Analysis
- max time kernel
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 16:14
Behavioral task
behavioral1
Sample
2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 901KB
- Sample260805-tp24dscd64
- SHA256 3eb7c589af4f429a38bc5ee2a50527cd08a4c8a43bdd682ea00b10c5b7bd2e69
- MD5 2bf89b5803c6a337b001965dd50209c9
- SHA1 a9626e106d5c0a14bb47a4bf0fa0e4f19878441b
- SHA512 97c4a35a7f065210522acca067388f3580507a774a0811a49e1cb837ef178b76410c08bb998f294fb5b4aaa28f2db9659c52001720cc5fe0653fa5fb5c35e4a7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0a:A3mnXoZjzyaT4aewsAjxTcgGcN
- TLSH T19315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/1352-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c535-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1352-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4440-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c94-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00050000000198e2-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-452.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-580.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-672.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-770.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1165.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1331.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1356.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1401.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c535-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c94-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-244.dat aspack_v212_v242 behavioral2/files/0x00050000000198e2-264.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-452.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-580.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-623.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-672.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-733.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-770.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-801.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1009.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1053.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1091.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1165.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1294.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1331.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1356.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1375.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1383.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1399.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1401.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4440 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe - Drops file in Windows directory 31 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1352 2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4440 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_2bf89b5803c6a337b001965dd50209c9_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1352
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4440
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 901KB
- SHA256 3eb7c589af4f429a38bc5ee2a50527cd08a4c8a43bdd682ea00b10c5b7bd2e69
- MD5 2bf89b5803c6a337b001965dd50209c9
- SHA1 a9626e106d5c0a14bb47a4bf0fa0e4f19878441b
- SHA512 97c4a35a7f065210522acca067388f3580507a774a0811a49e1cb837ef178b76410c08bb998f294fb5b4aaa28f2db9659c52001720cc5fe0653fa5fb5c35e4a7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0a:A3mnXoZjzyaT4aewsAjxTcgGcN
- TLSH T19315B023FB7090B5C23B49715BA5C712EB787C210B6056CBE3A886592F317D06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 8889629471f76f45301b216d1f83751b04458d9781bc8fc05c127c29685ad966
- MD5 490e0017cadf64969378ca1388dede55
- SHA1 cdef59c7d9e73eb0ad4a0137bfc9a5a4276d4d4a
- SHA512 a04ddab6888b8cdd3b276f8e00dd0d95600e74f2eeea93df305f6aa0ce124c5ff699d091cbf38babf0d1b266ceb4038b7eae88e83e86fc39e6c60884d03aa1cf
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcgGcZ0Le5ji0hmxNrM:A3kMPljxPji0Aj
- TLSH T19A658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 916KB
- SHA256 9cdc260baabf3796737a0f556dabf1ac3f562e0f7485f4a45c58a5b4365bef6d
- MD5 c3ae1f42dff40053d8b52b2cb0b471a1
- SHA1 76b3bd1e54897f77fec76ff0825d35ae16fe37b6
- SHA512 e6db8998f03dbb13d14f8b6c1539b4264465af8b8fce48509e99c7701161a62a48183565e262d3c03b06f4992d95419e0cd32c9cca56da8728337c637ccdaf7a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0ka:A3mnXoZjzyaT4aewsAjxTcgGcLa
- TLSH T17415B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 949KB
- SHA256 e6c8b066b1198324ccefcd595ea37581ac5e751c2ef9e39df832771f4e454578
- MD5 3f92cd8e96f42a3404742da91c179270
- SHA1 db95b661e007c1e6effe2bae6cb8fee270a993a0
- SHA512 5a276f76c6def7389835cd97053c9cb863c8dbff076ca0e9b01196fe0a1253995c64eded06b907c90856abf353cbe61aa5bbd437b93f1d47a9e89bbabe85abc6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0vb:A3mnXoZjzyaT4aewsAjxTcgGcIb
- TLSH T14F25B023FBB09075D23B49705BA5C712EB387D610B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 925KB
- SHA256 be08c8500f9b86c37a8bc17d6fb127b726995a73b2104f511c58d972a0b0ca94
- MD5 75e8cceb6edb9d116eed59f343b831b3
- SHA1 7a441a70bc4953fad908d1f901d77370811ada71
- SHA512 2b6f6532ff5817b550cbbc1edbfd29473ceb7d90321bb8023942a40e9c71cf3b960b76876b1c633e6c3aec69f3b665e3b54ade7d0ae3047ac8e0475f4910666a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0d6:A3mnXoZjzyaT4aewsAjxTcgGcK6
- TLSH T1FE15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 925KB
- SHA256 15060833a6eca0c7c9c9f3180ce73e0b6a7fd42e495d5ad9291d828760e66a1a
- MD5 7ec2889b01adddccdf0902f957012f64
- SHA1 12eaa6a6b62d40f56bb8775ef4af8d14353d9771
- SHA512 5a840026e3f7aba7d0da1165af11da7f57a42beb51202262b9bb8ba58def21eb719445e87114692eebf072ffecca28cff7e094c8bd3623ecc4b77ecb0a660337
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0Xu:A3mnXoZjzyaT4aewsAjxTcgGcmu
- TLSH T1F215B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 925KB
- SHA256 6b58d4602e3741424baf8daed41c6c1e890b54a6e42dfa81d6eaf6235e1d6e21
- MD5 f72c8d8fcd18d40128c8b714da9e223d
- SHA1 e030b7aeaf7a644310774981ec57dc3284d97e7a
- SHA512 73754d1af15370ce0faa9cecfd59781b311a4e131b93585cc37a2e9b36b793f655fba7a9095329f0be101db3484e2281a6dcddb1afb19c1da901cf78b6ec1c4f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0l9:A3mnXoZjzyaT4aewsAjxTcgGca9
- TLSH T19F15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 925KB
- SHA256 01f50473be876cdee0433a14701afefc04b4395d55a8255c3ce16ec7f2b2bb91
- MD5 4488e8b9b8cca499812dedf87776a8c5
- SHA1 e5d881479c3a3028d5a5881828ca205df46f2529
- SHA512 9c182052db2098d950b685b24ca22fb0be5a867cf5e38a8f55d94a0e5725615302bf9649aa39c4f565b84c118ec165bd01bd220b646f76feffe999863f966cb4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0Bc:A3mnXoZjzyaT4aewsAjxTcgGcac
- TLSH T1B915B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 925KB
- SHA256 f35de6bcbc262f754be317d6799e906b07b0455fc8f22183cbfd92589dd4ed51
- MD5 f5895fc1aa72a83224179a0faf1b7765
- SHA1 a7dc5cd64bbde7e08b587c172a67e067443ccdab
- SHA512 77393ccda31b806d1378cfc25d63e9c042337cdaaf07f52adf9e77a2ea0d715a243fa85e1a7d28aca8525092f6b4c69e65c86d94047fda4dc3e61e1d8cd7b779
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0qp:A3mnXoZjzyaT4aewsAjxTcgGcTp
- TLSH T1C115B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 925KB
- SHA256 58237d0d14fb0be98fa0ac95b6d6920add267ec97faadb4953a82b079b2e6927
- MD5 c0db8e6ffe104fa9c3e9736abab0b534
- SHA1 245e36fbe29fe6eaf7e602d4b92eda9875eb27da
- SHA512 60a4e84ea4fad4c512f038da1b53ce6aedff6be043c33fed0577ba2e6114abe90c6e576c87bf56b3557a38710025cb7bcef0181951184efb08f99030df4d8b9b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0N0a:A3mnXoZjzyaT4aewsAjxTcgGc0N
- TLSH T1D315B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 925KB
- SHA256 585a384cf52610eac565e0fdea2cc7dc04a944f0584958ba8a2cbebc05033fce
- MD5 4df0974be137f20d6b71cdb2e9d802e9
- SHA1 fe13bb158ff1b16dca885d3f151f3e93f9a2898e
- SHA512 cd2e8b2533ac4fa10a76c08bef0fed023bdbb299cbbe58c4c3c0e4d56c255dd82df995b64688297c0f428d18509e29b33888317acc80185680320f797094c322
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0/F:A3mnXoZjzyaT4aewsAjxTcgGccF
- TLSH T13515B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 925KB
- SHA256 f1a3d30e70621caf03a036cd744044658ce7736a2a6e5d7ec676d7a8000168ec
- MD5 85353226e081614acaf9c8e73d76a81c
- SHA1 88213af3a7d5962c91df762a84af9e5513ec86c2
- SHA512 76c9199e45c8ab41fc59b53f0327af887303deff0fbdc17e555195dea1952e963122ac71f210af79f9df2e01717a79faa7a298cced2540424e49f24b58a53424
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0gC:A3mnXoZjzyaT4aewsAjxTcgGcJC
- TLSH T15015B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 925KB
- SHA256 01f122bd492dc46b3dace2cb8db6e0e3636e9d3d6a4f471e4340c341dd3f99c3
- MD5 30a0a32ae0a9ec591ba85fa7b2d86c36
- SHA1 647b951c3ad9269ab35a6429e758fd3875a53509
- SHA512 5be4456e116727729e2c9470592bf0a4813e60ebde642cd4163c7a23afbcc3e13fbf6b8d286af8f39abe9fc1ee0560e640156fbba06fe9a92145c09d0165d352
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0zw:A3mnXoZjzyaT4aewsAjxTcgGcqw
- TLSH T1F215B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 925KB
- SHA256 632024dff93e24675da5617825202f1434c8e6745be049098ed73f74cd36984f
- MD5 d0dc48de9316d6edfe8ef5d647ef7c6d
- SHA1 aa01e01673c1e8b931261fdd52280e2e30b96c94
- SHA512 813aaf35d59fcd8f2b2a2bc27c25d78b916419b58cbd59cd980ffb84627183363b2ff3f27c003c557c30d7c6505b3201cb2f6f9a6df8794aaccfb264844e0558
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc06T:A3mnXoZjzyaT4aewsAjxTcgGcxT
- TLSH T12415B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 925KB
- SHA256 33e7d04e09c05c14edb6cbbfdaae1405ba90fff54bb16e7b961b04a4407a6c34
- MD5 ebef8aed727d5d7006502065fc420835
- SHA1 dad2e96e094120726b93230b9cbbe363c7df7dda
- SHA512 35d9d69de0da747e7efa6b38cb1579c6f12a62afbdee88c2e2066df78766352de4097da3d3940b0ec42bbee7f58ed15c882c2a50804a8f9e601d3933e91e23a9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0au:A3mnXoZjzyaT4aewsAjxTcgGcfu
- TLSH T1C815B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 925KB
- SHA256 47b7f545d2e68bb58df655a62685b42114d1ed3a931b051a5988784ec34f8c47
- MD5 2a0c314a4d25e9be6cbdaaa2eee1dd52
- SHA1 8e3edaf9550a18712493c1438746a9c417b144d9
- SHA512 4406ba5d88c9d9a888326740b5363e514d0c33ff7a94e3d3bce264332b8e62a33d554ade7ed8e1003a271a52bb77eb84acb7371030c78379d91e90b00b41f38d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0kb:A3mnXoZjzyaT4aewsAjxTcgGcDb
- TLSH T17315B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 925KB
- SHA256 bd3e4f921f9ab50a537876f58d4056a27c5c0e4c206fd30a5c1b9c497543b154
- MD5 0fa5b8a95f5da09af05922b43b62e619
- SHA1 950bbe00cbf3bbaa67fb4bfaf5e8812bfbe22c33
- SHA512 4d2b03b19e3be9c455e2d19f4a222ef08d51ed6bf797bbb26c67882054c241451d9efa49ac39ed807ecb5db1c7f9a5a1add594115bf9cb4c262da9c906a61885
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0qf:A3mnXoZjzyaT4aewsAjxTcgGcXf
- TLSH T10015B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 925KB
- SHA256 b638739fc288dc7da7af69311d70f80e4c449b430b881cd0953a9ff6501dbbe7
- MD5 2e82cafbd4271826d48dc5d9da411b94
- SHA1 34f7d46594a393ddbf8cd40d0c185dfd6cb44dc5
- SHA512 42fb0f345b7f883c5cf2e27bb32eb47e3635da5e84dd9aab190320bd519c290b9dc422f3c4bc082de206178cca59b87a5aff3db7b932b904528ad7e095095248
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc03K:A3mnXoZjzyaT4aewsAjxTcgGcgK
- TLSH T1F615B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 925KB
- SHA256 174a6dd20c953e1d4a9796237df7becf0463e5400c1acec85b6f7212c95fc490
- MD5 bf99bdbf935c0e17ee24bb269c1c9cfa
- SHA1 fbee51833a0c0480fb9b1291075526ffbd4e4ae5
- SHA512 3dba4009fb139a2b52bfe142edb5887488db115b66ee3cfe5a899c82286e6135afcce6bd2234b2e3079ed21eee24c8863e9c613c2c70bb459563d07d877c6a6a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0Ak:A3mnXoZjzyaT4aewsAjxTcgGcdk
- TLSH T12C15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 925KB
- SHA256 083931deec1f6859df9def94d88009b4d7ef58bd7a990e0d4015ceaa3889aa47
- MD5 c858b645875b1319a9c67210a1eed2a2
- SHA1 1e04d5315cb574d4e345100bceba63f98a463a71
- SHA512 9b5583092cb033d0f92e992f0f7e61117beeb45f7bf36f3e5e61437afb3e1bc521ba1befeb2d46bec7035d3bce8f4763001e48b2d33ac18a34953039f3c1b0c1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0x0:A3mnXoZjzyaT4aewsAjxTcgGcC0
- TLSH T1A815B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 925KB
- SHA256 ae915265fa5702fab8846175ac9d8d86c18aa5f06d4f106184d6a5b9237abefe
- MD5 94e743a746276d888078cd4ea538dce1
- SHA1 dd993770c83dcf333f0e35b1325538cdee165d03
- SHA512 d6b73ba639f440917c7c6d51450dc17bb157e990958535b336fd804818d0a0cc484eefba168f21e00ef55796105343e25e113f57c51052af52c06a94747e57f9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0k70:A3mnXoZjzyaT4aewsAjxTcgGcRg
- TLSH T10015B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 925KB
- SHA256 aa0c7c28c90056813667da00e71f86bf2e4e80b2fc4e8b9de4184e4cd2ceea25
- MD5 7b93908d2d41c29268967db0de9761fd
- SHA1 edc98b1d3bde65b51e841c71eca6d959306dfc5c
- SHA512 ae95048b6c28dda7c90e1ddae5d664cb2b3ff9fed648fbffeb6a35b9ef074fb5396cea25fc29eaca4b4b3e786f3d4bd29f8b82096f1baaad2cbdb2570f363b94
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0Br:A3mnXoZjzyaT4aewsAjxTcgGc4r
- TLSH T18B15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 925KB
- SHA256 355b46b020cda4ef0fe70b8dff3d2f84d8e687f20b49db0d4d71bad3651a44dc
- MD5 1b4dc1f29e6df010308f4a9135fe3811
- SHA1 06ab21a84249f6991072c6d4d49cff914c2f7962
- SHA512 291d8e8c2b5f246c254f2ecf894309cfba5971b903eefe775f3bd85dc33554f887f6e9b5e0f5a201a2b6bfa87644568cae13a9278f0de8bea9590d2846d7ecc9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0Dn:A3mnXoZjzyaT4aewsAjxTcgGcWn
- TLSH T16215B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 925KB
- SHA256 03c7f1c48df1a096837d2c6120dbc06e9e6704f1c95dd208b293f34b662abb80
- MD5 609c4d42cea74c53cd6ffd8645f2d6b0
- SHA1 971a7d617fc64dbdeb33d06bb8f25f2b3262113d
- SHA512 a8d40a7695bbfbf9ef6b9e383d4fb48c1e4491f1f03fae73361f34b783bce8f311ec8aa6f227d6b7d9625c95f84f99e02b234e1aa49055342a93099db9219eb8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0fx:A3mnXoZjzyaT4aewsAjxTcgGc8x
- TLSH T1AC15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 925KB
- SHA256 db37bd40ce120d8dfbe2c3ce3c3222115cf663b3d327358afd5d5a6ba948a847
- MD5 9f1a0958d725c0d2239399778f9240f7
- SHA1 7bae1c416124b46420c7a89c31802a27f720182e
- SHA512 7ebfcdfda8fd664dc60f154f768cc61a174601f2e26614b4279b7f8327f6bcbf6763d99c06cbc97236e625cb43624e3c6fd80c45b259afb95ae196ef7921de36
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0FA:A3mnXoZjzyaT4aewsAjxTcgGc2A
- TLSH T1CA15B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 925KB
- SHA256 a2802b65402c9e46bcb21b71e8481ac6316cd299270a7349d298c55d8fed68bd
- MD5 0bf854b7e977d4d38dc3f434fcff01e8
- SHA1 d7bd7f1eb55e56db0657a06fb7b6cde6730fcb95
- SHA512 8522bc757e5fdcf20a5e22334d23b131ede3916b1eb9a8c8d01ee8bbfbc9a9d61dbf6f66b4ee120c26c6fec95da75c170d54030f43baa72e8046c52ac1f02bb2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0+9Q:A3mnXoZjzyaT4aewsAjxTcgGcv9Q
- TLSH T1A915B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 925KB
- SHA256 f5d077fabe184de32dff9956e3a44ba333c86ca87d3181c72387ce554746cf93
- MD5 12d342056311cdfa9f9167fbe47da561
- SHA1 ee4b3821dd9998266aacc32e220470c5374dcc70
- SHA512 1adc0eef8eeacc20a013ec1a2b9538d9af85cbfc36a0f5b1de7e82f0a6d6f78276d24ef484db07e8a161f8168ba71d1e6b795d5120e1e38a8a1043d20d70a019
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0r4:A3mnXoZjzyaT4aewsAjxTcgGcG4
- TLSH T10115B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 925KB
- SHA256 0ee401f621d8f0b4485dd457f93187182d5f1a1272bfa9412684a4df6d955248
- MD5 e96604b642d56a99fcfb8f91c0e36b6a
- SHA1 923f91dba69e966dad39cb7b3d94fc56aa132701
- SHA512 2807ff8a7cbf6f24ff3b1e5541a034fd20ea424af14c7811c4b96bb1f56ebbb31becfa6b01165721f11f590f90688a2dbace5d98f8c8e5e7bfb91460a539d27e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0iu:A3mnXoZjzyaT4aewsAjxTcgGcVu
- TLSH T10415B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 925KB
- SHA256 df7d479b9b282b7881e653e52c087422162b20c117beda783da2467851d631ce
- MD5 ec4f37795e0c96d77d46556ddd5f02d2
- SHA1 5b36426c16dbedb534018ccab7db045507616fa7
- SHA512 edbc42c2b30ab97cacbef768262136f3af8e63f3be23d73356a297fcd58b56961a1b49d2440c4c429455a83daead06240459d7fef575f9f9a7b11cfbb8199a84
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0zj:A3mnXoZjzyaT4aewsAjxTcgGcIj
- TLSH T1E915B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 925KB
- SHA256 ecdfa5724861ee8cd96ebf97f6701b6dcef78da0e7c78e78f846a8a267435418
- MD5 858b6f765bdc2cdc87ab6d24bea6a6c6
- SHA1 33a1de43045b65258a10dbe6b8569bd92b73e63c
- SHA512 fe4df7b105401cce632e769805b74e86a57c73fc3774ecade6e2992e30d8a7aef7cc753bf66fb6641b692f0acc03b35db8156b2c881f62872ebe1a1cf31ede4c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0+g:A3mnXoZjzyaT4aewsAjxTcgGc5g
- TLSH T12F15B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 925KB
- SHA256 2031f9c42bdd6c97a8817916706526389fa0089e34c7662a6267ef7ea8332d12
- MD5 43476b84c9a2c9c54b9fc0dd22a1a9c8
- SHA1 8b0ac0d4279e9b6c45be5c6352cf828670cc8724
- SHA512 8c6f2ad8adb76b1950a0aeb10ef4c1cd2d0ae4e9df335b5f3960204ea1576237a288baafd9c5ffb54aea931c9eeedbd637849c0ef3fbc668d98076bc9d81745d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0xI:A3mnXoZjzyaT4aewsAjxTcgGcgI
- TLSH T12315B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 925KB
- SHA256 07adc08d94252bc138e1eb50d9b708ad876ea837b4f13f70db7607a7b1c82e1d
- MD5 f795c3077d0f91328f429548b7ba7b9e
- SHA1 f6a32cf474490dcd190374c8fe57424fcb1efd7f
- SHA512 b7c56ff413af716b6ed60efcf20973f6435d698ab192e2be4eccfb4803aed8535b377c2f782fd755e1c8ae8a9c649bd462f1a63350b3f6f2cfc01fb8ce9ec4ce
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0zo:A3mnXoZjzyaT4aewsAjxTcgGcio
- TLSH T14115B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 925KB
- SHA256 e92489b54ab31a603aff83e54b1fbee6f1713755d9af8c88334a4d948efb77a0
- MD5 6a1de081b3a343146ab10e4285f194e7
- SHA1 046b47da7d916d834e3e93eec10c637cc6531fa0
- SHA512 1b5b17fb424ab3317573de600f6040b5f6dbec43299378194719780770531921791c00abb13893e203e05a8a1f157b9b307af468cf6e40a8e7a80a7e9bbd8be6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc04+:A3mnXoZjzyaT4aewsAjxTcgGcZ+
- TLSH T15815B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 925KB
- SHA256 016e8a6fe6d07a434b624161bdffa5ca74e0267268ba28ccd1f0ff5830a4aac8
- MD5 97eda4561544afafa71d653087facc6d
- SHA1 ad4c098c6288fefe225a5b5e6924182508b00578
- SHA512 9602a92912fb7e20398ab61fae10b66a378f29b3b2a4d57306685ae3183e2d757edcf410a905109f28fb228a7cfcac8e1743c5d99663da5358a6cb314ddfdbb1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0QQ:A3mnXoZjzyaT4aewsAjxTcgGcHQ
- TLSH T16715B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 925KB
- SHA256 87d85a36e268ee04e4880b423d233a8d06378012c12d8e817d56d7b6ddf25b44
- MD5 66264e2aca7e5edb2f46c9a7867eea90
- SHA1 4fbc5f9cad4e53c79c5efb2538b019e6bd732a1f
- SHA512 7d26088916dc0f46de724dd1f30f90c133e5ec62931e66f7cd4bb90d391ac96c36b892b1f13ca3f839fd9187934d0b76ae3174cf3611a42b4734a24d0b21e1ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc05X:A3mnXoZjzyaT4aewsAjxTcgGccX
- TLSH T1F415B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 925KB
- SHA256 51c3b65f13bc4e3761bda7234e750605639a9911b64864851c12d6cd30dbcb2c
- MD5 3e0740f839445fb15734624d3ba2b935
- SHA1 a8ffdf9ebf12ce1cc431f107f22209d1d0e74771
- SHA512 88f41f07997fc46f9875c5b204e85fe292d1006917d90b10677a69209a86005d4ad578e2f3a721a6b77b0a2b3922326d47b5daecfac1511215cd8a1468bbcb36
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0TL:A3mnXoZjzyaT4aewsAjxTcgGcaL
- TLSH T1F615B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 925KB
- SHA256 254d6601f38c43f65237ebdfdd72c926ecfbd1dc309a9234e12eb9a6ebe9f9c7
- MD5 1315aa163fd8694f498a0ee5491af6fd
- SHA1 4220f2e18b71aab804d73ff0397172f93be8ef7c
- SHA512 ddb38d98bf04f2be0a59d83006eedfd6d359bb2c20f25c7487959cf95c2af4bcddb8c3147b42aa557998627b4e97d83c5e4e959c35b90efb49261b102e675982
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc05FC:A3mnXoZjzyaT4aewsAjxTcgGc+M
- TLSH T18315B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 925KB
- SHA256 de419efcd3574fa8c4d4f714022f5e9ebc17dd8d0d5a11af2cde861fa1b8c68d
- MD5 b20490383199e844ae2db0eef18bb7c9
- SHA1 3710792115bf2e8af02d24fba0498ef8979c1b05
- SHA512 271a9a4cc7d3672d51ed3407115e1da47a1008ab7384f00b286c56248d029ec3d2cfe27b0bd555a68ba706ea3e2ba313c196a3f2383b636164fcbb22a3705f9f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTcgGc0Ch:A3mnXoZjzyaT4aewsAjxTcgGcnh
- TLSH T18815B023FB7090B5D23B49705BA58712EB787D210B6056CBE3AC86592F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH