Analysis
- max time kernel
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 23:42
Behavioral task
behavioral1
Sample
2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 892KB
- Sample260703-3p4rnahs5s
- SHA256 d4c2619e6f7fc171c30e65a22ea0c78c13ed8d701ace10c82bd948910abf3d93
- MD5 e3a195c491fa51712883a82353ae0fa9
- SHA1 0c46e225c66bad2fd0166ef974ce8bf23801054f
- SHA512 c05f414e246676e3e59cd6fd1198ad1c0970ba42ee988303fabc05d2904b0f815e7dd2358d5a9489f54938cfc4c6cb694d6c4ac2aa701562a173382d88118528
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv69:A3mnXoZjzyaT4aewsAjl5Sapv69
- TLSH T1B415B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 37 IoCs
resource yara_rule behavioral2/memory/5052-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c5cc-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2ee-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2fc-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7b-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5052-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4652-72-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001994c-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995d-517.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019967-548.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019968-585.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019969-598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001996a-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019974-612.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019975-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997b-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019980-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019981-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019986-649.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998e-674.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b52-735.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a696-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a693-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a5ee-1012.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a5ec-1019.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a17d-1056.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac5d-1218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac59-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001ac5a-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a000000000145-2143.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c5cc-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2ee-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2fc-39.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7b-58.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-201.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-208.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-227.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-246.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-266.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-267.dat aspack_v212_v242 behavioral2/files/0x000300000001994c-498.dat aspack_v212_v242 behavioral2/files/0x000300000001995d-517.dat aspack_v212_v242 behavioral2/files/0x0003000000019967-548.dat aspack_v212_v242 behavioral2/files/0x0003000000019968-585.dat aspack_v212_v242 behavioral2/files/0x0003000000019969-598.dat aspack_v212_v242 behavioral2/files/0x000300000001996a-611.dat aspack_v212_v242 behavioral2/files/0x0003000000019974-612.dat aspack_v212_v242 behavioral2/files/0x0003000000019975-631.dat aspack_v212_v242 behavioral2/files/0x000300000001997b-633.dat aspack_v212_v242 behavioral2/files/0x0003000000019980-641.dat aspack_v212_v242 behavioral2/files/0x0003000000019981-642.dat aspack_v212_v242 behavioral2/files/0x0003000000019986-649.dat aspack_v212_v242 behavioral2/files/0x000300000001998e-674.dat aspack_v212_v242 behavioral2/files/0x0003000000019b52-735.dat aspack_v212_v242 behavioral2/files/0x000300000001a696-796.dat aspack_v212_v242 behavioral2/files/0x000300000001a693-803.dat aspack_v212_v242 behavioral2/files/0x000300000001a5ee-1012.dat aspack_v212_v242 behavioral2/files/0x000400000001a5ec-1019.dat aspack_v212_v242 behavioral2/files/0x000300000001a17d-1056.dat aspack_v212_v242 behavioral2/files/0x000300000001ac5d-1218.dat aspack_v212_v242 behavioral2/files/0x000300000001ac59-1346.dat aspack_v212_v242 behavioral2/files/0x000500000001ac5a-1384.dat aspack_v212_v242 behavioral2/files/0x000a000000000145-2143.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4652 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91390\javaw.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{6D9A8F9E-89B7-4650-9C1D-6E17F6AF53AB}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$$ 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5052 2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4652 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_e3a195c491fa51712883a82353ae0fa9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5052
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 892KB
- SHA256 d4c2619e6f7fc171c30e65a22ea0c78c13ed8d701ace10c82bd948910abf3d93
- MD5 e3a195c491fa51712883a82353ae0fa9
- SHA1 0c46e225c66bad2fd0166ef974ce8bf23801054f
- SHA512 c05f414e246676e3e59cd6fd1198ad1c0970ba42ee988303fabc05d2904b0f815e7dd2358d5a9489f54938cfc4c6cb694d6c4ac2aa701562a173382d88118528
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv69:A3mnXoZjzyaT4aewsAjl5Sapv69
- TLSH T1B415B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 4827357f00778d15c7dd0c76821ef88b5efba23f7b00014e443c08da70196b89
- MD5 991becda665a1e6b7ef68b6ba99d20ee
- SHA1 e9a0395e612c00715aff0bf764b4371cf53da5f3
- SHA512 91071d1a40a8ed857da6cd0eb7de2312568b120dd4ad619add1dfcb9979de19be49ba229868e85dab7018a30a94bd4575d56e50941ce52cb01332600fca38da1
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjl5Sapv6J0Le5ji0hmxNrM:A3kMPljyPji0Aj
- TLSH T163658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 907KB
- SHA256 c345a957cae199fefcc158f7639d1fa8d736651aad8c2aa999c4b2657a53b492
- MD5 4fc0a1a9e8249c6e9cace2ddc29d6808
- SHA1 2c4608b4bab06373eb8601ee3d228d6b78db45ba
- SHA512 f3e650242eb65104643d4b0c14f85da012a9c397871c6821b86e388cec679d54819e79ba535042989eeee5a086d9abecbdf14430ee23a6ebe8124f8accd81e27
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6ba:A3mnXoZjzyaT4aewsAjl5Sapv6ba
- TLSH T1D715B023FB7090B5D27B49705BA58713EB397C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 940KB
- SHA256 c345c281e0d82f639e1f7c400b4053383bdc2b9aaaf9170f44de05b81a71e7a6
- MD5 f8452fa867554abe19e184cdbf9aad70
- SHA1 ac1eb2f9cc940ce49f3fb2d48155cf942ad770cd
- SHA512 e841439933553eca19fddab9e0b41cc74b012428c5b89886eda5ec04dcaee98f0250483617e77c208108325a1473218a72381ece8f0b0a8c33f888405f8ea503
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv64b:A3mnXoZjzyaT4aewsAjl5Sapv64b
- TLSH T14725B023FB7090B5D27B49705BA5C712EB387D210B6056CBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 916KB
- SHA256 b19a748c1ac896c1249978af9e38c33b662d4afe11ad27483f38b8cd2f120393
- MD5 63fd5ed59ccebd877345ac6ed564f86b
- SHA1 b8f1b1d8fe8a0b0271221279984ea622ebeab571
- SHA512 210c19b037b4c4901d07ac853fbf976f49eb9cc0cd57952a69f63812b63936bdeb7ffb364f8693affdf0cf3e2f12cd217ba991c8df703b3bfa4dceb826a24a81
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6jZ:A3mnXoZjzyaT4aewsAjl5Sapv6jZ
- TLSH T15715B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 916KB
- SHA256 dc399d58816c6974047943dcf1137bee3ba30a8bf37c377de369e773d02dee6d
- MD5 5ec63229759c9836e89b5eaefa2cd38e
- SHA1 0c133d86098fce3b2c2e97a1b8e77ea34fb5c71e
- SHA512 6bd48beef219c49b464c1859d44d30b9d599b579d8320d32c333e5ae6068ea7d6f29d949aa72c77fceefe96e2d9c6b6c885733e90ca13e245f313f0106778427
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6Y1:A3mnXoZjzyaT4aewsAjl5Sapv6Y1
- TLSH T1AC15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 916KB
- SHA256 95c9a9d5c8fc16a6ca7ae78000ff46e15995bffbc01f6393ccb8f31077d5953e
- MD5 6a24da08acfd2e0db695931e8b8d146f
- SHA1 1df8c464044face0e36e6242ccd03d17609c175f
- SHA512 15b34f944d3c42fd5d9e681a80782f3ebe229fa578db600683d8c992d43780e102723270d0a9d8123418973aa0dc1a28e8e15c48b16790b6c6f64cc39aa87afe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv666:A3mnXoZjzyaT4aewsAjl5Sapv666
- TLSH T1CA15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 916KB
- SHA256 e09f2b758bcb3ffae2194f6ec7b04308344c17ec93aa2297b9f6cfdcedb8e0c0
- MD5 e287336c26677c661ec96f7efe25f220
- SHA1 d518ba90084f5ad5c76574b30471c56957fd22cf
- SHA512 aa58a198f18acc95fffb777063ab488493329608482125ca4fbfae73a8cdf7efe5c205e8920567bbff0d19058dddd8b58b26793573ac78b63b80c8f01d542bb5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6yN:A3mnXoZjzyaT4aewsAjl5Sapv6yN
- TLSH T10615B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 916KB
- SHA256 df7992ac29170f2a5aee9a638d4af1b41185c1481a4ab5a53aa5a6ebaaf41da7
- MD5 1eea7d3356bf600e174a019f8b363f36
- SHA1 82f4304fc30216e9832f277d2885b972851ac8a5
- SHA512 0c643ae55809695c9a07166dfa1b4b023ff2bf854f5e6ea588741d3a5031ac4c35112ebfa673ab6253a8d6d088edd65ba2540d4da836a8b8a62e62bcb576639f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6of:A3mnXoZjzyaT4aewsAjl5Sapv6of
- TLSH T11B15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 916KB
- SHA256 6dbb796ea2375067eae25e4d37d4deb8bcffd541787d7d66042f0c8065562dc5
- MD5 e300d2eb61596e344cc6139120e1e49c
- SHA1 bb6bb3d2b7988d4fee67cff9000abeafbb059d90
- SHA512 0426732b63d0df01125033c72cb962c04e227836acfc80d9d1ec0352114d70d223aedbdfbb5566cee44b8df8ba64ab2614a2446bc4a5a3bc194204ce051c1f4a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6Co:A3mnXoZjzyaT4aewsAjl5Sapv6Co
- TLSH T10A15B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 916KB
- SHA256 3891e9ad698124254e8ed8a55a91ef0e90daaa41fff1056185cb44b761ffa1cf
- MD5 22d62cd4eac2c48167ca2cf12e5ded8c
- SHA1 92e700454fadbd1d7d2f6d64b0918ba319a6dc0b
- SHA512 94b253381f8811fc999c956174491495aa5fb7fb187df419d5ff9bd35a7a21b0685c3f0a8cb16186f74bb838c9b95074b9d7955158e53dcfa34995417f61f83c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv62u:A3mnXoZjzyaT4aewsAjl5Sapv62u
- TLSH T18915B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 916KB
- SHA256 d2d38e09e8c059687f622a80b76b8778e6accde07943725fe24c8ad0569eceb3
- MD5 e05207a8aa3294e087d4c2f097174685
- SHA1 864216c4785d48a1fcf217a582948636b697199e
- SHA512 b08d7c49261642f0c7daa609031d8cfa010d9afc06218ba995319794064a56c9e5d6ff65e46d0334190c816b8660c23880c385c6764cb2a6ec9257b56e938c19
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6SF:A3mnXoZjzyaT4aewsAjl5Sapv6SF
- TLSH T1F715B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 916KB
- SHA256 e0cdb6f35d510ace7bedc0f7d63eb2c65ff5884b6a0d1a3e30a1f625dd0f7446
- MD5 733bb9832ea3351aca545b7e5285dbcd
- SHA1 22a2bd3c663dc9f61b6c149ab9d870a5c2604fd5
- SHA512 f6092a01a568e5fe51117eb24d067f51470418ebb4b0758f55e2bf043ee2f68879f6aa81cdb8fa5e446448f7cd651978dd93e186bd4b3522e09c81b267e5b90e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6Hj:A3mnXoZjzyaT4aewsAjl5Sapv6Hj
- TLSH T10915B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 916KB
- SHA256 b4e9b73e9fb0014dafbf6eed96d1145e30d88ef561cf5d6b8ee519a7a0e86c23
- MD5 e456013d0fb723b1cfdef940fdf07f1e
- SHA1 1aca31f82caddda36f149ef451c91abeb96fea6e
- SHA512 cbbfc12a471923f9b04de4f65663b26d2f7a680326a22484b98fea29097d04e91b64acfdeb1973d1ed990ff9088d2441052bab4f1b5d1f17f5f5e564f911be5f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6N7H:A3mnXoZjzyaT4aewsAjl5Sapv6ND
- TLSH T15815B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 916KB
- SHA256 ee6be062ebbb93ec004f5654a839dea1a069d8d8d8a535ede72c92324d5d718d
- MD5 02079d210776074649456baec219ea53
- SHA1 74c6ebf3ba9612078fe7ed8ddb50709d3e81a509
- SHA512 a4fba36285a9bae681445ae9f9ab85471d7026718712215967bd58f30b3c45bc25da9c3ce891aff411ee2875e2f7f985676cb4815c6f5e1d50d998b65b293076
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6Rd:A3mnXoZjzyaT4aewsAjl5Sapv6Rd
- TLSH T17E15B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 916KB
- SHA256 dd53e9a1c888a26b601b53332ca048f28ba9993228ce47de9611e7d18167f888
- MD5 9321014e9d1ac243a3000bae25468f31
- SHA1 a4cdb9c5926be23e18ff3358491888edf40d712d
- SHA512 3329115e087150a2b3b144647771c0ed6e2fcf2091392916446956c1320f31bc4abf140d690aec643499eb33c9a7caec1e4f8d8a271c67b3b2280679c8ace7c6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6NM:A3mnXoZjzyaT4aewsAjl5Sapv6NM
- TLSH T1EC15B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 916KB
- SHA256 193cedf17de3fdcc764d8737ba04d9007ddb1dd0fce40c13d0f27e676759050e
- MD5 93ba51ba6c36efe45a4588e8de92368d
- SHA1 ccb9b72c0e1b41eedd96ddf62f7b3c51c3125f83
- SHA512 6cf57e57a0c0d687edf902eed1542a043b5d660c8b697ba1c6cb28fa08b9a1360f8750346bcfa4fd145448e7cc6ddb11cb1e0380e274466c25dde44e9587f826
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv66W:A3mnXoZjzyaT4aewsAjl5Sapv66W
- TLSH T17515B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 916KB
- SHA256 345e3dbdc14798b4027fd371b961e91265a16a327d9078ad20701f1fc913cd44
- MD5 f8b7e33d24d89bd3f3f9f76afcd37809
- SHA1 833cd64088a7deaf6d5ae2f7edbb318c37413dcb
- SHA512 533f6e5b64d7d917ea587b76aa473b1880e009b95444c92b8eb9f3e64346a04e997040f112f47d1c45a53cfde36f4975d853e6012f7bde0d2105a5b7ec54955b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6l93:A3mnXoZjzyaT4aewsAjl5Sapv6l93
- TLSH T18B15B023FB7090B5D23B49715BA5C712EB787C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 916KB
- SHA256 6844877c670b973166dcf76924b1a21aa3a1f97b042cd35fb0967a900fe4b6d2
- MD5 d0a0e020f31a5594e2efa3afaef4a786
- SHA1 c6424ea0b0fcec4f331de013e5a51d6890ba9e79
- SHA512 d5a65c6ca942f48e4d19f8947c836414acda371c321fef322ea38e5c59166f289b89f7678774a844dd35a7cd5c62a991ad7f44a182428b589fb9d4ec5ef0d0e9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6v/:A3mnXoZjzyaT4aewsAjl5Sapv6v/
- TLSH T19D15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 916KB
- SHA256 a934e6c2ac79dd9372200123ae69bde0bb8592a7d0fbe2ccbb820e758ecd3e31
- MD5 207bda729d803d8e15ed21a1e9bcd9db
- SHA1 77dbaf2739257e5e3c934f73d7dad712adbbd7fa
- SHA512 1fb7d18abd249fccbcdd31fdedf816ccaaac62f92162f42d986f772d8f4a5419074b91a2a628b5c4a6f95ad1dcf22186ad434614d48d514b72d934249b405cd7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6da:A3mnXoZjzyaT4aewsAjl5Sapv6da
- TLSH T1A815B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 916KB
- SHA256 820e4e9e57146d0e9b9cb0d3fe1bd9b9585ffcc3b0a7d823e333e6ae95cd0f69
- MD5 113b2084ce0fef2af8ecea699ad84eb4
- SHA1 96b69c760d2223bd88af82571cc877d6d6418409
- SHA512 7315205eeb36d87a11f373c0923bf1f20a19e0a92e49c64247c26b933e3614a6effca3b07a52fa56cf99669afdf63536d4cd6dc82100b37e4375dd7bd6ebbf7d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv69j:A3mnXoZjzyaT4aewsAjl5Sapv69j
- TLSH T14315B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 916KB
- SHA256 a66a75acff41b935c982ce3fbf58a4cfc5bd5467e31662912a7c8294ad54d5f5
- MD5 59370dbf670c48325f31155168f5f257
- SHA1 4d7f9d80bcd64f4b3dcf5443747b2d08cf691a0f
- SHA512 c27ce168a07c55975ecd8298ff9264051302f7d9ec71abb592d1c6d3a2f559908c245ce5660f7d17561f158266e9b3d2de9b01a2eb94cc283cb602b22206b881
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv66Q:A3mnXoZjzyaT4aewsAjl5Sapv66Q
- TLSH T17A15B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 916KB
- SHA256 ed4a82ea5299fed199471a997e584d4284ab40920f13c18ce041c4f19415ff46
- MD5 bcef41c8be05926aad870422191d6ec8
- SHA1 5ff7206b4c8fcc111cf9b5371c0886217563077c
- SHA512 4bfbdc4596804a678a477d1e5d81310c78560b60733b84bccd13d4a851c6c6b7c6a767091c8c8392d04b53cd4dfa66dc19000727b07995e4539de7b463db20fa
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6Ji:A3mnXoZjzyaT4aewsAjl5Sapv6Ji
- TLSH T17815B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 916KB
- SHA256 1385e1a5e37f1f08c886f7b7d42a08c374b91e9549479c23ab292cccf1d6bcc0
- MD5 0113a48b2d84b5f8e65c6ac856e25a53
- SHA1 7f0006600e7311adce07e3b910e9c5971cca604f
- SHA512 a6372737466811045eca56e68e25584be3c997af3cef5c9224a08c85b5b6e92047bce5f0ca93cb62c9e82fed310160c02bfd9b90c84a70d272e282e2f60c5cd3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv699:A3mnXoZjzyaT4aewsAjl5Sapv699
- TLSH T15C15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 916KB
- SHA256 62508224d6472cfa52756d6e2c68806c0b700377646a5d7f21e5b9c9176a006f
- MD5 023736557a1870a45344f8cf6a0d3eab
- SHA1 a094ed69212afe1dd18bdbc735a91d2b60c022e3
- SHA512 52b18d1f1574c56d69e20d39a4b75ab3df939f30ea444ae5f49bb73ab45a177f13d6362ea70505f45e319c189890328f5fd8e2e367eaa5d1757b198251296295
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv63v:A3mnXoZjzyaT4aewsAjl5Sapv63v
- TLSH T13815B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
- Size 913KB
- SHA256 be7b35b03bbfd0bc0ce62d17f7a06399bcd54f34a22026eb12cb56a1430e2c03
- MD5 ca9730b1a2b089d288e8d2ea81392566
- SHA1 8cdc243e332a1274e5f58206e778009333b7db39
- SHA512 be8b339b108ed926659c739bf8a08243ec07d651eb126543599514481570c74768cb9a8df20e9b1d083d05d3957408ea7cd7325e7b648f8d3e6ba47fd061ebde
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6A:A3mnXoZjzyaT4aewsAjl5Sapv6A
- TLSH T17915BF23EBB090B5D27B49705BA5C713EB397C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
- Size 913KB
- SHA256 64790cdf9bedad4ee6ff9672ccc9b48f01e9f2b02599729241dfd40c7e2a3862
- MD5 dc6c368920bd4d7ecccfb1dbf37c66bb
- SHA1 91d189f77fc23141b79455a7ec9cec3baeeb49c0
- SHA512 ef6cd3fd62c9e4f8f11926ad104e9cf22fe8ca8eb7bf4944946cdb60d0f87ff27ae1545b032eee3ed4a823c4c2e126b341bb5b59c70a29abbf32f7118759517d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6Q04:A3mnXoZjzyaT4aewsAjl5Sapv6Qj
- TLSH T18915BF23EBB090B5D23B49705BA5C713EB397D210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 925KB
- SHA256 325a42338d960bc03881d8ee90a455a82eec338621fa6c69abc5222b4a9df405
- MD5 21a186810eed3fab0f6e7182fe152295
- SHA1 97be8bede2d30fd12abd2f86dd2c87d3fd131c72
- SHA512 a8ce09f22fec551606e6890f0c0b9c091b62d6e2f55c9d719100fcf3e35264846ec21beabdd65dfcba9f989486d82970e464c76a46e5f6d4feedb6bc5e5d13b3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6k1:A3mnXoZjzyaT4aewsAjl5Sapv6k1
- TLSH T10E15BF23EB7090B5D27B49705BA5C713EB397C210B6056CBE3A88A591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 968KB
- SHA256 97c7997187e17762c16948124b2ab3d7dd63f6ad3c5faaa72f43427c9761cb00
- MD5 a0d51fe94a17fdfb8e5386ed8db99ae5
- SHA1 84699ce042bb1cc5e44c285dae70dc4c65c8a64f
- SHA512 9b530ceae782f6d64b9357ca0e2f58f716e18e735bfe66156fdd46571e7108760760aea4d9ca809fe2ac571145deb1bc22d16b1784aa20749e0ade6ed0901105
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6ZKHkUl:A3mnXoZjzyaT4aewsAjl5Sapv66kUl
- TLSH T1ED25AF23FB7090F5C56B49705A65C723AA38BC210B6096CBE368E65D1F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 936KB
- SHA256 02df433e26b1948cdbf084c5b877a954327399f2a56bcf50935004f7694bd9e1
- MD5 a20dadf2b1b4549425349bcbe50a00dc
- SHA1 f58749f8706b373387c77a46bc91a93bc08a97e4
- SHA512 18c948a3cdf6f6244d78b181275494b066d7b4e718907691f78e8c1733cfa3bb8f0c556e29fc3de4e67ce8962fe5a387ba784f8bc38237e90c6f696776a80f24
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6EwZi:A3mnXoZjzyaT4aewsAjl5Sapv6EwE
- TLSH T13215BF23EB7090B5D27B49705BA5C713EA387D210B6056CBE3A8CA591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 947KB
- SHA256 0bf4253d2ad3f9fdec4e0ecda378270e2b75cefc2e71b39575f2b47941ba23a6
- MD5 458a6b0914faa1f43c2001754e2854a0
- SHA1 d8c6470f216315b0e9fc789d7992fd00056aed73
- SHA512 b8eeceeb7c5b46bb4ee9e65d4d52fbae547148306d7b4a6f0dcb613a2be7ab678a5baf5bd84d343aa7d881bf62000ca7a03f153ad811390a661501a5df9bda81
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6L2+:A3mnXoZjzyaT4aewsAjl5Sapv6L2+
- TLSH T1EE25B023FBB090B5D13B49705BA5C723EA397C210B6056CBE3A886591F317C16F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 953KB
- SHA256 bbc8a51f5c06d39563d3f73728d24d23dad188062d77878e7d264bc3153f9c75
- MD5 d35a8e3843bed70e2c84636d58a504c4
- SHA1 a5c6b4dcf1e3d95e5e7d263e4d269105a4c74542
- SHA512 f01df5fd2e8de8c9b8d7902f83c25d9c016f7058ded332d91399043939f1b2006115401d17e670481638c7f5ba13e70c41f4837b74f57eefa3328e4d547846e8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6v6:A3mnXoZjzyaT4aewsAjl5Sapv6S
- TLSH T127259F33EA6494B5C12B1570566D8712E738F8190B5046CBA3BC8F692F21BF07B3DB69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 971KB
- SHA256 fb5dce5d56c8b30059189bfce7fd565c049dbebe8b0e1c828a7630cdb96d9e04
- MD5 94179ea5e262e2b251c99c7b7f004c91
- SHA1 8328d0657ff431e049ea8284fe1e2d36ea32ee6a
- SHA512 9ee71ecc6302e7f70f91ba59eaee6a22357474affa7b3f2a135d8b0de0bf5a1a53ceba6896ec672d6221aaf2c037062fccda79572ea1309b422b2efdac90aae1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6pF:A3mnXoZjzyaT4aewsAjl5Sapv6pF
- TLSH T17025AF13EBF190B5C76B04709E65C712E638BD610B1059EBA3A8BB695F313C07B3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$
- Size 937KB
- SHA256 99c1aa6bd0f1b9d0de7e326b397d3bf7c7a8e1c260e028330ac0a886b6528bbe
- MD5 a9f8f2f3d4931429bde7500cf0aab164
- SHA1 f72ef459eecdf2f014727f742c07a439abbf97d7
- SHA512 2d238a46446c08cdd17e965e368ac1c3243bf24fe0d6a0b70a838754d9b7cdc6a74c9e0585b9c1bc148eee14d85bd69d76fe2b30c128e60b1cb92d65a86efbac
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRT5Sapv6j:A3mnXoZjzyaT4aewsAjl5Sapv6j
- TLSH T17C15AF23EBB090B6C17B49705BE58713EA387D210B6056CBE3A887591F317C16F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH