Analysis
- max time kernel
103s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 04:47
Behavioral task
behavioral1
Sample
2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 893KB
- Sample260813-fenalasarc
- SHA256 3312fe7bf69ac6ab8129f4fa3bf8c18103c680a137d65b36486ffa10eebf361c
- MD5 641360fc2467b8e75d9709851d072ed4
- SHA1 deffd8633cd1e9a64b3df9e6b1201702d7e0ef04
- SHA512 00c50a89125a2a2bc11f98da0429bcec1286b368d8c400e62d215c82ef6564130615f416e5a6a0d1832960561c473b886120eaf5a636c79ff6fd3d661a808411
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQw:A3mnXoZjzyaT4aewsAjxTcijQw
- TLSH T1C615B023FB7090B5C23B49705B65C712EB797C210B6056CBE3A88A592F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/5492-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5f1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f9-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5492-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4960-197-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ba8a-215.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a5a-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-470.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a59-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-574.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-605.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-715.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-734.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-778.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-823.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-981.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1019.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1050.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1082.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1095.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1126.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1145.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018912-1480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018918-1523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1566.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5f1-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f9-57.dat aspack_v212_v242 behavioral2/files/0x000400000001ba8a-215.dat aspack_v212_v242 behavioral2/files/0x0006000000018a5a-258.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-367.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-470.dat aspack_v212_v242 behavioral2/files/0x0013000000018a59-495.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-574.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-605.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-624.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-715.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-734.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-778.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-823.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-873.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-981.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1019.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1050.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1082.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1095.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1126.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1145.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1170.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1177.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1245.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1324.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1343.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1369.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1376.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1378.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1385.dat aspack_v212_v242 behavioral2/files/0x0008000000018912-1480.dat aspack_v212_v242 behavioral2/files/0x0008000000018918-1523.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1566.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4960 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe - Drops file in Windows directory 63 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5492 2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4960 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_641360fc2467b8e75d9709851d072ed4_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5492
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 893KB
- SHA256 3312fe7bf69ac6ab8129f4fa3bf8c18103c680a137d65b36486ffa10eebf361c
- MD5 641360fc2467b8e75d9709851d072ed4
- SHA1 deffd8633cd1e9a64b3df9e6b1201702d7e0ef04
- SHA512 00c50a89125a2a2bc11f98da0429bcec1286b368d8c400e62d215c82ef6564130615f416e5a6a0d1832960561c473b886120eaf5a636c79ff6fd3d661a808411
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQw:A3mnXoZjzyaT4aewsAjxTcijQw
- TLSH T1C615B023FB7090B5C23B49705B65C712EB797C210B6056CBE3A88A592F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 922KB
- SHA256 d70d7ea6ce6e4ed715c9349b37c3075ef67ed4d77134525fb11bad0c2e2b68e9
- MD5 39c05a4d420c7701d2d40f58c6584918
- SHA1 3708cfd916bf1920d86c1574dd05672b2ed1ee1a
- SHA512 9e256194e37deca02f88c47d4f98bbde274aafca625eb8a50809fd0e9bf074974dc5ddd8f616fa69c7150a4eebebde643329979f371432e2112cd0a49096b369
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQCP:A3mnXoZjzyaT4aewsAjxTcijQCP
- TLSH T10715B023FBB090B5D23B49705B65C712EB397D210B6056CBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 939KB
- SHA256 8646d964d79fcad917328ade74e815a67eb38fca6e2fc0f21e9501f022d9a17f
- MD5 61db6cff1007bbf4c0972a5e6dfcdb15
- SHA1 7fa792cde463f76a83129426be89ec1eb5448c13
- SHA512 981484dc0c1789fb6fa24b555aecccb3c20c54a4b7dc19f53a9c9f57a48363516e6a03aaea25eeaa6906bb209328c6e9c9026f09effbcb94eb5f17d23d7e3a84
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQt0:A3mnXoZjzyaT4aewsAjxTcijQt0
- TLSH T1D425B023FBB090B5C27B49705B65C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 945KB
- SHA256 c19fff94d153bac5265a52c88e78316d266ab43ca0956f68db4f2ebc33b8fa1b
- MD5 6588a442e4dbb64214905f73f13ef03a
- SHA1 26bc03c1bf79b6da09dc8939a1e22d44db00b409
- SHA512 6b9d93ddd6c2ac5dbddaf1fdcef13a416ad53b1a078cf60f48566d8a08f0ae78bc302b91d863ad74d9f232d02e450fc34e1428e93267c349b1012441d8f1cac1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQtFfj:A3mnXoZjzyaT4aewsAjxTcijQLfj
- TLSH T1CE25B023FB7090B5D23B49705B65C722E779BC210B6056CBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 96013807fdf59bf01fd4ec7d6be4d7d87ff57d10a211540212fb6982915b59f0
- MD5 308cb56d8cbc8c6cbfea6314f82820b9
- SHA1 99162634b92c4a6d426ba31b380d41c5121ec201
- SHA512 e903984b07f51c28faf39d0282ff8bd6caa9148d2ee0fe742d67bd96be454135deb75b838b7a52d5f8907a2163b866c270b22d5fa7abc7e646d3064725c3995d
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcijQI0Le5ji0hmxNrM:A3kMPlj9Pji0Aj
- TLSH T1AE658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 907KB
- SHA256 d43cbe4c3f587711199383a477c798658c9f99d6f7d7ba1fde4c714da4c48539
- MD5 ecc592049b42606e90eac4df4347b9c2
- SHA1 7bdf4f935b24dae5cda47b0f321da26c231ad0e4
- SHA512 d5a5e0782dbc323641f11a4ddad3e6dcc9de5ceee1ebcedd34fc530e33ac058e262e36536e81eb8225f4920e908ec3e69fc0aa1c35f793429cab9406cabbfcb7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQya:A3mnXoZjzyaT4aewsAjxTcijQya
- TLSH T1D215B023FB7090B5D27B49705B65C712EB397C210B605ACBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 916KB
- SHA256 3228905feb7d88e7108f80181f6a5527ee585dc2adad5a1e77f9137b696f3730
- MD5 7b9e6dfcce51b29b960e933e974fa147
- SHA1 58f8652c86f8c0c323d1257e53ffb0ce306c7c5e
- SHA512 d63e2d132e4f7cf45015bca3638e49d4f27c4d2c8e3b654bab98ce9c94700db15c54ef5a96be95a4b20e8dad8b311dbf3a747b6c80838e9adae1edbda924856a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQD6:A3mnXoZjzyaT4aewsAjxTcijQD6
- TLSH T1A215B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 916KB
- SHA256 b3f2636e68be1561fe8a136f8986192bf6fe60ac7f78b6f0c9833e16ba45817f
- MD5 55194c3532651dd47bc20f5b81c99234
- SHA1 b95bf9f44ad3f846a78dc748bdc7c52e823d1ae7
- SHA512 4c279208526df6ec3a890306ecc6a98c0561a73973b8490ecdf4be1bc294dfcfd967266c4db7a45efe42851f0d857d047a757e2c5687ab9b2b9cf0f29042d876
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQtN:A3mnXoZjzyaT4aewsAjxTcijQtN
- TLSH T1F315B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 916KB
- SHA256 d76933fedd5d148947e1246feedfed524b57b3ee616a40ffa2b55c6f27f4ca4a
- MD5 b94967a0f3449a2d6a6e58101dc4fab4
- SHA1 320525d4493a25164c87bc9880a720e9e8a384d5
- SHA512 ee1a48e875e27abbdf418f237a25da96c1b4f504ddd2d7e465a59f259a113d1d61948ea286ecfbfbfe171669caa20888d66a1fc686a18206286589293a2bd578
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQbf:A3mnXoZjzyaT4aewsAjxTcijQbf
- TLSH T10415B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 916KB
- SHA256 be7bde35bc0e3f9a194a090fd71368c4748e3c999d97c14265b59010f218195d
- MD5 ce17143777d0d72a9ab2135cbd77ffe0
- SHA1 40e350ec6c93b86878696e6b38e1d74fef3bc342
- SHA512 9b1bac76726db76179b680325dc21dbcd5664265da4ec64c46eca311c112bcc25d28727f58f8c921179bdd662a9debd904ee28c2b1064e5dda11202823afd8ab
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQNo:A3mnXoZjzyaT4aewsAjxTcijQNo
- TLSH T19715B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 916KB
- SHA256 8815cee148e62b1bf8acab7670b276be7a9b9534ae4e47b6e8bff39fcf689064
- MD5 11510fcd71f11986935a26f0060a76f0
- SHA1 1042e7d9ba4825a2647667f11ac1c9187c1b4f42
- SHA512 dea1d3a96dada7dc60010448358bce65a63219ae9a3970acb4d856e94795ac7da67df4aaf79df5b3cbbabc0b749a1853356e36dd04ec6622220c559939475740
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQNu:A3mnXoZjzyaT4aewsAjxTcijQNu
- TLSH T18215B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 916KB
- SHA256 1ed8f65de4740012c05ccf4e30548692c375e9462cdb5fda4d69556ba65c0e00
- MD5 3ad63f2707f0a3da68ca55e946d2c21b
- SHA1 00a03201f5b2a2a1ab313a85cec8bb84f51eebe6
- SHA512 2a595602be1cb36058b64747a1e52142b821f0820a96ba6f3341afd53b644d9ca5dd7e5e8dca2180b9088eecd3c4c812aa5e1715988876fd0fa4343a8be1cadc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQj9:A3mnXoZjzyaT4aewsAjxTcijQj9
- TLSH T1AB15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 916KB
- SHA256 e6933bfdc56f3e1c141de608f4bba7b213c2a54afd98eac86b19019f68352536
- MD5 3e76bec648979eb04e0ee578a4a93677
- SHA1 2b51f30f7512bc4748ff4dd5e0a4cd562f3a4938
- SHA512 5505e4494919744611759525fe6e254bf3492b08d231a1c9398cf15aca25fa0bfb7157c3135b1e3a6a58bb689fe4dbd607a7b3e04cd4c42a042e612cd0bb825b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQPc:A3mnXoZjzyaT4aewsAjxTcijQPc
- TLSH T1F315B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 916KB
- SHA256 dfbebd47ce4c2a08e4af446dd30e11d4fd75b82a17b82e55174703897130d567
- MD5 1a26904cd520b71544bc1930285a8506
- SHA1 eee0782759ea504ec154918e19ed1503398c6906
- SHA512 6d082aebc5c4b237ecfbf4e1956ee7e015c4426b16a83d14d1056fc6ef54653a1b9a6b9e02cdce7207358749581888c008d75d46e67ccc55a160e0200d8ee824
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQIp:A3mnXoZjzyaT4aewsAjxTcijQIp
- TLSH T13A15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 916KB
- SHA256 5821e43258b9768ee5e4f63bc319453cccd3750b70bfa12f6dd0d8f700bda299
- MD5 e009a19fad0a552c245def1d0e795ebf
- SHA1 11f93777315cc13cdcfe31eabbb19cbff61da43c
- SHA512 066b84ac29550e54717d49d360dd2431ac3bbdbea6ecd73a313754f27b8aba07cda8af1cb96f83e9397366b84fd001d0dc691fee921d672232cc44e416d5268e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQf0a:A3mnXoZjzyaT4aewsAjxTcijQfN
- TLSH T1ED15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 916KB
- SHA256 51e862fda7bc25104ac925d9554bd2765a887c2c06a201dd7bf98798c16fb042
- MD5 2440f4d514d7675f53e6f5f879511bbb
- SHA1 2de22722210b9614635648d5f4327e65e3fa5485
- SHA512 60036e993dc00ff11085b0d836b38acebdd9ba444a0862b08a2ee278bd7423cbd51df720dd89882de882d3e5046e6790313a2d6f74ea188904fd528bfe219960
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQdF:A3mnXoZjzyaT4aewsAjxTcijQdF
- TLSH T18915B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 916KB
- SHA256 7181aebd1ce50d66b747d9ae20092d4c4be14188d54676e4f5f0c10d60248a2e
- MD5 f21c59f431768810d5aff7cab8762a4e
- SHA1 a3c13acddb76d74fb98674b019d0d06be9a632a7
- SHA512 98d895f6c45ae93237034924cec09aa3030b7ec2fea631013dcc563033db5890011bb89738bc26cd802f0ff27b81ca4a5d9e1e3b2154504c06f8bab8521c8540
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQuC:A3mnXoZjzyaT4aewsAjxTcijQuC
- TLSH T18115B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 916KB
- SHA256 60cfde50e96e89c182aba1a1927f3bdc1fb141a0a6d467858f673be57ec99e6f
- MD5 95dbf07161209eba93f0df0c26261a18
- SHA1 4e1a5acfd3759abc06d67789f19945fc3812d2ca
- SHA512 335369a6b99e7797bf0dfe77ff466f0fd163b60da97a365d3b4139cfc5e90c8fc13e916d2dfeaa009248162303bf96a3e7a9cf78a650f70f0d95b9a5262d700c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQxw:A3mnXoZjzyaT4aewsAjxTcijQxw
- TLSH T1CA15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 916KB
- SHA256 ca28b41e2a0f17ff354ed3c2fe5b50a403c57375d5abab942c4042bb677830fd
- MD5 3ba3e82adba89ff2d4c595a621e2ef0d
- SHA1 6c034cefcf668f1c525af2a9c51795ea5214c23d
- SHA512 226a0df13e432b12c8c758968860599448561ba566997f7960939638e3e0fb8491643605cfb6922295c13946e4f5e6a1e4f0252b7605c5d1d14bfefa6b064530
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQYT:A3mnXoZjzyaT4aewsAjxTcijQYT
- TLSH T18315B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 916KB
- SHA256 b44078736de05f7475adfb3d1b709ef2737faf637a4688287a7c5a008bec0a5c
- MD5 21a0c1d3c20b00cf3a88128a5042b9cf
- SHA1 6ba4576c1348f90923c602c6fe3b25ea4448b522
- SHA512 0ffe62b639157557d957d97fbc892c107d9b4a7fb79d0d12216426cfd025e8a3521cbc1ab36975e807959e2603cb0cf7c5ae0e96b86d8f06c382a3ae51978381
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQ0u:A3mnXoZjzyaT4aewsAjxTcijQ0u
- TLSH T12215B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 916KB
- SHA256 a017530803a2f8bcf304de1dfbfd1eeaa17996891e796dfda996fd8e2ca577ee
- MD5 eace77e600f7829e2904ca58cc163a40
- SHA1 c846b6503ac72c1989c48a24f5df799c1f34fefa
- SHA512 2175ac26cf87ab6e350f4ac62ca69e76d4ff28fc5db5b45b33ea34d229fdbc81441926234982ab8e6878ac73d94cfa3485da0a7cd034157fd188de78e67510b7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQib:A3mnXoZjzyaT4aewsAjxTcijQib
- TLSH T1FB15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 916KB
- SHA256 ab56a8b2c4d29bd16bba66b957fceed23b0d78e1790510760568fdfc6f3af213
- MD5 33bf40b4d94be1cd838f90c8d995088e
- SHA1 fbed3d7a346c7eae56420b39a24ec5d2b9284aa5
- SHA512 2dad2843b35d3abfddde1bb46faf1166f7a62710642ec671cecb9972970724a23ae03c57e1f01715436faf2474a165b3351b7c9c1f7e567dd5cd5acfb3a45588
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQkf:A3mnXoZjzyaT4aewsAjxTcijQkf
- TLSH T1B115B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 916KB
- SHA256 0f391b586f1c359a54ee8f196620d9bd03cda711d7f2ab429ccf9646e9e8f534
- MD5 a7e1524f869150992b9f8b510f75b2e0
- SHA1 ef4e4aae174a8e92ca17a144e1b4c61bc85a6e43
- SHA512 08fba9a7970ca567f22a0c6360045e13ceec0a2eb1f6b94fbf2e44148058289d7805889b6178d2ed68fbabac58d00e584be3cee637c4159023eb9e790351165e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQBK:A3mnXoZjzyaT4aewsAjxTcijQBK
- TLSH T1EC15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 916KB
- SHA256 71f3cb3dac41cf4faebf6339d2c981ac25d4f8da47a135f5f378ac363070666d
- MD5 8d3a9083eab8bb30c587bc0c48bbfec7
- SHA1 141b26067f5ccf69ab087e18b1242d2c86fa96dd
- SHA512 4ba29e675b0c4cee28b3b3a7ca10f16198c2dbe3f132e9749b740b4758d690db9bec9fcad5e088affa824773f8834f4e0f847732336994e6c4c03a4e6627d112
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQ6k:A3mnXoZjzyaT4aewsAjxTcijQ6k
- TLSH T18315B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 916KB
- SHA256 4ffb8200436b9a2de122e24b3b5b6a3f8b6ecfcc70a3825043222c837b65ddc1
- MD5 5108ad89363c5c1b5f93763db3518309
- SHA1 6d0764c4bbcbca9357d605bc26632754011fb476
- SHA512 07783e429d44c8096c80632de5795ce9a24d98c7f43d0f128859e186e4ff0b53266ccc40a46d255e82fe73db6c09c9ac423ba3ff32d008b4541b02b43011eb01
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQf0:A3mnXoZjzyaT4aewsAjxTcijQf0
- TLSH T15915B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 916KB
- SHA256 304790ef4e0c307eb43fa812d51d7c1304287535c8eef0c543c1fc3544e3e423
- MD5 91a9cbb141bfc9c86381f0c5dd6c0ff0
- SHA1 3b9131929a02a15cad90bfde28b968e08cd064bf
- SHA512 716ace33b710ae0acdecbedf263db7eb141f69607f3d60c876d2f350dfa07b54f1c72fe1e25c90de495244559524925b6ce288f335bd3d8cb6baa1e256577433
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQu70:A3mnXoZjzyaT4aewsAjxTcijQug
- TLSH T1F015B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 916KB
- SHA256 ee427604f36365c42ed51f824c1734bdf3479791336091ca11618f74e751c069
- MD5 5e585656af94a11dad4f3aabe0693211
- SHA1 b3e335d0024b6976650265858120aa5b498620ed
- SHA512 f67e676299bc08b9bb63fe3d4af61f89273d2c65feb4f03b8fcc1147cf1ba380d36de6dda3d722adb16ff29cd2706d11508bec7e2d9cd4532708200a953a08c9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQ3r:A3mnXoZjzyaT4aewsAjxTcijQ3r
- TLSH T1DC15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 916KB
- SHA256 0d3f11ffeda66c90853b5496419e2ed9379084db161a50a6073f671e2019b6be
- MD5 a6c2672a697c77790de9a5f4712d1294
- SHA1 a2ff0c5fa6a72a932ceac07ee343ecaae8cd7492
- SHA512 4062cdeb3e20189c1f94378a82c7d41c0d1ceb1e676f15fa4365a0898da8a24e77db72477053fde393c5c216c0b7871ed5017a6e6b61bf3d66933fa99fa5a686
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQBn:A3mnXoZjzyaT4aewsAjxTcijQBn
- TLSH T12215B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 916KB
- SHA256 e846fed4538332d5398fc480d0388fc741de43070392e9f67822752fd538f061
- MD5 4152f593d3df2ac81958ce1d31caff21
- SHA1 9d24a8c2e7803785af84965583c9613ef6920986
- SHA512 bdab3a406b8faf3ab9e5c1d470454568fd2c785dbb366a54c86f177999afaba38a81ecae9c30d10a31195bd8a09b67a67238039fc0091e84654bae7a317316dc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQtx:A3mnXoZjzyaT4aewsAjxTcijQtx
- TLSH T13215B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 916KB
- SHA256 e6178bdffe8622512c997e5a06d5eab50ff3b4e50a68629aac4ac4c37449bdb9
- MD5 8946fbcefb0ff1bfec836a6fb7024378
- SHA1 8380a9c01b5eb81eb99d60bca7ba4f47bee33cef
- SHA512 1137be6fc2d6edecbb2fab7beb5caf9b86fbebf61749c0021632a5b75026bc21a6736a8b14c266eac855e350c5077d3354676dfb5ffc0f4226dc1ffdd36e9709
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQzA:A3mnXoZjzyaT4aewsAjxTcijQzA
- TLSH T10D15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 916KB
- SHA256 82c155acba6d6f8dc08df76451d6d2a85741a15e35f67a92cf3a1a45e6378a4e
- MD5 9b6bd1d79aabb9e131068cbf521d2787
- SHA1 0470a2d18d34dc545f4fc7e318d9d6e0e5bc1149
- SHA512 59fbd8724feb3c422c3c13429c669386dd037008bbf6969673a172e51fe3882e73aac88c1e868082b7def77486dc35aec725949866d31cccf01759d0a6baf24e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQE9Q:A3mnXoZjzyaT4aewsAjxTcijQE9Q
- TLSH T18115B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 916KB
- SHA256 d1f941ad4fc5c833cd28505955bf17c09f27de1d27b34fcd451792d9fb2fae18
- MD5 3e4989eb616bdfc4f1a9f224abd691bd
- SHA1 cf110f607e1f12beb11282a1bfee107e049f2c2b
- SHA512 5c8dbd00ba02bb84db3ec54b106d5265ec242fd2b8c770155afec48ce072c68db9579baaa9c20bec233174cdc98309890f32a505b5dff02d865fc7b0407b7727
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQd4:A3mnXoZjzyaT4aewsAjxTcijQd4
- TLSH T1B915B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 916KB
- SHA256 5dc3715523866c715bc40cc29349c0eeebe977f7f85a03d48229cb95fc9a1867
- MD5 b0fdf4f347590a7d83deadcaab4011bb
- SHA1 7e435075dae87c8c0562f05726ed5b9612bc204d
- SHA512 85cb6e69572c4ad8a90fc9384acab92918fe5937ebd36fc977e1e44edb3abd845ae609fac56e7c090b6e36e5eac50160639c6ced091a2ce86a48a460ebcdcbb1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQ4u:A3mnXoZjzyaT4aewsAjxTcijQ4u
- TLSH T14215B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 916KB
- SHA256 2095cb5280d7adf47fc083b6edfa474c9ecdb7ceee8ca0088e53cc2fc46ef641
- MD5 842d3a51b6dfeae763c2d9b1f616a115
- SHA1 4dc6e1d3ffee9dfc47246a5520d4b3c0ce550840
- SHA512 f7da70de45f0ae1baf4ac1bf758b34da6556c3a555ca629f5535bf517a09bdcf8f88d0f258ebfada3f31bdc40afc23faa82c3582553a34b464a16e68255dc010
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQZj:A3mnXoZjzyaT4aewsAjxTcijQZj
- TLSH T1B015B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 916KB
- SHA256 3409d224717daa9c32086cd9e5ef45f221eab4feecd3635cc9f6df1ae7fcc9c0
- MD5 a5b4ff9bcb8be9a309c755bfb898704b
- SHA1 d86cdc6e2ee6eb31c0cac3ac1587a35ff98369b3
- SHA512 3e05c137a0e3b89b1a6689ed0b9d17e11c5151acf5547e880c2691e1ab3db9e8c82e2989c9c0d6417b5e083f7d5dede38c75f1e5407cc3e46fe5e8478d193106
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQAg:A3mnXoZjzyaT4aewsAjxTcijQAg
- TLSH T12D15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 916KB
- SHA256 53e06702c6ae942a2b894b267b552689abe51cbbabbae2579e620636aac46938
- MD5 0aa2241311116b0354c8e5fa4ec075f2
- SHA1 6a392fe2e0a7600f6e616eaef7867b9fb981643e
- SHA512 ee3e489af9bd40e5c65c5cb04923f1dddddc129317f6b7ae6c07de38063f60b95ae42e08fe9e19cddcfb3bac54d5d5178bea416b2a5bb9dec0d57636acac31ec
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQvI:A3mnXoZjzyaT4aewsAjxTcijQvI
- TLSH T1BD15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 916KB
- SHA256 fc2e0b61b8f5ca4cdb02a6c64a40e1df3b1c707fdc015e042ce6ec3c4b574c4b
- MD5 2fbd3fa9df6935d290b04ffa6e8bee3c
- SHA1 36eeb450699128da5379d343f61e0d64ba1303a4
- SHA512 596291485e86db2d2a4caba87d15a8a97ee945068642d09b92787b18131ff30599bbce7a0bd6aa776f33e6fb62c5b22614d9dae665a4c9915bf11142e01f58a8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQVo:A3mnXoZjzyaT4aewsAjxTcijQVo
- TLSH T12815B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 916KB
- SHA256 58962943793b8fa9554776ff9cba73f4d4bbb12279abec3413885a017a486c75
- MD5 f629fe56cbb668a5bb7046e3c5ca3799
- SHA1 3504b43fa175b7ae2c1be39256c1b50a39bb3185
- SHA512 e35602d722bdcb541913671ad28335fade72f7b922d174916c402c04654e24d8354a35edbfaf67648305af0cd5b740eee1edeccb226015bb441784e0cbdf14b8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQG+:A3mnXoZjzyaT4aewsAjxTcijQG+
- TLSH T1BF15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 916KB
- SHA256 2635deb1ad5a7dc93843221cc420703b3bb064da5dc2cd0c4fb62698c2b86b21
- MD5 af1f1989f1d84590060f9a1b3a83c2c2
- SHA1 a97d570557faaa03f6e748882a7c5b4110f0b938
- SHA512 4bd2512a5822f2d37e3f9db29149284da682eafebb275a2f8892cdbf3e58916befc1b68c0ac35d5e77539f4d812066728cce4d66ef5386f20cb1bb74c36b3962
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQGQ:A3mnXoZjzyaT4aewsAjxTcijQGQ
- TLSH T18715B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 916KB
- SHA256 d9cd3977b39d017ebac5170e559df13057d5f6dafd8c1d076dd30a65f461442e
- MD5 7a457c5008d9f463d24b45a85b8c464e
- SHA1 6548af01aacdc49ed91056d3751db4a582189e7b
- SHA512 5345fa8150b5da4a53a4ac57fcbb5e84bfd0d5b5478a7988ca4e7451b3d142b584141956534cea7a16b20d116a5dc0e8abffaa18c424df920a50286fb93ee918
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQXX:A3mnXoZjzyaT4aewsAjxTcijQXX
- TLSH T1CD15B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 916KB
- SHA256 8c1837c71497c2eea1bbe59119fd62f2946e1934450814ce8c9d78956b791882
- MD5 6482335a3d7d706e3d54437a780c80e1
- SHA1 541263ef78dec7052cc8dbaf68e886e935e0aef6
- SHA512 05f0d2888aea60e024abd17b0ea7488f9180b5fce3c4f5cab86b7ae4fbd74a9abbb9542150cb5f82dd1fecf76bb06468a19dfa094886bdb40978d77c9a6bf1bb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQNL:A3mnXoZjzyaT4aewsAjxTcijQNL
- TLSH T11815B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 916KB
- SHA256 1516d45c2853fa7bf9de7f7ed71acce45bd1b3b5ced3f177bf1b3cca35067590
- MD5 c84338a267a14135f921d1388d85110d
- SHA1 e5190268fc27b1369508a905bc2ee8ff7e371f52
- SHA512 a0a7059ccddf93b020b118ac9328d48fb319488948fa2554f0062a8218d221096b667d8e4a1a9eeefa35441b516bea3af79235b32ada66fd7e9010967a9dbdbb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQLFC:A3mnXoZjzyaT4aewsAjxTcijQLM
- TLSH T1AE15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 916KB
- SHA256 ab83ba5f23f3992ef133246cd8efb8a37a3df5d130555baff76362533bfa251f
- MD5 dc61d5e555be6674379b1e1559522c17
- SHA1 3aba31d7fc6b7839d9d5d94fc80dc9ef9dbcdb8b
- SHA512 78375fe3e992e39eb65dab6eec7f7c6a6d34fb48d0c22f69785369d5dc5c39c9f3fa1d68487f40e3562be763573dfff94dc1d5d8d70c7e6834e23246d34d3b8e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcijQMh:A3mnXoZjzyaT4aewsAjxTcijQMh
- TLSH T1B515B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH