Analysis
- max time kernel
98s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 19:42
Behavioral task
behavioral1
Sample
2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 946KB
- Sample260716-yevzjsct3p
- SHA256 aa0aaabd0c8cf9ec518c0c484b418162089016ab7a9ec5338c6f65fcfac99be9
- MD5 c78d5ccf4852cb125f22c4784a652ce8
- SHA1 99ae42c90ac654cdd7a57f583e03a4941f1174a6
- SHA512 058d18783eacb1981520f8a515b2b2dd254ee714c95a08f7b1157e1363f6a3d67bf77943193e855842a787c27adf63f75021389e39ebf0c31488bce4c4ecbfb1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcu:A3mnXoZjzyaEFoHaewsAjYaEp2ahcu
- TLSH T1F325B023FB7090B5D27B49705BA58713EB397C210B605ACBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/1728-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c582-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2de-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1728-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1784-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb53-153.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-468.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-584.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-714.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-739.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-788.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-819.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-850.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-881.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-984.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1039.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1125.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1144.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1169.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1176.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1285.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1392.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c582-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2de-39.dat aspack_v212_v242 behavioral2/files/0x000300000001bb53-153.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-293.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-468.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-493.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-584.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-622.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-714.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-739.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-788.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-819.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-850.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-881.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-888.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-901.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-946.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-984.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1039.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1125.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1144.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1169.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1176.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1285.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1322.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1348.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1368.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1375.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1388.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1389.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1390.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1391.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1392.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1784 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1728 2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 1784 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_c78d5ccf4852cb125f22c4784a652ce8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1728
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 946KB
- SHA256 aa0aaabd0c8cf9ec518c0c484b418162089016ab7a9ec5338c6f65fcfac99be9
- MD5 c78d5ccf4852cb125f22c4784a652ce8
- SHA1 99ae42c90ac654cdd7a57f583e03a4941f1174a6
- SHA512 058d18783eacb1981520f8a515b2b2dd254ee714c95a08f7b1157e1363f6a3d67bf77943193e855842a787c27adf63f75021389e39ebf0c31488bce4c4ecbfb1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcu:A3mnXoZjzyaEFoHaewsAjYaEp2ahcu
- TLSH T1F325B023FB7090B5D27B49705BA58713EB397C210B605ACBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 dabfb5cf587bf9edc4f851e8afe092dac0d7945edf8b58739078e840498d54ec
- MD5 512f6644c6b5dcfa9f4cb5d9d0e067e3
- SHA1 2d0e988492defb2eee3d643ae16d04600b2ba774
- SHA512 0b526e8350c55cd4ac6cbd7db3a0e543487fd5aa08291333a225e28472d9ca9f4670d1f193592bc36fd2d8782ae28aca906f43638894469ce4a4ea1ac5a10593
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2ahce0Le5ji0hmxNrM:A3kM8ljcPji0Aj
- TLSH T178658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 960KB
- SHA256 5fbe60ec8c6d66e441e7ec80f1d21a7f87e48469548d46368a80346e6c9a09bc
- MD5 8bdf786be20ceafb17b0fa9e326082ba
- SHA1 21d71fa35b27bc645a0052561a2f1f53b5d85b10
- SHA512 de4cd1787fc15d39a6bbb6865b8b08a67e46ba225d1501d2bb47f500f24688616261ca8b98316301bb30e55e20cee2ef7129652f193d23f30dd50db64f1809ae
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcYa:A3mnXoZjzyaEFoHaewsAjYaEp2ahcYa
- TLSH T1C725B023EB7090B5D27B49705BB58713EB397C210B605ACBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 1.1MB
- SHA256 45faca73e3463605d0ccdf800e46bdf05fb2b1dc483cdf96d5be4b217a1c465c
- MD5 6f5dcdaea6109180713d4dedde5c77d1
- SHA1 cb8a4f90c6c13f7315914cda35ca72ebc0a751f1
- SHA512 caae77a2bb47d71421fa7682c79fd135c4a25eda871c65ad7d067d997b830f49bc8591abf919a3c5ba0eb09460c9db534629d36db8e7c70d687a0c06c0892d75
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcEXsf3z:A3mnXoZjzyaEFoHaewsAjYaEp2ahcHD
- TLSH T151357C22EA6090A5D16F4570DB658712B63B7C210BE096CBA3E4D63D1F312C06FFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 969KB
- SHA256 e8ee707c9e8b645595d43c7ae53b420d03503905bfdc1b7355ab7baab8515389
- MD5 1dc0b34e25aa74c2d09a3ae18629ab8d
- SHA1 1ea14e8c571a9ba8a51dd2b2071293ec83907d70
- SHA512 a982b10b18a61db890ca5d7b746df4227e494974f4efcbb0aeeb4fded595f5f782e10a2795663e7a386923d844e43633aaa2c7dbc8fa71406a3f2b01eada48c4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcJ9:A3mnXoZjzyaEFoHaewsAjYaEp2ahcJ9
- TLSH T1BC25B023EBB090B5D27B49705BB58713EB787C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 969KB
- SHA256 a21d1843183e65509f7d9b7f01d2fa704367e4c89224a9a1c40f0b3e7b38494c
- MD5 cc39f0ccdc4abb2eadf5ebaead3f3fe6
- SHA1 4198fc1da8a977cb3770e3c88138884d355a47cd
- SHA512 d830d00ab35b58788f8c8e3cd73891825dedc1e632f53c64363f846c4e7067b3d47e89d362156b1d354c9031b21985a2e427324fde76a8e22753f2440082c9cc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahclc:A3mnXoZjzyaEFoHaewsAjYaEp2ahclc
- TLSH T1B525B023EBB090B5D27B49705BB58713EB787C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 969KB
- SHA256 d1229fe44bdb271af7aaefbc73ce5ada816dd22dc414d4b7f06718e1a7059dfb
- MD5 cd018aa38d68545a9e2c5db3cec2ac94
- SHA1 48bf35b325152fa4e913c9fdd1371642de47676b
- SHA512 6ccecc206d4565e88592f5adb9988198e02a7a86c92f81c50bb2359eeab87a7c5d3378e695ad40b28b86f8186838109512ebc224cfdb9881e8ab2515cc43cc4b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcep:A3mnXoZjzyaEFoHaewsAjYaEp2ahcep
- TLSH T15225B023FBB090B5D27B49705BA58713EB787C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 969KB
- SHA256 f9878dfcc8f19a8fa680b4bbc28ae460bb15854884e2c133d4faaf29f6181cd7
- MD5 d8efc4bef665b4b9962bb20d60f94e46
- SHA1 dfba9437979325b13174597dd4a73aecd0f6e5c3
- SHA512 220b62de0d539c9cf97f59a8c97146333f6a7376677a488c6a6daaaffbf432b388e1eaa98546ba23f927ae3b2020c112b12f4c7a099856618cec2af36740912e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcR0a:A3mnXoZjzyaEFoHaewsAjYaEp2ahcRN
- TLSH T11025B023FBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 969KB
- SHA256 2f47f6c687ca97b26ee2e5a62c2e4aae09a1bff67be3422391c9d1fb574fd42e
- MD5 b21e941c3333749e9b5c51b2cbb561f0
- SHA1 78e8ea680c424f29b78834b17a4f41b88e491753
- SHA512 2e224aec151af45662a15865445e8d6cb8e1065becef87999bbcd39146d602af9aa9254ccae861a0fddc89d0811feb3517af7d3b1c260b5b41c7430b3c07fd1d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahczF:A3mnXoZjzyaEFoHaewsAjYaEp2ahczF
- TLSH T11525B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 969KB
- SHA256 a92cb936530c6eb919914282fe3403c98f696fb0ce5fedddde873ead35be6bb6
- MD5 b955c9571553c6622e286ba8258ac460
- SHA1 ddbe4516cc91af6f207bf624d68106a607d62263
- SHA512 331b454facbd9d8f78c87551a91537e6bc8497319d41d82f0e638269b02b33bcfec5f8c7a5212dc78c555fa3492b86ce2c46bf31e6099523b660d70adf3fdee0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahccC:A3mnXoZjzyaEFoHaewsAjYaEp2ahccC
- TLSH T17625B023FBB090B5D23B49705BA58713EB787C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 969KB
- SHA256 d9d0dc6af6b9ef51985499c34898a13cab4c9f172c1a0a5eedd3d48110bfd8a2
- MD5 e4e2e8f73b05fc904396a3c5635e63a6
- SHA1 db273b78d1c61a3da8a85105f6864f1438579880
- SHA512 ec863240a34d9ef38de82682a9b66b4cb086f85365ab055dab7fe2793d707fdf0a004d0744e14470d518f81c3f0f667babca203d8b69a7a3d3b92b8ac2cce30a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahc3w:A3mnXoZjzyaEFoHaewsAjYaEp2ahc3w
- TLSH T1F625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 969KB
- SHA256 ffe440c5101dc73525373b2b5d60e97dfb6269b98c3f4a2998bb38fa07c910f6
- MD5 5d72ac48e9400fd7b6cfa7408b95483d
- SHA1 bb446827470d6145a5e83becda1e96cda689387b
- SHA512 3c62f6e70a6f88c086ef07ee9c48d2fab0c90957bad6239aa1e8e5fb2f281df63f02d5f11ff47ed171209916bc6beacdc87f9be7d323af7804bcff98b0aca942
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcmT:A3mnXoZjzyaEFoHaewsAjYaEp2ahcmT
- TLSH T19325B023FBB090B5D27B49705BA58713EB787C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 969KB
- SHA256 d16592a5f83090a2915255dfd491c85c3ebddcb7f94538df642df5cfe7601a83
- MD5 a51c781529b49644c5f6833812aeacce
- SHA1 5a46c9c0de4f5cb6d2a8f095971d9709d3a42972
- SHA512 83abea1b7458c30bb07ba1b6ceb10ae4004fc0eb886aac5b136c341aca00b5add6f2bc06ae31297acbd063ab8c597a7a97704d2e0bebde6c6d9fa3f654d72fc9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahceu:A3mnXoZjzyaEFoHaewsAjYaEp2ahceu
- TLSH T18725B023FBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 969KB
- SHA256 748f8cad0be85c54bafba5a45a5c667960c47477cf0ada16327bdc406c530703
- MD5 033fd4adddebd9e652d0f8894ed69eee
- SHA1 e434b9d1d8b75901a901e369d18f557064044778
- SHA512 9d943887caa3647344e41a761ea04d298e7cbd43453d70b7f66887d6f5c4ec08c149dbbf5bc8be6baba1cd14b49a1ad5ef381afe19c1ccd8c96824fc7a0e4d59
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcYb:A3mnXoZjzyaEFoHaewsAjYaEp2ahcYb
- TLSH T1AA25B023FBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 969KB
- SHA256 93d3d80375f4d341de3cd60dbb65a83c399f1c68727816bfa126d00a7d4f1f5b
- MD5 ce476abaed8ee41e0c248f3e778bab6f
- SHA1 fa5e44d8e1e14641c0200c0bcb485c15c1c1f0db
- SHA512 59f6bc7a581290c2f3daf07e45905bb4bed23b0cf8d9809ae33469a819e04630314af7520015a76430a6386f05582c863cf2a5b9b14460a08a0c0388b4a3ef72
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcGf:A3mnXoZjzyaEFoHaewsAjYaEp2ahcGf
- TLSH T1CA25B023FBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 969KB
- SHA256 972e46f5d5eebb02a8075bb4761e99db468f99bfb297c1e19a2f765887b5a8fd
- MD5 0e4e8969b4bb6cbbb53fcb415b26b155
- SHA1 a67d31f83fe19a551ea558b10d8df06e1a83ce79
- SHA512 0313bfceaebbf05695f890c603c514d6fa862666ee959374ab828cc2b399766a437a0b509848201e520cf7db872720f3e6d31a9cbe1dac15b4444409cdde8449
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcDK:A3mnXoZjzyaEFoHaewsAjYaEp2ahcDK
- TLSH T1B625B023EBB090B5D27B49705BA58713EB787C210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 969KB
- SHA256 d37b2aee397de388b6190dbc03372ddace56750577465a11557de6691507fb18
- MD5 62612ba2c96c0c1bf4514cba53629e28
- SHA1 8f907fef99b641a9e0e1c652704124b80affa8ca
- SHA512 486d921de34b64bfbd08ced5b3c5a3dae0cec0e7da25123c8a2e2bcb69c1a1f5c823959f19f7466c6861b23e18d0667549de4c1d6227b7271c357ff585d134d3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahckk:A3mnXoZjzyaEFoHaewsAjYaEp2ahckk
- TLSH T14B25B023FBB090B5D27B49705BA58713EB397C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 969KB
- SHA256 1c63192657ab2a81c1054250a1b5ceaf3791abc851cae5900d7461d4d42b0605
- MD5 14ca604f17e42d42b9b23ce858c495dc
- SHA1 55a508680fe750f928e9044def75cf993913fe57
- SHA512 0a1615c314ef17fbfce9bc42b7704a44ab1ef6e6a59cfbd68cfc6209760049026485834076d715215e8a87d726f34244f955aee684d779f16c4ed5683569ff2f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahct0:A3mnXoZjzyaEFoHaewsAjYaEp2ahct0
- TLSH T16625B023FBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 969KB
- SHA256 73d5480285c86eea8bf765b530623c27a23b1f3a994fcc977a70bc9764ad8611
- MD5 06714b6e8f585b572366ffe9091e3a9f
- SHA1 a40965c16ed752107abe9db6faf95fbdb8f9c179
- SHA512 9dfa8fb3a9351987d0ee8f5cbef642eb615eafc47f49c9d82fd3237dc1e067fb3ae3832ecc4968305acd926eb93a2096d507a128b5a7277f2ff2fb68770b0647
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcw70:A3mnXoZjzyaEFoHaewsAjYaEp2ahcwg
- TLSH T14525B023FBB090B5D27B49705BA58713EB787C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 969KB
- SHA256 2b7810243510516968f5ff4d448c72df48441f6f6df23d8b066f2b639b8de0b7
- MD5 01d88a60b20c5fec1e94f630483b770e
- SHA1 8236201ec0615f2222b2e25d342da4606fe49d7a
- SHA512 80b9749279875605d62e76b17e0d105107c1e943dd51296f3b30b3aa928359cd878afe4a2b62e50a1b8aaac2475823df2c51b7d4c3c05decb0c52fd41549247c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcFr:A3mnXoZjzyaEFoHaewsAjYaEp2ahcFr
- TLSH T10E25B023EBB090B5D27B49705BB58713EB787C210B6056CBE36886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 969KB
- SHA256 7f2cffab9063f1276af07f6fbee4bebee5ddb23ebd706e282708c56f027091f7
- MD5 9155d8ff0c65294649fa0a49879f8cce
- SHA1 42c9950cbdbfab10d846825127589c73c9464c80
- SHA512 8314ffd53144c4900712b09682fdae61d977eeb82b90b5a75cbb55582e39c7ea09d470b6f7ec673441ee88b4c17711f9b10ce1323639ea52f396a1ac3ea98bb2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcPn:A3mnXoZjzyaEFoHaewsAjYaEp2ahcPn
- TLSH T10825B023EBB090B5D27B49705BB58713EB787C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 969KB
- SHA256 dd2cb06090c8b9fd90bb9ccc6358a6269dfc5941cfb0c4f1ca021b4e973976e1
- MD5 70019d7b99bdb45f28c7e4d3e581ae19
- SHA1 a03a6ac346d9acd3a10053e57fe683d17a2eaf31
- SHA512 ef5c406e58e75291047e2dde4d535370048342bc8e100d231a091accd5f17a5cf96b41f73fd326fab89dc5cb0e68485efa4c922f2f5a50fb3fca205de3d37cf9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahc7x:A3mnXoZjzyaEFoHaewsAjYaEp2ahc7x
- TLSH T1C825B023EBB090B5D23B49705BB58713EB397C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 969KB
- SHA256 08267da8bc7fd9ae07f41539cfe7babaa876d468d5b72817d475afdd630891af
- MD5 82bf79bac8b73a1d980accc791a28c1b
- SHA1 2596efae1202eea57fa047e1146daad53123f5e7
- SHA512 810a0c6cf74f4a1999d9343541eb3eabbc07445d9424ebca462df0efb75d9ce59f634ff1f3b5d45b306b694aca525a3b1e8ae4b15156b2e3058a84cb7ef829e5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcpA:A3mnXoZjzyaEFoHaewsAjYaEp2ahcpA
- TLSH T11725B023EBB090B5D23B49705BB58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 969KB
- SHA256 76e413a6fe3a3b242ca51cd65d52e80a625772a29e6419f709cd612967511f07
- MD5 947b17cc7c9f9b9980df8afae00d2ac1
- SHA1 53418bbe01def3451b35d686726e947f6d4a972d
- SHA512 507aa4db3f0bcc4951b3fb370eba1c8f20a1f6d72b6aa6f7493c7c913bbbf9fe8ecad86a0ece0a8d337c1562989a8611d27796630e24f63868588e1e81d55710
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahci9Q:A3mnXoZjzyaEFoHaewsAjYaEp2ahci9Q
- TLSH T1E625B023FBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 969KB
- SHA256 5305e4d2eb01532c9bb37e8b8c4d934d2e5a04ffd92633221a7286c174e82327
- MD5 72bedd67c2c9de4dda1d9633eb6e6737
- SHA1 38f35d087b2403613676b06c9285359a7333639c
- SHA512 e67acd5475d5767632c07810a7ce6fdf2e454b2c9e7432c16a0953f38c98c3a8bed7eefe3bd7cca2e307edcde90da8108e701c6c7d55578e78ec6ac1f15c33b5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcH4:A3mnXoZjzyaEFoHaewsAjYaEp2ahcH4
- TLSH T16925B023EBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 969KB
- SHA256 43e6b0e2779f0fd99cea2663304d4214a75831acb0283056c1c8954cf4643520
- MD5 6d312a439a7aeea92be8692540ae99d2
- SHA1 28e9165d8292f6755dcfe7ccbfae12c60a76cd9c
- SHA512 5b4eb99c50508e6d7ec56c78c18e64c8a589a22848fb9267c0ae08a1d9c6cf344349e4f87bb220199b8ce10a32c83be8cb40466a5d540380fbb44b45b59e0b4e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcmu:A3mnXoZjzyaEFoHaewsAjYaEp2ahcmu
- TLSH T11525C023FBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 969KB
- SHA256 61a5411e53cb450ffc7a6da349d8e377d574a96948e0bac63b93932ee6ae9d7b
- MD5 0d0ffcc304f0dde84c701cd1c8606c8b
- SHA1 85007e7382ee68fed797336c31e01644337f6510
- SHA512 f4d051e4c4e0a3243b9a75eeff129add59cc4ab8361672186b2c902fbfb139d7f01e7d1b2abd2d3881488e8b3611778952b61ca81e253736c709a8dbe26a3ad6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcXj:A3mnXoZjzyaEFoHaewsAjYaEp2ahcXj
- TLSH T19025B023FBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 969KB
- SHA256 29cec601f495ab0e7ba5230fbc416cc5cc54e71905072c22d1c68970d59c8f93
- MD5 78b5a40e7366e2e46968bd4a8a614b46
- SHA1 9608883dbbca27d42bcfe92c02d64422fa9d938b
- SHA512 37ac886ca14250a9ef2cf7522a13651e1b8c61209b5f092a0640b77e5ace1feddc316416c3a82f3f463ffec46f5471014e85a0074d6b81153f88d8a63fc53345
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcCg:A3mnXoZjzyaEFoHaewsAjYaEp2ahcCg
- TLSH T11F25B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 969KB
- SHA256 02b5256c996ef3345bd5642173a2c7b4cf4c9b7a760020e3edf2e25db0e28260
- MD5 53f876af539268bce97880d920f11440
- SHA1 ec98cd892d95a61c345d6dec5707bf9777466f9d
- SHA512 50ec2e6f1e981830025cd343af0bc1c5a3341817e5ac44cd73ed74a2d687cccb7329595f7481ccb86dcc8d06a3d14d4bb27ad192467abf860a46d481974c1895
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahc9I:A3mnXoZjzyaEFoHaewsAjYaEp2ahc9I
- TLSH T18E25B023EBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 969KB
- SHA256 9335ad0845e0a85873676623e47b83def60b21b4a94a7650ea4aa36f6320e193
- MD5 54090e427f876a262544ef88b86b5dee
- SHA1 43c6d3cac9ed5a318b20d533b1984409deed5aff
- SHA512 ca5bacbdbaed4cb0bd0c95dbfb577bbb8e70e1f2bc6c6dc8e201ca9d399a021048a6f9ff43d19ad84e1b5a8cf6e9713df441d655b91b92f48eb9f061437b7184
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcvo:A3mnXoZjzyaEFoHaewsAjYaEp2ahcvo
- TLSH T1A525B023EBB090B5D27B49705BB58713EB787C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 969KB
- SHA256 d0d3fe552a0d585f686664b7ad28857d04e3532e6bad9109e7dbdbbb8944b465
- MD5 3e0046a92146c861fc5b3f9db04751b1
- SHA1 02e2ceb54dc6891bc298b28b68a2719da367c53c
- SHA512 c9127ac312707de04d898f30b192819edcb6be3df4f92c51d066d4b7a42f644173b752036269c7268d226a99205a7e46348a5fea0f7d9a047789657a70cfcc7f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahc0+:A3mnXoZjzyaEFoHaewsAjYaEp2ahc0+
- TLSH T10E25B023EBB090B5D23B49705BB58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 969KB
- SHA256 f8599777d19134a5311f9a7e99fb159d8a46f15fc3f5a81c72426fe8dc1bc92b
- MD5 2e6c0a8465c4a9267aa021a411faa76c
- SHA1 8e3dbacd1999d483f380784f83552e8696e5830f
- SHA512 8872577b1958e7bab6e062ca430207b75104a710082b52ead54626aa5eaf216577b5140da9904229d0eddf98119b306b0489b1e8c26ede65204b64f9512d3253
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahc8Q:A3mnXoZjzyaEFoHaewsAjYaEp2ahc8Q
- TLSH T15825B023EBB090B5D23B49705BB58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 969KB
- SHA256 2708200d3710418061b7ad9dbb6276129b53d8f4af4ed9eb41387035f3a1f902
- MD5 8153dc44f8315fc32cd7fe0066e8c251
- SHA1 3dc9bbf9ff3e933f1168a93f4164b9df21a28b10
- SHA512 308737e8989c3ac015d9de98764fdb0d8e58f2edb337f5085fad935e4d24115cf774795e2611dba36d412f0cc40f449fd8a1188b0b66f859d26db35b7abccd80
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahclX:A3mnXoZjzyaEFoHaewsAjYaEp2ahclX
- TLSH T14125B023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 969KB
- SHA256 d42f4392317c32d14740ee5f9c4a8541a802369afb88e2c23f7f804da6d53604
- MD5 bced7cf367f63dc40349693201563987
- SHA1 38b180fc0b8cad383f4870d52fb2a96b875a0e36
- SHA512 f18b97f8102f668b0449788ebc555b0cff4bcf6936c605eee80044fac4da8acd8a7008a5724bdff445f5a33501baa8121ed073ef99ac7029e15c227ca7580b22
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcHL:A3mnXoZjzyaEFoHaewsAjYaEp2ahcHL
- TLSH T1EC25B023EBB090B5D23B49705BB58713EB397C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 969KB
- SHA256 5b6d981090973ba39460f293fa099b29b545f87ea17d53d54065d139844acbfa
- MD5 f18eb2b179de52faa193f528249b1e47
- SHA1 34887ffa3cc8b78a1c8a8bcd181eb40b813c3e7e
- SHA512 f6f19f9635b7f0c7bb8fb09d11aacc014d0fb5d061fcb8c39456c03d9f1c04477c4c46d46210a0881e7ecf0a42ff62dad5a6c1e0e94366d28071e3781b389ef5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahc9FC:A3mnXoZjzyaEFoHaewsAjYaEp2ahc9M
- TLSH T1E225B023FBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 969KB
- SHA256 82e2fd08ece3521704c212fb4549ee72a645dd0e8ba928d6df7b94c7f5c4d296
- MD5 c96c7e8910361f69dcff513904174ff6
- SHA1 d76d1fef00e46e20bd0041f140eab831c090bdc1
- SHA512 6066fbf54c45c253aacee040005840922893a30363aa6df0488c0df8330234a0e0836d9574a42f3fcabbf427e975623a2378203c70e4b9d5413fbdb6c8cf8795
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEp2ahcuh:A3mnXoZjzyaEFoHaewsAjYaEp2ahcuh
- TLSH T1B425B023FBB090B5D23B49705BA58713EB787C210B6056CBE36886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH