Analysis
- max time kernel
117s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 14:35
Behavioral task
behavioral1
Sample
2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 907KB
- Sample260731-ryf66sca36
- SHA256 ad1d3176d310f82e793886e2deb8b62c546343256ac7d2de637e26a3d17fddd1
- MD5 490c3e83167db007465d30a69bf6131f
- SHA1 9686e40a1f11f4c0f3ecd13ec0726a5b7cdb1939
- SHA512 c1375460685125d7f51bff08cd1af16fbf108c0a79061ee5dcf33326b95c76e557e3a07bce247a4735f3344e90dea93c97e141ec7cb1905833e668243cf3510e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/if:A3mnXoZjzyaT4aewsAjx9EaB7/if
- TLSH T12515B023FBB090B5D23B49705B65C712EB397C210B6056CBE3A88A591F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/5692-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c458-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5692-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4612-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c84-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018978-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a52-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019844-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a54-355.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-586.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-636.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-772.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-798.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-811.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-860.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-918.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-944.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-963.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1019.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1076.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1101.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1114.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1151.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1196.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1233.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1350.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018922-1531.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c458-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cc-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c84-59.dat aspack_v212_v242 behavioral2/files/0x0004000000018978-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a52-210.dat aspack_v212_v242 behavioral2/files/0x0004000000019844-230.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-231.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-251.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-270.dat aspack_v212_v242 behavioral2/files/0x0013000000018a54-355.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-476.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-586.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-611.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-636.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-772.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-798.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-811.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-860.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-879.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-918.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-944.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-963.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1019.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1057.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1076.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1101.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1114.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1151.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1170.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1189.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1196.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1233.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1336.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1350.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1364.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1389.dat aspack_v212_v242 behavioral2/files/0x0008000000018922-1531.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4612 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5692 2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4612 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_490c3e83167db007465d30a69bf6131f_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5692
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4612
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 907KB
- SHA256 ad1d3176d310f82e793886e2deb8b62c546343256ac7d2de637e26a3d17fddd1
- MD5 490c3e83167db007465d30a69bf6131f
- SHA1 9686e40a1f11f4c0f3ecd13ec0726a5b7cdb1939
- SHA512 c1375460685125d7f51bff08cd1af16fbf108c0a79061ee5dcf33326b95c76e557e3a07bce247a4735f3344e90dea93c97e141ec7cb1905833e668243cf3510e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/if:A3mnXoZjzyaT4aewsAjx9EaB7/if
- TLSH T12515B023FBB090B5D23B49705B65C712EB397C210B6056CBE3A88A591F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 960KB
- SHA256 d184992e6e0d6adbafc8ed6cf761373496664b5df4070ebb6c32066da6e1ed4b
- MD5 88fd2aaef4bac75e7741a7616a281c3e
- SHA1 0f8ba3af0eb8d036def4e915a17813464fb28419
- SHA512 8e43aec17d260a234469836dee47d09652bdb64bc27fd678e92999c2499a5b03e0e54d4ca913fd0d38b94f12471d3b8716437eee807fa9468194f412519b8ef0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iIFfj:A3mnXoZjzyaT4aewsAjx9EaB7/imfj
- TLSH T1B125B023FBB090B5D23B49705BA5C712E679BC210B6056CBE368865D1F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 03a9b03cc72e933886f8f9caa9a6149c8103e7f17b128bce9321fee8f01f0254
- MD5 f60d1f986b2b0c11cb9cb72354c41290
- SHA1 b1aafe2012deca8ad7f3dd3aaddb698d525d2bf0
- SHA512 6efbaaa659b2e339882f5365c31492cdf691c9f1d864a844bc64c425bb660f251cc1f9366d56519a8982fdd24a5f18c4f20302b722cd1fb513bdeeccd3d622ef
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjx9EaB7/iL0Le5ji0hmxNrM:A3kMPljUPji0Aj
- TLSH T147658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 955KB
- SHA256 925b3c9a3645e7ea8eda0559426f74156e8a3941014d7cfaa959a1aecad0b2f9
- MD5 a4eccd2b3babb70cdcbc3adcba9458f0
- SHA1 8db23b6b8b191630497af47d68161c5f935250e9
- SHA512 5fd6dd7b404f5f85f8863812cd64d1c501d339efef49f45cb1c32d436e74eab0ab8563377a76c76072a2bd75688ed3f28f5f5adc65f57a927de1c09f67d64cab
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iub:A3mnXoZjzyaT4aewsAjx9EaB7/iub
- TLSH T19C25B023FBB09075D27B49705BA5C712EB387D210B6056CBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 931KB
- SHA256 16b3329ff0faffc69a0396245e7e044747cdf1fc5863d376976eb6a2c5963ad1
- MD5 6e31207f51b91a8cfb4d1b6a69d3b8e3
- SHA1 174d3b8dff74b9ee59fe6de2a1af5b1f6b463a67
- SHA512 f766b0322b572804566c2185e852d2a5e4a19d11b5b8441b25a03496d2eba8cf14e93e3b46cfd5314b024bc7b2e6d6b7b7555b9dc8864495e30b7d4f42b21e12
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/itZ:A3mnXoZjzyaT4aewsAjx9EaB7/itZ
- TLSH T16A15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 931KB
- SHA256 1ebc442d0d0ae802872fbaa44c82650fcc8214f2d21aa867fd35fb1fe8a1e720
- MD5 1c8876d42e767016d99767c8a82965e0
- SHA1 cb8416fb16c45b72bb891d302157f12d593b2ec9
- SHA512 c046c2dedcabe45edd37eb1f7fa6a608feb9db4c236735438d3d2d840dcdc204dac9cb0c1f7807456b9b84733cd1abbc5c67ceb161223ff36bd0c1e1a3ead553
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iW1:A3mnXoZjzyaT4aewsAjx9EaB7/iW1
- TLSH T11815B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 931KB
- SHA256 b6d59feed98380e846cb9a816fa4ee0524ea07c18f190943c87ab90e48c54d21
- MD5 2d41abe7c1255546c251254ec7e7ba0d
- SHA1 f23c4d8054d5932deb279a9877c00d300e133492
- SHA512 1b08633ee095ae16ff31c8c259873d1ac39d1a8406761621723c643373da75da8317f8765df8e54a4998e13bc0be2ce2b5f163ec44cce857a872d6d534147994
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iE6:A3mnXoZjzyaT4aewsAjx9EaB7/iE6
- TLSH T1DA15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 931KB
- SHA256 e36052464ad449ad5f42c6ad38c4a16556084b449855904a607027d8798b00e8
- MD5 3d3d52e6e22e26a3c745d4316f1a3c58
- SHA1 a34aa72428ea1dca5d8bf03bce42d26fff9f4bc0
- SHA512 78957132c4f13ef936b9f070a0f77278d1fa5aad6bb16a44bf4fb40bca31f72357be7f20f1d894713414025e15dd52b8f1aedb0e418e5622109c85fd62ffd42c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/igN:A3mnXoZjzyaT4aewsAjx9EaB7/igN
- TLSH T19C15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 931KB
- SHA256 517a1e3b9082c5c7989dd52e3a3d6e05ce8627e39b100230e6a7c2cffb805a85
- MD5 e714a9833e1808453100541ab6ed4eef
- SHA1 a8600adb17a9417c85529deab85af2f2fc4aa7ce
- SHA512 540c06c94397980e248c74c7e0d6e6d47c3c58e72be3db7a749c27f70d2f2ea7ec5cbe2fa0477089a92e7b018be6935da9429e368d64e4ea037aa3e9b6a13866
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iOf:A3mnXoZjzyaT4aewsAjx9EaB7/iOf
- TLSH T19A15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 931KB
- SHA256 93e6ec9946e6fda02089f321ab4572f58e61a2f05c5c3236c165eba9821f9f7a
- MD5 98850bef79a8b79d5606d260363f609e
- SHA1 7270fd445d77be43f09ee423dd1264f3127de40a
- SHA512 26ef3dfca625b30ee0740b3df1d5dfd9477d44475be62f0a8ed83734140e844d84e45aad16c58f13b761d5771f76f3d120365db8493f43c85e01d509cdac77a6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/i4o:A3mnXoZjzyaT4aewsAjx9EaB7/i4o
- TLSH T12515B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 931KB
- SHA256 883c703e936bba61e0fe2ab11476922b359a6ce0d8052f42e163b16a60531dfb
- MD5 1fdc68e146a27e72dcb68f19c4c14b9d
- SHA1 4b0734346a4f81f62b0582cf97bee46923ebecbd
- SHA512 859684f43b37b63767c8b3fd9e5bf1e0bdba54556acb8f51b669ed6a22b3e13bcc33d4a9b6cea1cadfde402ecaf1715f1039efc6735623d4cebdea58584abb9e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iIu:A3mnXoZjzyaT4aewsAjx9EaB7/iIu
- TLSH T1DD15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 931KB
- SHA256 a16d2547a680b90f6a657bc4842d5b3d5e09d66e7c11a526e4048bffc536361d
- MD5 e60cefdde7d6de765486131f82516949
- SHA1 f6928a9a4e7897f42990029ba764ad72772e217b
- SHA512 6a1f3af02501cef5e3047991bc46a96fcd84d183d473d92bfe4ecc65c80234f605e0e1ef25dac2a2c9ac6e2a8dc5f996b26c226e1627f681f48e7a8745356b3b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/ic9:A3mnXoZjzyaT4aewsAjx9EaB7/ic9
- TLSH T19715B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 931KB
- SHA256 ea398e7a971bf67bb0672c4e0dd2f8131579f205617af9b730ae9b4f8cc85ebe
- MD5 98d79e0a7e0060876d248865da2d54b1
- SHA1 4eab5e47f36e410833163cd732768c8cd4e0a6c6
- SHA512 600f4a074f2787ac97e3eb70c5d9365bdffc3c25c0a7667e64d6208c088500219b962125a9bdbd6239b2a0ad856fdf0b3b7accd8483fa8f655073c17c8d9ac26
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iEc:A3mnXoZjzyaT4aewsAjx9EaB7/iEc
- TLSH T12915B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 931KB
- SHA256 e32faa22f51b489a3b6bb892641374dfae9d683864cc526b36092abc3e68203c
- MD5 9db18bf5694e33e9eb45eb316ff5e827
- SHA1 c4dd17f0918222652e0eb6783d1ec38adef53b24
- SHA512 7802bea101556248276550567a55736caf27fa0c53e702a4c4a697a9068efbfbec2afb2835dc2c6326b195bd4a7c002dd02343e4175872e556f47f03bbc2088c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/idp:A3mnXoZjzyaT4aewsAjx9EaB7/idp
- TLSH T16C15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 931KB
- SHA256 32b092f690cd1c1068f00fcbfe0db9b5540e1ff4f377dc215461a3276ed68a57
- MD5 28078447482642f03c7bf994229471bb
- SHA1 108c645a0de98c420cbe9d982e9c32f71903c988
- SHA512 037d703f7f06bf408f2eb2e3d08ad9b6f26647910816f2b765a4dd8a80a4555953b470e390fd530b25169b7cdb63739dd02f5509093c2a69bd141feae9530512
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/ii0a:A3mnXoZjzyaT4aewsAjx9EaB7/iiN
- TLSH T13515B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 931KB
- SHA256 97313d99f4314bf563d41650309119f7be012b40c173947ba7f7826bdbec6d94
- MD5 75f735075db9bfc053aa8fed8db20ad4
- SHA1 bc3d82504e7bbb06a0d95ac1c1a682b837e45ccd
- SHA512 3226af26b09319225711f7e4020595c329da8497e2aecb189e7f238a9d5661536b152fdabac2cb2457a36bafd034e64192b9cd7ce65ccb80b44ca3b075846d69
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iGF:A3mnXoZjzyaT4aewsAjx9EaB7/iGF
- TLSH T10F15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 931KB
- SHA256 af6d3f2b84351e999929fd3f1c944f4b83b115dbbc5a03b82c4a35e1fec37cd9
- MD5 a22b6b599f3862e0a2ad5b8ca62d17f8
- SHA1 602ceec15b29d9b67006a3a1db33cabdf5fa7290
- SHA512 743d785aaac5df19c5afbfef9983ccc3829b44b1510743284b75dfb4096d862578e9f6dbd70f0ee8b0cda871bf975075b5577b5262d4f6e49a03e27f188f69bd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iTC:A3mnXoZjzyaT4aewsAjx9EaB7/iTC
- TLSH T14F15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 931KB
- SHA256 54d0226705bb60541907e4902248beef3fae9456c6c670a8c310cc5961e794b9
- MD5 8f0a04a3609cf74973652dfa35be139c
- SHA1 b7ede028096e1b2aa22b16afd723b55fc4f92f83
- SHA512 1be0e76681911e34fd4fd74fd759329ebaf98f4d41abadb614296f5e51198f9935c5c4f3dbc4d7211ab60f4a97eaed6ca6145797e14d903bf2645e63d2fe52cf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/icw:A3mnXoZjzyaT4aewsAjx9EaB7/icw
- TLSH T15E15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 931KB
- SHA256 1e70b37589705e206eeb131316fbb1da7f8fa4f4a33d2b3fbf2ad0e50fcc4e64
- MD5 63a505d6f4053ea491555c89ce0bf146
- SHA1 44b9d711ecc4700df876b940515a6b3302e87f55
- SHA512 0cda8579d4316b809e2885f37a93c72fd60dcde5fb49ecd8814d5e84142fa32fce417be4c88496029e775d83714c24e6ef9224806782eeb51aac1b3466fe8089
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iTT:A3mnXoZjzyaT4aewsAjx9EaB7/iTT
- TLSH T16515B023FBB090B5D23B49705BA58713EB797C210B6056CBE3688A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 931KB
- SHA256 ba877c156dddc38dbbd17746933a2f2683438a85727c6573a15b479608d37de3
- MD5 68388b2db43217fc147c540ddb4bdc33
- SHA1 d4664cc0e88fd4bcdf22a32b349f6e5469d2849e
- SHA512 6841e3a71c54cf9c9729f223d63e86b2ecb30c55d668dff08d53c3744593a877c980eccc4b3bc7aeebb8c37ebd1c14fa5021d97448ecc8607e7fd094190618b3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/ilu:A3mnXoZjzyaT4aewsAjx9EaB7/ilu
- TLSH T15815B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 931KB
- SHA256 6ab26309cdd4f62c1bfb4f62a4dde1ef295e8013f97ae74854f245a4dac48573
- MD5 80fc5fe457d84b1c34e539183afb2b3e
- SHA1 181851f66541773cb14b3450ea9ab730be8905b1
- SHA512 34a10434f2ee5bb571e7e1ff9f6b10de9d30bd7b9406a18de631eba6cb0a37d6e99ddd4d698615dda5870dc2808af3956f62f610b48657a1f2d76c77a06942ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/itb:A3mnXoZjzyaT4aewsAjx9EaB7/itb
- TLSH T1D415B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 931KB
- SHA256 7ffcc9ccf5a539d6903812239cf069e71d94ae2afc587ac4297e5ad7df0d9171
- MD5 f4ae73390a029c65cdd238845ebb51a8
- SHA1 d3526ce27b343c796996ddeda3ea5b47794a8bf4
- SHA512 a1caf406565497883411933da2071e3504deebaef5bcb77e172f56c23ca4d0ac2e9c3ba8f1294ff5d7c518aa635cdd84762f9875c08ccc14f9aed06494d4271c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/idf:A3mnXoZjzyaT4aewsAjx9EaB7/idf
- TLSH T1C715B023FBB090B5D23B49705BA58713EB397D210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 931KB
- SHA256 fe478858203e998e30f13b27d17efbb197fd88de2a10b8b12d99d2b2cf3231d5
- MD5 5de0e67008d7fb2b145dc1e7370d71d0
- SHA1 97404d553f17d7283e7d4bf2571bcb7f49e802a2
- SHA512 7ad90f31c2fb0a206a61ee02f8292ee1e357a29b5f05aeea3504f860e616108aae2251b79e9697e90df253f782ffb5e8a1e7b00d5aa2a2db78f2d8d5246cbbae
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iGK:A3mnXoZjzyaT4aewsAjx9EaB7/iGK
- TLSH T14D15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 931KB
- SHA256 f6c7e7fc42ea3ccd0e2e3a70d1bd1bc2f27aedab4c5479b28082c27a6f1620ef
- MD5 e6fc76c69ccb04523d0daef78bc37e52
- SHA1 907b7ca293f595aba6098b3c4dcab59e7ccbb22c
- SHA512 c940bac51f1ebb4b2ad5fa9af78153bfc101d162af15a4240f83f75048903ccee7fd17b3d6c9dd68d1d564e70a7b3e0af9b88da38b9944c42ed09cdf167e471a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/izk:A3mnXoZjzyaT4aewsAjx9EaB7/izk
- TLSH T17E15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 931KB
- SHA256 0944089fc04a2f9abfd7eb2e8a60457cde6238be2a1868567d2627be7d41fcc7
- MD5 858d5d6c8a46050facaa96689c9809c6
- SHA1 1abac164e692291ebb94e08c58f36405b759362f
- SHA512 91e5a04f67c3fe62a27cf888b0883c97a8d8e84ee9396a3c3d4466cde378d5b7dff4471023b3aaa67994362642023a69ddc1d68217d9ad0c4fae24d6d289954b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iE0:A3mnXoZjzyaT4aewsAjx9EaB7/iE0
- TLSH T18715B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 931KB
- SHA256 1423a48e1f84f8adff9c7b7fc57e3d66701d7158bf8c54bd49c4c61d3f672f02
- MD5 cf31c195e17b75f162c42a773180904f
- SHA1 7a08d05c2b602ddfb4ce0b43fd07118c24457301
- SHA512 cb960be2689d8fedea08b1707e71cce1f76d19984178f97b2a79aa9c25c3e8bd1de25a2335bc81e69598366f5725f5582c40193dd790f499c5ffde2eef043b11
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/i/70:A3mnXoZjzyaT4aewsAjx9EaB7/i/g
- TLSH T17015B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 931KB
- SHA256 098ebb0bc887fbd200d44feb59a669bda0a41565c00edd7ad920ba24bbb5210a
- MD5 95561195c770c68f9c0ac00947add7a6
- SHA1 f07a4c04215e5eedc0a1919bf451e5b5892b84e4
- SHA512 101244ae35a115746cb0765a2eb19890a8bcd28d5e39878f3e2fa5699367a1e7ccd25b6518323d0c1054951daa3fe1feca9e3e1b932ef5c3d5a011bbe105ce5b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iSr:A3mnXoZjzyaT4aewsAjx9EaB7/iSr
- TLSH T13615B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 931KB
- SHA256 7b347e8141cda455a8cd5cc779aa5a68e86e60f7b63d5240facf6dba01f0e3e9
- MD5 e4b71130354d0011eadabc76c43b1c83
- SHA1 a6521056af77d8b6e8692497d3b7220b708aafbb
- SHA512 e5033cb3b7af539d104ce27d9d4efd4bd99042c2a7de58865d6dc3687007b3e61504fa751130fdda5344cb0d65762339d641c6bea468a2a2a74515c670483495
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iwn:A3mnXoZjzyaT4aewsAjx9EaB7/iwn
- TLSH T16D15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 931KB
- SHA256 f6e42b51adbd34da5fc1425ec0249699859a10ab3051f81f14c5e9c96157d88e
- MD5 bccb54513622f1e488d9b47611fb7c64
- SHA1 87d1083cb5c21990125af7fb8520f84de37519e0
- SHA512 2e8784154ed331cc0f0fea19756e9e14555df3e36a684a9072050144ba631bb248f025f10fbe2f65bf64d92cd8ef87556f4003933e51f7241a560562908fb02e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iOx:A3mnXoZjzyaT4aewsAjx9EaB7/iOx
- TLSH T12415B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 931KB
- SHA256 4dc00277460bc2871daa6ecab1fa5c6f5afff94924b00883df18b4958104476d
- MD5 61152321686cd2424859d5ff621d2b33
- SHA1 1f88d364bea8ed95fa246ba3f9c734e2dc50583d
- SHA512 3a2d7b5dd2cc8a4ebb2411fb4b0ec25a4bfeb6fe98ddfffa54c027158ad4c82feef224caf51afd3a05ec20e92daf037cf104488018376f0b6d2d59ff55775598
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/ioA:A3mnXoZjzyaT4aewsAjx9EaB7/ioA
- TLSH T16015B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 931KB
- SHA256 01e73dd94941bbee425bb9eed24f59780f327b0ecf114ec1d08c9d057d434364
- MD5 bd2e163cfee27a1d258db20983db0357
- SHA1 b688497e34effecd5d4d7c399d25513b1e58b7e7
- SHA512 49159754f93dcc98fe32864babf824c5f3fb3a279623118c3a3224f56060afc8276562211746c1cf14de947fb52a86ad2c215ccb6883ffb95731c344c8df2109
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iB9Q:A3mnXoZjzyaT4aewsAjx9EaB7/iB9Q
- TLSH T1EA15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 931KB
- SHA256 341a6dd1d662750cbb46f44cc345a6e57f3bddcb1a4997ee0317f0be6ae1b780
- MD5 2a08edf1a84360da1de601bba83b12da
- SHA1 acc2e4e4c6aca3345d4cc0c360f6d3f0ce041f98
- SHA512 1ba218355f4a65ee54ae43518822367bb31653a84f358e6f5070743d6bc1153879edefe3c4f587d695643863b8ee00da35ba44b7bf684c51532566d50afb881c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/i04:A3mnXoZjzyaT4aewsAjx9EaB7/i04
- TLSH T19815B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 931KB
- SHA256 9d12207d27862e60c85119f59a2f3873b73f5fe1fbfe25f658605954cf255908
- MD5 8e2f75b5b478f690539f9b84d708990e
- SHA1 a35caddbbd9cff8db2c8062c77fb90ac1d12b5e9
- SHA512 1363a9e15f61d6f76462ced815842869bdb6fea5d3eca82e6af39bcf175b34ced0fe16303345ec5ec90e2f07117ee652923daad102ac6567a425133cfe11781a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/ifu:A3mnXoZjzyaT4aewsAjx9EaB7/ifu
- TLSH T12A15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 931KB
- SHA256 c2147119d4b5812dfd2911fcd94dc4be054373187ecb0079d0490da5aa3c6527
- MD5 81ccb9cff60cde2fa4e60f2b40150dfc
- SHA1 5232011a08a06446a352fb77b3db47d64dadf619
- SHA512 ba0393175789f4179b0a4c1df15522b87bade3dc69bbfa74a96505f48e11a8cda7bda2f883f60b623f309568034b8d11ce55abed98d6b25cd990d4352202c27d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/i6j:A3mnXoZjzyaT4aewsAjx9EaB7/i6j
- TLSH T1F115B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 931KB
- SHA256 29864eff612932592a8a6188a8e07eca212bc22bd73a99f082fc224b230a184b
- MD5 d958d702e848d2cacc23aad1f6a512f3
- SHA1 50e8b33ba4720d2da578519648a96916598afc38
- SHA512 2594b6d4a9435ee43c66fed5015b354a1a20b7f224bddc2d1abba82a323e50022b0aab2aed3a6420df37bf9d0bd4e1b7c4dae5faf8949dc9d62a4beb425eb120
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/ing:A3mnXoZjzyaT4aewsAjx9EaB7/ing
- TLSH T17615B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 931KB
- SHA256 dce60015cbbaa2fe67b0786f36a96bc518a63e02e5008fe1b604b8e23600dc03
- MD5 2bcc412811432012815d45fa422eaacb
- SHA1 613fc39c0118dc6d2ca79e227c68694936f83a73
- SHA512 474e0d8a2483caaa28c759a61a617cb9d21a6be7a751958e5df7ecddfd90156f02264fc36e070f7d2837361b9a1e022ece117ecb8474e6cb50c0c7f685052a4c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/i6I:A3mnXoZjzyaT4aewsAjx9EaB7/i6I
- TLSH T13815B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 931KB
- SHA256 e0d52333fbf6882b2bb7045464060b1cb6107172d70f746da9958576027f29e3
- MD5 8f252c8aef8644bc50b664fdfa1ddb20
- SHA1 b1112b4fe1ed699e8a60b4148411c749102b76e4
- SHA512 03ee3d420a11a2b372d9d476c5f8c442fe2c70e348176288e15c445f9018374e5c1b5916103876cca3d8a0877219acb7612c63c1f767fbdea53edf98eb3dc3b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/i4o:A3mnXoZjzyaT4aewsAjx9EaB7/i4o
- TLSH T14E15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 931KB
- SHA256 8ad4cf9f6377c4a1886d6938e403597031bb88a7f4bae92df6b3097e9ab39b5e
- MD5 2bf8a6c6165d5c5591d92aa4fac1fd9e
- SHA1 1ffa83f9a266ab6631935a9fee334c3b4a3bd6cf
- SHA512 096e0c6ae666d88cb0b8a4d0eea5857350e757b2160c0c2662ab639024edfac881c996ea8f9abaafc79e6c8f2fe5d9f75ac7ea97cdc5d3fb805553c477893e7d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iL+:A3mnXoZjzyaT4aewsAjx9EaB7/iL+
- TLSH T1D515B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 931KB
- SHA256 9801dd4e731f60192a9f24a23046d50ca08d4a2018f6328c16bec4f823575e26
- MD5 286f7c1ddec4747cdcb7eb66dae561ce
- SHA1 9dfdf2d038305a5e16ccef26802012a9fc6ba16d
- SHA512 9a4fd663543276e276ede51d59494df72663ea588f1dbcf1bc7060585546dd0386707490b137822bd8e6bb310978949f33b54cb9f58d173a2bfffeb55a94780b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iBQ:A3mnXoZjzyaT4aewsAjx9EaB7/iBQ
- TLSH T13715B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 931KB
- SHA256 391d0e7304bf45625808cb7086f7d6b1eca0d1f21fe440022465e080f8af9c30
- MD5 46c88b0e1af5f29faad334c742d75769
- SHA1 942e24711ddb32c01b36203e3cc5fe29d3230dc2
- SHA512 b357f94d0f8c0159acf2b5a349ed3a0d0351d1d1d612f8e5c6db3886564cf089fd4f63e364cd98fcf02cc97800197a0dca5c2cfc5e941ee2ba7b7873f0218b97
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iGX:A3mnXoZjzyaT4aewsAjx9EaB7/iGX
- TLSH T10315B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 931KB
- SHA256 48113ac918fd653b3e56c531d6cb9122de37da2fd174dfc2df2870ce36352357
- MD5 563f467c871b94c59d9f65bce61fd41f
- SHA1 7b026415badaedd48641df4ad9e2aeb420954b31
- SHA512 34ff54ef311c4ff6297d5dce970d2fb3b166f8ed3b2cb3c434c4697b2e3f24cf02905adfb353d8fb4ce7a7abf205424bfbada3e0e280551753872cc6a6b2338d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/iAL:A3mnXoZjzyaT4aewsAjx9EaB7/iAL
- TLSH T14015B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 931KB
- SHA256 533ea76257bf5e808d6195c88033b4070aeb88cd7878584375db44609fed2bd8
- MD5 f2fc0e9a858265f352836f26803176bd
- SHA1 5f06d8d8df76081a3f36e00a96be93e3c1ebe911
- SHA512 26894d0a826c6d65588a1f4db37b4de6fef44dc8d158449f090ea6347c3c1c02db74eccce926824b2a395c31d54f202fd173562d042ecfe0dd1b5d9e2ff252ad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/isFC:A3mnXoZjzyaT4aewsAjx9EaB7/isM
- TLSH T17D15B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 931KB
- SHA256 6d56e90f4667312ffe6539b04d8026594e021f5dbf6a7564b64ed87c8e7c61f7
- MD5 b7d021379891f99369f66796faf5db4f
- SHA1 18a443ca30e5777b619a32bab041a9a75f4c459a
- SHA512 39726346867e264302331ce11361da45e2148a8916cc6465bc76a465091ae956df2c7d43f93151563f996432372116270fda545a25dfc2a08d37806e5bf41f74
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRX9EaB7/i1h:A3mnXoZjzyaT4aewsAjx9EaB7/i1h
- TLSH T18315B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH