Analysis
- max time kernel
101s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 12:19
Behavioral task
behavioral1
Sample
2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 783KB
- Sample260528-phex3ags4w
- SHA256 f255d8f1aec5b104bdf1e60a09136f1b68737e01454844c03e01f8ebbd27d4cc
- MD5 2b356ba44d101edba7f9ba5dc329a178
- SHA1 c9695c286714addad92c32b5d49e05eee502f62e
- SHA512 f3016855139cc48b006036315d5a2fa3ea54a00bf06683aa2d9dc896f63fe819d3dbf437e7ea9c17e84827c7a810e2c70178313e8452beeff166e0c06a7a2345
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR39:A3mnXoZjzyaT4aewsAjJ9
- TLSH T11305AE23FB70D0B5C27B49755B65C722E7397C210B205ACBE3A88A592F317D06B3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 50 IoCs
resource yara_rule behavioral1/memory/2836-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024660-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4112-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000215f5-58.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2836-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4112-73-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001ff6a-105.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124c-278.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000235da-423.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002124d-478.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124f-503.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002124e-570.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021250-607.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021251-632.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021252-681.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021254-730.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021255-749.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021256-793.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021257-800.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021258-831.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125a-863.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021259-882.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125b-895.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125d-902.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002125c-909.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021260-928.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002125e-941.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021261-960.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021263-985.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021262-1017.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021265-1060.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021264-1074.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021266-1105.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-1136.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021269-1149.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021268-1180.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126f-1187.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126c-1194.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021271-1231.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233d4-1365.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000233cd-1385.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233da-1386.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000203a3-1481.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000020294-1512.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000203a5-1531.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002029c-1538.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202a4-1551.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024690-1674.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e506-2115.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024660-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x00020000000215f5-58.dat aspack_v212_v242 behavioral1/files/0x000200000001ff6a-105.dat aspack_v212_v242 behavioral1/files/0x000200000002124c-278.dat aspack_v212_v242 behavioral1/files/0x00040000000235da-423.dat aspack_v212_v242 behavioral1/files/0x000300000002124d-478.dat aspack_v212_v242 behavioral1/files/0x000200000002124f-503.dat aspack_v212_v242 behavioral1/files/0x000300000002124e-570.dat aspack_v212_v242 behavioral1/files/0x0002000000021250-607.dat aspack_v212_v242 behavioral1/files/0x0002000000021251-632.dat aspack_v212_v242 behavioral1/files/0x0002000000021252-681.dat aspack_v212_v242 behavioral1/files/0x0002000000021254-730.dat aspack_v212_v242 behavioral1/files/0x0002000000021255-749.dat aspack_v212_v242 behavioral1/files/0x0002000000021256-793.dat aspack_v212_v242 behavioral1/files/0x0002000000021257-800.dat aspack_v212_v242 behavioral1/files/0x0002000000021258-831.dat aspack_v212_v242 behavioral1/files/0x000200000002125a-863.dat aspack_v212_v242 behavioral1/files/0x0003000000021259-882.dat aspack_v212_v242 behavioral1/files/0x000200000002125b-895.dat aspack_v212_v242 behavioral1/files/0x000200000002125d-902.dat aspack_v212_v242 behavioral1/files/0x000300000002125c-909.dat aspack_v212_v242 behavioral1/files/0x0002000000021260-928.dat aspack_v212_v242 behavioral1/files/0x000300000002125e-941.dat aspack_v212_v242 behavioral1/files/0x0002000000021261-960.dat aspack_v212_v242 behavioral1/files/0x0002000000021263-985.dat aspack_v212_v242 behavioral1/files/0x0003000000021262-1017.dat aspack_v212_v242 behavioral1/files/0x0002000000021265-1060.dat aspack_v212_v242 behavioral1/files/0x0003000000021264-1074.dat aspack_v212_v242 behavioral1/files/0x0002000000021266-1105.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-1136.dat aspack_v212_v242 behavioral1/files/0x0002000000021269-1149.dat aspack_v212_v242 behavioral1/files/0x0003000000021268-1180.dat aspack_v212_v242 behavioral1/files/0x000200000002126f-1187.dat aspack_v212_v242 behavioral1/files/0x000300000002126c-1194.dat aspack_v212_v242 behavioral1/files/0x0002000000021271-1231.dat aspack_v212_v242 behavioral1/files/0x00020000000233d4-1365.dat aspack_v212_v242 behavioral1/files/0x00030000000233cd-1385.dat aspack_v212_v242 behavioral1/files/0x00020000000233da-1386.dat aspack_v212_v242 behavioral1/files/0x00070000000203a3-1481.dat aspack_v212_v242 behavioral1/files/0x0002000000020294-1512.dat aspack_v212_v242 behavioral1/files/0x00050000000203a5-1531.dat aspack_v212_v242 behavioral1/files/0x000700000002029c-1538.dat aspack_v212_v242 behavioral1/files/0x00070000000202a4-1551.dat aspack_v212_v242 behavioral1/files/0x0007000000024690-1674.dat aspack_v212_v242 behavioral1/files/0x000200000001e506-2115.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4112 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe$ 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2836 2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4112 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_2b356ba44d101edba7f9ba5dc329a178_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2836
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 783KB
- SHA256 f255d8f1aec5b104bdf1e60a09136f1b68737e01454844c03e01f8ebbd27d4cc
- MD5 2b356ba44d101edba7f9ba5dc329a178
- SHA1 c9695c286714addad92c32b5d49e05eee502f62e
- SHA512 f3016855139cc48b006036315d5a2fa3ea54a00bf06683aa2d9dc896f63fe819d3dbf437e7ea9c17e84827c7a810e2c70178313e8452beeff166e0c06a7a2345
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR39:A3mnXoZjzyaT4aewsAjJ9
- TLSH T11305AE23FB70D0B5C27B49755B65C722E7397C210B205ACBE3A88A592F317D06B3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 919KB
- SHA256 f1ad4bf8a4bb1a6af29d9c1bf97e3efd4c03d400fd4a1cb738ea9e07af805279
- MD5 4bf3a4039d2ce56b655dd3888c928809
- SHA1 b91778f24a2c5637c5710eb76bffb4d332b0debe
- SHA512 7c5fef0414452ba82a194c3bf6f884b199f017cd4fb9f8d614895e35ac229bdfdf3fac0c7fb34dc5e2b451d0345d0b7e1d7da76aca534ed97cf8d72392528f1c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3HmEZrZq:A3mnXoZjzyaT4aewsAjJGqU
- TLSH T1FD15BF23FBA0D0B5C27B05711BB597129B79BC310B6015CBE3688A5E1F367D06B3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 875KB
- SHA256 732ec5aab01f52daf88471b6d941faabf778080da9a4eba0f1320faddc416f48
- MD5 bae231d821d5a4a9f3bc1bb6714ce1cc
- SHA1 7b03a8937ea23ffd9ecee8b63a9465763c41e3e2
- SHA512 f97790be88e6928bf6cbde83149e21b3184a5ae28f79d393f5c098b02a44ab2d4ee3d5a1c53927c42c6bfe443b147e38427222ca268e264ef7b8532da2f23b81
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3p:A3mnXoZjzyaT4aewsAjJp
- TLSH T14D15AF23FBB0D0B5C27B45704B65D712E679B8200B205ACBE3A88A5D1F317D16F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 868KB
- SHA256 43399600362668054cb77405a0d6ee74160ad62b1e3afff2bb5e492a6c64cd31
- MD5 ac6bc6be41576b421b891826187d63c8
- SHA1 f96fb06fa943f0a26916b332ee12a85557f33c06
- SHA512 6fdde87989c0b5ffbbf39a0c814f9aec099f9d0cc6cf7351900da5957c6074e758bbb0c813170a9441e44511ba3f36c949cee01f770ca8a296dd33d849038655
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3cYmIjE72:A3mnXoZjzyaT4aewsAjJs72
- TLSH T1B015AF23FB70D0B5C17B49754B65C722AB397C310B605ACBE3A88A591F317D06B3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 836KB
- SHA256 c46312278b6cc52e0b7584520dd2d238d972e91b8a34861051da26d98fb1f2b1
- MD5 5278e20fb268d79d90a9df4ee121e077
- SHA1 13e7aee1cd07fd4be4cfc0450a34f66f4164df17
- SHA512 bb2c8733e878a6cdb7a611038916105f7945067b5145bd9a743abfe87311cbbac0454d400bc9f1e869b2417ee25727a4019676b039e78fc267f4a221095eb7de
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR32Ffj:A3mnXoZjzyaT4aewsAjJ8fj
- TLSH T14005AF23FB70D0B5C17B49751B65C722E679BC200B205ACBE3A88A591F317D16F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 891KB
- SHA256 5065d00de14d43cd341de6860cdbd9a65e6d0bdfaf16283c7aa93f07aff70e59
- MD5 6e53fb1353c4723ef5aeb9037077bed6
- SHA1 586ade4b291b1e27646a890b29c1a08d43a65800
- SHA512 1634a7fc72854206f5b2c3d3755b1f2cc6b6caccb684acf6fea5cf182a7a146a0c8105b7c3446107c75306fbac103ae672615f9f4dbb7d2c766af345d29bcdb1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR36zQl8Hok:A3mnXoZjzyaT4aewsAjJhhk
- TLSH T1E715AF23FBB090F5C17B45754B658712E739B8310B605ACBE3A88A591F327D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 898KB
- SHA256 42359300b7f5f298ff0a5a8e0dc305f93450635b9926400864cdb9b752863b2d
- MD5 e5fd580ec4179341f3193e4807e5fa36
- SHA1 7ea35208365a1e5e55ca5a69829814dd989ed809
- SHA512 6df6d4dedab98f26189cffd5e4f29fcd55578a91f41cf9dce6c981aa806ab30e0e360f09dc8de0f9c725cb1e58d0e0981519f77abc08f8ac655b237fd5c86dea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3/nRpAr4svndNIaUnE:A3mnXoZjzyaT4aewsAjJ/TjE
- TLSH T14715AF23FBB4A0F5C17B49754B65C712E739B8310B205ACBD3A88A591F227D06F3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 16962f896682f9c889597d5b25149c893b3ec036764aa8fe54a816aef6394601
- MD5 72e7c1780fa319daef48152f0ef10cc7
- SHA1 8b51a93145e32911dcc418bf654220d556f72a27
- SHA512 56cba4943af8ccbf56ff1516882e0f0edb7d01fa2727e1dc577731407dab44dfd7a1de71ef958a127b93a364de8ef11aeebf1b0f17af4aaf48dfc7d2b944a59d
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjJJ0Le5ji0hmxNrM:A3kMPlj3Pji0Aj
- TLSH T156558E22F6748275D077C4B5CAE2975AEA7134510B308ACB9394C76C2F277E29B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 831KB
- SHA256 ae29e548bcff12c841f48b9d9f3ff1602ea6487ac5732df30e93c6549450535d
- MD5 cbf8da73e7e0b437fdd7720c52ab6b91
- SHA1 7b11ca77c88693859f217a30135fa3959cd79d14
- SHA512 daeb9fb0c61c3d7e717ebc16b964eefea25e45b34c893e00ea03d14d37f73dc703fb58a45628416fa4820432f8699862661b5b87e9851ae7d0c05e6126df8942
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR34b:A3mnXoZjzyaT4aewsAjJ4b
- TLSH T19A05BF23FBB4D075C17B49755B65C712A7387C210B205ACBE3A88A592F327D06F3AB16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 807KB
- SHA256 484f0f0aef9b9732fb630eaf5f0fa98b801c820a8da0ea99f39e84e860e22e9c
- MD5 f203a82c5ff6688c5a919b96aed916b5
- SHA1 2c4211b123a63aff846a0507ff829ed5410f0b16
- SHA512 d63bad4a9c581e4f1c7d89026c8fad712550181d218196029587e5839a046752f58719dd8e20d226ad4cabd44313bd50d4a4b643efa8c6fee88736be75d4f65c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3q9:A3mnXoZjzyaT4aewsAjJq9
- TLSH T16505AF23FBB090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 807KB
- SHA256 3bd234e1d9cdd2da0d0d670ed4359058dbdd2ee192c67e68f7bca3312f956ed0
- MD5 a371ca8b302fe17e97e65af874198baf
- SHA1 26befeb79570ec4b317f49f031da2d97628193bf
- SHA512 399bc93f0fa1f23db38c8653ee705cd5af86f3f0ba69bcf5491da8ee433ee03c97817a319d73323f89b789fb4afd181c566a4f1169ba16e19ca2d7eb18d6f2de
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3qc:A3mnXoZjzyaT4aewsAjJqc
- TLSH T1B005AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 807KB
- SHA256 103c663daf8415e24e1f0ec1a9cebe5e9d1cdb04645df6a316008b11a0f61c9c
- MD5 8a113705da67f2eda55558cfb4f8b19c
- SHA1 4ab034ee3b4d11880898d0d2ea62fa1d5f740a6c
- SHA512 1f36cdfd38120a10e1fdcba0fd4b9f58bf80e7ee77527c1b121d8b189c43eed251982cbac1a1a28abe351921cdb8055fe8cb583972cbff66c73c3c513a197d93
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3jp:A3mnXoZjzyaT4aewsAjJjp
- TLSH T14205AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 807KB
- SHA256 ff92cccae49de8e3f1154772d1a21d6b6be47eb1363e1d33aad3f60b2d2e45dd
- MD5 94db4561464a6637febc30cb4c369ba7
- SHA1 148372594f6e762bb1a1b0003db245d437281214
- SHA512 7dd7df9ffe80765794252b9930fbafe297759357f15642b80b85879ca7c5ec212a7e3dec90e5662e0367bf3f4693f8a8f40e59ddd18f93ce79a70805ee4310a7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3E0a:A3mnXoZjzyaT4aewsAjJEN
- TLSH T1F605AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 807KB
- SHA256 f61ff5942ee034daf4d5e04ce88afe35b2bb4ca8804ff439b7bcbe823ebc931a
- MD5 e4be72a078b4289e2fec8d77baa8a152
- SHA1 1abaf4d61eaccaadb7af7e3006ab418720fcdbb1
- SHA512 dd88672d75473cb6432337272cd3a26d9628e276a96a640ab3840b0e65bec5c84f51713b7cc460fdf73dc21fa155e93515d45c8cf7a57131624fe422f1daddeb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3sF:A3mnXoZjzyaT4aewsAjJsF
- TLSH T1B605AE23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 807KB
- SHA256 dc313d8c22346c5cc9811701bd583a49f44d56008ee370c085e1ca7b2cbb724c
- MD5 e8f68dd4bf78206438d665cde6dd32f3
- SHA1 0725228b4989a38d7eb6a41553bbfbb2a0a8cb75
- SHA512 19582692245b3e56d5b5e76b56fce01eac7093cf047b23731a7554bb23e4ac915ac0b6b91af0a5c6b430f144628ba1bb57de979ca18022cb7ee4d1fe71b391a4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3ZC:A3mnXoZjzyaT4aewsAjJZC
- TLSH T17D05AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 807KB
- SHA256 ad9821ca71ade934bd6ca3269c2bb65a32f05157e1c46957bf0f45b7f6432d67
- MD5 d516383180932054552a3fd50f19a728
- SHA1 6aa61d7a1e6a4c10f1ad0befd685fc522a4cebab
- SHA512 71b581178af9d7dff80cce268778f028347f3b6be37c52056a18b7da02e3b84be62f75b64bca706821d656b4a533a47c06660c98974c69dcf7d676dc83582366
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3aw:A3mnXoZjzyaT4aewsAjJaw
- TLSH T18B05AE23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 807KB
- SHA256 e61fd504c266d9480e3ffa7a56e5cc4b9df1eaf1447fc7c054c7049e3cbb2474
- MD5 3dc2b32656fd2ec6026ebecb507136f9
- SHA1 eef3b7376632047cd58a7255b240ffc104684fa7
- SHA512 54dcda675463a6af0ea5fb168561e40213d5f687923a6e0c74f5aa0c48791f72b289c7c00a3787c82efc83b301269178aa1f1d6fbd8134597c4086e2921faa1e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3hT:A3mnXoZjzyaT4aewsAjJhT
- TLSH T11705AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 807KB
- SHA256 3acbf06ccc0f2498f6f50465b6c9782f049bf869f3394291ef9ac8801bb413c0
- MD5 e83a5440d4c95a23b61e2ce05d4bcdd9
- SHA1 a9e6ed22d90caf434b8a25d09baddec5e6e20608
- SHA512 5580cd05246f424c0ac36b2aed9358e1072b301248bf89c3266f17a878d4e7f75856a4e0bc42d19a1d2c47761801af7917c470935cdf5405f04e77c2af230930
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3Pu:A3mnXoZjzyaT4aewsAjJPu
- TLSH T1C305AF23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 807KB
- SHA256 b47e015cb412ec474e813b55dff2954c41ee929be2b17f0e000c618456a20bda
- MD5 b0e545896ad730c7900e418b017a8385
- SHA1 a2d2a207381f8aa632fcc834012d85bb6a83468f
- SHA512 2cef66e1db850272f9683babaab35a79750557df1d26fdf201d295660b69a02433888fd557f5edc5ee5e3d7c13d891a2c00703f7e26104a1363a90376d2ebbe3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3zb:A3mnXoZjzyaT4aewsAjJzb
- TLSH T19A05AF23FBB090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 807KB
- SHA256 9681693aef44f3bdb8b27c83f08646e84d1054e62e43ec6a24ca0fec9feea4c0
- MD5 324bc6b92df29d559093af178881c170
- SHA1 6f259c0ad7b4a24d0ab05dd59e08c23b9b76388b
- SHA512 dc47337f0591fca8cc6a8529d7412540213cfbc36612d0010ec32edac55646b3288a613055401f748aa04d89c724f951f830481b6f9ecd8c453a0ded25f2d146
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3Hf:A3mnXoZjzyaT4aewsAjJHf
- TLSH T1EC05AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 807KB
- SHA256 ea4db3fcbc1318eeb6dbcbc9d284083b04cc465bba1d1b5ceb94337bf5c815d0
- MD5 dfc0259d38fcd85007e7c3982196a9ad
- SHA1 11ba00fe472dce36359d556b2b65c46ff975c115
- SHA512 b62f9090415975f82ff3d4d514aba6ee9cd17c2ae2393f3220347eaeb58cb3801f6ec2914c9c047ce47d726cad6b1f65bd2011cd6112f5976b72409d77875ccb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3wK:A3mnXoZjzyaT4aewsAjJwK
- TLSH T13005AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 807KB
- SHA256 db88ff31161fd78fc2d01ca710c83afbe4294187f593aa4cba9a5332b6fdbeb7
- MD5 98011d1a6be763a1fa522662c42cb61e
- SHA1 9c4017dc1a656341d0327fa19d4c7a5849855e87
- SHA512 32e4d75efe1b77751782bc447203ff8d455e14761025089c2094d75a17c9d3ee0e33feee0faf769b8cf574f1d8353dfbd04aa4381c510f2ffd97a46fdf9980e6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3tk:A3mnXoZjzyaT4aewsAjJtk
- TLSH T12305AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 807KB
- SHA256 a028150069e6d6d1f86038158268e4f669293f37fcc53406e6d4c62b46b6fa39
- MD5 99c0ef03627d5654cba99c1b9ea6efaf
- SHA1 a41bfa5aacd935bb1862b0bc9dcaf88a65f2c9a0
- SHA512 d974d840d5d04220660f13388254b742822466ee5f19939452744c11e70d8920edd57eacc2a6e13d0266959ef3641d94a0aaafccc93ce0db16216a0a786b3def
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3y0:A3mnXoZjzyaT4aewsAjJy0
- TLSH T1F505AF23FB7090B5C27B49715B65C712E7387C210B605ACBE3A88A592F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 807KB
- SHA256 65a9464aa964ddfc515c6127a91c009bb978d207d76fa297d048af23702b4745
- MD5 9924f34fd69e939f9fa90503f2e7308c
- SHA1 c08a9b10764e240cb2c04552b26833e579ec3c9d
- SHA512 cfca6d114960b4970ce0730328db672737ea7a28d80a43de1ce1038b1446c2fd3e38e224601cea8953aad8cdc7cfc672a53a5c480f2a3dce12a94cdb6b00e60d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3B70:A3mnXoZjzyaT4aewsAjJBg
- TLSH T12F05AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 807KB
- SHA256 d000f818b284319f32185891f49f240e5f9ff861d28865af34208f9409034508
- MD5 d42ab92efab3e83b2f8b09eec241b48d
- SHA1 abef96e53093622e9b532724f080598a90df3e3a
- SHA512 494f39663a23755bca3da55af9cb982920998e195bb2d86d4e7ae0bdd09ad903a0287933cefb04b04cf932a47cd14dd9ac22c21ff91ca6f78728b6e9301fff5b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3or:A3mnXoZjzyaT4aewsAjJor
- TLSH T11E05AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 807KB
- SHA256 aeb59e46ee9bf48b93133e22dca43b4c9ba28e132519757003decbd471c460fb
- MD5 e71486c42f92af1d3a412f12d3d5cfb1
- SHA1 08c2bd612623d9c5cf1d4c05bc1514f26d9c5c37
- SHA512 042d33febdd16ef6fa817be1ae6133792b603782511c2315cc1114ee0e070c5e701e3c90e64efd5c923a8bd71c267483e6a645ee3242660fda975444d4d27dcb
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3Gn:A3mnXoZjzyaT4aewsAjJGn
- TLSH T18E05AE23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 807KB
- SHA256 fff42ce8ea745140cc54f5146fd0688a0b9416c2f7a65b24dbcfaced5abfc334
- MD5 5171c4dfa55e981bbd55f14dca4924aa
- SHA1 7c75be7b5cdb3df3cb5eff7f557a777f00155b54
- SHA512 97783242ba06ce259b492045df9c2cad80535767ef21002d66112db388c803d7f640b5790ce83d9a1836e27a879f0aa54e0381580d44472cab527788bfaf0115
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3Mx:A3mnXoZjzyaT4aewsAjJMx
- TLSH T12805AF23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 807KB
- SHA256 4e3decd53afda9be446944213dd219889b4c39666eb67482b426e923254ec92e
- MD5 86052304ed468e2ddd0133727016474f
- SHA1 f2b5a6acd8a5262f9bc569507cb2e65dcd7db357
- SHA512 d9da4fbeda24f9289211c20bef920109a33b0f86a1a0d335c842b8e07a1e602912dcd8b42d7dd9bd599bf457fa921c66859463358fe1713ef2a07b35989cdff0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3GA:A3mnXoZjzyaT4aewsAjJGA
- TLSH T1E905AF23FBB090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 807KB
- SHA256 b0cb0a8138b6ab51cd9b89813467d3f711862ba9e2392288dab5706cc213cad0
- MD5 51ad77fe368a7d812bbdca2d80743f7e
- SHA1 a8a0b9ca8c77f1d5e1484d2ce9f798667335746c
- SHA512 2db30a1305d67b3bcf1874edcd333fd76180e9b0c71462211fe289504936220423ef1f3f7d8206e205372f9b5123fc88ccf43e8fddba35b3bed691baae0d7fc1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3f9Q:A3mnXoZjzyaT4aewsAjJf9Q
- TLSH T15505AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 807KB
- SHA256 59ab2a3a50cdf3bde7ef322250169d42fea82815f235ad5385cbd91541307f4e
- MD5 f3773d65d6a245189242dd5b268a627f
- SHA1 9a44bc85926ef2a7e48b5640c5c314299b094e07
- SHA512 5c19d897240adb0d1f7a0a411ff302a2954ddab0243940e272ea47d7413211bce4bfedcdf1aec7b5820ff72da931de2785892f68f1b36e362f0bc87b9e44aa22
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3W4:A3mnXoZjzyaT4aewsAjJW4
- TLSH T10E05AF23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 807KB
- SHA256 bec02bc95363e2bfb51e2ca96eed8f48b80595e301812a5e6c934392e2668029
- MD5 23ebcf81ecb1bbff7fe02076aa5ea03a
- SHA1 29cddac57844ed467e911f97be1ea149b9be44a8
- SHA512 dd1ad0e778ffb5848ebd8c00e2c57d41af2b4d26f1ce3eb82c1b7ab0a2eb3759b6e3d25e29f4f658073abe5b38161f52df368c3f26874c8caec67ffbca6961f3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3Fu:A3mnXoZjzyaT4aewsAjJFu
- TLSH T1CF05AE23FBB090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 807KB
- SHA256 0ae30fe39ce6b9454e8fc122244ccfa8072a5a1ff63774879afc113b9575c981
- MD5 c30970b553aca2244e38ebff289bf41c
- SHA1 2886fa6087ea5824a5d69208de946a323035be5b
- SHA512 442864a51e96b7b4dc5fe68104b0107c05200560092f8bf9f3cbb279ab72b4ea1c310e88d4f09ae46d07d8fd29999915f07b09ef0a34f0db90e7b31aac91009c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3Yj:A3mnXoZjzyaT4aewsAjJYj
- TLSH T1E405AE23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 807KB
- SHA256 9d47639da5aa61d2968c3e7deeea22a9a892f81e3aee1b076ac14a9f3453c89b
- MD5 175aa68da65a2ea9045e442035af750c
- SHA1 85e4aa1d7af30510a8f6fd03aec4f32b7d620605
- SHA512 f98a2f3eb0f2b9dba8edd97d45c5e2627bb2d09eeb99974392252df96b198282f4afa48b270e9565edd32a0c583f026ab208bd3817cb1aaa8d0bfca3b5156312
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3pg:A3mnXoZjzyaT4aewsAjJpg
- TLSH T16305AF23FB7090B5C27B49715B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 807KB
- SHA256 f54586fc2b23a977f7945cfb5071f0df7a9565dc29daa34d326d3c85f9098c91
- MD5 ae7a845f30c226eea653907c41bfaa16
- SHA1 1073fe0b780c59fb8cf7935db8e0661df0f688b0
- SHA512 bafbfb6cb4bc674eb6c1e3f532fb9f9c2ae3c1cd4323fe6197ead6b1bf43a91102b6480ea349afd3ca302b57dfc996fd77384b348dbd33581c49fcdcb36fb50e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3wI:A3mnXoZjzyaT4aewsAjJwI
- TLSH T1F405AE23FBB0D0B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06B3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 807KB
- SHA256 7cca1fa80a063eb52cade2cb3194cad71e6fe4a6c42174359faea4d871f8a7d8
- MD5 79356d4012dd77856e8bbb74f2cf0537
- SHA1 78f73d5dc22589f4c5a8d49cfdacd5ab36173534
- SHA512 e59a7eeb9d37ae8b74c4de3daf860d74798311069f0527dc6cad235cdf84f87b90ba9e73995d1f31945460acb85278291cb66c807f454781d10c2638cf8aabca
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3yo:A3mnXoZjzyaT4aewsAjJyo
- TLSH T15105AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 807KB
- SHA256 09dd8a544a393218c33c2f59076b019ad4256d87dbd4d76ac0ca24af178b8b8c
- MD5 46c173d311e3d5da5d644e24849b0cb8
- SHA1 a6ea6e4598e9cd4bda8e6e8bbdd72824ecc6e20e
- SHA512 d4d3186003d9cd7ff94773232d3ba886788e4d452d2c88a736941183fbf066f7578fef1d6fb8b02fd70caea720725521e7a9d78ffac16fb41f4f08014c6697aa
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3p+:A3mnXoZjzyaT4aewsAjJp+
- TLSH T1AB05AF23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 807KB
- SHA256 50ab85f6478e9fc84a58b6f4db31508fd2260b1c97c67cbd70816e44a4a4b9b0
- MD5 d1f0ccb573b4faffb812a453d185add1
- SHA1 e60a17213974d7774bb239e966f2f162ed23836c
- SHA512 ad3b1c3110cccdaa790175532ea634b381a3e6407e0ae76cc25e39ec072ffe76f40427d8b674f62ebbf772b66241948f48f9e5ddb1fa8fb9511ca8f40fd20d80
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3XQ:A3mnXoZjzyaT4aewsAjJXQ
- TLSH T16605AE23FBB090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 807KB
- SHA256 1774a02bdd647be9ffd2bbd184af4ad8959cc7b747d6d5d488643b62b2a4ab55
- MD5 579b03755c95ebd018ed19798c0cacf3
- SHA1 24d644b5d2af5170561f219bc922b54358737347
- SHA512 4da401ca7dad893d9927fc56cc61ce8754687210789f82db2239da7aef025308d758059e824d0cb513a2c3031155b409898155ca973e341c4ddddbb0f3224b9b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3sX:A3mnXoZjzyaT4aewsAjJsX
- TLSH T10505AF23FB7090B5C27B49755B65C712E7387C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 807KB
- SHA256 ab29dd01077245d337c2becc33fb9c631d6cdbb523c8038d04dbcc0352ea3a92
- MD5 6d3281f92a85766f2026224aae8c829c
- SHA1 4d58234408acc03c45cb76afd4da061ccf355b8d
- SHA512 ab3ef23ed81aab1c7e617a699aaee3837fec634f40422f627de5588042b530bf035805d26e474cfc08697e375c65ccab181b0c6a7938e11051b13dd8f033d9f6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3KL:A3mnXoZjzyaT4aewsAjJKL
- TLSH T11405AF23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 807KB
- SHA256 f28c17891e1019679400c80d50c1fb5db8b27311728fa48f8a1d7cc3020a6457
- MD5 bf11cd211b4e9d2d486cb89798571aaf
- SHA1 a673063988d5499d1791fa91b7829faa0547b91a
- SHA512 3fa1f663e20fe7e66af7b7112678ba43ff26f3342e7d63123abd4743fb86d5fa16a226760288249c9b781b50840121519f6577af526c47ec703d41d56e63960d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3uFC:A3mnXoZjzyaT4aewsAjJuM
- TLSH T1B405AF23FB7090B5C27B49715B65C712E7397C210B605ACBE3A88A592F317D06F3AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 807KB
- SHA256 eb57d3d2b55500463cebd3923ae655589aab2032d5be4ba864d83f0b226a22c4
- MD5 c1f2cc27d4ca5970b281e62693a776c2
- SHA1 54ccd581caa41f5cdb34e10b8062c16ce8af9bd1
- SHA512 178552ed21c0d3615903e3980b8893eed3dce2e1dfc3979222ea8d9cc4fa35a95a7afccb58c518454b668ff7c84dc54c8182c3bf2b1d896ca16d2f95fcd1399c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR33h:A3mnXoZjzyaT4aewsAjJ3h
- TLSH T1B705AE23FB7090B5C27B49715B65C712E7387C210B605ACBE3A88A592F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\pingsender.exe
- Size 866KB
- SHA256 e8e1c499b9dbd8230a0513e07456cced870d09d79f4ddae876457413beba9faf
- MD5 5c7ff26d45ba224010679d9086639033
- SHA1 4740d5afcce59ac3068b76292752de01625de49e
- SHA512 5cf9739d4a265c7902a9608083cf115cb9570af476f88d3bf0bd183216f534302554018c76132bd70327fc06e0b2413dcceb47632feb827f9c369d207e02f613
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3qFdX:A3mnXoZjzyaT4aewsAjJI1
- TLSH T17015AF23FB7090B5C17B45715B66C723E7397C210B605ACBE3A88A592F217D02F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\plugin-container.exe
- Size 923KB
- SHA256 1dfb38e993067f5fcfd2d142bd38c6bc937f3ad109b369fc131d6d7dfb5dd5d4
- MD5 1551270da2f8a6a61eaa392e53608cde
- SHA1 c20256cca6bce8d7c4150474c198b598b767de4f
- SHA512 f52c8c4ef90b1fb19b5da7ccc9d1ec0133c36d5103a9a0bae3bfa52ec3d1e1e94f5ccb8201ac62f1fd627c971d2288db3c43b41defe4ccce761cdcdfbb115755
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3BLeI72m:A3mnXoZjzyaT4aewsAjJB6Iam
- TLSH T12A15BE23FBA490B5C17B85745B61C722E77978210B205ACFE3A88A592F317D06F3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 848KB
- SHA256 89b2178c2dccee85837f9cd5422990862a7af8a43c086b9a04eec5ffa55459de
- MD5 40a360b11698cf0536e6148cb767f13e
- SHA1 f841d02068ad3ba0493cdbcd5f2676834a8fca9b
- SHA512 1653da9131a683422af11e6ea333cdd77c624f2f0a79ed936e8e53e87e9649b20029cf745839b8b07458a7082a30242e3388cfa568beea02446a201062f39048
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR39Ihp:A3mnXoZjzyaT4aewsAjJIp
- TLSH T18F05AE23FB6090B5C13B55744B65A712A6397C200F2056CBE3E8AB6D1F317D16B3AB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$
- Size 843KB
- SHA256 eed9eaef7ce19106ad685f68b5184f0a7cf66cf6a3e698302725a0e7dc2a16ce
- MD5 f174c879890851905e460130d0c051f3
- SHA1 a1b1bac2278323b6a6494bd943534bf6516d881c
- SHA512 76b3d0e0a0cbbb1769c3429a35e75fb899ec61afa3b64814a35a0d9363fe1dbd1f31b6c72b5c006db48cdc78b12a5f3c2e21f554efdfd4152a6b93eca8c3c1a7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR34pIyvJd:A3mnXoZjzyaT4aewsAjJ4jv
- TLSH T1F105AF23FBB090B5C17B45754B65C712E739BC210B605ACBE3A88A592F327D06F3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.0MB
- SHA256 f27e55adf6e320611069d7340744e51a5fec7f97a69343ce622957c04ab78f79
- MD5 18690daedae807f73b6e5232206e92b8
- SHA1 5482e5d7cd2e658537b008a2ce6235da6f5a1ad2
- SHA512 9b19f33d856a6aeabaddee93ec61724f6740b33c539434ab49113eeb074c19cfbec84cc45eedc56c0fadb62c918e9fa7f642fcfd527653fb13a64ccef1b7f5c9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjR3YGVxwNR89u+Y2yBYz+:A3mnXoZjzyaT4aewsAjJZV+PAk2hMH3
- TLSH T17A35AF32FBB49076C17B05710EA9D726A738BC210B2155CBE3A49A1E2F717D15F3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH