Analysis
- max time kernel
102s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 19:34
Behavioral task
behavioral1
Sample
2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 928KB
- Sample260809-x92vxavare
- SHA256 8ca87dfdfed00626bf528a661ff1316de6d83f7c2f4a26e8e1dc57ace4942c50
- MD5 b73ffc53e6b2df3a76f3354a6c3f6e31
- SHA1 dcb58e4af6e408e38e53d88a1298db9c7de884b0
- SHA512 300eaea126ecd9def4d08e891e1f2988f72e3acd0e8138ae638d3e8485fe66905bbbd5631b1e90ae72918ce908af7247ee7af9fbc56638affdfa40701ba72f8b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaE:A3mnXoZjzyaEFoHaewsAjYaEg6FbaE
- TLSH T19715B023EB7090B5D27B49705B758713E7397C210B605ACBE3A88A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 32 IoCs
resource yara_rule behavioral2/memory/4364-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c551-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2fe-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4396-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4364-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bacb-318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e4-470.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-593.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-715.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-884.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-923.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-997.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1040.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1077.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1127.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1216.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1319.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0025000000011a83-1542.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f0000000066a5-1899.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c551-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2fe-39.dat aspack_v212_v242 behavioral2/files/0x000400000001bacb-318.dat aspack_v212_v242 behavioral2/files/0x00040000000198e4-470.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-496.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-593.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-624.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-715.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-820.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-864.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-884.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-923.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-948.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-997.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1040.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1077.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1127.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1147.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1172.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1216.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1319.dat aspack_v212_v242 behavioral2/files/0x0025000000011a83-1542.dat aspack_v212_v242 behavioral2/files/0x000f0000000066a5-1899.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4396 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECFE93F7-0E0D-49A5-A40C-A888E035F269}\MicrosoftEdge_X64_139.0.3405.125.exe$ 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe - Drops file in Windows directory 63 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4364 2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 4396 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b73ffc53e6b2df3a76f3354a6c3f6e31_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4364
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 928KB
- SHA256 8ca87dfdfed00626bf528a661ff1316de6d83f7c2f4a26e8e1dc57ace4942c50
- MD5 b73ffc53e6b2df3a76f3354a6c3f6e31
- SHA1 dcb58e4af6e408e38e53d88a1298db9c7de884b0
- SHA512 300eaea126ecd9def4d08e891e1f2988f72e3acd0e8138ae638d3e8485fe66905bbbd5631b1e90ae72918ce908af7247ee7af9fbc56638affdfa40701ba72f8b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaE:A3mnXoZjzyaEFoHaewsAjYaEg6FbaE
- TLSH T19715B023EB7090B5D27B49705B758713E7397C210B605ACBE3A88A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe$
- Size 1.2MB
- SHA256 77ee254ec44eacd5d6123387384e353c99f9d3a58f8ab149336ad8164fdc695e
- MD5 164e84222f04009f5525d327f1495aba
- SHA1 a8dadd02ce1f9738d31afdc25022e30c0ed63b48
- SHA512 ea4ef5ccf1b317f7cd24a6c69f4495456081e3e1cb7b13d983e55c736383c0423a5a25dae7e383a2635046c4c105cae542460e673b41eba45388fe46aa33c442
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEwTWaLl3z0zDD:A3kM8ljtT1Llje
- TLSH T18545CF23FBB090F5D67B45344A658B12E6757C210B608ACF93B8565A1F333C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECFE93F7-0E0D-49A5-A40C-A888E035F269}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.0MB
- SHA256 7a018d4ed71f0d691643c9548b5f80e01751cc9de9a554187ff9dbac4b51ae61
- MD5 92d78839600bd28794b4eca217fa8fdd
- SHA1 a8e0505900b3b6d40aad28e4e532bbe8ceec5032
- SHA512 490b7e810e059c556e5e5fc2d19b9c83b443be99a780334604bc0d85a28cf72dbd77aa5a8d35eaba269dac1d997d47ce15f0bda848129a9f3f866847d1773b20
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6FbaElbBPzBAU:A3kM8lj8BPVAU
- TLSH T1D525B023FBB090B5D27B09705AB5C712E639BC210B505ACBE3A4965D1F317C0AF3AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 6cdcc6b011fadf1c94b2d015c60cd1a83e30e47fa6314467a786e582f2438efc
- MD5 2dfa932ddebb2670027e9b12b4970bae
- SHA1 277f8f455d7e4b82375e987c4ea31ea6e2fe60b5
- SHA512 19ced3e198bec7decf79d07ef880584ee59f607fd9991fe8074807a10da41f4c7da00e3eb890e9c09e9912bf9f15638489f590a47f88741f37a459751b3436a7
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEP0Le5ji0hmxNrM:A3kM8ljwPji0Aj
- TLSH T1A3657D22FA748275D077C475CAE2975AEA7138510B308ACB9394C76C2F277D19B3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 942KB
- SHA256 e5a42b68d4646c942a0aa7c47da8ddc4c8b7d941485a9a7e5af3a3b0d7be97d5
- MD5 dbbfbd5462a829eb0771f094864d2c2d
- SHA1 b06e2f3affbab482dfdfba07b89357fa3228d306
- SHA512 0f7760b5378bc8e8cdc6bce160681eb7a75ccff8c4ff3b7b89c283998a66416a95c23acf9efbe731e232a4c85867b9bc4cf5273743d421d4b461bcbf57ce3c57
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6FbaERa:A3kM8lj
- TLSH T16525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A5D1F317C0AB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 952KB
- SHA256 68c19368376b25a104885ec7e4459ee4f588cfcf92a48d1ca3f88571e64f64a5
- MD5 b52ac42bc9221cb339691b71d7f9eba6
- SHA1 e2c36e2e7a1b785573bf680c54615b51203de622
- SHA512 07efa9c990d251e709cf62659417ea923c4d4ea49c8181c91057ef1d180849fd9f65667216c84b79b71ada8ea7dbf3bf2add24f6d9ca21bfa28b05665e82d463
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEpu:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEpu
- TLSH T12925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 952KB
- SHA256 739a9f8b0140f41744a2adf61a6595c50af0df2f9156005cfef106dac8a85df7
- MD5 7313caa440bb93a79af8883263cdd5df
- SHA1 54a76653969cad5723a51c9551b38ebd2c0c9d95
- SHA512 5a5cac97983d63df2c72d333f0fed63d924c5762ea335d2286d85a9d17d6d2e09067e475e17c9ecf81fc643f4f6db3c2a31143d5a537a30f4942995077802545
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEhb:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEhb
- TLSH T16525B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 952KB
- SHA256 2da5c373e283e18eb6563bdbc458e5cea07ca1db82e4ca30230c06024b2eef43
- MD5 dd8e7d8d25b596e8d3ca25c4d9901c8b
- SHA1 24c78e6f2e5eee577c2811fae148c88f25922a6d
- SHA512 18e2c9a4e4ea60a3db96c1e4946f4bc0cc0c0318df2413906b98411203fb5c9ed90d66f5bef59ee214767e2966cbc1b96be22dcadada5ef08fc7ffe08cf0106c
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEpf:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEpf
- TLSH T1B825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 952KB
- SHA256 a36c09d0c10f6ff3007225601564b652334cff9b72efe49976fdf8f15668fe58
- MD5 f022d4df1b3c6fc8e115e0801fb784b8
- SHA1 71b1f08492ffbccefd937be72083a51c4a215820
- SHA512 76659635d96e60be70551d99c74e571a5537bc86e098388eea94f6069bd6486a17f90c79f85b6d96b47b86ba536f43987bb35d88d39d0194a11377d6fb4d9cd4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaESK:A3mnXoZjzyaEFoHaewsAjYaEg6FbaESK
- TLSH T11225B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 952KB
- SHA256 68db3184c19a7c5941a84438efd520cd334e4001d1bfdaf9f954db8a92b3991d
- MD5 aaedc9f20c6c9f64d260689e16c526f2
- SHA1 3c4ead1c3c1b760b4bf2324eebb5472c6ddf178f
- SHA512 c7b3e934a62c46f29326c620d408e18443f2f9ae5e6b1bfc8fcd5aaa16c45dd193e0eae1ddd3b8829dd510cdbac09d0d492ae3e60f837d7aec431cfcdd48ffe5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaE3k:A3mnXoZjzyaEFoHaewsAjYaEg6FbaE3k
- TLSH T1D625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 952KB
- SHA256 eb39b25a648088962a63cf77e103dd8a867dca7f83b906ae4f01680703672003
- MD5 a172024e8431e416f3b641fb5dd118df
- SHA1 bab55e54a0a25a4fc93badd5cc1e1fed5b234518
- SHA512 d5910dd21ead3ac4a7fabc96613d7893b0d820b61688248011b3785e9a78c5fbcff8268e89767ffeef4a1ba5c2c7ccb19adb98019b1ebc6a6b4d9ca5b40a0d73
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEA0:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEA0
- TLSH T13D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 952KB
- SHA256 4065b6ffd24f44d139502f658d64b52b206d32e3c957846b64c21f7dd78d5b8e
- MD5 d6e6bb010ba480d93dcdd56d0da2ba81
- SHA1 f59d62e4d61382498431ae2204678a771ca13abb
- SHA512 0ab27fa2637d7dc3d83d0ba753521da5097682cbbe5fea1ffa50d72b8021e497adea1fa713e6d9e31ec0dfd0bdef21515da14853cdaddd68d44663477e9a45dc
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEb70:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEbg
- TLSH T19B25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 952KB
- SHA256 fc04cb2e44822c96683f42de4361a2c3ca10ade44a4b3bad031c0127abf9d14d
- MD5 cfe68ab487c999149484fe020f45d11c
- SHA1 a191087e1ceb87ff114acefbdea292fd44f6d2a9
- SHA512 aa3caf0d9e34b6414166222570514dad1953e8f75aa75b712fbe7aa75d51ecaacbabedd789423ae0956aa9ab9a5cfd1ee75b53f4b3b6a45575040d18dc6783d6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEWr:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEWr
- TLSH T1EE25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 952KB
- SHA256 b234ea6b99b53bae5444e0172aa47ccc1d5e0ce455c28e8e8d310153daad9cbf
- MD5 73a9f1486a2e5d3419f021604c73d96d
- SHA1 7a5db92078457fdad7625e98d152feb1924dc8fe
- SHA512 d974b95a70d841c239eb394a9844692e12b52803d70900252707bc4301dfddc5400e723b6838bad1077ec59937775e75c766f629fb1425175af5841d72ca76ca
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaE8n:A3mnXoZjzyaEFoHaewsAjYaEg6FbaE8n
- TLSH T11425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 952KB
- SHA256 9a03a9849fd98874f3b515ab61d81f13dd8d85d9cd96b33cde8ad07c3a2f56ae
- MD5 3406a2a8ef546c90fa627f9df9942068
- SHA1 543f8ffe98d942c29fa13ea3c46d1859b41b8666
- SHA512 1a98a91504bf38b5abd80fbf8320b44d879057df70955e30f9b24d49b627916807a56aef53096af21e454ba12d924e783acebd38f93ae21749c9396b5eb9f60b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaE6x:A3mnXoZjzyaEFoHaewsAjYaEg6FbaE6x
- TLSH T19C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 952KB
- SHA256 2bcc2ac57889a88e2b3e70ffa596f3db5e56104099d79329f8339199f9559034
- MD5 fd0a02edb100978ef8f5c25be25bb939
- SHA1 770833eb1345bad419bce4e9473a3264ff2df17a
- SHA512 2b8b506899495b6eb4a9c39adaf50c3344bee115a9ea63939143f035c432b3f6289e3d91b61644f067b12ffd916cf2e0524f621296c456b259450d8a867a1196
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaE8A:A3mnXoZjzyaEFoHaewsAjYaEg6FbaE8A
- TLSH T16325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 952KB
- SHA256 10a3844014dda29ea784f16f9feba1c76338c5fe6f8226a7a1edf6c38e1176a1
- MD5 12bbdd1b3c23471b7ad015dda42066ea
- SHA1 9d7c62862f0add06f9fcdc3686112e8c6203356a
- SHA512 11399a2718125d3ded0b6b6a6282b7f48eca027aece07ecf8320a0fd5af561d9bc22677b82119e4022dcab0acb50cc4df9bb60a93daa068b05c9092334d61f1b
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEl9Q:A3kM8ljl
- TLSH T19425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 952KB
- SHA256 ee085c875ccb02474507efeb45762b9b6b514b080c921a100462e587e54f4043
- MD5 51f0965374e788496f670f2910f27fa7
- SHA1 86d2aad11a38984c8b6a4a83568fc7bc01aff40e
- SHA512 afd4abe8f66f824f74d5498fa979ad717c160d765be92bfaeec40e58d3464932b406b2cfc9a778e41d26a5616dd2ce60b36b869f48408475381dea6e69c487e9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEQ4:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEQ4
- TLSH T1C125B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 952KB
- SHA256 154d8525806b0a6c177f5ec4a2d98cd11040af4b2269ffa5ddef6037e972ef9c
- MD5 2bca7de0a0cd4cdf0bc09f376d4b49e2
- SHA1 31e9778d26ada906ab793ebec104df924a4247d0
- SHA512 1a2115adad422544202cd8d4644514719eef7f47979d1a30478ecef13bba552b444313ba194af9d60b422061a3bd985b6fc3a79e88a5409c298fecaaa3626445
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaETu:A3mnXoZjzyaEFoHaewsAjYaEg6FbaETu
- TLSH T10725B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 952KB
- SHA256 ce29f0de8bfc94e45d1359e5acdabc127d94aff9ff485f773111cffb44a09bda
- MD5 ada093a6b1cb68e3f72444565a211304
- SHA1 fcc9528031835006269e24f165a6573c72fd416c
- SHA512 dbc4d754453f254903c13965c9f518add43a5d89a8d7d1039029e2ea8cb16f86f6742f63ccdb259ad235e291a364fed8393b97e64e04c357c2e9ffb6e1fc8990
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEOj:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEOj
- TLSH T1EE25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 952KB
- SHA256 80b4686215c78ce2789bacd309d8586d78909ad95c02cd13d7fb08e2ebecfd5e
- MD5 2f4ae22fced988b9a380de49e128a965
- SHA1 40b6f78ccdfb073610155c7b3ab85e8dc1ee09e8
- SHA512 f5010a96582221faa9b48c46a9f5ca56e4a6bb7f0d7cd499afd97768bd890f2d698732b6e147e0b9d94274399b1f2af6fa2a8efdbd044487868dbc310f9d6380
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaE7g:A3mnXoZjzyaEFoHaewsAjYaEg6FbaE7g
- TLSH T1E925B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 952KB
- SHA256 8c1b690ebe4dad03967d6b44d7a1e8ec69dc7eaf498d3fdf31842abf158dadc2
- MD5 fb4c0dbe075370a08f7b5be729c7acf7
- SHA1 d2599181e48f541cef80e812010cf68cff086a32
- SHA512 e4f3e1cb20c282b0a22e4591d3889d181888f4905ae96ebd1f3764982f51ef80249c4694c11c456f3e56082b9787e3a68cc4221e8322a8093ceba52542c70c8e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEmI:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEmI
- TLSH T11E25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 952KB
- SHA256 7e581ba279705340aeb2daf8815f22a209cf54ecba921713d2410cc2f56e01e5
- MD5 2607bfa2c53082ba001ab4a45f877d5c
- SHA1 71d9561ada16f4438fbafdfeef5acff18ca9ac18
- SHA512 ffa4ca4ddf4dd6053f27cd06c3e1533d156c5c2235141120ce19a4e06c9329aa6455a7677a392e1c06cc1fa75104049b039f7d6d20e3859eedc7b46a195e0329
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEUo:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEUo
- TLSH T12C25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 952KB
- SHA256 ac22150e4b9439d5e140f47dfd5bb7f9fcee71007f24fabf4e6cbb2dd1d1a91a
- MD5 b916c451843b88bcf689e89e1e98318b
- SHA1 d98f26ae4b5094bc8e94e2f71e74ff5191417b70
- SHA512 93aa1f3d770f283dc0a888eab4f702a2e2a24f23e25a5a1a5273d2a1a9c651389d0302dd34b35f0bbb90d96b88f17222eafe370220b013039dc7c0b955c872ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaE3+:A3mnXoZjzyaEFoHaewsAjYaEg6FbaE3+
- TLSH T14D25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 952KB
- SHA256 6fc27ef34dbd86d6dfb9135dc8d2a41c17835d854750aa95209ac64ea11a4cb0
- MD5 97654e8c32a53b5c48d5037853efcc7b
- SHA1 fd0bfe121da493895eb46ce9e973d9007203b6d0
- SHA512 f3a6e4f558aa1ff7815cf82faf06c767ad1c41f38a94469d18a50b63ef093ab6a6cfb5f82c56ffd745dbd84b9ff02ffe5426e4ceb965a05d38a72ade54ba116b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaENQ:A3mnXoZjzyaEFoHaewsAjYaEg6FbaENQ
- TLSH T13F25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 952KB
- SHA256 e2fc6ce82fc850320e866f9ffb21ed6d5e789f51355b306951af51e2a43dd585
- MD5 c28c5d099cb0478d85d7b4eac4aed2f6
- SHA1 9bc1de8002b683cb8c0095dfbd6f8715f1ac66f5
- SHA512 5ffdab777e904ad55d81fef1dad8552d0483dd81891a5e2d5ebdf2941c6cd51334815d268a24bf594da799e8147614a1d04d7c11232582fe5fe8746568dc4aad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaECX:A3mnXoZjzyaEFoHaewsAjYaEg6FbaECX
- TLSH T1E325B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 952KB
- SHA256 4b7ea46a8c3703ef029df30df006fbbd2a8688c5663afcae45888085236528fc
- MD5 a27702b4e34d3c66b233db6979d8495c
- SHA1 44e0ca298b43b6f6aa34c5b3f388dec432015145
- SHA512 96fba02623c1e0604e765e097ff1d8ff265e730e8c95002beca72ae4823cca761ad4b72c8af0498fdac2c11fd966499a484f39a151f824fde5d93f952306708f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEkL:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEkL
- TLSH T16425B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 952KB
- SHA256 7f7aeaabe1bc56d8af142b8701b13d3897476f5bd68cce034c5deb76645df831
- MD5 02ef33cfa98840c11ea87b46fe4986f1
- SHA1 016891ed6031d3e1fba29e72e00ed4a2e8f2e81e
- SHA512 b056914d5e36f1469cb8f999049aff7aaff46a236679d7386b0d42fff758892fa82c2f2b67e2d0d40e3a2e67ac5368be6780944ff6d9030eef9f51ad2f388597
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEAFC:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEAM
- TLSH T14825B023EB7090B5D27B49705BB58713E7397C210B605ACBE3688A591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 952KB
- SHA256 b8c907e389244979b93b3f98c08e9be49559f1206aed4d7f624641dffff38ad5
- MD5 8f9cb84fb60cb2f806267ad9b29852e5
- SHA1 8ea71f65c7d6779ef0dcbbc25deaef4b752f0720
- SHA512 78964fd158b116fdb657dddd884c3fe2683f798feebeea3c5fd69eed31cefe068d53a059c75c4cbce694b79f6cdebbdd5103d4e0a7761ddd6c8442404ccea4e2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6FbaEhh:A3mnXoZjzyaEFoHaewsAjYaEg6FbaEhh
- TLSH T1D625B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A88A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH