Analysis
- max time kernel
78s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/07/2026, 18:19
Behavioral task
behavioral1
Sample
2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 937KB
- Sample260715-wyjphsbs8n
- SHA256 337dc44c73b8cd94df7247568f9e829c3cd0f4f1ce02aae246fba85e45ef86cd
- MD5 b47e42c65f6a347cb88ea511c4a85bb2
- SHA1 af14176d971469cc2acdc7c66422b0b097de31e0
- SHA512 fb837e89e15bfe3c2e4e4c98a232c106cffef89845ec9aeb720793d7fefadd372bd9eee5f5bd1152eda786ae54b70c5c2f131ebe8d87b93c049c67d9bd079498
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhN:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhN
- TLSH T1FF15B023EB7090B5D27B45705BB58713E7397C210B605ACBE3A88A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 47 IoCs
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024579-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2976-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6dc-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1656-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2976-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b6-224.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ba-261.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202be-387.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000235ac-473.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b2-498.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202cb-589.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202c6-621.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020303-659.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020305-732.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020307-751.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020309-794.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030b-843.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030d-868.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000203e9-887.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021265-894.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021264-907.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021266-927.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-953.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-984.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021269-1034.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126b-1052.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126a-1089.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126c-1108.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126d-1139.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-1165.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021271-1178.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126f-1186.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-1223.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021273-1326.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021274-1345.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-1370.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021277-1377.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021276-1378.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-1385.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127b-1399.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-1401.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-1402.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202a2-1459.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024595-1677.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023116-1808.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000073d-1953.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024579-6.dat aspack_v212_v242 behavioral1/files/0x000300000001e6dc-12.dat aspack_v212_v242 behavioral1/files/0x00030000000202b6-224.dat aspack_v212_v242 behavioral1/files/0x00030000000202ba-261.dat aspack_v212_v242 behavioral1/files/0x00030000000202be-387.dat aspack_v212_v242 behavioral1/files/0x00040000000235ac-473.dat aspack_v212_v242 behavioral1/files/0x00030000000202b2-498.dat aspack_v212_v242 behavioral1/files/0x00030000000202cb-589.dat aspack_v212_v242 behavioral1/files/0x00040000000202c6-621.dat aspack_v212_v242 behavioral1/files/0x0003000000020303-659.dat aspack_v212_v242 behavioral1/files/0x0003000000020305-732.dat aspack_v212_v242 behavioral1/files/0x0003000000020307-751.dat aspack_v212_v242 behavioral1/files/0x0003000000020309-794.dat aspack_v212_v242 behavioral1/files/0x000300000002030b-843.dat aspack_v212_v242 behavioral1/files/0x000300000002030d-868.dat aspack_v212_v242 behavioral1/files/0x00040000000203e9-887.dat aspack_v212_v242 behavioral1/files/0x0002000000021265-894.dat aspack_v212_v242 behavioral1/files/0x0003000000021264-907.dat aspack_v212_v242 behavioral1/files/0x0002000000021266-927.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-953.dat aspack_v212_v242 behavioral1/files/0x0002000000021268-984.dat aspack_v212_v242 behavioral1/files/0x0002000000021269-1034.dat aspack_v212_v242 behavioral1/files/0x000200000002126b-1052.dat aspack_v212_v242 behavioral1/files/0x000300000002126a-1089.dat aspack_v212_v242 behavioral1/files/0x000200000002126c-1108.dat aspack_v212_v242 behavioral1/files/0x000200000002126d-1139.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-1165.dat aspack_v212_v242 behavioral1/files/0x0002000000021271-1178.dat aspack_v212_v242 behavioral1/files/0x000300000002126f-1186.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-1223.dat aspack_v212_v242 behavioral1/files/0x0002000000021273-1326.dat aspack_v212_v242 behavioral1/files/0x0002000000021274-1345.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-1370.dat aspack_v212_v242 behavioral1/files/0x0002000000021277-1377.dat aspack_v212_v242 behavioral1/files/0x0003000000021276-1378.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-1385.dat aspack_v212_v242 behavioral1/files/0x000200000002127b-1399.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-1401.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-1402.dat aspack_v212_v242 behavioral1/files/0x00070000000202a2-1459.dat aspack_v212_v242 behavioral1/files/0x0008000000024595-1677.dat aspack_v212_v242 behavioral1/files/0x0002000000023116-1808.dat aspack_v212_v242 behavioral1/files/0x000300000000073d-1953.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2976 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1656 2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 2976 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_b47e42c65f6a347cb88ea511c4a85bb2_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1656
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 937KB
- SHA256 337dc44c73b8cd94df7247568f9e829c3cd0f4f1ce02aae246fba85e45ef86cd
- MD5 b47e42c65f6a347cb88ea511c4a85bb2
- SHA1 af14176d971469cc2acdc7c66422b0b097de31e0
- SHA512 fb837e89e15bfe3c2e4e4c98a232c106cffef89845ec9aeb720793d7fefadd372bd9eee5f5bd1152eda786ae54b70c5c2f131ebe8d87b93c049c67d9bd079498
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhN:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhN
- TLSH T1FF15B023EB7090B5D27B45705BB58713E7397C210B605ACBE3A88A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 966KB
- SHA256 bc4b3716044d94a495b569dc07bb0063d41949ff79f5d8b908938456ab0f79f9
- MD5 efdd95f9aad493998b590bc5e5f7af51
- SHA1 e64952739cfb324158a5f1489579a67ef3b88a35
- SHA512 45d5660aa9e5db0c147c085123c278237474c2ecf8634e7f63841874b7068d13a7c91b0cccc051cea9c4aea6509cee556a3c14d47fdaa4cdcd1f8f966eb8f9d8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhbP:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhbP
- TLSH T14625B023EBB090B5D27B45705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
- Size 1.4MB
- SHA256 fc30145c19b15e37f16bf9083e5e5efa70a53218e3a0ff7bd1d7623f1ce67703
- MD5 b5bd8f0246abd7509f895a66d0ddec80
- SHA1 b007a33e1da168c959a0e1bb7caec5f096f38c99
- SHA512 8e1080d3eeea3f6324cee4ec9addec2a5b7e9f959e594418c6f7054c34387e713c4de07b3f9489c18cf9cd3ca966433c7ed18fec814a71623c8f3ed03ddf85b7
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaoRh1Ur2d29dBrtpDiI:A3kM8lj4UidGl
- TLSH T13465BF12FBB480F5D17B85708B668712EA75BC610B609ACF53A4866D2F337D06F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$
- Size 1.0MB
- SHA256 cc9985d2744ff52535ebb6551a218fa2dddf3737446cfcbd07a929409a9c1b8f
- MD5 cab86942ab5a5c7a7ce234e15b33b61c
- SHA1 e2d4b96b4794f89d8fced8455afc89db387bcd02
- SHA512 08b6c28fbaebd1d1c4cc6d0d5fe7eae6fca39f45d617088d45816f7f52a8cb59bea0265aca77caf81c92a1a14a17ddd7dbc04e1aaec10e384e8ec431f206b379
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhvTjE:A3kM8ljiw
- TLSH T1DD35B023EBB090F5D27B45705A658712EB39BC210B605BCFD3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$
- Size 1.0MB
- SHA256 51904f57cd1bc76876156d9dd6c80f085a5c30e02201ad37c28af283c3df0aee
- MD5 262639ed3d4537985b80d362612e5edf
- SHA1 4cfcf2127824b412c8c671ba193ce246dd7307e5
- SHA512 af5e27136a5349c0d6adc482b623d94caf721cd9559c50cc0a888a21b08c8c8cdbc86be84bb2dbecd62d3aa1063628ee0484cd481871b32c7bdee7d2c6dd264e
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaoRh4Gen:A3kM8ljmI
- TLSH T18B35B023FBB090F5D27B45705A658712EB39BC210B605BCF93A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 71254fda914957b25a5549f6037016225f225c36c586bcbafbbdb80595f79cdd
- MD5 d0f9239a470d9e086bea2541c5140152
- SHA1 97e578cc01960728942b05bcd34b55b8ed19fa80
- SHA512 a2ad361475a6f62a15183c959762ace062d940713f93f9adb72ed2bb70f7ff19518d321786256801c72303ef0442115932dfd9a47c36aea278e5c57220fd1719
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhZ0Le5ji0hmxNrM:A3kM8ljEPji0Aj
- TLSH T10E658E22FA748275D077C475CAE2975AEA7138510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 960KB
- SHA256 5aa140e224989159042de984da38cb2647095ffa11084c5e8cb0e9d28224f3fa
- MD5 0c23a3664e603887fb2695eaee903fe4
- SHA1 f9e4553bab3ba4a39777616ff3d95f7a80970877
- SHA512 5a5cbc940cd238b5248f19671b46d47aab58968861a2510509d179bed1ca69a192953f4dc61a567bbf79dc9e12c25d149418b7a1da9288e804beb9d363a83ca7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhK6:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhK6
- TLSH T1D425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 960KB
- SHA256 74b3235216ebaff108c6ba78f0952a55b881cf99b7bca37679c1e2b91c77604e
- MD5 0af0728ca26558c2466fb5b6ab322335
- SHA1 4ea19c62139c86e6e13e8482f14b7ddba9b9066e
- SHA512 c112095220750118fac4bc82b61483ac593bd1b9f44250ca9f05e1b7dee2a878d57c78990aec891fa233892607250f044c6d4954b73c5520a3b6a50be9004c19
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhiN:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhiN
- TLSH T18225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 960KB
- SHA256 8de4513b6a7c95ff1eaf8ffc23d9de74dad27e186e063a7e0570136651ccd80e
- MD5 304dce7a43c664a29a29e71bc58aab7c
- SHA1 44f06a408c87e6025dc034ee19a75f4626d7b161
- SHA512 b10e8885ad53982ac72241da2a647bc811d9f6a76dc01afd0bb53a934d7dd6b64829e3e07a72defa791678b7f174ae4c935636c607e2152d8b8339665a4aa2d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhYf:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhYf
- TLSH T17825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 960KB
- SHA256 f59b31f3657507b9833908121898e165bacb282bd26dff9f6ad0242a98a45893
- MD5 b42850186cf088da31acc9d2d1a8c943
- SHA1 d02e4b258936afac1db672682c758253f568717e
- SHA512 fc52ca885d1592bc6c6c6b30037b75c4d819c9d00db48a93c3dbfe923de96fa1e93951e84dba527aec55201c3abeb5cbea5679b0791eb7e3e5efbb38d858d6ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhyo:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhyo
- TLSH T10025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 960KB
- SHA256 d3943a3e166c1d9e8368ab5084d5b0f9d62601ff63f256853345dd2341d49fcf
- MD5 fbdab3eae984aac278d625f7a2ef5e01
- SHA1 9357f1e6848a8cdeb0cb80d88641defa94cb339c
- SHA512 bdbfaca0bf6c965dbadfb87804534321c2580f1ce673199e1f6015de1b06e320ddad719b751afc5e70772708b462a9bf96498ba80be3a3fb6004a190274fd63b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhmu:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhmu
- TLSH T1FB25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 960KB
- SHA256 ce46071255abaee22e5be67cad0f1d0342a8008e60c18458988068811415e451
- MD5 2a7d6f82192786eb069f41ba625e89c6
- SHA1 a2b2d51e72ea055c863575ea207cc8c5602fa9a0
- SHA512 6da03af5bb39227410e1e9ab4d0b288d3be3e1599c03ac901ec567f39b3c5015c84747326038f4b5b2b6da6504440c07f45aa9c84745c372c1dc3362685efcdc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRha9:A3mnXoZjzyaEFoHaewsAjYaEpHaoRha9
- TLSH T13225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 960KB
- SHA256 c9b058bb8328b7939167bc794e094cf3935181a1440ab860f7d20f8f6ad1e307
- MD5 5f39d1e658b5e5bd64936bbeeb417c4d
- SHA1 def5c9e846583d6680450be595c6541e739550f9
- SHA512 29697cde5426561e8c1d26da2222bd4dccbc541c9058bd613bedfb8e33a3085b680980ae19b1c52727af7f2d103b1417255208723f66d0c2d2d94817d471220f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhac:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhac
- TLSH T16025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 960KB
- SHA256 2c95f7860bb7c695062c9b405e46f25c05f35606f2cc3a490818d4f81a5ab9cd
- MD5 cdbc87bc0e0d1b3a2bf5a2c471d5fc8c
- SHA1 163835c6106d4aa072bee422eb231d52b19befda
- SHA512 4ea805579988550d32f0c92589e9b6951a6b088205e6d4633a4df1de27693d92c98c698f5660dfc04ae839fda3ddd58a66135f4217a41eb1b063a0706316552c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhTp:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhTp
- TLSH T1CB25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 960KB
- SHA256 9f37fc3dfb30d43cfd5f83cdf05a1072fe641f6ab7de254533d5619170cc86ea
- MD5 a8b6ea6c5d76d1257c5d593c6681d726
- SHA1 057439c3b69281dc500b79fa7ba09fc344a0a258
- SHA512 18c782040832d21b96d1a5690c7c74bf4fdd7665ad10ef07e87f9880c854b5498b525019f3d415ee28f351afcbe45b5df978308918cc75e2539fc391096467c4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRh00a:A3mnXoZjzyaEFoHaewsAjYaEpHaoRh0N
- TLSH T12C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 960KB
- SHA256 46535a9009e960687ba04cc5fc00f8c5e1bcd191514917355d537ac98ba3d996
- MD5 8b0eac24daeb7a0a99ea2bf54c44135d
- SHA1 8a589c94095ea76f2919cbd85b5c563106ed175a
- SHA512 dccaa76c3e3a75a3bd448f1b800bb4c0115943ab5c728e14da8834e012f657d55fb3e6339095326c19f7fd575079716c90a93195ef9a1e8f04b610b7efe96310
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhcF:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhcF
- TLSH T16025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 960KB
- SHA256 f22c8a56899b3bdd95c6f2d37d4da23e9064b7bb10d2d2d54f097b773975f731
- MD5 dff005c332e6920ac433e281aad88a5d
- SHA1 366b96c98abe3b58342ef7400a9e27ca684aef28
- SHA512 df42fa0ada47e4fdc6d8e53b9d00efdc7f1dc1ee85052f9621ed6a70b0c0c34d2426d865c3e2899983f60e3ca10a411e13eec5a8876db3c69d9a11947aa8d596
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhJC:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhJC
- TLSH T1E125B023EB7090B5D27B49705BB58713EB397C210B605ACBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 960KB
- SHA256 bd70c49bf693a8ff49a275dc0d63d32662f91aedcf288bc4af85c6581970ab1d
- MD5 9ab0958fc6253226eaaf757f0c767963
- SHA1 08f0f6df417a4892595596a1f37a4d15b4bd8a2b
- SHA512 73d3ab6d7bcd83d09de0fe6b5f846d753accb86f81396171a81c83e0d1046cd019d67534e501d304e1797a7bc0a97901c2a8c34292d52221f0e60640855391c4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhqw:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhqw
- TLSH T12025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 960KB
- SHA256 368ed29ae0a2e60132d4f23c192edeb2ea2a83746c2683f82931ca29b96cdf88
- MD5 487ef0eb51e66f12d21229165c6231c4
- SHA1 d696901fb3bac18cd052d1d711293f3181f41a3f
- SHA512 b93a24087a3af797582056f362c0b990662b251f1cbc7efc7a28818ece11c1ce5f1a81d69c3ca4e2f588b0eaa09ffd31baa78afa9d9a33d7de21fb2d42d9681a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhxT:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhxT
- TLSH T1C425B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 960KB
- SHA256 df48e4ea0c4892a9a696ae5bb2c988205743062c715f6c46937c6c62d52f81c9
- MD5 dc70e7dd453fb8dbd253400fce454e6e
- SHA1 7ee13e4e5fbf9716d9ba51ee14ae164ea67c9e1b
- SHA512 f4ecb94e5b21a8cbb2254ac7461bfa88877bd6f9578e5bd00e66f264a23caa773bc2bfd458caef8740a0d990f5e83b645d663135f2bad42d6221c142fb361b55
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhfu:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhfu
- TLSH T18025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 960KB
- SHA256 3cc625d8b2fac1cc645038818547254309cd19f1edbc6cec7d879c9035fb68b1
- MD5 88ec1f1595a1520e3bc58bb197675770
- SHA1 253a68c37b2f02f18e7a30eba95ef190f7051521
- SHA512 34d9eba2bac3e2e54e561f96b97d4e2c486a10c19d835411033dfcc7b7445d2116418cb337a8eceace0087b30146e4e5ddf7c7494a5ce13f225d103fb9a24144
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhDb:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhDb
- TLSH T14A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 960KB
- SHA256 dbfd87ae2eda208151b98445d0e079d129ee6d4506cc52d0463330610d176bf9
- MD5 36a9f92230312d8a825db59f44da66f1
- SHA1 62c4621100768cb1ed535bf57243c7f09bdf1629
- SHA512 4d2158ad77166efe3b1486da5b6fb2cd53b9bc7154df222cd5db3c8ac9e3de61e5f894e64f48f4376eebfc40e8abec25d9e1f89fa3c3671b921839fd08b566ae
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhXf:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhXf
- TLSH T10F25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 960KB
- SHA256 cd125c77208a8ef49aaf0887a81bacfab99f87f1c9787d8b9bcfb7a97074ee80
- MD5 bb34f2e678841eba9f5b0c0e3149d00a
- SHA1 aa99ed9642e3224ad8a82a3f384abfb712ee1173
- SHA512 f2c340c6d6c2f7948d6504a085b0bba325cdfc3746fbeba875cc73665e8f2c1a6b0b8cf3ad52f0588894021cc7090d675a1036571073f2f7e2bc7016608531e1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhgK:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhgK
- TLSH T1A025B023EB7090B5D27B49705BB58713EB397C210B605ACBE3A886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 960KB
- SHA256 dfc81783429666c37306e18430b76f35f9edf814899f84d780a0794b11e6115e
- MD5 2f54cb8f8aa79590183567038dc0d8d5
- SHA1 6cd250cf7ca21c9c1fc0e7351b27a07927b9bc19
- SHA512 aa46c114561831aa7ebe43b3ea76776d26a60c25e0d80b679fb7165c878a1d07193b03eeac3731f2b4971e9bb97fcbeaebe36d32f78a8b05dd7c4b5b7affdaff
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhdk:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhdk
- TLSH T11125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 960KB
- SHA256 917e3e3e2991d69592aa4a95ca14b9dabf2d948d8afec26cfdbbc4e14a1d2cd1
- MD5 ac9e35e218a1549e8ed258dde3e6597d
- SHA1 74e8e9feaa13dd631363af40b97810573376c916
- SHA512 258f0eaf6038a687faafd9499f3bf6b2fbd7e7a1317758d18d28cb3e2302c749a027afb92829eadbde9cbd5b90d07072b76c7ddf7f59250b8cd8c1c968e0bb86
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhC0:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhC0
- TLSH T19325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 960KB
- SHA256 bffb4667c5ce0a92a9af563a5ad4231f07b84145f4a426e6b586304df2615c29
- MD5 e8338587aed91b245df1c9022f04f964
- SHA1 491b195d7b3aab1dcdc91873c248310bc0dd9d39
- SHA512 b9526d965af5e955be854bd7cf86b33abf0b57ffc3f8e980154a5ac3300eb9da72261ec942d1a3c7688c8ea306bb47ca38f3c8b242debaf9642b277943ea9c90
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhR70:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhRg
- TLSH T1B125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 960KB
- SHA256 c78ab0538e9cb06cb969466869daa48612b0adc60fac9874a7e52659f5e7bf0f
- MD5 70bcf47c2907bdd4982c997d9f695658
- SHA1 7d8a46f8e1c4b89f9097fb105488fcf5556df067
- SHA512 b291b2ce46a5985047b3eac8fe14ff18c9fe805090aeb8bc68563941f6ce3d29cfc454b71b56241473b54ef3b43b87771dec6ad7314cf23c360107c36677109b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRh4r:A3mnXoZjzyaEFoHaewsAjYaEpHaoRh4r
- TLSH T1A925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 960KB
- SHA256 569b13867eb161fab780dca2c5f98d39bc936dd2fb8a42ef0bb5f5bf516ebf58
- MD5 ed89d2bef9d1fdf51b886af31af3f9db
- SHA1 0c675a24967ebf58160d808686f444fd01b9a261
- SHA512 aec3ff95f462be79e1b9bf55c1c6c250970083ed88fb8492e739677f435439033c1fb7c15434522d0dfc1c5e6027c4f091048eaccb0bd5df003a4a82144a0085
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhWn:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhWn
- TLSH T1C625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 960KB
- SHA256 ee8141c0e3c3591827df87a8478262451268e88ef51097a050f12705c903d4f1
- MD5 262b06fce781fe3d14f080f136f42825
- SHA1 f884d8c5e5008337d301efefb4a0e388b1f64312
- SHA512 8cfdc0c25c5b8c5a746bc692653c9689be14246d24e927893ee682baa84d934cafe5943e8cd5a5b44933c52a847b8862f360fd18d1413cd02f9a3bf57673b79c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRh8x:A3mnXoZjzyaEFoHaewsAjYaEpHaoRh8x
- TLSH T19D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 960KB
- SHA256 7f6dba7ed4a5c42e7eae8aedb2882a4f30a33b24dfd5ba7ab9b9451e97a77158
- MD5 2c94fb2ebaa5b7d61546891cee927d52
- SHA1 5391ff016a3ff1353d40f960d33160b75f65ed66
- SHA512 498424e7f273e9d0e12e0d9125cebb4e66ab4ff1a24e3e067c517738b0d7f54f7e83e9c1b8df2d3bd21293a37adbc6c7f6a763e29846a79c32a8890f9d06459f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRh2A:A3mnXoZjzyaEFoHaewsAjYaEpHaoRh2A
- TLSH T17D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 960KB
- SHA256 f719a10d2d50e81d0bd9db95255dc67103cb40463a97aba6509dc4706c8b312a
- MD5 66a2ce6e472e6b9231cde07e7ed8f64d
- SHA1 97cdd4578b0fe14df0899767fda74c0ecaec3003
- SHA512 bec23a8d71d98467c3a6662829f203a16de948453a65a85e9eff2a66be274b43b7ef9ef66e9a291c6dc50698b717ffecccf103e85de309e10dfd7b647653f0ee
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhv9Q:A3kM8ljR
- TLSH T10625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 960KB
- SHA256 84b7675515295f8b5403eab64bbb174b01616cedf5fb672fb71afe78cced7037
- MD5 29b4f0b1a480b1396ec3b286b9594c9e
- SHA1 cc7b3881a6defbb3d0bc217181ec26282d9714b7
- SHA512 48ee23530fa589c396c11b19ebafbca4e6e1c85109592e12adbef105935f036ada5aca3a6bc1dc25ce9ee11a1154f9f39f5d2d6a74560915da18198ceeac09ad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhG4:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhG4
- TLSH T1F525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 960KB
- SHA256 471e41a59ca6f724ec5551e9b348d5d57f1c458d9cccb0ee0c035e38b8e9e0b8
- MD5 357ba0c277a9ba8cbedfb28bf92c48d6
- SHA1 7854825f3e9ad9a899d5822a694b7f83fd177347
- SHA512 768dae7d3af94c4a4c47afdf9ce62abdaa636200b60ea563e4a9443c0dde5ccc6809d19aad078bc0a87ec055f22449aadad25ecc6933aab8efd714721074aa61
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhVu:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhVu
- TLSH T13325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 960KB
- SHA256 8f5c81110b5886808d0736567f5a1a71e9aa215fa2ba5bc675da0a7682d620e2
- MD5 c18329f423ff2034bc0c6f64acf6862c
- SHA1 e14aa99f6b947e9f84ca34a2573706a87f4bf3ce
- SHA512 c779e5f2e5a70cb402b1c6b1c7eb5492274f4075067eaa62b9fd88ee0069d61bc2f29f17c28d69c0038df02fdf6d7a35324d62996d03737f7c6eb9f44f690395
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhIj:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhIj
- TLSH T15125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 960KB
- SHA256 79f56a59ef509102e96460d07c759549f58b312963f034baaf6eb9a3c21bbba8
- MD5 ea5cee5371f670c17c3e3bdb8a8bf29b
- SHA1 9dedcc03acdbb0dc6b3b09d37671c7f0e819fa14
- SHA512 6ab2f39c382f6ba057a12c11cd5f8459e54a5a714164f3e2ddd36eb793019e8bc9e3dcc722de32380baf3870c89e74a20bdfb9530a9ab98803258606a6211963
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRh5g:A3mnXoZjzyaEFoHaewsAjYaEpHaoRh5g
- TLSH T13825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 960KB
- SHA256 2e64042d6341e66d799f0092ff8ce74ad6b403250bfd74ebd1fafec438c89af8
- MD5 5474e63463dd4ebdcb482253a5384b20
- SHA1 df8fac118ee92e6362a71b836038ed289a290645
- SHA512 5ef7bc28875b5b1c0eeb44794fcb7d5f334ab4c8971e292aec54b3500bfe9842e866ee061d1a3775fae43e6a09461e41923caeb322c90c421b21376df3ca0ecf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhgI:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhgI
- TLSH T19A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 960KB
- SHA256 77b3c57e70d775dedeb5ca93ee4e46e4060072abbadbb718dd9592eb93e7bd2d
- MD5 d7cd78bd0b494d0bc3a89085339fd011
- SHA1 cc3b1011c3f7ce1e9fc613b636e7eb1d7fe9fdcc
- SHA512 abf80ed712cf50d07a2715af2d25bea6df0225134f50ff0edd9b28e77129119515e6d8adb869f72703cd682a349f9066f9d298a1454751dbae17748379cf2413
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhio:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhio
- TLSH T14625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 960KB
- SHA256 c17a21426809c6457bac177a46bd8ba933c0e1584dde0c8b62228b63a95647b2
- MD5 42332bf5b1cbf7ef77e84bd2c6a02b14
- SHA1 7d6b917b275aa3bb37d19edc2f05da285af64041
- SHA512 a3047a0c7fee04d8dc7dd9ea6620bd6618889560cbb374b0a7ee4455ebe81b8618973c2ad284b0a6b7060a00db208c297f696e6e2672cd24ccb687dc47f475cd
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhZ+:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhZ+
- TLSH T1F825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 960KB
- SHA256 ec376e799fbf66cf308d92dad746a2ec93c94c2a792aae49bd048a1b746dba46
- MD5 f7b200615c46bbace379e64114f8869f
- SHA1 c0792d1489ecdd5dac2c2dee478e0da452dcd151
- SHA512 b1d77720205c8b9092f80e07cc4bcb53f1910dc3e8b1d6485cd2a59e96dcba8f81d8be00211c27f2f846441fc68c7523c5441fcbbe357d0de097b2af23f2d2b1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhHQ:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhHQ
- TLSH T15925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 960KB
- SHA256 c2ffb2ff249786ad715d11e60bf5fafe12b8ff2e983c389c2e561bc4de0b5d81
- MD5 740cbd3c17c64300be75a34daa8ea616
- SHA1 a76e65ae8d4ad9d152d59d6f002ae5bcc4b475f2
- SHA512 872ac5cad0a2a5126d953e1dff3c5f86bb3f022b6f112ed7ad94772e3393151dd3f2ad6e2ac287b9a909e4bd2fc4948a54ed2efeb6cbe403bc846a87862292b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhcX:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhcX
- TLSH T11C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 960KB
- SHA256 825bc490ddbb4c29cd44d78e625ad7f36244513573f6ff81761a6e16df617152
- MD5 fa85bfa4e291f8113616554eb8f7e5ae
- SHA1 02f337d4e4793d669732ac9ec3c596f97cb5df6f
- SHA512 73eee9708bc35f41cc5fcf525061cb6e3ed857b1d773eab5d75d0635a16bf89791c6042305d6c75a9f72546a21cd7032fc67a334d9d10f8c2bfee3f77e587b4c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhaL:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhaL
- TLSH T16925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 960KB
- SHA256 1d58b9a5391dec0994a1e6137d1cc5d000860fb779570b8984384566f831784b
- MD5 bb8aaa82215f8e42b32d64dae97a5b20
- SHA1 56c68540e6238ba75fb9f34a1bf3f4bf0109a6c7
- SHA512 bbb36c4a9d25c8b7a9c302c265aff79730e1249f392416cbf3e0d1a66c8bcf090afe7ba33d8d271585c5683e04d210fe465aad27244d14f94b178723f98332c3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRh+FC:A3mnXoZjzyaEFoHaewsAjYaEpHaoRh+M
- TLSH T12B25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 960KB
- SHA256 30e7fd3d51bd366457a1da48bbb90d4ad849219a4e710bd9c7cb49ff80f25c88
- MD5 1876bfb0fbab32ab2387f9953aee451e
- SHA1 d1b5884aceb954610f644d13963d10967419e915
- SHA512 9fd8ccf75265c1e9ad01a132230b67f90a9f985cf585b3b36a26c9cedb7f61692de4758397c5eac6aadc77a34fd0ca681cc4caba8152ee6df10390ee636b3157
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaoRhnh:A3mnXoZjzyaEFoHaewsAjYaEpHaoRhnh
- TLSH T14825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH