Analysis
- max time kernel
99s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 02:29
Behavioral task
behavioral1
Sample
2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 952KB
- Sample260808-cyynws1vfs
- SHA256 8626f1d709a249321273e8e6244caf64e64c34e81c2ce3be6808a93814ea5795
- MD5 e85c33c4840d9ee0dcf466ce6bcdec50
- SHA1 457d301b73b83dc08902bc1ac1e59dde7977d537
- SHA512 1363792474ca348aa8897ff5ff6cd59152223909d04f5cc409a2e4551eb4581c1755aa2c30970b672ae4a279efafee4c362458cd919d6cb8aacae58282761d17
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaB2f0D:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+
- TLSH T1F925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/124-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c538-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/124-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3104-221-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bb3e-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198ea-433.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-482.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-592.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-672.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-759.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-822.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-853.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-951.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-982.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1037.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1050.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1087.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1100.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1156.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1176.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1337.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1362.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b7a6-2117.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c538-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b300-57.dat aspack_v212_v242 behavioral2/files/0x000400000001bb3e-270.dat aspack_v212_v242 behavioral2/files/0x00040000000198ea-433.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-482.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-592.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-623.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-672.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-759.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-822.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-853.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-885.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-951.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-982.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1037.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1050.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1087.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1100.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1137.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1156.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1176.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1184.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1221.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1324.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1337.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1362.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1375.dat aspack_v212_v242 behavioral2/files/0x000300000001b7a6-2117.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3104 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - Drops file in Windows directory 52 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 124 2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 3104 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e85c33c4840d9ee0dcf466ce6bcdec50_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:124
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3104
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 952KB
- SHA256 8626f1d709a249321273e8e6244caf64e64c34e81c2ce3be6808a93814ea5795
- MD5 e85c33c4840d9ee0dcf466ce6bcdec50
- SHA1 457d301b73b83dc08902bc1ac1e59dde7977d537
- SHA512 1363792474ca348aa8897ff5ff6cd59152223909d04f5cc409a2e4551eb4581c1755aa2c30970b672ae4a279efafee4c362458cd919d6cb8aacae58282761d17
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHaB2f0D:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+
- TLSH T1F925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 f95bf7f6c84fc68a012edd70cba9f5217bcde829cf93fe1138211f5b0ba6b4f5
- MD5 527e25040ad0e26b158f9a07c75802b8
- SHA1 1f4886eb2cb5d6702d168146d704e5f1cdc2c4d5
- SHA512 667cc3791e813222bb2775f17060724627668c652edd976a7426ae9b78a3f925e7b322c33b08d3fd97a4961156275d014b8fd99f2f65527a3a3183911c20bf7a
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+P0Le5ji0hmxNrM:A3kM8ljFPji0Aj
- TLSH T182658D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 966KB
- SHA256 d8cb4b30588ac667953d8f55cda76baa968ac30324d9316221075614c37b3af1
- MD5 1442d51626e803e7fdd6da88a5cb4b09
- SHA1 e2344f82b05ccbca4d138620e0397e17de2a204a
- SHA512 5b392b65409055febc44c41c517851d9a0b7f60aa5dd14335a10a304806228288bad0cfe09f49b99c83e8e1741605a496cbaea271bc3a4edaf6309320609ac61
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Ra:A3kM8lj
- TLSH T14825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A5D1F317C06B3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 975KB
- SHA256 bdbd4e50005731c79929561414c0ca70cf7bd31cead93c3358ef323c1a853fe1
- MD5 a5e0bb14922698937371e4c923402745
- SHA1 8e60a56bdbcea61e44c4cc759a64fa2a54179d49
- SHA512 73a5994c74524480d204ad74b30eec6ed74c4ce643ff2d1af1cc1e645c9c45f8c829c237f68a02f984d769c4c047be2219222a9163d669c80b9c536646e321fd
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+g9:A3kM8ljO
- TLSH T14525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 975KB
- SHA256 947338c439b9949de2ba054551485460488b2a25cf07a60feb9cc122f208f2af
- MD5 a1258e9565abae0774ab3ffb7e085dba
- SHA1 51606bbdf51455ff766c211c59980e7412fc2a5f
- SHA512 7eec6f7cdb0ac2626459e637ccd6ff152a9320fbd11e927a5ce26a37e2966dd21170bf025986c5ceea376e205238ca1a5026b2f1f748c9884abc0b4b3d7d5f92
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+oc:A3kM8ljj
- TLSH T15525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 975KB
- SHA256 344146ea7d407c613416d2f6f502747c0a9de4881c2263f99acdbc0392177b35
- MD5 85160fd51a28c99657bfe9e14498e703
- SHA1 d21a234f30bb0552ff09986cdbcac0e3168db488
- SHA512 1fa9a2a06035eff45715f086fdc24835294deb1de08501825eca76687b7a1ac33f2fa0cad773243a9007c33fdf4cd0bac39eed9853c4f421726b4bf146d28bcc
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Bp:A3kM8ljh
- TLSH T17B25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 975KB
- SHA256 4a6b85a3ebae25e39c70021513a659c593967d586ef307a0bfc622829f81696e
- MD5 e2057efc13b6f79f2459ee1cc4b0e5a5
- SHA1 4929241f7a9d001ea50260fd836988255af8a75d
- SHA512 44c4ec6cb41263c2ff58bbba11818747739f35b8b54031d0ec8372ab26d00c1be7feb0760dad610d7f64a90eebb6470b7948ee8a729454312e1cfad0a3fbaffe
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+WN:A3kM8lj6
- TLSH T1AD25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 975KB
- SHA256 a4cf338624863681340ea9d161efbff2099d9dfb4c0ad6fb611f3cfa76faa23e
- MD5 18bf1443a41352d6e3cd71e3af3b9870
- SHA1 5ddf7f225328ddd60e885eaa96e4c83e5e35ffd7
- SHA512 cf38ac78dd469f1854762a4c5e04f834e17bdc4c6815d22ed3bbc9fd9361c99bde6c690619be1fca48d12b4163f76983ad2fe794ce3baa751325f5ba6599a8c7
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+aF:A3kM8ljA
- TLSH T13925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 975KB
- SHA256 4c5b361b78d3f38c965ba1d37fb1c8039fd496e1670fed822e56d0cd2879af4d
- MD5 980eefc1b36db1c7a5438c9a56c37bb1
- SHA1 ce8f0a9cf4b63c7e3f182bae581705e933fe90ac
- SHA512 0b6dba6379ca719cfd7a282054303410af0b4aa4156d75b783ad85161451d4aa30bbc0f67297cafffe3e89e1fbe7e760a2ffa2524350b33f48170c4b06323c0d
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+vC:A3kM8ljU
- TLSH T1B425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 975KB
- SHA256 4419977b2b9ebb8bfcb11080789593518b6ab41bedfa873a9973e7817e11a284
- MD5 0d424adec9f07fa74b3458a0f97b3e08
- SHA1 c681c20f01e855146053bc6ba5966f2059db4e8a
- SHA512 9edbd5ff2e4304bceebb6d900159ffed49928fa43840d0d8708264e67e5774dc24efcd99662615fa9dbe9ad08fabbafd90bbee04fd1a83fba7a408407baf6a47
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Qw:A3kM8ljp
- TLSH T12625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 975KB
- SHA256 3f389bafbefb22a24b93dcdda293cc8e6ab177099cc491768235639044806db5
- MD5 164f524303e2e0183d72cf91a1cf7984
- SHA1 5416408fff71db306297b97515b15b93a6d467eb
- SHA512 70aafc619d0162206b90d2f2e316aa59b113638f3acdba9b6c18ede0c7e3fe514da187d5f5542261826f68ba7698c36264722c78270f919d5a7dbe15ff027dea
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+vT:A3kM8ljd
- TLSH T15E25B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 975KB
- SHA256 2c4ff77a051cf1f449443a5e47fcbc0088cd5a363feda2e2191f261440e7dc53
- MD5 0254007c3ca6f5865f0df07129fa28e8
- SHA1 0101c9736d55bb66662022de62a2b8da869e2a0f
- SHA512 78add18acbb1934a44c4d48525309b33a82e10d2509694f7ee9e1c35e602fc543fb0ba252505c1424cde18c397ce4185a7e4ba76cf9e86e814e21a938fd05478
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+pu:A3kM8lji
- TLSH T16625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 975KB
- SHA256 5e61aa34d0b308ebbcd25a18e8b029e485928f65b6003d858e8b27bc76f96d67
- MD5 952767f691131f86bf7e8323d4f18f71
- SHA1 291cb0708c54ca5048228e2c4cf1a9f048931ef1
- SHA512 bdd9c22a9276bf78986bf40e09784cd7a94af08b1b321d61bd4fbc66f4b43f76db123cd90bfba7226ea305db299c751473fca2712ca755e43224d3bd96590713
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+hb:A3kM8ljT
- TLSH T1D625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 975KB
- SHA256 b24048dec32d40240ff4fe3a89c8fa9184d8d6514ba81b22960674b47029f041
- MD5 cffc4b69a6f2a2cf06ce3ed1c4840298
- SHA1 dbbb8ea680818bcb25307adca1eb80d2fe971480
- SHA512 773bdbe7b55b24104301449b2c97d20f5a20c0e0c9197bf204a5535b292d1ea5e5e001e2f653cc1def576b332bebd257853cc70260066259d56ee446d0bb845a
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+pf:A3kM8ljL
- TLSH T1F325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 975KB
- SHA256 49dc94a15897523a3372f254d70d04e329e38f10beaf11aa17ed3f4f820bb5e3
- MD5 1570185cf898a41d72debf59a603f0d1
- SHA1 e47067e6994c5d05b103ab80874595b6a2f88661
- SHA512 0da1048a1099aa9f2d1289d3d40a6d872dc44cd7f56d5c2682db2581bc0dec70a8f0c5bf907331e0da2ee37be70b69b1a27c5a2ccd6f853b1f50c972d7fa7b82
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+SK:A3kM8lj7
- TLSH T17325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 975KB
- SHA256 603f7b3b1465d8fb3f161e6c8fae5f21bd1bdbda91d0b31d70c6b78672f7f263
- MD5 71b47edc0479de6fe4f8ef3a559b1056
- SHA1 15ac1c034bdbffb4e5f7713aa5a3d2409184a34d
- SHA512 7f2de2983101db7224dace416619dac7b04804c56a570df5a00ae372a16e3adacbf01bf6e2b89ad92835bf383dbc7729266b0eb4c5be1eaea8fa88a0e98aa299
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+3k:A3kM8lj2
- TLSH T19125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 975KB
- SHA256 266a678c5f10be5110ebbe541f0c7ecc9e3257f42c58cd3af36ac309084f5e26
- MD5 09983c0502acf70003c83ba9711cc6ff
- SHA1 8aec4d59330bcc2856977d8749c70b2b6a205737
- SHA512 895329bc25e02f63d98c0a1243bff383afc61d5447945444ff015733ab88f95248bc96b562058710784bc1c7feac8747a084ec70358361de601a304ab3095007
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+A0:A3kM8ljL
- TLSH T1AE25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 975KB
- SHA256 ff318ecd3ede9c6e0ada7476dfd75c61429b828a22c07747de3fcf49a4e6902a
- MD5 0a9db73dbff04d4a3d26a94815e4da7b
- SHA1 0c89bc80e55f10942bdf1627cfaad5b01e8025ac
- SHA512 58d73fc795c30e31be96601d543d9edd358bcb2e41e1aae5fb876f29447426c3c5661916330cbbd38cbc8a28d4328e124b7e05ec810a49aab73e631e7d8144fd
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+bg:A3kM8lj+
- TLSH T15625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 975KB
- SHA256 1c5be2c6ad1a18c41d1b63324fd673d79c6149ff9e818884679125bbf4c33e6a
- MD5 f255d99edbd1d90a62756aabb0a30ab4
- SHA1 b67fbef69409c16ae6a583a4606cc2f4d33aedeb
- SHA512 ba9ba0d941313c4ec926fe137c43944ab60fbb992678d3af9183a9e12e61f56ab0b75ec3351be836aa3f196e28cbd2c44ae6fbd38bba6b035c9bd35b845a7a70
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Wr:A3kM8ljA
- TLSH T1E025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 975KB
- SHA256 ab7c43a56d9b9156edc3101676ab120da98e97b03c355413b7eeaffd54a2b6c1
- MD5 8aefe03e2f6ab0bd31dec2a80659cf39
- SHA1 2a86a9093f5a7922b52f293426e5cd97e194668c
- SHA512 d47557a57695a4d547745f396ebcf500461165d2968f5ebc732ef94b0d300324a27551550895ba70ea5ed5b3ccdf44776d83fe2a50d7f5e1d154c507853df8e9
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+8n:A3kM8ljS
- TLSH T12C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 975KB
- SHA256 8e9f11af1e7256a3c4ea18e32c872cd79f427ca864fa0411fd83e6630c33959c
- MD5 fb294422c2e10bc6d7e048318b093557
- SHA1 c061255ed9ee7a6531cca2ff88a1f1279307085e
- SHA512 060e341df23cfa095cca61cc9ab83b8af9dc36fbc6e73c4cd21be85f7637e9d70840b8301f6ff6710f1660e5e2fc079b91d2b354ceb83d539923994baa7ae2a8
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+6x:A3kM8ljg
- TLSH T17D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 975KB
- SHA256 09ead18f1e1badcebf670792e13523a048d01289d3e8d002fe4dba860440acc1
- MD5 684bfca2d739a93d12e7dab46e53db59
- SHA1 6a3448f24fcee22dbf0012bb6c81f0bbddb437db
- SHA512 1e0f14aab4e6356fbeed2fcf16f580bbe955baa3689abfcbbd8541e5d0dbeb5b20b8ca8969d5707fd2351f1ba634684bbbfbc5f8b9fc91d876688c9678c79614
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+8A:A3kM8ljD
- TLSH T1D925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 975KB
- SHA256 d8cc9aa4fe43aa364e21b6b05dee10b174eba44ea25a4865a9bcefd946f20fa8
- MD5 b6f33f822e070622c8af64e816b6f79f
- SHA1 e92d98da4c50ecb6fa910c9af1b730af7a0a9279
- SHA512 804209405b92d0a585d29d054d6b455c1157602ff812df276d72743f2829fe7829346b6ab223f6c18e46037d3c9d06ca4a386c8e24ba647a11f555335f8ea4df
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+l9Q:A3kM8ljO
- TLSH T10F25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 975KB
- SHA256 e11110bea58e5002c2711f598704cf59c83fee3444bd82c7e869c2b570d5c18c
- MD5 ba381959a6f65ab60ebc50645b0b9cb3
- SHA1 cb2d1f41f91918cbb23a55cd099c7c7debb3d5bc
- SHA512 53abeab87e5312706050d8aa1291de5c24acbb0bbea4f9ae91ac34eeebe662745ea4270e5188104b969bc6c8ac1ccaf2b3955efdd9ea13ca1a51bfcf22683723
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Q4:A3kM8ljt
- TLSH T12225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 975KB
- SHA256 113d1a734f421534ccd7bc7781b3d5e7c4b7e64656c946d43656f7fbe4d2bf3f
- MD5 3a88bfe514e7846ab4b6c0c1f66cec82
- SHA1 e58ee00d3b6799c575713b8354bc3c71bcd61e68
- SHA512 92118438d90052908a11f2ff50a782999fb6fe1a36ee1e0aeb79c42c77334bd5d8912728a4de3dc1fc758914511eff169cc538a107eb0890145076d425ff150e
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Tu:A3kM8ljI
- TLSH T1EC25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 975KB
- SHA256 727590344b6b9e08fddb5e2abe50d1c297d0c0135303df40060d3528b2eb6681
- MD5 eeafc1eb7976c3de423e642617a7ac62
- SHA1 02c825fa24679f90c82978200523129928c4acb9
- SHA512 46db371753fdeac84ae8dc8cb7358ff64ceaff012cc6560e3724ace09a203f2747067c7b4cb46b3f6e722e7549243975b91dd26c2faced14c5e1f7a933286bdf
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Oj:A3kM8ljC
- TLSH T18725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 975KB
- SHA256 7f2e693a1ffae5bf3b91e873f70bc27ef211ffff7a1984b9296ef4bc1e600bdc
- MD5 4bea62786fa6bbab56412a71f3f0fa8d
- SHA1 c31ade044bf398f3313df43891d8a2c82b342a8a
- SHA512 dc6b2b99f4aed60e0640dbb45582e465b6082600234a3861ecfb125b83ffdec7dfdf7b266642ce6b763f61c86807e1840324f21b906b8913767b1f6a7403e73b
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+7g:A3kM8ljG
- TLSH T1D625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 975KB
- SHA256 5e2da7523915dde540fef14dad9c9ce5ebe290c85362cfdc5ed8c680f0b1b49a
- MD5 7adcd91c9817813432078ed884d8b8a4
- SHA1 d736d5880b77fa656932bfadc51b3e0c0dee554c
- SHA512 5bdbfc12d74a243c6783b2c77ad4aa35c50274938b4c15274810c233bcd3b42bc9b686f97c5346806228a8f0805bd72c4241b74942ee2c96c5495aa70af2ccfc
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+mI:A3kM8ljP
- TLSH T19E25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 975KB
- SHA256 3b61ba1112e4aafb111b9225f10b699ffcfaab21ab7be2c513aec6baa5fc8939
- MD5 9e3afb21922ed1975b4104db0c6b0dd7
- SHA1 80d073d7a0ee22bb8eb4408c960e1f010b8cb4f4
- SHA512 4b9e85ddea2f2481a5248bb5363682f7c66bdff2ad9cd0beeb5b5dd757159f2f171ad21f2a24d800f88ca5cc62e40b06f7511eb2bf939af081faf748cd77fc20
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Uo:A3kM8lj5
- TLSH T1A625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 975KB
- SHA256 5b7b2e80e6bb342537a241345bdd547d31174525b11ff5e7b03b9e5da8495a12
- MD5 cf51e80bcbfb723e86bf601b23c52755
- SHA1 fb74759c2a6066843882a019ea063223fb6de76a
- SHA512 1a6a91cc86b221cbde6263618398ece39f187f543a73f026ce9b1ac6570055d9328fa590c9d9a0c2142defd6b43ebe2a2a24d796e02fb19aa976ab8222f16d7c
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+3+:A3kM8lj8
- TLSH T10D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 975KB
- SHA256 9f67f2cb18fe614bff014e750c0232f009796026d54f9e3ba766ecc105a6ccc3
- MD5 d2e82d611918b66e368a705b0b38db88
- SHA1 2271165dae14a8959f3e19626e2714795b1d2b46
- SHA512 232f508aef54d75f29794faaa2eec36849427c9d454020ee5fedd7f851cdd66b16fa90adcb46fa9bef95dba2c69861fdc23a994da223dfb4f397dd80a7acdbc5
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+NQ:A3kM8ljU
- TLSH T18B25B023EBB090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 975KB
- SHA256 213e758fe5e7cedf2667fa7769ce8626cfeb1339e3b46db4e6f4df154060f866
- MD5 8ebe4cea77179cd27a907b6db15728ff
- SHA1 15a57a483ecc77fedcbfdb7655b5df5033ded99c
- SHA512 4b3220a051990dab0a76e18a38562a5ebced1e39392246db45da8c872a6bad98fd10fda1e7ee6ee77db7219f1bebbebc2f3b14c3cbf4b3507a5899bfe435686d
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+CX:A3kM8ljU
- TLSH T12625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 975KB
- SHA256 217111bdfa7fc5f758ec3ade2fcf0d5036ac5f952c00ab7fb0d16f6cb696112d
- MD5 cdb19da5247017305ad29f46a4e8ba97
- SHA1 e1fcde5de5dbd06a206cc1302f244deff31b8eae
- SHA512 a480687179852cd6074f147a1e243f29d72a8b49047f7c845aa129b9b1094975f59846b963655f6cde36249616db05e1be4b5bd0a1e04c1d6d26743e1de0acb4
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+kL:A3kM8lju
- TLSH T1A125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 975KB
- SHA256 219c7e0587cb96f670570dc810bf9817496c2c4b21e4d475e664c14cf7e90b1b
- MD5 e578558501ae92d6ad070b0a1716ddf0
- SHA1 f5471cd47a72c9f772f2347dc64d7f73fd212223
- SHA512 d6dad8a34ebfa837e7c97679550917ad8f37d8b0b4b6e7532a28b01d034534924fc12ee5d2a3f8db6e57944190738e59a5a324f98ddfa851af6e1681c0f504ae
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+AM:A3kM8ljb
- TLSH T1B325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 975KB
- SHA256 2122a8c57ed455bbca5062c6f67501060599ea14bb63b55baa6b99d6ddd9cee7
- MD5 8d8a4df5f58db5b897ed736af2794a78
- SHA1 8c706cdd879b8714634c5da33a399859353ac4b0
- SHA512 95df8e8dd4f40838e983c0f5b4ac5bb7ec99178862d2aa83b44c816071065f219fa8f5bfcbd5a75778c651ea8e5c09e36aa71793be0e76571bd3b53d6022fee6
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+hh:A3kM8ljV
- TLSH T10525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
- Size 1.0MB
- SHA256 d3b089553ee814d275abdf790e27e1507d29283d3a0cda4827006e4e32937161
- MD5 7dda99ec09720080ec13be32a21da4c1
- SHA1 6ef4b7aaf712eb462ac4a32160cdf781ec85d431
- SHA512 eb82a4be9c02ec30339ca8573f0a0abb71e757b3ad33fdf38ebcd20cae7417eeb5435596b5784d108b1c4774e66f8365c3cee0739e8f07ab0c99dfdaa5580f79
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaB2f+Tx5:A3kM8lj9x5
- TLSH T17D35B023EBB49075D27B09705A758712E639BC210B605ACFF3AC96591F313C0AF3A766
- MD5 SHA1 SHA512 SSDEEP TLSH