1476d51b1e2aab32b1c66047aa75e2fd480f49da83d1f8a15d7f86245916ca61

Analysis

max time kernel
100s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 945KB
Sample260707-bbm37sey61
SHA256 1476d51b1e2aab32b1c66047aa75e2fd480f49da83d1f8a15d7f86245916ca61
MD5 c97c9e8b36af14fc24f2e8803c5c6225
SHA1 c7f3116df280df8d6f0f4c7330811ea7c343a32c
SHA512 344e69a3856660b5b2eac3692578395ac17b32b7238012be4313227523c68644f1668c0fb1a2ed2aeb8a7dd8c57c09df8761f1d3e2153f50685d809a79aab07e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE
TLSH
T1F925B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/1868-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016c88-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016b3c-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1868-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5696-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001897f-200.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a59-255.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-480.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-511.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a5b-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0005000000016c88-5.dat	aspack_v212_v242
behavioral2/files/0x0005000000016b3c-11.dat	aspack_v212_v242
behavioral2/files/0x000400000001897f-200.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a59-255.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-480.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-511.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-602.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a5b-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-724.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-841.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-867.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5696	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1868	2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
5696	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_c97c9e8b36af14fc24f2e8803c5c6225_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1868

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 945KB
SHA256 1476d51b1e2aab32b1c66047aa75e2fd480f49da83d1f8a15d7f86245916ca61
MD5 c97c9e8b36af14fc24f2e8803c5c6225
SHA1 c7f3116df280df8d6f0f4c7330811ea7c343a32c
SHA512 344e69a3856660b5b2eac3692578395ac17b32b7238012be4313227523c68644f1668c0fb1a2ed2aeb8a7dd8c57c09df8761f1d3e2153f50685d809a79aab07e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE
TLSH
T1F925B023FB7090B5D23B49705BA58713EB797C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 12c5e06c5122e8f77a6bac8ab724d5247665cf74e613aff376f4ca32471ec4d9
MD5 75230d5e868ef98f43607cb987674301
SHA1 b8f1868d8436f9edb53e00d7c502dc510533decf
SHA512 fc63ca0e6767356fe78b5366c549fc2c78c509adadcaffe338460ddca4f7d718d876be0e2b918127cfd662032b81b09c90c0895f792f72cb1daca49920a5b9d6
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEP0Le5ji0hmxNrM:A3kMPljzPji0Aj
TLSH
T182658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 969KB
SHA256 57b3de8b66f74fcc9ea88aa096a1dd19b53e877d1ed1a4715eb623ef78e1118a
MD5 27082db2ae0bb31fef0c2251ab503610
SHA1 9f205e54b782ffb1097ab2110643c5de2cf5056c
SHA512 6da19489ea058189f1523aaf6cec0ddf46c779a443dd2c785397aa35490cd22c02d22aa0d02e4da2595a67e010003e16e925011aebe8a3e2a78a825047c45630
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEpZ:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEpZ
TLSH
T12325B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 969KB
SHA256 4a1736b3fd8d6c14c0f8a4548a695aa416336285da44c9b6d9329501eac8b0f8
MD5 cb2ba094f172d6211ebe46848d7b995c
SHA1 8d7be274ecb4164025d56affc48ee085227561b9
SHA512 2ae8d656b176c5c708dfbb579c21435c7ce7f3797407dff20f3150af29992bdf954ce3638a5279801acdb5dd96d35a924051cb6aa4f1552de2ec06c9263604ce
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEC1:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEC1
TLSH
T1D725B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 969KB
SHA256 cdc37aa5185a702356054a269091b3ae32189cca1cdbfd9d65f79b6dba1bfc07
MD5 f090d704ad0b0dafe151df71d26a6d20
SHA1 fcb1b9db7112d34e07b54951b4bca796e9b5c734
SHA512 0c53d5b049c712c14b20b4ee2acaaadc1431b3ebd8bd88bb7db63d558792cc812733105a5fd49a2f130ad3a7c8759a492b0ac60ad7c258a2a7f2b7972cf39fde
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEo6:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEo6
TLSH
T11125B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 969KB
SHA256 db1b9ca0a508a1880e1ac983bfb35095ba0b7be0d0b1e23a240546fc2bde1c04
MD5 815b7eaa34f7a36f66a6d1a6e7d86817
SHA1 1cdf7dd27e9e2e2af1830718978ff7b076debbe6
SHA512 c1fe932170b6d691af8b6bc2160605eae4e3d50807996e38479556b7546203c1d3c580d899fe232106974d4644f6bad96feee8c08e6ac0a1f1928cf835765028
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEsN:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEsN
TLSH
T1F825B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 969KB
SHA256 e82ac6de2d61cad8418fb1dc9b47b40c0cd9b3da533eb461837a215e0b62f9f0
MD5 5d9e5773a58a2208a9af927eb97e46be
SHA1 5d7aa87aea545ccef0f454e937ac219f2f7096a8
SHA512 a7029c69b21c5a2753229238b4e9ee7c72018a0e764c0fbed5d0a8ece96ccffb9a795ad716cd91a5149a3cd5d5967f9c26026759d8256cd3c86634e6f2ea2251
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEif:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEif
TLSH
T1D325B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 969KB
SHA256 e00202246f0466246b9dfd15bf366e53106a693bdc6be8ed597ed92fd7eebc48
MD5 13b360ace26ac4faa60eccc13933557c
SHA1 985291f99d1dcd2f7d696c49db1fc7429b7b42c3
SHA512 31bb12b7dbd358e258f6b26838f56b545fd40f984e0350ceeb0314ff63b3a468ed03792ea8421b5e1dba4d665868d041ae4d39a2424b4df07531be67899ca905
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE8o:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE8o
TLSH
T1DD25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 969KB
SHA256 3519002355179f37c30b926bab433470b09e350fc4fbab0acaa34c0161c2adb4
MD5 e86dcb86a3db32f70dc2b95d26675a4d
SHA1 b70dc83e314fe77f3d3b3ace35cb121e30f847ef
SHA512 667d80c0cd7b3c7c0b0f9e3ed7b55bd093dbacec132be7592b20f70e3ea8d181f2175a4f706e8188812d48a6b8c29c456bb97ac11770d0036bbefeb8e2eb7a5d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEcu:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEcu
TLSH
T1C125B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 969KB
SHA256 4ad57d51ff6f394756ceadee3b5a260a197ecd6eb75e13e06fed5041a2fafeb8
MD5 98babec5b6e681b8b4c149f3a34f103e
SHA1 cd828b3d35972803668dddd0eafdd02bcfd9edb7
SHA512 9a9dff71e6eb0a0e2f2326295b24e040d0bcab76f80f7128f67da4399ce88eba15fc5a0ea94a68e70566f2745c2e802996c7fbaa4600efd7b769911b19d8707e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEg9:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEg9
TLSH
T14525B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 969KB
SHA256 24b2c67071e8acf3643a9333353e206cce855b66e3d32adc5a56244d3b53b730
MD5 17047e93bbc5e651a54260923cc4918f
SHA1 6f201e9b7d5785907d67a3dcc0bbb1189a1f52a4
SHA512 f96dba8cbbb1953cbdb12a65be82a56fa4a221905ed53accda326781562b51cd014ae5c86dfb5c8551ef404efcd9ecac959c8e99c9e0c57580a69e52b50d2138
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEoc:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEoc
TLSH
T15525B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 969KB
SHA256 2f6c239a70f045c34d76b75363e865c4cf973af414df36a4549451e0978f05e0
MD5 cc7e1c8528d290232713a707ae39e25e
SHA1 c6b9133f35083a20b61f180efd6e2f03818003fd
SHA512 5e7ba974898241fb6f121fa854a64a490360be29ff512f887499a01e5e4e6c546896400977c8fd53dd0de7c04a8b0508911a426e200efe5c0dee8736c5930600
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEBp:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEBp
TLSH
T17B25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 969KB
SHA256 ab2a1eecf15af24916ebecab1745c3897b64fb2ea3251f17abdfd18db9904960
MD5 67d6938109272c7f0b4d13d73fffce85
SHA1 cb63e2ba613d13b8fc91103f58779bf1b8008c40
SHA512 ea588ce15b073be4caa1b329a2469709869f899eebab0f1aa51b3cce632cc60f5672ab9aecdea6f8899209ff74f339a8a80da1be010492616c2e6135b270d293
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEW0a:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEWN
TLSH
T1AD25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 969KB
SHA256 926be5b3c33a86c52d22ae6e399c92ec8c615e90b430dcdf0a69cb074f987175
MD5 fa9db6fb6b6d94260354f19ab1e98b8e
SHA1 9623233bc263537c1d037127663aab80ded8448c
SHA512 f285236ac649359fa3fd4016cc77548e17cbfc404ac61875225ff2a318b56f7cdac237a8d4daab2bc5c2d2a850b6c038f34e91b4d494bd6f529efb597e0ef0a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEaF:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEaF
TLSH
T13925B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 969KB
SHA256 44b622fdaba88bffea3b728a631039d0ecb261a5944ec38fdd842e1170e72a22
MD5 4be93e003b90a112f9e36c8ecb211b21
SHA1 4709bafa328906f0d03eee04e4ddb15b2a1e0666
SHA512 34dd2a6d280a962c0645db1de7d77f7173901d6a39336375444090c688fdb31a508f3e3ce8bce46bc52f08222a2be9491d84ed897cb4808acb35b3b47c1a4c61
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEvC:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEvC
TLSH
T1B425B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 969KB
SHA256 2f55c78b9bb8fbb117e44de67468df014c978704124700bbe439b35809d1ec84
MD5 463968c94a24a0a248f647419888e161
SHA1 a9dbb430edd07167225925812e93a62f06ea7262
SHA512 085bfeff9a8c94d49e976d479d591823da02686d7b11f0aa21a575fd5165776eab3632e9fd7f3e83837244b934388a1be1ee89b5797a4658c07f1ad0c694b0ff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEQw:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEQw
TLSH
T12625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 969KB
SHA256 e3889d4bb35144b15f4ec219c11be5250bbe7b7179508a479585c217b1c2a4a4
MD5 d8b4e60a9199f437149ba9e0a5deaf26
SHA1 04cb609bf2c11fa6a6bf7682dda049e5509a1fb7
SHA512 53b6e85d3b9a0ef87d2b0d01973ffce6df4ae5230888a4ff2a998b00e05557fea2177f8b4aac6a9096219ef58f6db5d2ae3db694f2b2bcf2b66f23bf938e8c15
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEvT:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEvT
TLSH
T15E25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 969KB
SHA256 de4c70a9905a17f020daaa7c93af0263c6511b6a4ac8f64c7ece1ef5ae467706
MD5 b8a5e58727696262bc0049105d22e39a
SHA1 23e054f88386207331b4c65675c67c3e99788ef7
SHA512 2837ef4fd52877faf024edb09a770c67f62c548977ffa16f398c2331b3c5426399b36a6253e1b76e189e7ec635b90d34fcd2000b9e0652bc6c57043c2920a4a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEpu:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEpu
TLSH
T16625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 969KB
SHA256 a0a170d743496a48a29ff1ea256c92ce4227db12619900642ecf9e25f9a6b0d4
MD5 72f687ecd5413a42621ec1ecb79ff23d
SHA1 c71124f5c1f645552d448635deed1a3986305c76
SHA512 cf4119c11bce2508f8cfb2dda8495275551f7b9cc78a9bdfa13d01f0bf2819dd4592f11c977403a4ab0f84cfa6847ec9433824b9e623055c9c230da2f642ce5c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEhb:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEhb
TLSH
T1D625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 969KB
SHA256 3094138e7561dd1b97f7a702c6f7298b457332ff63352648dc5e4f3f22b9cd48
MD5 e3f5b288dd7daa8695c25a4c1928d18b
SHA1 f1fb795455df3858a4a33d671d01b03a8e1876c3
SHA512 f1def7b1b7a47ef12c2e6d4461252795ef39c15dd93050c2040c713f74b48e7a6e4581098d493cfb18be98eb9982dd4bbbbb257489402dcf2cbe82bc4fb71b69
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEpf:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEpf
TLSH
T1F325B023EB7090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 969KB
SHA256 6b4d84a3a3e076c5e419f777f6681c5101962055f49fcb23fe397662a7146c04
MD5 5db8c69ee7d62626844e2cf9a2c1b320
SHA1 75783c3d92be6d9d9d01257160519cdb01ccb7ed
SHA512 c5d1fd2f438c7490d3c76dba190f6e578f881f86a852162e8ca40857e450682cab51928e5f94caba17c08a63e5b90d27cdb9084a92e25826b03c198649034e79
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaESK:A3mnXoZjzyaT4aewsAjxTcgNaa6KaESK
TLSH
T17325B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 969KB
SHA256 1bf948c734e4d2abe97bda5aaf2ebb491584a857ce3faba111b179bd0ff760cd
MD5 e69f2c7580d3afe0420e18a999219fc2
SHA1 a8636d8c663b4e45b0c97d2bd092051efc078e76
SHA512 1ca5f648b5a2459d5c606a14bd892ec83ee9b17a7ffb4db4a8a872d6dd85dfb6282d17740e51013abe12a148713097f1178133e91348878bc7fd3cabb0546498
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE3k:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE3k
TLSH
T19125B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 969KB
SHA256 089b75a40d4354064ccc4808e0f5699062f62c5f482fe8d38053a91b2cca1656
MD5 8d51472c276857da32d36070db391b99
SHA1 b4912875f883f24660b83b2931cf06bbc112b74f
SHA512 54adf5be5b99daf412cb1243effdcfdda45441c04983a3dce3860826fdc0a7290244ca9704fa87904f255d4fabb4ba0375ca4f1eecb913bf4e5248d59cd690cf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEA0:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEA0
TLSH
T1AE25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 969KB
SHA256 d857d41f73bcff753a22bbf508f0e5351b243905fd30038502d1ed3bd675184d
MD5 c46fae956c2a93713340f15deafbbd7a
SHA1 87d187723b1b101ca6867420a26addc9fa8c1ac3
SHA512 4670d57e98adace628f27b899d98f19b1c002758519e4e28e999d1fe183642038dfb33066dd7711630fd8de021005e7eb20b94b6c791652a7272cd9beaa51db4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEb70:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEbg
TLSH
T15625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 969KB
SHA256 7315b2e6c45997c40e54784d785d53fb52fddf07fc4255858b06d695e2e05bff
MD5 ce5e183c8a25bb1ef2f612f106118eca
SHA1 0491f878df139b7f487a5e60489c08935b41545d
SHA512 6a9024a0493163ae76de8b52a1873a0cd1f3965a146c8e54e792f8b41183d2c304c282948de0129b455e724d8a8acb6288ca379f00b8fb20d99ed7d2f550d79b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEWr:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEWr
TLSH
T1E025B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 969KB
SHA256 5ff1f94a92aa9f69bc6c4df055fdb9170a9e98abcb21030d88877e19fe896260
MD5 0b95f59955eb43657b4ba4014e01bcba
SHA1 1baa151b4e2f14feb34302f70ee35d51bb2e281e
SHA512 0f40f83e5849b0a2173918b4be347fdb1ba1e7f7e7fdb370cf387764613d96448508cae2b347ba6c6b11fc08c2a0ac4780bee2f6a7192b390b191b1c76bb022c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE8n:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE8n
TLSH
T12C25B023EB7090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 969KB
SHA256 c1e3523b18bf37bee12457ce4c75c9499e715b784df0cfe220c71b9a974dc6c7
MD5 ba65a5f13a8598a91744cbb4fba4ae95
SHA1 e9080b567c427ca2926f286e71fac642d5faeb9f
SHA512 92a9491a2df05722139720dd80cf7903404ab705bbbf7132e153d06f5caf3385276df437494aa4a16fa75ce5ddabe40208fe3aa092bdb8a5acabcc62ac5daf21
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE6x:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE6x
TLSH
T17D25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 969KB
SHA256 1b8c3474c42e51a485e0ecb04a7f786d8c6d190909d68338a9ff0d0fe19497ac
MD5 4fadba601379741c5db6f2d01559cdf6
SHA1 bc7b9d67628e2b3b5d13156a9c6da59e99cea57a
SHA512 5ccdf12bb1126e1bf61ce75344ed2b319865bdb4baf8d9ba8789bd284995d7fdeb4120e5d635cd621b163697cc0b0ec4e635f80b1c775e361bed52b265fd2a72
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE8A:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE8A
TLSH
T1D925B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 969KB
SHA256 94a4f07bcc00418c9966411b9c9773fa73f492fc868ceb76fa1009707ef276df
MD5 009e769f9fbd595f41f4af14e9b80d7b
SHA1 3753206efe1b6c419d29929b04fafa424a1382f0
SHA512 d5aa943e04e2f4fdeaf98bbabc82842620a684d94a5bf8229e95ecd3aefece92ca9a0614a5997b0cc581d44e4fe31ab6731114a7f28193384eccbfa7c894d689
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEl9Q:A3kMPljw
TLSH
T10F25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 969KB
SHA256 4836edfbc9a0e967bc976a2e21280b17c54217b8e3b8d2515c3593f0a27bd69c
MD5 5b7d027a5c34b78d864dee0a2507b1f4
SHA1 38b69941de6a4845820f0567f484a3563e58d7c3
SHA512 3fb15186cf036710c8388ed0bf8d049729687333892d52f7bcf2c5d9cf0a96cc244695acea141765f9472407ec2e66b49d7fe5164b0b4ff50fdf001240558d79
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEQ4:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEQ4
TLSH
T12225B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 969KB
SHA256 9d202415804cb973524bb02d841942b4e63a0ed715ce878a0b2b8d2d661a3357
MD5 3628724de394526c308d8c19b7f1986d
SHA1 f9f911a28ae302f74ace16863d78a503f49a338e
SHA512 31c18165f0642975350a2285d29ac56e9fdfe96ffe5aeced1c28541eeb2d15e116324688f961fc4c441b35c936589a7805bc3e2b1671e98bf41ccf828830b035
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaETu:A3mnXoZjzyaT4aewsAjxTcgNaa6KaETu
TLSH
T1EC25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 969KB
SHA256 2d43ed1e7abf103d2a34a79690b7f9ae26d394c3d88e3bb87c9be4930a34cbc5
MD5 37beacf2b85782b621e003553346105d
SHA1 9cb14768b3cae995bf5cf7a57a25cde3939b834e
SHA512 c902a9be982ca7b57ab8d1579c3788b579a4a8a0cd8d4be4ee9602fa57909b72fc3e82f271713789b80ccc32d605d816801a8801c8decdcbd06b0b7755ba725c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEOj:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEOj
TLSH
T18725B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 969KB
SHA256 e784164fcc883d6cce94aa54a2e2974f503bb5d0657a5ab105527bc5e1309c10
MD5 5a467a2064429a37e949e8d9b7409f68
SHA1 bc4dacd2b4eb9b48bbb76ddd6e6bc9abd15a2dd0
SHA512 f16a5dfd6523ab022960499462d8d34f689fcaed803e61069b03d9c11dbfd1c56b9c137f71e886903a75750910fe1008e782833aedc6bf8e54f792ff61ade366
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE7g:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE7g
TLSH
T1D625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 969KB
SHA256 761c2f8b39b9d4f35b5c503a13110b979f47ae547b5cb0832ff12be245fea74e
MD5 a2154b80e178a3822b80d8f3bb9e571a
SHA1 55c27c841b02851eb4f8fad61cec02f01f8c0eba
SHA512 c76e4891fbdfa0a48908f47e99bca513712ffc227ee6300d76036bf69743d2e0e67480b11fea44c2cd7bd1bb3e748c9481bf35df63249e1ae44d1c678beeb3c1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEmI:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEmI
TLSH
T19E25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 969KB
SHA256 bd48f364700146e85cd65740296fb6cf2fd684986b23ddda5203a0cc9a24a23c
MD5 7bb04f889af9a7af6d455a472f25dd3a
SHA1 41e0c219285c5a945b74029f421cb8e1acadfac3
SHA512 98c5cc36a088bd74849192b32a80c2795fa54ed3a60c4a6a1ea54e01a5c27b95c4ab0ccbc85323117e0935831b42df67e0850da54a6c16c7500e3c0bc8ba7fd6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEUo:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEUo
TLSH
T1A625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 969KB
SHA256 23fb4313ee6948c5f067fe9cd37345e65bd4a8c900176a31511eb2e383e14ab6
MD5 9eab347f61f20712d354b75494921e4f
SHA1 eea4ab721760c5ef8139659e7b3e5a512d61fa97
SHA512 0adc8226cd1710725516e909d121bed7771345434cf0035b5a42f70faf2fee375d25430c66378e3d08e24f8f63112639bf9aa86889ad21ac9dba287dec3d83ff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaE3+:A3mnXoZjzyaT4aewsAjxTcgNaa6KaE3+
TLSH
T10D25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 969KB
SHA256 180d24a339a89d394bbfe00fd835ef58aeba1d375d12af29974f884547677844
MD5 8d44969920b8b0cdaf72adbff43312ce
SHA1 f6a00b243dccfee635ab865e7ae15546cb39065b
SHA512 d08ff46834edbf52835e1c1d59e34081a9b64cfb357e488d974ebb1be202e8ff7bf32bc05c9c0c15230b9042e403151675ad941c393403dd168e6c10a1552592
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaENQ:A3mnXoZjzyaT4aewsAjxTcgNaa6KaENQ
TLSH
T18B25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 969KB
SHA256 56fbe7d8a43e902bcd2beed3f8ee7545942ccf51fc9497b0d696bd230903c1cd
MD5 b57a2f4e940c005c23d4483a8ff4d468
SHA1 9adf05368462d8e87a886d7ff408022afb74ff8c
SHA512 855e52c370edcfa01dca58ed9d665285739158809d44d7276eae8b98c9ee39505dadb9a3b93769ad8f61efa175467b8f71274763229bd16cfdc5a98162fd5441
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaECX:A3mnXoZjzyaT4aewsAjxTcgNaa6KaECX
TLSH
T12625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 969KB
SHA256 1362b4fabd0fc4b7eff2200be40e45524618671229fd9b7cacbe6352706feb82
MD5 6f2fb6525dae31ee2ff87a03f7ae195e
SHA1 e0e872a6043d7647df6843eb74a8849c202a02a6
SHA512 0c0eee113e3d9151decdea69c8dcf70ebc59ef76de3cf9c764816b5345dca806ed71498acc505ebc2d525886d064beab950a135b776b019ccc110f455964b66d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEkL:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEkL
TLSH
T1A125B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 969KB
SHA256 8e99e9a75755ecd9817efbfed850e47ad5a3fda5204e9540ea86f5be731ae702
MD5 7e0881b43a26282b0b8130fcd3b84bd8
SHA1 e66b6cc0df7fac754d994bfb9a6e8ca9f348414c
SHA512 a556b2fd3a2c82bc961ed1b6582ac0338bd0d5a8f475b3b750a57a106c085f6b7311134f656a28f03eb0f4abb54c8245e083d3d89a902598d8eef4084e67a7a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEAFC:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEAM
TLSH
T1B325B023EB7090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 969KB
SHA256 44e8f79fe9f3a2717277f7936001b26512a7965e061746e9c6196ac346563682
MD5 0af0813dda76b72312e80054bf675114
SHA1 35d3fc5f607b1b840a713bd1f4f7c8525298b50b
SHA512 15787df8f8428e3b7d86950fe81382e272744e00b6ddbf82170ccfcbb6a61d7a46cafea63a0c334ed0ff64851135a38e5776c7e6570d14081cca4bc1b117157e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgNaa6KaEhh:A3mnXoZjzyaT4aewsAjxTcgNaa6KaEhh
TLSH
T10525B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1868-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1868-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5696-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads