f06ecf577fca3d5d93de1ada4265e144acae696c004027ed1dad3f5e33e2b715

Analysis

max time kernel
112s
max time network
96s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 922KB
Sample260728-vsbw2sdl3w
SHA256 f06ecf577fca3d5d93de1ada4265e144acae696c004027ed1dad3f5e33e2b715
MD5 6adb7e09567a33974784f6825ad1906c
SHA1 669f9b3c617748e2bea9b4cc8faad5af77221bc4
SHA512 4fd8474782ecca3e6b448aa836c730dbf201bfa5a9a824fbef63483dbf5ba187b899b9dcc0a4a78cd2d9bd1cf4575b43017d8c70ef7f2fe0b3368b29ba6189ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa:A3mnXoZjzyaTjBaewsAjmEguRaRa
TLSH
T1C015AF23FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317D06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 48 IoCs

resource	yara_rule
behavioral2/memory/2624-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c52e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2624-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5828-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c9e-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001898e-192.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001898c-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018990-338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018992-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a6f-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-722.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-828.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-859.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-986.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1067.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1408.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1410.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 45 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c52e-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c9e-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001898e-192.dat	aspack_v212_v242
behavioral2/files/0x000500000001898c-259.dat	aspack_v212_v242
behavioral2/files/0x0004000000018990-338.dat	aspack_v212_v242
behavioral2/files/0x0004000000018992-477.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a6f-502.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-722.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-828.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-859.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-986.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1067.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1128.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1185.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1325.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1344.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1406.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1408.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1409.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1410.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5828	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
5828	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_6adb7e09567a33974784f6825ad1906c_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2624

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 922KB
SHA256 f06ecf577fca3d5d93de1ada4265e144acae696c004027ed1dad3f5e33e2b715
MD5 6adb7e09567a33974784f6825ad1906c
SHA1 669f9b3c617748e2bea9b4cc8faad5af77221bc4
SHA512 4fd8474782ecca3e6b448aa836c730dbf201bfa5a9a824fbef63483dbf5ba187b899b9dcc0a4a78cd2d9bd1cf4575b43017d8c70ef7f2fe0b3368b29ba6189ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa:A3mnXoZjzyaTjBaewsAjmEguRaRa
TLSH
T1C015AF23FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317D06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 782fe1e9f96c0af3e1dfef4c60f1aba0aa4a3243313fc0f527c938c4b7c2f073
MD5 ecba677485b95bd6f01f5550b75c442e
SHA1 6070b97396890f08bc41f32a5564a72fd178e94a
SHA512 66d2a9ae6069ebfc49d0ab9d7727cc1d8a295f1b7085d640f0b2b9a0705bc8b20e4b009d2a468c8f1a5024738f4674f74e2f35ab2bcbf362f1841b231d12909c
SSDEEP 24576:A3mnXoZjzyaTjBaewsAjmEguRaRaP0Le5ji0hmxNrM:A3kM0ljhPji0Aj
TLSH
T17B658D22FA748275D077C4B5CAE2975AEA7138510B308ACB9394C76D2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 936KB
SHA256 ce4c62d73fe9c95ac8025104610f4307f5af8d5258c8abe7b2962e904ba6de25
MD5 dfb9e01076ff45a57738eb02768c01ef
SHA1 aee723b82472e7d487c651365dc81b8f870ffdf9
SHA512 4a84efead3d23e9d6c67a394807f7c2d99cb2536f2744b1d7f531cebd61c2d0d1a7549d3fef410a006fa52aad7c17e5d90e25f4c67baf8bb3bb6a2eb17b43c16
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaRa:A3mnXoZjzyaTjBaewsAjmEguRaRaRa
TLSH
T16415AF23EBB090B5D27B45705B658713E739BC210B605ACBD3A89A5D1F317C0AF3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 970KB
SHA256 f1ba148317c6b68ee822b1c9a348b9b49269967d396fac517a4b9ae70fb49249
MD5 3a57880ede360407a0cc2877a9c01555
SHA1 db58b2809ab920093d35475784ec256058586ffe
SHA512 15485c7b7364aef12a2bfe30ce831e127533a38b0f5fd2f94023b42c565f40ac17af5af349f7512f799b3c55ea2a9ace6b2f9880a3d34bb4994a2c182d745af2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRayb:A3mnXoZjzyaTjBaewsAjmEguRaRayb
TLSH
T1C225BF13FBB490B5D27B49705B758713AB39BC210B205ACBD3A89A591F317C06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 946KB
SHA256 dd3284ed04ed9f9dc474de2c13d9623af474655ece3ecce803bde44946bf935a
MD5 efff87a980549797927672052704e49d
SHA1 e1bcbe870a3bdf19125387405b3041dca80fef65
SHA512 5d64de89f444aa2ec1195674277e33263b5ffe7460d0cb76ddc9b890333ea1278de47b525e25d0247f0407c050179e37407a41d544ff81c488d04a1473c1f00d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa6s:A3mnXoZjzyaTjBaewsAjmEguRaRa6s
TLSH
T14525B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 966KB
SHA256 8ce08b04a522b4db2f0231e33c10a506919e58fb43af54359724dd46777daf52
MD5 4c6d4f1b1f1b34a4ca62dcfff52d0ece
SHA1 e2375d9d5adfef8e3bd6a81149a42286960839d6
SHA512 45c3119824bb2e49e3e5bc834481a46400f38aa2bceade7e373a7034db38240077a5593c1c518ac9334bedf41ff2970a5f1deb42b2197bc1eb141fed36903b45
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaLVc:A3mnXoZjzyaTjBaewsAjmEguRaRam
TLSH
T1FA25AF23EBB090B5D27B45705B658713E779BC210B605ACFE3A88A591F317C06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 946KB
SHA256 9d7b01f5d22c5c9c807d5523bc1006b2aba0032abfc85c18c5852d620876d5c9
MD5 d46767f71078ed8a4fc688f1b1e4d923
SHA1 f33c835eb3f9ce80254ed67f39173775b81a02da
SHA512 636218f629b9a54c925894eda2a2691f26d651070cc90d2a7533cbe9a33089688b70f39fe7fa5f8874aacddd71f95c3704b6af23c5fa720dc979e9407722d72f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRapZ:A3mnXoZjzyaTjBaewsAjmEguRaRapZ
TLSH
T19125B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 946KB
SHA256 ba0fb008743203fd5cc5bc1e73a5190c5a29f1d01791029c81c87e6ce89ed0fb
MD5 68317777c9c042553f4d26443442f8a8
SHA1 b86f556d7f4453abafd8365069183003f0761a82
SHA512 bd99b0cfe0cef173153b74c68425e33f201b37bf0ee176c4dced09c7a1cf14d8d1aa4b0cadb21d3a1557de0ebba42795c5143c2e885cb488e10a2d7176a32b89
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaC1:A3mnXoZjzyaTjBaewsAjmEguRaRaC1
TLSH
T14725B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 946KB
SHA256 c588e54207b4cb95720bb01e969b67986eea3e0ce0cc3f0d3e3fb39b76f3b73b
MD5 c1b487bd9c9fe1e1c98abc562bce94cc
SHA1 ccea0e7a920b4c0e588fb23965fc5ccefa61b858
SHA512 12641dfddf025b8c875ff1a33d130b17f1444012f35fab0008df7bd68a336955cc29f9e31380a172b657cbfa74fa3313d33982932db5f3101e36c8eb719db28f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRao6:A3mnXoZjzyaTjBaewsAjmEguRaRao6
TLSH
T1A425B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 946KB
SHA256 94399a7119f6c0603a1a3155d96a68eb165cab6667410c362b5326bb2df2b61d
MD5 63ca610ead25285ff52d5e514096a303
SHA1 189b7c9768a79c3c2619339c9fbb5b015bac15dd
SHA512 604e55a07ea68faea886cec84ee35440917b1f3d40ff178a8943b9285fa7bbfdd61ce174f9fde54a96f2e28ea3678f8cfe5e38134b956fc943a919baa21d4290
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRasN:A3mnXoZjzyaTjBaewsAjmEguRaRasN
TLSH
T1B525B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 946KB
SHA256 6e7973c4b758e57d9fc7339bcff8a3faa2e9c82ce65acb3f24c51bfe691f1e9a
MD5 4ffe288b3520d79f9f13892267a2bf05
SHA1 e6320d2a6281e85ef0eee6de499d855436537173
SHA512 1df78eea3507080eb78f2ef0ef1d29659fd47ae80861418fb51d32e1860eff9791c8f944b847744cb70a5911e6755c281e4ebbd841c44c92ad277a7814ccb70e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaif:A3mnXoZjzyaTjBaewsAjmEguRaRaif
TLSH
T17325B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 946KB
SHA256 3d92c5a9f14c0e624ce4804c657f5e97701507f0908213e25b348fab087ff810
MD5 979036840dac786a4afa72b7de7caa40
SHA1 0b474bacd3b0ef9c2315b65ca65c9427a484be03
SHA512 3843910b7291515d96855739fc55f70501ca5530323adf87745966843a7541111c2d30d63b4020b3b2de1123c8a39d234f80b606f361533a8b5a46529c1803d6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa8o:A3mnXoZjzyaTjBaewsAjmEguRaRa8o
TLSH
T10925B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 946KB
SHA256 b868b478f3ab13710e199b29d63628018c9c8da2c3a5bcc9f0d2777321214df5
MD5 927013f2978e86388e431063041f3d53
SHA1 6bbc3438d303d978c11bba8478e5544c646a0520
SHA512 0131d74bba15adc19332762a6839b81f036667b2deb1c13a8835130b4d348c0bb74255d18dfac510ffe22aaebe685cb282bf4436b79afe6fc27abb4fb98a585e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRacu:A3mnXoZjzyaTjBaewsAjmEguRaRacu
TLSH
T12125B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 946KB
SHA256 8ca113e5a84d1feafdff7d0e2d97735f14e797a6a8442dd047c6f711c7a41c8b
MD5 9140fb8fea4d514a30ba12bcd507791b
SHA1 76fa6367a3d56bffaffd8bf4cc93140f1be0fa6d
SHA512 627f67272e0b03d18a8add82875a1742524def8df118a7f032dab878f7462a6763a879b0fd70afc576dbc3abbb45f6011ffa2404d6f596795581058ee03bf5c5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRag9:A3mnXoZjzyaTjBaewsAjmEguRaRag9
TLSH
T1CC25B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 946KB
SHA256 d73ba2a3882ebe783bc4b1ae8eb7c5f829e70378d0c0dd4c622f8392388f075d
MD5 b64f9a5620431c74d8e7e9aa6ce7fc24
SHA1 f5d691bfc41dc2de5af8701f136c8da57b078444
SHA512 5195458877d3a58a5f203c5fe938b91e69a9fc3db39eee019c4c2e102ec353955bf2c05dc30f202682de1d10fe3441cd09cd41f4731df3e50de08564c3b3a786
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaoc:A3mnXoZjzyaTjBaewsAjmEguRaRaoc
TLSH
T1D825B023FB7090B5D27B45705BA58713E739BC210B605ACBE3A88A591F317C06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 946KB
SHA256 2d233d5569daf2347db2041e4f68481f64358b1219dc3001e9c29682a2a1cb97
MD5 5b2a8f56d1b52591c8eacb3d8a6bf4d7
SHA1 59625ee28cb9e52e107b21fabea83c0f52dbfcd1
SHA512 9cc54cb289b9d955f5ef98bf4b4b7eee44bc8ec6dc5737896161a4f6653002292e288c25646a71682ce49c66b5d313c5b9c711adad462f0b4fafbe60ab2ae796
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaBp:A3mnXoZjzyaTjBaewsAjmEguRaRaBp
TLSH
T13525B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 946KB
SHA256 123cec416fc79020aa64f516b886acb6462f030083d7b05177cf6c91f314f1b7
MD5 ceeb6e4576592bb46c6e7dbb60c24022
SHA1 5577f9f98b2959e96f64082dca0063694bcd4b8e
SHA512 45f77392bc51498fb0430a4051c929f3eaa5fa00dfe3bfe8a9420393862ea65dc052aa2c54a6d4828a05789848dd7bfb9e56725562e62763e0dbbda13334ba4a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaW0a:A3mnXoZjzyaTjBaewsAjmEguRaRaWN
TLSH
T11525B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 946KB
SHA256 a3f5a6268bf968ca8b6608ad4b61ee4c6d3529922313a3caf3a16605f2d996fc
MD5 02f0f042b3a733230950c48fe9a54ce6
SHA1 8437379e10b6fcd291311c4f015b4e1804139b79
SHA512 5903856709fdb793cac3dfe98ee5e8e1f8e69cf25b1418796f150c4efcca82171f4b7c2a4c3ff80c7572add937cd5471393031752b2022e836ab81964ec6d5d1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaaF:A3mnXoZjzyaTjBaewsAjmEguRaRaaF
TLSH
T10025B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 946KB
SHA256 e21081c9ccb636f3a79dfa8510dbb7dd4dc72a4ec6a9eaf052e74bf77342248a
MD5 c86bf8a74b6d610a9e2e2ed52d35cd90
SHA1 8cb1d2a24fe4f82a5695b14f85872c52faf8dc82
SHA512 facdf54ba9da114fbae6bce433b1db21df4733e4dedf1593c3d8690d70401b650279b81808d3dbc91366d6bdd1d000f312fbd009cf3298a72acfcd68d96ae5b6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRavC:A3mnXoZjzyaTjBaewsAjmEguRaRavC
TLSH
T11E25B023FB7090B5D27B45705BA58713E779BC210B605ACBE3A88A591F317C06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 946KB
SHA256 e163dec280e095518acd671f4232e7e929fab422953a1a2100a1398ddfdb360c
MD5 ad4d424eb4d86d55eb933c2dcf280b16
SHA1 b3b19c9b5522b8defd7f63b671d9dab326fed936
SHA512 95a0cff77c88ad3767e5140e8b7bb06e4b52cd97a9549f2e8505c65b26707c63a16f5c293c3865597ecd65da55e2896cb8fc406d58f4972c8daf495f5430407a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaQw:A3mnXoZjzyaTjBaewsAjmEguRaRaQw
TLSH
T19225B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 946KB
SHA256 5a4975f2d2e8b2b118463a885ee5f7efd79a32d6d4e7a3a2c3df08add3a8e322
MD5 9c5c03b47220c8ec4aa3eba5fce01fd8
SHA1 0a17b18ba09a7f1a174f8cc8f123ac955364668b
SHA512 808ef0c27423344b5312487f236ea6d30d5395e3cdc299bac16bea0619ab8641b6a4a09fa220ce334fec3e129e389908520de5232b24a51bcd8ee6868691e7f6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRavT:A3mnXoZjzyaTjBaewsAjmEguRaRavT
TLSH
T15F25B023FB7090B5D27B45705B658713EB79BC210B605ACBE3A88A591F317C06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 946KB
SHA256 37d6313c5a81286216be29be1946117e04abc76f70fac3e7d4aadaf10e9fe609
MD5 b3db7cbce280523298b810eec7d9f975
SHA1 4b69dc2ef58c4fdcb75d8c2327fe3a3a05acc0af
SHA512 b73f6188239d1558302d7e4e731fabac4f52ecc87e673a269b8aff0463210b67aba6415400b9245f3a814daaa7950e314daaf323c34b821dab132b9732527f8b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRapu:A3mnXoZjzyaTjBaewsAjmEguRaRapu
TLSH
T1F125B023FB7090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 946KB
SHA256 d120b7a49f8e00f165631099ef0bb37c2a75d4897e0fd348e3cf450501ff6142
MD5 145baa996c123b8685721bec41af2d8a
SHA1 167b10cc04078861a824744325cf5e5d258a7354
SHA512 b69f524bc03556c189e4a5e8dbb9147c9f16e2b6e8f9c733d118ffe2696adc6e86a9015fc63114907cbe42cd69021a6350afa18b33d724bf14569689164dcc0f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRahb:A3mnXoZjzyaTjBaewsAjmEguRaRahb
TLSH
T1EF25B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 946KB
SHA256 e48843f847e232bebdc5ee582ea98cc2e97f317d3ae41e3d4118ef6ca17bc2ff
MD5 b419f2c3aa9da79162699697081ac352
SHA1 0999cc4f8810f564af549796e05d9a089cf3bafd
SHA512 ea0a3d6229711193a0317ddb1886673607f393c4ead62f83bd94692654396033e518fb50a194509f5c7bc87600b42dbd9c28c23bc23735f45bea3d76fd0ed3b7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRapf:A3mnXoZjzyaTjBaewsAjmEguRaRapf
TLSH
T1CD25B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 946KB
SHA256 cf78c5b364d73d6b4c2dd137523b1e42e8dae0444f5f017969327c5cb84bbdfb
MD5 0826413011ba0001075ef86cfc95193e
SHA1 e09a136d5cb6491c70ff53056ba5039a64405b68
SHA512 4264af277ea0c9876c7b226d0f87ed8811db22c0adced1b77083707d503331e2b6452d737bd1ef7a984616d348a6bfce0f47ea0712e8bb3159c5d05505edcc90
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaSK:A3mnXoZjzyaTjBaewsAjmEguRaRaSK
TLSH
T11425B023FB7090B5D27B45705BA58713E779BC210B605ACBE3A88A591F317C06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 946KB
SHA256 22f4fc01e19fb3a7c1be47c4a31728982e3c109b29f1b7ebc8ec628c64e75ce9
MD5 4ab9343b6f7d1c21c942edb3874691e9
SHA1 aea6febe732152abfd3904bd327abc0707be1a79
SHA512 f521a1a0375a1c5c1f3370e5204b35e400550df57f0a7516641ddbd4a6fc24013b7e9a33c8a34cd19747e6a2dd783939fe93147ae131daf50d99a6a7dbd27f60
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa3k:A3mnXoZjzyaTjBaewsAjmEguRaRa3k
TLSH
T17425B023FB7090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 946KB
SHA256 2c5b9a9d632601d318733c4922b9b2a0ac92c8f750ea8272a989e6446b5a6666
MD5 2d9c6260a2fb7c16ee444006a796f4b2
SHA1 73df24199bc4a7c743c278ecd75cbdc5d4bd9749
SHA512 c8e21fac3d2cb5b6b11fff4cc9c0ae69bc71af0bd5e9968b96add38730b386f1dd00536c555bf1e8af78209b4b7017fbf152d3f886e7ec8c25ccb44f0a2b313a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaA0:A3mnXoZjzyaTjBaewsAjmEguRaRaA0
TLSH
T14525B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 946KB
SHA256 bf91f0662e92f56a31b3af9c98e47d8eb795dbf099b700458c9556e69e46f6b3
MD5 1eb4b7f08ed0b4069650cf9f4a8eb499
SHA1 f85a382733450602e0ef082fd512dc2cfcd5029b
SHA512 c27aa0a7717525ce10badd96ab50061681e8f0bbd098c0647c4692811442ecd7467e8022adee4f4c63ae69a5654f9c19b689a6798e5d77c3aa163dae323bda3b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRab70:A3mnXoZjzyaTjBaewsAjmEguRaRabg
TLSH
T1DA25B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 946KB
SHA256 87f9b154e58afce0619867b556c7170768ccd7d453cc6167c753fb7e7dc92f62
MD5 7535a9cbfb3e9e0dbc3657f121c0bfdb
SHA1 fd4f88e2f33553392b86c5a703f2d24810dc75f2
SHA512 a7dfd1a2c01649c296c4c5afda12fe78877a9f65c7bca329f2d8d82239f816eee02b55cca8415f8042f7eee056873056b7907dc650d5c762f6aae95486a088c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaWr:A3mnXoZjzyaTjBaewsAjmEguRaRaWr
TLSH
T17525B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 946KB
SHA256 54a30246d832ad77d2aaa8f81fd49245727dd8b5ad14542c7561cfc8094574cb
MD5 3ec292052a5d7e20843cb97a23d40677
SHA1 b16f7fcdaec64bbcf934e9b48d6173115aba7486
SHA512 b414800590116f2397a9ced6facfd4bdb2010fb542cc1f65c0342d4c2074f9b665c7feafac8b69fd3cb85fa7bb9fe058edf2da26a53ac4835b35ad858eef8ade
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa8n:A3mnXoZjzyaTjBaewsAjmEguRaRa8n
TLSH
T14725B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 946KB
SHA256 fcb824608b951710f2058a8863cbd50ca96d2e9b886f4bebc7cd63b26b8b36df
MD5 b347cd04d2f4dccb402de67646f36875
SHA1 3e8be011db19447f0f243b2fe4b0eb82788d0bed
SHA512 ade4f6e31660199ca979ac20b0346193783934cab606576370826716650e569a6b0fd7b9912c7696c129bcf640c7a1b53932e86abd5afe2057f07de4e75352ca
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa6x:A3mnXoZjzyaTjBaewsAjmEguRaRa6x
TLSH
T11525B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 946KB
SHA256 72feda7b634d225e2dafd84cb01962f05870cd6a329b157204ae7b0d81869c4e
MD5 b2eead22767a9adebfc81f814b94549e
SHA1 bd746b752593fef0a9d9fceb2df3c6b46a8e718f
SHA512 1b164a57ab73594d5cdcf9ca6aa6c316f7ab52626c54e3070c33137b656038af4c853445107829e3dcbf2d3812a5a3e72370cebf6ed35c472b7e6bd019717cd7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa8A:A3mnXoZjzyaTjBaewsAjmEguRaRa8A
TLSH
T11025B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 946KB
SHA256 3c40392f49f710ef4b18d113348010a2a2c0a2aaca372ef9c4ea85608555581d
MD5 755a1b81554c3cfce23b23affe1766cb
SHA1 6f1885997131c3d2f82a424baafd53d65aad3616
SHA512 26282ce61d80e4027e8248483a7cbe26a852cb7f8077f07daed519d9a53ab4ca9c260cf57efd0d856da745c0d5e15d91231ec513fcedadc0b86c6a99b0d89ec7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRal9Q:A3mnXoZjzyaTjBaewsAjmEguRaRal9Q
TLSH
T19125B023FB7090B5D27B45705BA58713E779BC210B605ACBE3A88A591F317C06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 946KB
SHA256 a64155cb89e262cead8417a2b069cef2c20119a119260a54ae3b61a65bb983f3
MD5 d7d4f7286e051ea70700fcfd79a1d3b9
SHA1 8a19a1ffa68a74e704658321a3d07f069e674708
SHA512 74e9a166174c0ba1cc053125ff7fa2ba0098e3a627b83e08cd65a8ab0fd62a6b5c1a2abdf509255696607ad60d5e1c782ca6ced5ecd46b7db73b275278a468b7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaQ4:A3mnXoZjzyaTjBaewsAjmEguRaRaQ4
TLSH
T17D25B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 946KB
SHA256 24474dbb78ea208cee28769fcc8e9a69dce3b73d34964f8d686f1a46c916d990
MD5 fc17cdfbcd58585c930f065e567971f7
SHA1 e0c2e96f41c2d448f29cfa81cdb60a273a9dc7e4
SHA512 c96f6a56d558d7dfcf05f578cc99d82d26afda3c39dce8ff0163210182aaaf7bd08135d0763110044bec14085e95e99a2253b21d61122bcd3620c1e59e0228ff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaTu:A3mnXoZjzyaTjBaewsAjmEguRaRaTu
TLSH
T17925B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 946KB
SHA256 e40b4d8b09adb161025601184582a3f0d231103a680f1f969ba30ac2ddeeaff1
MD5 67b075170858ab656aded60c6794cac0
SHA1 c0f86bbd48d01da74bc5e4b22d184e5baf7961cd
SHA512 e229845ca84f7f0240b32f7f75c6dc6ee70df3169b4d20898ae6f88e60f28f299d6f242a542ede1e410d1ab2f8cbac6d9eaf435f632fde0b10c85be6f9971afd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaOj:A3mnXoZjzyaTjBaewsAjmEguRaRaOj
TLSH
T1D425B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 946KB
SHA256 a3f02a9e251327181a69b1d3e13a2e47e8deeeb1851b2f5787ee92d01942df7d
MD5 9eb58c008c78237e898b347afb3fe00c
SHA1 619eb0ea050cfe5a743039937e428fe26c742009
SHA512 e278bbeaf8a2d5743837f115e05a3b6ee94ca7c1d54c3e96c1eaeb37a21e2b942cd8ee44b45ec798c9efd9330485eac8c57f3e7b37a3b72b546d3c6b1a92ebb7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa7g:A3mnXoZjzyaTjBaewsAjmEguRaRa7g
TLSH
T10725B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 946KB
SHA256 f224909a68a17a1d0d35fbf8dc25d3fa4a0b2c638b9294011c2af0d4fb69008b
MD5 ca1d42275993b33fa60280ccc7d0834e
SHA1 7105d34f716a7894893ef870bd958b15b65b1f02
SHA512 7b0576f6aa9aab5ad670dde75631a08388f6a2e48f6c8cbe661bf2dd314871f4ef6eaf94c99a350a87370c34777e9fcf33f0795edc1606e6b1face70ca465fd1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRamI:A3mnXoZjzyaTjBaewsAjmEguRaRamI
TLSH
T16725B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 946KB
SHA256 577f3185bac5ddb6beb7cc8fbcf64a08b960c9031545e15bf6e1be9317f8914c
MD5 eea9828360142c3946c2776772dcdfb4
SHA1 ed585678ac13b788955a4765b89da3c1a281c7c0
SHA512 348b03b1da7b6a3c305f7a97df994117e65d2b3e7c9b374f5d9c2ba979f2979e7e7afe2e488f249caad653c8311e37e43baa652dc52bd4324ac129ba8b4e3893
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaUo:A3mnXoZjzyaTjBaewsAjmEguRaRaUo
TLSH
T1CD25B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 946KB
SHA256 f66e2d858d8fdf86fcd4de03fa501f85d5a5349b4b67761ff25b73285c511c64
MD5 08a3f343a0e98ac7b4aa2cd0883e6556
SHA1 487afbc7a58c3f8032597cad8e79b1e653df7cd4
SHA512 8895549e6bede06ca52c57e3935292d463c921fe3de3e61763724966549d3fe4e340d0a3b76510e6f453110c9f91e72f4896b0ba9af583af56537eb6cb9d7936
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRa3+:A3mnXoZjzyaTjBaewsAjmEguRaRa3+
TLSH
T1F525B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 946KB
SHA256 59225d9a4d8544faacd427a1275097e6c3104f2525e3096d64674be74a7882e7
MD5 50a4b5a4214863fe402960394ece94e0
SHA1 b917c110e9b82e80a1faed6834f037620b96cd77
SHA512 c2761554f83113a4e41b856903b3ac35f065ee127aaa47c92015fdf68ed0d10fcfa4f941b8aeaf246801e8cbb5b3d7345e0447abc6e572dee6b0fe65f019ecdb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaNQ:A3mnXoZjzyaTjBaewsAjmEguRaRaNQ
TLSH
T1B025B023FBB090B5D27B45705B658713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 946KB
SHA256 d1a1c29b9ef58b03cfc11017584b01101f4c4047e0e4a1444cb26e1596ebe0fd
MD5 c9bd68efc7dda0b3096823747dae918d
SHA1 11b7d6d6ba89cc3f0c5387e52002c5466a4bdf0c
SHA512 f12b5561083733f6aa27536dc4dce07c92961eac07f270c3953c0e39298cb4baf563443e06e1c7d6d3e1d91f256821c8e4172fe67352d17d44cdb341147387bb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaCX:A3mnXoZjzyaTjBaewsAjmEguRaRaCX
TLSH
T19D25B023FB7090B5D27B45705BA58713E779BC210B605ACBE3A88A591F317C06F3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 946KB
SHA256 ee659593bc93f492c5ab1dde92c64afc886a5a3a7d2675c3b12edbe966f508b7
MD5 ea2113f139b7ae43efe7ad37916d3d15
SHA1 025288001c88d3582896190d314818557f22a65f
SHA512 3f16f1bca34db0663548e15f1b5e641280e2bd0c3c2d12c983f68de34c814913496618f42247530a4bd5b6f6ce001ebb6e992615d99dd0a289bcd71c65e5fff3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRakL:A3mnXoZjzyaTjBaewsAjmEguRaRakL
TLSH
T11725B023FB7090B5D27B45705BA58713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 946KB
SHA256 5dccad809149eebac4fc14bfc2421173caa7b78a024e665375b276e88b03b8c0
MD5 b930e60ab1de9830e0333fbd770a12d6
SHA1 23618e0b6bb4089e9742e03f3443485140525334
SHA512 579248878f080f0aa2a5adc16d2e97a9a58c54410e1bffdd12d19248e1e51107236b4d4f9a3bf426ceebb8100e3e8703d844209e832f7215078bdb98c2b91ab0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRaAFC:A3mnXoZjzyaTjBaewsAjmEguRaRaAM
TLSH
T1BD25B023FB7090B5D27B45705BA58713E739BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 946KB
SHA256 ccd68f3c15ea310f76c8385777f159e3109cb74bfb80f703e30396a937ed3d3d
MD5 8d5ac62079e18e8e87239d2ae8ae3900
SHA1 b529b4ef44ac7b01e858fdca1659aa636a8c608f
SHA512 4c449603376a6b346432ff8080db96628733252badfe02002232ab599e65b612bb9f5807321654690c48277f995334de2d09595110afd6806931aa57579ac1cb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfcAwSfxL/2Dc3jDLLmt0LDQewsAjRkEguRaRahh:A3mnXoZjzyaTjBaewsAjmEguRaRahh
TLSH
T1BE25B023FB7090B5D27B45705B658713EB39BC210B605ACBE3A88A591F317C06F3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2624-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2624-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5828-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads