111347a0f7325d83f22c4a00
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3So:A3mnXoZjzyaT4aewsAjl5SaRaRaE3So
- TLSH T10D15BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 912KB
- SHA256 a84649b3d95a228554b7dd00c9d7563ff816b9a17d05c4cf5bfbba03fb781c42
- MD5 fa2bd8f0163d78c64b45d8c56e7bff7a
- SHA1 0584e3bd3531a8a56f96d050ad064a849817e355
- SHA512 e8ca5d86c873b49c7d3d37839607fa029f6f42d48bf60f69320191c8da4aea6c157702426458873fc31effef9f465a0b053996b90093969aa528a7c0510b4cd7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3J+:A3mnXoZjzyaT4aewsAjl5SaRaRaE3J+
- TLSH T19915B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 912KB
- SHA256 c60fb2eb6ef2bffd454234a464e254d04032c5b7c483ff8f29042d52f83bb597
- MD5 2434bf4de0bec007f922ae89e8696350
- SHA1 6fb6b2d2f1a768b68148a1630d70da2bb2b175c1
- SHA512 7bd7c1f57430f33039f0bb69adbcb79f0e3531c6ee84552cfd375dbb0ea9ab1893bfdb1af0736d04ef5818301bb10fce3008bb6d8f19c70611077a843d70f519
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE33Q:A3mnXoZjzyaT4aewsAjl5SaRaRaE33Q
- TLSH T1E115B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 912KB
- SHA256 b88d3d649a8daf8314e6344cb206eb50d9f1ffa97027dde13b99074caa771007
- MD5 41c38dd314d9b37d02b3a98682bffb2b
- SHA1 ac0ce472dc96cc7370ef9cbe3af039e22496e067
- SHA512 f87f445861b52069d34c6706df606823b03466101e1938f2aef0cc0b135bad983b0b71782d9667acff77a863ae51b642ab3efecddca52597ba352686f0b3e364
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3MX:A3mnXoZjzyaT4aewsAjl5SaRaRaE3MX
- TLSH T1A315B023EB7090B5D27B49705BA58713E7397C210B605ACBE3A88A5D1F317C06F3AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 912KB
- SHA256 27fb8e178af9787a86f2a5952955d768250bdc91cc6023ec2140093d7cf4cca4
- MD5 91ccc4d572d0e9633d2c556c92a7fa19
- SHA1 e7ac8ba3766e2cd288645651e6fbc043928d112f
- SHA512 d4260bea113534f0b68f194b629a7cb9477e48685b3eb0f16f2c179b90f2d97ceba0965102d4b3876f5d072cdea6451ea5bb4074be19cc4de1cca666e3155f9e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3qL:A3mnXoZjzyaT4aewsAjl5SaRaRaE3qL
- TLSH T11E15B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 912KB
- SHA256 0969d550315ed94b949fa522fb9c78706aab11c14cd462a62c96f5b2a3f67343
- MD5 ac6498678bc48f0e4ab9981b02018bc4
- SHA1 f19bd9365f39a82766fc38b22caa4c2048e2af3d
- SHA512 a6617a0634b95d3d12d91ea3042c3021266bb20516775c989e6aede4399e6b40636181109b93f88a314c40e8d1544d127f565ee9dff07f1a6908468ff7a3c22c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3OFC:A3mnXoZjzyaT4aewsAjl5SaRaRaE3OM
- TLSH T1FA15B023EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 912KB
- SHA256 ca34448893bfec7080edceae7c0010d8ca0d71930c24a3fa4bbf7cd282f92229
- MD5 3a8cd8c4b1f88541b243155c43d02295
- SHA1 4140864ef88a3aa94cc6d720744d53514076ce1d
- SHA512 b0836d0f7bc224a3116aaf0e7b1893978b85d175dd6b8e9ef59177e47a7fd5edd67c18c2656e5746647a26ea387e5bdfdd4cfdd2f163df0a87cffda2fa003e7c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SaRaRaE3Xh:A3mnXoZjzyaT4aewsAjl5SaRaRaE3Xh
- TLSH T15515BF23EB7090B5D27B49705B658713E7397C210B605ACBE3A88A5D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH