Analysis
- max time kernel
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 13:17
Behavioral task
behavioral1
Sample
2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 939KB
- Sample260711-qjrtpac19w
- SHA256 f7f02545e825c7d746ce6f88826b1446e6521d3d66f7fb5f5798011e8b28120c
- MD5 63643e79f9e69dd523ed8151e712aac2
- SHA1 f101d92a82d4651846bc16190ef27e39fa6af767
- SHA512 a8608a0d35cbf90b8767054ca29584a074090a4fcd5e19069def849713457bc4aa42afe162fa01c388f93ab181102793071bf912a483738e4ca03efe0167ff75
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFC:A3mnXoZjzyaT4aewsAjl5SapHaGzM
- TLSH T19625B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/5088-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4a9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5088-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6092-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-35.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018992-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a6c-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-237.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-275.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-432.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-488.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-603.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-690.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-753.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-809.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-944.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-963.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1061.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1086.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1161.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1355.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1495.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4a9-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-35.dat aspack_v212_v242 behavioral2/files/0x0004000000018992-208.dat aspack_v212_v242 behavioral2/files/0x0004000000018a6c-209.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-237.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-250.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-275.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-432.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-488.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-518.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-603.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-634.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-690.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-753.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-809.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-858.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-903.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-916.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-936.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-944.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-963.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1018.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1061.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1086.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1105.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1142.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1161.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1181.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1195.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1208.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1293.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1336.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1355.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1380.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1387.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1388.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1495.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6092 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5088 2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 6092 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_63643e79f9e69dd523ed8151e712aac2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5088
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6092
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 939KB
- SHA256 f7f02545e825c7d746ce6f88826b1446e6521d3d66f7fb5f5798011e8b28120c
- MD5 63643e79f9e69dd523ed8151e712aac2
- SHA1 f101d92a82d4651846bc16190ef27e39fa6af767
- SHA512 a8608a0d35cbf90b8767054ca29584a074090a4fcd5e19069def849713457bc4aa42afe162fa01c388f93ab181102793071bf912a483738e4ca03efe0167ff75
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFC:A3mnXoZjzyaT4aewsAjl5SapHaGzM
- TLSH T19625B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 968KB
- SHA256 b3902a39100cb01da120c79f2604bd803a5dc4236f0ab8f026ab44be3cd5a4fc
- MD5 f4fdc22ca7cc12471bd355ac5f8c673c
- SHA1 496d697a05583ee32b276ad4f4f6c2cc05a1b908
- SHA512 85c35377f592d5bfc21b09154c5e03f18858d1a2d5a6db5ac3556fc8e0fd871cb21a71bfc03deebe2668aa7eaa5634ca170f77379993a93eaaec4485d898cac8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFUP:A3mnXoZjzyaT4aewsAjl5SapHaGzWP
- TLSH T10C25B023FBB090B5D27B45705BA58713EB39BC210B6056CBE3A886591F317C06F3AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 517271a8e0c9826f3c6c65f352619a22893bdafbe60c9518738dee44a7d93d29
- MD5 f628593071961d9327822f02c168d8c0
- SHA1 34e3ce99f69b2b37203510954377a6779e2ee93f
- SHA512 25a42d190369a827cc8e0f419f293ac1ead32edf707ec7d3b6ba273cecadaf9670fa99634f163f3f21617a2eae061cc441cac576850703b8c929080a086f7211
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjl5SapHaGzU0Le5ji0hmxNrM:A3kMPljQPji0Aj
- TLSH T151658D22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 954KB
- SHA256 149c4931b767d8ce8823cdc319d27a5f1a00e1c5928dc119fddb129ea84abe5d
- MD5 ce5e3a5335ecd4b62242b931a82ad22c
- SHA1 77be0f9f66b9042c518153669f1eef9f92c5d6b9
- SHA512 866360eab5b92e58d74ec7c8bc0e04756c435dc6e82094ed3521bdf8f1a201056fb9a0173ba741d525ab831243c687bee2eacc990ff18db660df583ee2b0d6fd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFMa:A3mnXoZjzyaT4aewsAjl5SapHaGzea
- TLSH T16D25B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 963KB
- SHA256 beb47c2a85058d8089f7744da277c0baa919b82fded24963333220a593d036d1
- MD5 2987b69f4acd099ce5c9a02355db7720
- SHA1 019dfdcbaecf6462da67c1391cc28fa9322a5b3c
- SHA512 6a6e73b7b84e92494e6a67988bacd04024ae49112c4d2a190e28d1b1b9a467be397aaf446bbf2ed890fc1a94ade83e500f3b6f1b9a6db794a181b50ffca53811
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFGZ:A3mnXoZjzyaT4aewsAjl5SapHaGzAZ
- TLSH T12825B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 963KB
- SHA256 db9be2140845afb43bd440e152b9eb8cdb4dcd54be2df77f8f775bfa1736ad59
- MD5 2d76256badd693dc07045c9678ed9c59
- SHA1 fcda604c4124db9ecc185ef2a48768830ee2a5d8
- SHA512 15d82dd51667a50a318ffb3f6fc449cd6dc53b72c82e996b0994e15c8704fe2e0e8d91450cd7841ce765eb4a0c419e8959ec8a116dda5e163de20a5a40fe1397
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFx1:A3mnXoZjzyaT4aewsAjl5SapHaGzn1
- TLSH T15D25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 963KB
- SHA256 86da01064cdefc652879efa3ee0194f0a0be5d9fdb42c41cdb2bca1d01616668
- MD5 f2be5d98a9530bec853b82048be46dd7
- SHA1 5c58b1dab1dfc7b894905b819522c6abe01d13ca
- SHA512 03b70a61fc5a0d8166c24c4e02be5443034c5c29013f737bb041f78ef97a9a3fd3670ea4ffc7c66aec637f9ea705c87311e79a3e40809e18913c73a0ac06c9c4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFl6:A3mnXoZjzyaT4aewsAjl5SapHaGzf6
- TLSH T19725B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 963KB
- SHA256 54a755110f53984be3dc59c4ffb9c57f51ec1989975ffc6fe3c83bacbb73205c
- MD5 67a7edd111ccf0ba8a47b699b74bea9d
- SHA1 f42af37660465c29a475d611748eb09c5b1d17a9
- SHA512 00405ada59a60bffdc8af2a261c9d6f2528db7cc513c5881fae51ae6f78c4c30c3434572d3aa5ce75e8065d6572949e993d6442a0120cf72e9ef453445a6ea9e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzF7N:A3mnXoZjzyaT4aewsAjl5SapHaGzBN
- TLSH T1FD25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 963KB
- SHA256 3b574b513dc545a691a33fee6fe547916b91ae5426b02e96c7332455bdacd036
- MD5 a751c79a784c2f3756cd199e07bb1112
- SHA1 98d43381b216ab042ee5167ca4a1950d57b47dae
- SHA512 b67946a003174d340fc6c97678329091772625f789c0357f24ef22e8c99695c50eaea2686292982d3bb255bc4438df61b19276f3e9fce408984bc4d9e6c8cc6b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFZf:A3mnXoZjzyaT4aewsAjl5SapHaGz3f
- TLSH T1A425B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 963KB
- SHA256 b37142d6c6588f1c7a09002a7b2654a232941f8a20d6e8386b1a9154f08d3c18
- MD5 9bc4e2d3ad31564b19d4d26316d0b525
- SHA1 750fce2cc4b7e7c62b0f3c991aea8cee10abf9c8
- SHA512 24ded07ce2d78d083d541f1eea55250481a60cf0b491d20ea9ea2cd407ad1f8810b74fce2aa0c7a1a52151198cfb50a8359e7ea721bca21ce8c6400a8bf7f7cc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFbo:A3mnXoZjzyaT4aewsAjl5SapHaGz5o
- TLSH T1A225B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 963KB
- SHA256 2cdeec9c76987fedf71133c1999e8cfa44c8526b2db5280f89e6ffba253670bc
- MD5 8456a799fd87199a42be480e99f37992
- SHA1 afd650aec554b5c1474d5287d05f5fa70252824b
- SHA512 e2761b2adf550cb7d9d1b97014c2c5a15cd03738065ef43eda53a770a52baf370f9189e29dae46cba39fc2fd13cce7afed74740b99ea40a031298bf6b5c213af
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFPu:A3mnXoZjzyaT4aewsAjl5SapHaGzpu
- TLSH T13C25B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 963KB
- SHA256 44959a5d084ab7b7be122e199c58307a36748686cda0a6e4d002ed17cfaa44ed
- MD5 7f77b5fb8f85e23c8c88b35a3d381f07
- SHA1 88f495c350c0889cd82e589e2f53aa2c6220e11f
- SHA512 c1aa1915150dcf0f29f0f9c6315c97833013eaad8ccfd3ff15a2aa46ac96d47cf37422f246b481c157621f0f479c35704720c09d17733f7c5e652860a94a476b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFd9:A3mnXoZjzyaT4aewsAjl5SapHaGzP9
- TLSH T14E25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 963KB
- SHA256 f61d99774cd03fb266052a6c4b72415ba0cba2fa21f65bcf076973821c536204
- MD5 f562f4e7466424291a82ab31dcac51d3
- SHA1 c86fb55aafc3a333d6df711a0feed71bb57521f0
- SHA512 1589b48097425b9eeb834ffbd52dcd454fef32dd20ab8ca72df5773a955f0915ab967ffc68857e3fe887d14469c1ec0e397b3d000af366cc2e55f2edad431064
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzF5c:A3mnXoZjzyaT4aewsAjl5SapHaGzrc
- TLSH T18025B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 963KB
- SHA256 9a204c247ca26df1c10e4da4a84a457ad22f7fd433c2af8c418905e81f78f0b0
- MD5 953a6e66565f0e9bbca0458e970b79ca
- SHA1 337a5b4031c5900634c9c3be3fd0fe29e80bc1f6
- SHA512 bd20a62070738261690de564174f253f6640a3b2d8835e5bf2024880b5acb0a14c77bb5475ad9ab3fbe2f38ba352368be8fdcaac1f45fe490de56085c3ed688f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFyp:A3mnXoZjzyaT4aewsAjl5SapHaGzUp
- TLSH T14525B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 963KB
- SHA256 00b1220af37b98fea1f0fe1f5831033e0c3a82801ed6c8dfe6b34beb531dc5ee
- MD5 b624516d5ab6c16720ae416d1a45f379
- SHA1 aecd2355135891796f5ffa6474666b1f06a42337
- SHA512 73af66c92af402bde121e08966240f4cde50e8ace21f50dd6d24a25362ac6cc152e434409c4c698f229d921538c29255395728b92a68c3fdb4a71a992f745636
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFF0a:A3mnXoZjzyaT4aewsAjl5SapHaGzbN
- TLSH T1A125B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 963KB
- SHA256 bf2504599e3ea0f1438f2f8e2cabdde08778e10477bdb7bc82bf40e344d2219b
- MD5 9fa6ebcf904d4697a06d62ba92540e7e
- SHA1 092267743efe3444607ba9f74bd80ab511906b9c
- SHA512 36f072432a2cea6198bb29785bcbd0525017dfd9ad2253169f81e97130e356f552c2ed77b258687901dfff96befd5871fba94e74658f8c6029ee110f86baea84
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFXF:A3mnXoZjzyaT4aewsAjl5SapHaGzpF
- TLSH T14F25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 963KB
- SHA256 9301d4af2a24208d450c672d7e3dd4101022863372142299a7f99f877d047972
- MD5 f40a77c94d1dd196d565ef552050450d
- SHA1 d43d5a62fd89520659af9badd6d28fc389ea82c9
- SHA512 f537d42dd0955f34de16e8d64b43115e15dc372639c8a4ae19b4397482b819b8e4bf5bc297f4bd13529a38e45e1d2ce7e101c6ff69024d133f3ea54400ef7a98
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFoC:A3mnXoZjzyaT4aewsAjl5SapHaGzCC
- TLSH T1D125B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 963KB
- SHA256 541a0d3b2168ef2a37cf34d0359ebfff548a27ce241ee2f984bfa0929d40434d
- MD5 75a1b67ea20149232bc0f2c989ecfd08
- SHA1 6cb65e8aac30de4dd1d00c59950489e95457f385
- SHA512 28c0c2f95a728fb51a53f5d94ba2202995a4e8cb86e53308a0faefc56e9bb1d4d3892004a89ddbb60acc6af673d3192f3d65436b7cbad192b3ee61f580d992a6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzF7w:A3mnXoZjzyaT4aewsAjl5SapHaGzdw
- TLSH T11225B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 963KB
- SHA256 62eab02d5b1bb550f11d0ee343345f8c9a39dcc19f5627dc23d5745421599971
- MD5 5bb27b2179651850803940317251d61f
- SHA1 43e70580ce2c041690a3feb853c0430a2b66f3cc
- SHA512 9c617da0adb3bfb80f1e5da6eb3bebf42ef1d889fddb19aaeb8b928594cca1baecebb28d7a55efaf5dadeaa52cdd543d09b0dd245efde8b4b1b839caf595ad22
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFCT:A3mnXoZjzyaT4aewsAjl5SapHaGzMT
- TLSH T13D25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 963KB
- SHA256 c12a8ae8816bb397041791812a63525973136e5bf58c1358256171db13d860bd
- MD5 8dc2ec935cdc3c29c6de213f2c68bc3d
- SHA1 b4576589f76dfca2f654f6894f269fe0e29585b8
- SHA512 38002ca865b9bd9bbe421af042cb5fd3f3419bf7535717147dd64d6402e79a5391c36570f4278a906000bcb18ce9f938d64ad5adf9da0ebf4839ecc2539a2088
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFSu:A3mnXoZjzyaT4aewsAjl5SapHaGzgu
- TLSH T14A25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 963KB
- SHA256 e45ee2456118a2490d4c819e42d6071c0d40bb830fe0648b74fb1eb127ca307e
- MD5 06a047bd796466da6cdfb632f4dba2f7
- SHA1 af2c7cb8e5dceb6fe93321b0ee64d48f65dae50a
- SHA512 e2ade0aaa5f88559c196bab6cb2579d6726a7abba712e00fc45f088c33bd165e6372c1c9759c7bcb0083fe68043badd9eb70b8ff7bf40ab71e43003cbb9b86a9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFMb:A3mnXoZjzyaT4aewsAjl5SapHaGz+b
- TLSH T12425B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 963KB
- SHA256 06724642218538a58aa21d576b74e0920764878c4c4a7935a95efabab5914766
- MD5 86923397657c878bd47be84e24be439d
- SHA1 1cb52d3499f666177df8922ea833915e33e25e0e
- SHA512 6c50ac6e9b17cc334e61281c67bc27b05be375d946fbc3f451acefd60ce701d245e118b4740ec6f741991291c6a4c63cf5fd3869a0d195d2d707c6cae2b1b8e9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFyf:A3mnXoZjzyaT4aewsAjl5SapHaGzof
- TLSH T1DB25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 963KB
- SHA256 8ce4fa1f5b18a6b61679f39a15a864eb8f122b2236e0c8f7a56b82b3eeea6248
- MD5 8dbeabf2595899c3b7da7bb803521165
- SHA1 debd6d83803f00229946bec12d4b2abbef113637
- SHA512 b7f7bf34a881f5f9c9981b2993136b54ecf3d8e311fb26cb76cc3ac35c685267679cf8f4551d1da72fbba637e920c14847beaa27618cade46160e4018ff1e6b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFfK:A3mnXoZjzyaT4aewsAjl5SapHaGzFK
- TLSH T14625B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 963KB
- SHA256 8b5dacd8fe91a1972797bd639530b62b7763323bdfc979d4d9a4040d63c58bcf
- MD5 578a034c009dc944acb4675f230b9e51
- SHA1 dccbaf858b664b2bd6fa257e473ba230f7b627f4
- SHA512 6dceecf8a8398944b7f5b0dc27eda536ecffb804b532cffd38283e8d04c21ba18d45c366395bd73e32be023172248d305085ec524b62c530358717aa79dfe4a4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzF4k:A3mnXoZjzyaT4aewsAjl5SapHaGzGk
- TLSH T1BE25B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 963KB
- SHA256 08342f50c2a1c63eef6a1113d938b5e193452ebb82a60e6c239245375f8de75a
- MD5 2054ede5764e5988c8622067eb7d9a09
- SHA1 cdf4c8e126741d211f28600c46a52911bfeee64f
- SHA512 972fe0cfbac8fbc8c2aceeee5358137ef121c95e5fb587e13200c76e28fa5c506f051b125b3d214572eb340ef249c9d1a0ab263e24c0091b31c90087b13abf58
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzF50:A3mnXoZjzyaT4aewsAjl5SapHaGzD0
- TLSH T13125B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 963KB
- SHA256 1ba4040cdaad0fff0f7b8b0dc3e1be7e755f4eae214607504894bec9ada37df0
- MD5 1626b6e820db9459cc2a96761d79bafe
- SHA1 b28ae50cef550c8ec32b16a16ec2d76a886a4669
- SHA512 68c4a620bd8da2b1fca99aebb0e651cd727364955331ec297f09ea4d0618b2f30a2fc86bb5082842adce6846a4228613e07f44cda9dae4dac73dbc639c264b2d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFs70:A3mnXoZjzyaT4aewsAjl5SapHaGzSg
- TLSH T1B325B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 963KB
- SHA256 b6514eb2556ceef70f1a90c9fd7a580db55209f55328a9c64afb71d4d7262491
- MD5 ea9b0c1d3aac4f59f86eae7b71299019
- SHA1 b6e90734557bfa798f8935c6dd5245f0fccfeef6
- SHA512 9b9428253d0fd27db92685a94f37fe2f42829bf25d99d982d2e433024fed2b784aedb393c6bdd7b210a6201fbdb391be25daf32d1d272424c179f31b798a8612
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFJr:A3mnXoZjzyaT4aewsAjl5SapHaGzzr
- TLSH T12F25B023FB7090B5D23B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 963KB
- SHA256 4fb04fdb95e245dd37b18b48ce13134072a2fd832077a5d99fbc086aac29ed15
- MD5 654555d74fb30b369178ecb4f4ea6fb0
- SHA1 5a125f74c8a56e1201feb18b523f6cc1a7cdfaa1
- SHA512 a3b0bca424c7e784933043bce2a61837c56f916053b8b76fcd75416ea18ae4acb1a1d5b066804e14bb3bdfda959cee54ef36876db185935e923e1104b386426a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFrn:A3mnXoZjzyaT4aewsAjl5SapHaGzVn
- TLSH T1BB25B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 963KB
- SHA256 b6bb03eaa3251aabdc68b3a73cbef6bddb3facaee00475d3a24457a75de7f68e
- MD5 40f7ddd1f2ea4fe06625eb34964027c3
- SHA1 b81a25009e0ce1d2b42f84d654658e7dd237158d
- SHA512 bb28c3626f2404cc2e22c8e4e93627284d5e7c8b0af132e6cfbf4242299c36db549ebc4c4fd0c50af1c84f5f09aa2c69d2933806386f750c163b67a7a29ef64e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzF3x:A3mnXoZjzyaT4aewsAjl5SapHaGzhx
- TLSH T1F325B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 963KB
- SHA256 dbc01a60525ed9f007a2721dda8d8f1512861279326fbeb450ab22dd1953a50b
- MD5 7eec21321ab76aa1a7c9a84213394497
- SHA1 e3f5d356530f5e852e7612dac16089d68af06ea0
- SHA512 4c8438de1f7d9ca250defb96f74a2064e363938bf46ef1a29b5781c10fb2cba2e3e736d31e64cd37c9ec565811f226f2a9e68f0f2099da3e85868f98db9e26f1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFtA:A3mnXoZjzyaT4aewsAjl5SapHaGzPA
- TLSH T19125B023FBB090B5D23B45705BA58713EB79BC210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 963KB
- SHA256 743a18f8975598fb232c6f2e5370773dd1c4bd06bb67ca06ac3efc920dc3dff9
- MD5 130f066eaa0c4c07aa6841414987088d
- SHA1 2dea302b8d347695a278cafce64b92a62b4a49af
- SHA512 d8bc36f143601f2a8c03832a98d45af64bfe3f6b2467a8146691eaee566ba6024e0ec41615e35fa55552287c75977535b0fe4da922743c1630ba05515a664d08
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFm9Q:A3mnXoZjzyaT4aewsAjl5SapHaGzA9Q
- TLSH T16F25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 963KB
- SHA256 8109d23f75ebd2805630f4150caea3b436233930b6661734e13250db9e600d7c
- MD5 5990e6ee754d0961f268f5a84ba1d0b6
- SHA1 b7e305cdf5ce642d7875acbdbc8669d2dd16c8ee
- SHA512 0f956e8c3eb6d9fa634be3fb9ed7bb08c2ba46087c236ddedc37a0c899f6c96f12cc29884643a37898d92c207f9678ee165d12a084d051a027a8cbc95b885850
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFD4:A3mnXoZjzyaT4aewsAjl5SapHaGzB4
- TLSH T13425B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 963KB
- SHA256 64b3cc892bae62d44b455738bcd78d2d91c47694b27b72be81e09e9fe5b914b1
- MD5 f562f8df5ebc281940623d0fdba30e5e
- SHA1 fef6e0ac039edb07068d3b91a6cb5acdf6fa5a18
- SHA512 e8a4d1a86e16bd525d40433f443a3fd4f14443b9c097032ac1adc741e6b5b758c1bff21dcc3011280248e429059e3025c71a22ec86e7f03fc6fe2a6fa7034727
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFqu:A3mnXoZjzyaT4aewsAjl5SapHaGzku
- TLSH T12B25B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 963KB
- SHA256 4d73b7911b4dd291ac03fa18f024bfef68bf1a68ef42b84d0e1cfdeac38b1494
- MD5 95124f8edc9caa04456a289d125e661c
- SHA1 bf341826e4e5a7a5379e8c70d5515bc9f8a0786b
- SHA512 24a16d5defcb14107609e11b716e96207132f1c821e0981a8d23489b4159db84eed33b8450d7ac2516b26b8b3ffe73942742dd2c6fc503fa7d08a628d918489b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzF7j:A3mnXoZjzyaT4aewsAjl5SapHaGzVj
- TLSH T13725B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 963KB
- SHA256 24782a78b672dcb7faee6ae39abb8060263524bab6289c7b45c3913bb7c5b0b0
- MD5 21ed57cbe66777d9876ab6dc9e9d7194
- SHA1 1568a96ce46177d1ffa50afbf9308be735b4113e
- SHA512 05fd1128f544331bb72f9837cba596e59445d2cdc648d56ad6d67aaaae19c033b203cf04d349c289edea1ef17e0942f0cfc0410dc28afef797e35fd9638215d0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFGg:A3mnXoZjzyaT4aewsAjl5SapHaGz8g
- TLSH T10025B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 963KB
- SHA256 c0327c6f27f24ec5ad77dedadff49bf533aea87ae45681a3f0ac0d160db4dc0f
- MD5 0a2a37e4e62b6dd3a4061594afe62bad
- SHA1 fbafaedd707577eac32f81826472b38a61c990be
- SHA512 6a9c69bae8e237af62ddaf0f31febe45699b0c31ffe56adffd5f795789a5a0053e8393fbdc2df632d27a5c9cb81b42e6dae7da235ea3c4a63fb01ae007d94841
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFpI:A3mnXoZjzyaT4aewsAjl5SapHaGzjI
- TLSH T18525B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 963KB
- SHA256 4768f18788a6ad9225b0d53ebd5444f691d0f5e31a1f2963cec5d75593a01a7a
- MD5 b61049967180f1a3afbe7da12484c9ff
- SHA1 f67f4ad2a8d70d1bb308072e8e5bf5688503ec7f
- SHA512 f3e5ab56a57d60487c0050b87d64efc18faad9b52635374737ede2f4cc35b9f35ac458cad3aa00acb31df79543a1afb07b98ccea57965086d523212f8c459e75
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFLo:A3mnXoZjzyaT4aewsAjl5SapHaGz5o
- TLSH T11225B023FB7090B5D27B45705BA58713EB39BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 963KB
- SHA256 c90c5b5116dfb2e628cf79283f568046636b145f2f5073e9cb1e6c9890921391
- MD5 20b1ef9c58a9b6fc96509df3b67048f9
- SHA1 b610ed3b61dfc4b137f74a7fe5d1c7cfeea8dab1
- SHA512 a159357952ffc477b35c7b49d5b1c85b0025359857c46c863ebba3ed7a1c52370e345313be13177a2268c128cd65f3b38e5aa201e167c57e7cac734a39c79694
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFw+:A3mnXoZjzyaT4aewsAjl5SapHaGzq+
- TLSH T1A525B023FBB090B5D23B45705BA58713EB79BC210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 963KB
- SHA256 b40c6ca2e263a45f2a896d064270f8f2340673a521e91d915b76df7f432528a2
- MD5 4653ff968cddb8dc93e66daf96bd6dae
- SHA1 3cad803bcc11c27bc7fd00ef342fc4de78ca2c9f
- SHA512 c19c281c331c3db64621009ec1ee8f7cc539bc5a6c018c0d0b88eccc006f00b5b2eec597f0099a374ed0b61165368d1472e58d5db49bece08271482944d1054d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFIQ:A3mnXoZjzyaT4aewsAjl5SapHaGzqQ
- TLSH T12425B023FBB090B5D23B45705BA58713EB79BC210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 963KB
- SHA256 4dee84747b05abf62205108a045b9f01f81f314db479903f394bc3bc37aaf7a6
- MD5 d76f7bddb93d2a5f51d4518e4c276201
- SHA1 7d20f0232aac8e8045cc4e60ccbe56304571cfdc
- SHA512 66b03330b2050e94b892d4cef5c185edf6b4564e97202662ee5eb1aa570a2a645111641997f49019e3e3840479e90d864dded59c1b45271a0776a30b38fabfd9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFBX:A3mnXoZjzyaT4aewsAjl5SapHaGz7X
- TLSH T18425B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 963KB
- SHA256 03892732439f42e7c05b8fe0c180002c9b319fd2f2b6c5dc117196c24a49a33a
- MD5 5ad1547dc2039e681b225a4fee87d3a0
- SHA1 d82e2eb918ab59e02bd5cfbb65bb9d0261b1d090
- SHA512 4861b5e85cea2fc96ff0607d73e098314e33741654f7c57bb0aec4a90b5977f321216b6c069ca1911ae8f967c6ee008063d19cf4611554dbd7b5a20772b09552
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzF7L:A3mnXoZjzyaT4aewsAjl5SapHaGzpL
- TLSH T10625B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 963KB
- SHA256 02641d9d28e1d2170aff99c19b7fb017906b9d5083112bd9c70491d46e96b0e0
- MD5 852a6022f4ec2183596c6a50b952d543
- SHA1 66e4a3c8f8bb9e9c14a9ef2e4b76a8b6cc4d7919
- SHA512 2334e1f55a32ba2fe266793657813c9a0028479a35ba10b808e743d33aaef76e754219f600dfde85e1dc500985b67de73b3ee4f20afb901dfc7d4a6b4ce2ba7a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFBFC:A3mnXoZjzyaT4aewsAjl5SapHaGzXM
- TLSH T11B25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 963KB
- SHA256 70730cd6f11d355b1e43b70d8d1d35a54d1a5a952e211cc809b499353a4e0693
- MD5 fab3b90d7602f992461aa564292efae7
- SHA1 2e2893524c9dba518944682d31a1c4875e7e063b
- SHA512 06b3e560ca87908d780fb2349c48a397af0b0b6c236f4112cf318436b28558c234ccf508291c1d61aa26824b9aa3c1d2cad35c81a086750d72b8b147d83e4c5d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5SapHaWfzFqh:A3mnXoZjzyaT4aewsAjl5SapHaGzgh
- TLSH T1FE25B023FB7090B5D23B45705BA58713EB79BC210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH