88e358ceaf12ab2d590a0cd4d7daca0dc9f4ee1982caa02d053435a92df67394

Analysis

max time kernel
120s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 952KB
Sample260808-n26dpawdpb
SHA256 88e358ceaf12ab2d590a0cd4d7daca0dc9f4ee1982caa02d053435a92df67394
MD5 3f6e16ba4ede8985849117fe0d39ddf0
SHA1 aa527c1ab32599eb4b7d39027b30656284713482
SHA512 cab3cd4853445bca9ca4c354fa1da1e008a1b900f3fb635a21b884bfe28123102513044696188ca1509923a51fc0ce2e891f804eab0929093e47c57a1ab0c5a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa813F:A3mnXoZjzyaEFoHaewsAjYaEpHa813F
TLSH
T12825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4296-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4296-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4172-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-643.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-938.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-957.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1012.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1156.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1189.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1349.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-475.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-500.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-580.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-618.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-643.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-747.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-912.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-925.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-938.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-957.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1012.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1055.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1080.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1099.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1136.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1156.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1189.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1220.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1323.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1336.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1349.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1388.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1390.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4172	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4296	2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
4172	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3f6e16ba4ede8985849117fe0d39ddf0_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4296

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 952KB
SHA256 88e358ceaf12ab2d590a0cd4d7daca0dc9f4ee1982caa02d053435a92df67394
MD5 3f6e16ba4ede8985849117fe0d39ddf0
SHA1 aa527c1ab32599eb4b7d39027b30656284713482
SHA512 cab3cd4853445bca9ca4c354fa1da1e008a1b900f3fb635a21b884bfe28123102513044696188ca1509923a51fc0ce2e891f804eab0929093e47c57a1ab0c5a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHa813F:A3mnXoZjzyaEFoHaewsAjYaEpHa813F
TLSH
T12825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 0061cc252cbe4f9fd9e894f2b1d5946f9bf83485ca3f687a70c40283cc54d059
MD5 a2f9a7cae5fdee0b7cc301943e7bff89
SHA1 f02b2c4fc904aa3abf06c784d1841fb5a2038fe0
SHA512 40c8e9ae7798bfdf2f454dd30787b317767c9904224a53b81c506e15ed5eb1dd0f69106ee2cb53db42aab965ecdfedcf22f96360da9c564cbf6196b7a5e3286c
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FP0Le5ji0hmxNrM:A3kM8ljiPji0Aj
TLSH
T1CF658D22FA748275D077C475CAE2975AEA7138510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 601558464a0d2e941df2cb6b4fe90258fc3cf0550f86cfb7ed27ee060d5d4d0c
MD5 1a64227228c9bfedf6a68646fcd96393
SHA1 a84ab772d04dd37d03935bfbb5217f6f27bd3037
SHA512 5aa2327f31f30b0fd6d19be1b84904576f4be5e9ae5c24dc655f0dd72f152904414f45bdfac3618d9654e241057cef3643fcb23c05c042dc5d595e712fa7345c
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FRa:A3kM8lj
TLSH
T1D425B023EB7090B5D27B45705BB58713E7397C210B605ACBE3A88A591F317C0AF3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 975KB
SHA256 102e4f9eaebfd9c88dfa1a471cc9b57ec95c0985d517e8ceee1f6b661d40712c
MD5 99cd5a6e9e0d75d057d109efac510de9
SHA1 d0415239fa2937b998437706003e50950a3597b4
SHA512 cce28b7208c0bed064a7ea43ab2f9d998f1a1d3da65c8fba2325fccdc08e5a4838ccc01b22e2ebb4dac305814c89db3807988bbf234e9f3acd9c80f8139c1cce
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fo6:A3kM8ljM
TLSH
T18625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 975KB
SHA256 724d796bd33730674f5d2afae6e727bd2fd948f78407ff41130304ed49432303
MD5 07e76a401dffcc52411cf8957bce863a
SHA1 a5ef75aee9737fa6f1a5c4de1ef296f02579a378
SHA512 6dce8b85f735877fdf11b8431b20511c31f51daeeb5a5f5191709e2ea2bb203cbe68d64ecbffb5d5136b6095eabe86a74461abd92733305ffefcf24a7e5c592c
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FsN:A3kM8ljx
TLSH
T1B025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 975KB
SHA256 082c408a915fc9b042fce3a77f2e88054d1708713c448fcb313bf220f21bdc32
MD5 72a5767a893920922eafe12ae2aa6712
SHA1 428c94aa60a3e4e129e208735236db530054676d
SHA512 0219ef864106cb4773b7e51e7cf528b7d29027e767e3743c7344e98a2b16893f6b0da458e312988c11f088fab3f7de5737dd50a8b9cb7bc9308653c2dc569c1c
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fif:A3kM8ljx
TLSH
T1C425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 975KB
SHA256 098dcaf0a7c267ca96b09b65c0843f95a052fc4206146c089eb40f3870310006
MD5 bdafa68bfa7c21a903cd635bd52ccae8
SHA1 cba84a1e34ee3e3ffe609b71408f02e6d1c0201e
SHA512 dcf47a80d9e918d0fc7ec00ff85200a9c8899fa1fb716c7522ab071312f72015b4012a83f8e0032bd5f1ea73905fc3e9f7d610b1223b9d7429a841fd94b57bc7
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813F8o:A3kM8ljE
TLSH
T13325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 975KB
SHA256 29d7a74e5c1b658888fde979698df77946bb72c2a8d1dd9bca1d689ecc7d9b88
MD5 fb78b06f47399e278c88c14f654c42db
SHA1 c48c7bd11312de4177f6a31dedfddd71ce31390d
SHA512 8a0e3e98724d023f2a66a9c31f5d68ac6ba81ec67e5d8b85c94a8f9c9c2feb9d58d7f256ed8e30ab3066895b1e4d9ee16eb6ba2b38473dcf744322bbe81006c1
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fcu:A3kM8lj2
TLSH
T15725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 975KB
SHA256 a814afb4e501a384025ed0b0cc881ca7d173510de3317a5e2e041d605b237776
MD5 cb6c457abf9799dffc33ce4e28f8e9c5
SHA1 a413e1d158a59d268059ea1c97f53b071aa815a9
SHA512 e86da533f745765655974790a72f7be22cb5d14e35d3b3c341f54c03d632a2c5bdfe1167020f256a0355c6ab698d6a46a20240501e647d16d408fba379795b32
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fg9:A3kM8ljX
TLSH
T11F25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 975KB
SHA256 172a22f7ac92413b2a7e765aeb9bc30a83b5bac91d98f6ba48842b2f908d141e
MD5 df2849f9dc4071eaaeec2a236326f582
SHA1 a9a8c03eb2acdad97e8e2bf84315e11091b67f3d
SHA512 0ed2124431148d8801c0b02ffaef58daf76641ee6df38c320f8de5d24763d199312573549a63d789f53af3f65bac790ed119747bee3fe0a8b08e25045a997982
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Foc:A3kM8ljm
TLSH
T17225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 975KB
SHA256 17c0b9b862b476ab26b46d92c3c7d4cfe9bf64af52b956eea029f2d64ef62739
MD5 d95d47d6ad0ac219dedd78940c01c93a
SHA1 b8f1d9f986d37c2c2bfd5e61e5b1889d1198ce44
SHA512 dcf2f3b86cd69a99cbdbd1b5877cf29505f670a3b2c20f54b19cd178fbc4de51a8a8b696528a7a178bb974d4a194cbf6865b40182ce147dfabfd05e69ca1e52a
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FBp:A3kM8lj0
TLSH
T1D525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 975KB
SHA256 01b3e0b4c023e817398fdbc8876ed9826ec5a08ad4681905aea4a06af31aa8fc
MD5 25061b79adad59ca076a21208ac01785
SHA1 39f30b576d37ebd02cf42a4cd4c0abfd7c27b66a
SHA512 43aadcaa583eff0bbccc0ed0bdeded4bb15313f9c73d6acb8e428dee8a3532a8f5697a6c4e1e3e3427b49d2ab2af471ee4fd61925f688e44cd0ef9760940ddf1
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FWN:A3kM8ljD
TLSH
T1A825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 975KB
SHA256 72e247f38fc581c0bda8d787b29f74ba20e9dc1ddc14419fe41d9da73f56759d
MD5 6952d97e3ac1ddefa21a59fe7b8f9195
SHA1 78fb4673a04af9fe91f1b1b698bc343e36c1ef37
SHA512 8e27be8c9d9fd2799d101e7f410b050e4d77e3da7fadb47352865695ee527ef7229499682f5a25a37337f9ca4b3616e93b6f1436441cf6de6cef6edd478ae81c
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FaF:A3kM8ljV
TLSH
T16625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 975KB
SHA256 dd4dd88892fd8a50cfd47da665d0f0612f8802a60f5876a8eda637037433b812
MD5 2a4372eeaa81c006cdfd1ad2299598a3
SHA1 80cd937b25ecfa0803a54a50708923569014d687
SHA512 95d8c96fc576e8b36ce5003c39382b86c2cc61fe248c707b820966b5684a0c01f3e00bcc2bcd4cbbb153c9fafcff99d9be343ae82623537226fc0efb51eda74f
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FvC:A3kM8lj5
TLSH
T15F25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 975KB
SHA256 d2e9fba6985f5311d1c2d86799388d1ef338cd3a0cc4b462f7bfba854ea41bb7
MD5 a7cf3648ff9181ec91d1a8837062f6cd
SHA1 4acb4a99f7cce838c62f20c09e4704b5841cc186
SHA512 adbed07d9cd0657b03a3cd8dd59f1fe57f10daca26cea5b0404353d7e699be9db6780d193e7afc800c5ca9b3aaa7ee8ed567c94325a891f2e63245b80f4d33cd
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FQw:A3kM8ljk
TLSH
T14325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 975KB
SHA256 17974168685af849ceec5e8eb347521e342af9400c544fce221ddad222d55a11
MD5 594639a3678ef53d37d98895a1efcbaf
SHA1 d0416a596042635402a458f75250d44d00a61c59
SHA512 4011dcf71bc56ff9d1aedf98566eae98088ecf930ed5f753db403a7dad65ce243d4b86370cdefd7d042677fa6ca23c6dc2ac48028dc1335ee95726fac06f9d84
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FvT:A3kM8ljM
TLSH
T14725B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 975KB
SHA256 19bfc68fad8b108d797e696482088aacc7ec811a812340a5be98128bef14f0e8
MD5 27e7f1486151b6b7c38249cd8e84b30a
SHA1 b7458d5226eb18aef1c59170643f2582edf6c67e
SHA512 b3bcf5668547cdade9d35ecac028a3b7250f12c5b99706edbd874191c3b9c7f649a69610f3c6a457b50e19f359b4de1df4f1a74f7da4d9e1bd48e9ee35e2434b
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fpu:A3kM8ljr
TLSH
T1D025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 975KB
SHA256 dd1538c6550da1f7c6903e3daa837dc225a395166efea822f4abc16fc8462b64
MD5 91a7be7266c2a55fec685542ffcd3f9a
SHA1 3f1395c366bb41d6fc1f260e98ad21780347ee25
SHA512 88726da0071571fe41575a354b9b0ac77f62b08b71db4cfa7d1619cf696c9635c348fe0c6b19e03aa1150d93a7199d79acdd164b7e6dfad436411d202c436616
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fhb:A3kM8ljC
TLSH
T10525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 975KB
SHA256 4675268cf2328607b41f7201385a7865f59114823c596c5743b557df8157ff78
MD5 68ffbd51ed3233ab36f9fe37cde6ad5f
SHA1 41cf416a1f7807fcb5ac8d44b96afde65da5dc38
SHA512 52b1686eb75fc637284ba673133211d5d8491e3d1fc35cb162d2bd927fd0ddbcf9d419491b4eb819d40bbdd6011b70a538421b9408bd36d6c9ebdab6b79b906f
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fpf:A3kM8lji
TLSH
T17025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 975KB
SHA256 342e4ac53e85de70abd8e53bdf82fb039ee31e5410ac371fed17b3c7a7c97bd5
MD5 1d96627d77251d50c0c24fe18482bc28
SHA1 85b3e6f032a39d58915509524773451435da39ce
SHA512 96d78b20ad3dc0a86c6aafd084592acd6bd92c61489ba21bf1478723f4cb6b8c388418e3270bd1a708363b9ccfd33cfd2701889563302fd06ca2987ea11b6436
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FSK:A3kM8ljC
TLSH
T13625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 975KB
SHA256 7063a2fe93e3dacbaf41e8ccf1b51e2c1e397305f62d05dacafecec6fd0875d1
MD5 af80a46a4ab743770b855620a57d979f
SHA1 019bf15e5e020c8abe46de2bc2a765c0a6990ed1
SHA512 ccb6ea4a4d67dc903546c08e2e4f7f2553b8d26b237df9e8241ab6afa37c3b61a0c485408dfee460caf3922feedbc2bcba1d9c99e613aeda2a21b4060868c293
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813F3k:A3kM8ljX
TLSH
T17125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 975KB
SHA256 bc07afc3db1061fa6bb3ad3ce43e7748207f800d3428ca2cf87483bcc2a6149d
MD5 33f7b387021ecf0f9e04cb46ca80640f
SHA1 60e2bcab5511176e4263372514a48a49432f6d4d
SHA512 700f2968fa2418b31af3482a87cbfdd14fa2110b0e32f85480487470601f56ae37c7536b5ed55dc3b0b7e2bd83dae5f5f47f25c85fd00c423372ee1aabeb223d
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FA0:A3kM8lj2
TLSH
T18A25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 975KB
SHA256 f451abc1ffb14499baf5c9bf7555dcc9d0f50bd79fc8b4b4796f8c505d9a7a73
MD5 8418717393f5dba459bf3c8f3909d3b4
SHA1 fc9f790e380a0321b6df41a0ad13cc5cdc12f512
SHA512 425160af3ab470b43bb6bad346034679d2cb795c3a8e1c15fc00ebbacd02d40e8df7bc6909867b35e990220929cb962807b1ccd3812cc6cadc636242f2346b4d
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fbg:A3kM8ljP
TLSH
T1B525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 975KB
SHA256 6c13d2ab439ea214202631c4e42ba6fb9daa85840e2bdc5f31936c45c372ce54
MD5 4ddaac657f8b78700555ae353caa2d77
SHA1 03d1949c071a1de00a55fc2c0e3a10efd0ae4275
SHA512 6d5630109f5376b59cbec31c08529af4d009e037580b49bb20de2667fe640d2e767902027629bfdb9da2c2de8a397b34c3d40002894ea12816646558e540d2de
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FWr:A3kM8ljp
TLSH
T14325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 975KB
SHA256 a28ead83dcee104082b649069f6534b8895a95612b6ca9d567f764042f1216fe
MD5 1d3a172cfbd7612f1434dd44af789dd2
SHA1 b3465b30968b8fc98d6194d704bd737c28870f35
SHA512 cb21bde36013636710ea8f4dd392fb10e9ba3273bebca5dfa5d72e32b62b87be07183f888ec84f80d0ea966d3b702276e62cf94943a215409729928f2c5dece5
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813F8n:A3kM8ljD
TLSH
T13825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 975KB
SHA256 3952ca4b5818d7efc3ef8c60f9a042e8d941dc301c6ace2264d7a02e447e1e1a
MD5 3c0bd6154f516c6666c23fb863b260fe
SHA1 ccd2346463ecf66b274486a698d5bfafd4ce2805
SHA512 568e50ad878957606b7a96be370165273ad332632b1c3ee7b674045b23cc277d6bac4bd60860cc92e6d81ea7de2aa7fab4136608cdcf7f94b8119a358786c612
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813F6x:A3kM8ljh
TLSH
T1C925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 975KB
SHA256 b0b33f6aecdcb0686ba3ae13efc6fb148b993a950c82df60e73e95afd9bb9209
MD5 8b7681d7af42f824ba016be5762a2685
SHA1 ff979240a2933fb86d9f6bfd9a93327709cdf1b5
SHA512 16f660a1fad5be33f3eabd6e4b179ad56284b1c889975a2e4062c1df2c19e9e4e1594a41a8911a85cb6b234de6a28fd78e4ecaaac34000b003947e24c8d25834
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813F8A:A3kM8ljO
TLSH
T1CD25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 975KB
SHA256 f2f8ab3a3cdb0ed485656aa7d5413bd762d8c4043844d985ce201db22a4e137f
MD5 a1d0cb5b089adcf4c478ce08666e7ef4
SHA1 8cfce72c1cc969f4e6d4855b42381e7c0fe90a35
SHA512 408537e6ca14b3b9828686a50e634cf69dfb67b4492caabe813085d95b6171ae84a359f40e4bce66d84404bbc05ce6603a307d138ae6342ed73e1f93f9774dcb
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fl9Q:A3kM8ljT
TLSH
T1C725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 975KB
SHA256 10ec87f79e33223b0c35ad06ec3fbe732613643ae5de816d1b33a36f1beb7ab2
MD5 314d0dc2d8799d429023eb2fb35e6e4f
SHA1 4fedd322bd309cf001860cd558e8b209ee3eaa73
SHA512 cec19accdddb317a25c28ab76278d1125509c951b64ea2aede678ce4a2dc7ed612e86dc4b29006cc036edb3b1fe0a386ad2dfdb309bddca6dae068afeb2d3e97
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FQ4:A3kM8ljU
TLSH
T14925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 975KB
SHA256 60b2ab65e4543e8bf8b8b4d2ac3959b79d8e0b0bc20d2fca88ef9ff159eaa943
MD5 e1031c5a8b7a4fa01c130444996f37a9
SHA1 90864179ebbd778b7dae189f393fe8adff57f7a4
SHA512 28322da4a3c21273dc368fe8adf272f4956b5da0260af5ffb66d61b7d9f30edc74b7dc474c4a337819a16af9c97d1c7f07d5fb0e453209e0afa53bcfd6abacf7
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FTu:A3kM8ljF
TLSH
T10025B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 975KB
SHA256 7b105e6c762fd040f251bfd39797f69a1dc5572f4c3e808f8b1ab13041b228b8
MD5 c4c531d2b9c78f1f132546763fd64a73
SHA1 f761a934eeb5b61ec86933911b6a0099dc39886c
SHA512 87a4750dcab814c321d563dcb68c524ca254f42e2ee2dd46187981116cb9f6a42f65d633a3f072ce9d090d99468119192d15664d26041b3f8bd3ae6bf9f7030e
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FOj:A3kM8ljH
TLSH
T1D625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 3e710e60ef4e33c90a6d5ab24e4d419d91e15aeaff3d90e6bab15d83640637dc
MD5 e97ce4b6ee1d573e067096837d27320b
SHA1 7987f6d74575619e07648726a44cf99c564072b3
SHA512 c920f210f4fc178c6f2157b9b25e212ac9056045ecaacda89e9a8b8f00d657d0c01ff9ed5f537597789aec5e907e874b806f40ff0bfbd4b535ffd4ca1453a275
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813F7g:A3kM8ljv
TLSH
T1ED25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 8165f685b009c48d4ca2f5ac91045cbaf54fa8e08261737bb71a63bbad375c7a
MD5 cc0b6a393edeb53531e7fe8a3ff7f1c6
SHA1 b7397be6a78a2472dcc4f28d6015e09a496720da
SHA512 62cddb8dfac59069dc2e4890faa03fec00fb8a56a891e11dd315cc3adf81e7883ddba0e91c2c6002f7bdfd3c06b42cb01eead9428215c50315ef79333a90ccdb
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FmI:A3kM8lj+
TLSH
T1C125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 316b7ef11bf3c5bb4caf83e6d8c4251819c9b029e9f5fe204934e35000082b06
MD5 853d578460783d1b2e3f403e0082e34a
SHA1 9d6832a42217eda2c4cf23ad9eb0f082ac8c9dec
SHA512 b33d235ab085ee1a013e32db41705dd6cda3d12c43c9ff9bb22de281fda52decadb4cab1b874f0c039875045de55c5de9a4b49914a9eaaa6954cef8c5f93192d
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FUo:A3kM8lj8
TLSH
T17625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 925d7388085d2b3de0a211bc5add0c98ee48620c771676037625fb5724eccc19
MD5 aae053b427942546937ed9c2f1b8dfe9
SHA1 72d1ec2291725c47badd66fb9dfe5c8c5a17f39c
SHA512 e870f5458600ad3321b998a82eb6f1912518f32bb08d970be2e3bcc51c25628f04523080706844b1a9c6fe16984a0ea4aae31a5f64fd4bee0b14d49139006115
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813F3+:A3kM8ljx
TLSH
T19E25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 66cb598125f6dc632c356d86a898fd331cae3d2252edee94c0a356aa444df7c0
MD5 75b3bbdfd4b9afcaf15557baf11a7954
SHA1 46263ae09f8be3d1b4ca03cb9d13d63a42a599bd
SHA512 c3e876f23191f9ed61daeb2851dac6909120a5eec23a0a54df4dea4ea295fd086e5082b23f51e97b0f479c8fecd43a606b8994ce1854f6b3d408b6f79821fe0c
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FNQ:A3kM8ljx
TLSH
T1D525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 a1172cc1ec2b358fa1484cd04619dc8a611e8e6b735391b8ab76dd0dfefe29f6
MD5 468220d8df998d06fd8c255da85cdb4b
SHA1 8bbabd00960f883781f34c933a2c6792b75e4b57
SHA512 02990e060e9907459eb8098a0c7cb56cd7bee7e9874675b7c78f4d1c8f18aa747569304e8dcd1a47829ab5367f1bb536c20ba742c9b539dcccc5508b0cc3718a
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FCX:A3kM8lj9
TLSH
T17725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 f5c850faad15a83828396d74ce935c1d030c554ae6f2ef518b7d000593c905fb
MD5 7a926570772904bdf100458caa14ef63
SHA1 abc94d00e2df844d7bbbeca8f7e8d78f9ba6d291
SHA512 41a340f0018d032a60a21f8575bb00ef604ebb58d68e5ea4192f2e9c9491075d07aa68ba9bffdce19fe4e6b87af612b432c0fe4487f8b0b2a01a5f85149f70b0
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FkL:A3kM8lj/
TLSH
T1E825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 293303fafa09f312106c884cfaa679c17fda2f35b56f34f58ebc141e0b8ac2b6
MD5 f6d246f7d48b136aaefc38f94d490076
SHA1 528ac67e599e9b9d0e2625490e66f7e54dde8697
SHA512 625acc4ae3ede28a0c04797d5251429d148a5c84c6804748edf72cee56298ec149afeb44e969bcc9e1ad75769bb5fdf620f8dcb3c6ce63c1812066e5662f8b75
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813FAM:A3kM8ljK
TLSH
T1F125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 abb4535f5abad2e820537bb5c0863bb3064ab86de0a8cf3ef39d3839f5605aaf
MD5 2edfd326d4c5012da2e274bee4330968
SHA1 efcf149636368b51b828b6eed4d2dbf55f6557bc
SHA512 7b859f9cc258ec6748870e422112d8d82bcb9c4d71bd31b4753f9e7094e9fe650962a05d71937aacb467c3afd3a23dddc26c6abbb60446456169a6a7d55c8ba4
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813Fhh:A3kM8ljE
TLSH
T1DF25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4172-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4296-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4296-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads