Analysis
- max time kernel
102s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 20:48
Behavioral task
behavioral1
Sample
2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
- Size 946KB
- Sample260809-zlg7psywex
- SHA256 ed3e2fea83cb3fe2ce819d59fb5f9606717825b7f245a72ccd764712be8327c1
- MD5 abb868cb9cdb84d0ee472e16c76b7590
- SHA1 1dab27ad9361f988e89caceba1e42461ac6ed5df
- SHA512 0bbba0bee6a6450f3ff1171eee4752b1fd3c8831042cf7bf5f02f919f099e9f2fe5fd6103b5149c5c6011c6b42b971e3e3cae5d02df3f2937dd41de49dff0148
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00a:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0N
- TLSH T19725B023FB7090B5D27B49705BA58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/2572-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c522-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2572-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2132-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019857-224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-442.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a67-589.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-706.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-786.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-823.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-964.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1050.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1366.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1402.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c522-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b300-41.dat aspack_v212_v242 behavioral2/files/0x0004000000019857-224.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-442.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-497.dat aspack_v212_v242 behavioral2/files/0x0013000000018a67-589.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-621.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-706.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-737.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-786.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-823.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-873.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-964.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1007.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1050.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1099.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1218.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1322.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1341.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1366.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1373.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1380.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1393.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1394.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1395.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1396.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1401.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1402.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2132 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2572 2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe 2132 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_abb868cb9cdb84d0ee472e16c76b7590_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2572
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 946KB
- SHA256 ed3e2fea83cb3fe2ce819d59fb5f9606717825b7f245a72ccd764712be8327c1
- MD5 abb868cb9cdb84d0ee472e16c76b7590
- SHA1 1dab27ad9361f988e89caceba1e42461ac6ed5df
- SHA512 0bbba0bee6a6450f3ff1171eee4752b1fd3c8831042cf7bf5f02f919f099e9f2fe5fd6103b5149c5c6011c6b42b971e3e3cae5d02df3f2937dd41de49dff0148
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00a:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0N
- TLSH T19725B023FB7090B5D27B49705BA58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 83466408adf7c3a98391ffa6f67b467ee9c9f94b9e0e27f08bbbb92e92e2a66f
- MD5 433f17a3af7c90bfc76ed79992ebcc28
- SHA1 67e49bf63bd3d6f796235ac31a6d9a7c80c40457
- SHA512 4509b8ac73d31a0d65a685436c935a0da25d0913ec4601c7153939c0ef8822e90f23e98577e0db2ab689465e3a3d390e084fec6a23df65ce7e37ea4f95f6c066
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Z0Le5ji0hmxNrM:A3kM8ljQPji0Aj
- TLSH T1A3658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 960KB
- SHA256 00bf80a200baf4a1b7b4345545cb9c0d1988893fd61dc67eb764fb4175a5a74e
- MD5 e6ab7a4fd90741c8a57b87f04838cdc6
- SHA1 6572516e5ffbb99233fc7f5f0abf44e0cbd4fb56
- SHA512 33d3b0b90140a4e2693f637e83d239ee35698054992c03947c707d1c418eabd6a2cf8529da362b0658332e4fece3ccbde205623fd314801302e58425b283adbf
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00ka:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0La
- TLSH T16525B023EB7090B5D27B49705BB58713EB397C210B605ACBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 969KB
- SHA256 05c55300d77f4a4f9ccd4f47aad628d88b733255e1f47db729b09f32ec1368ce
- MD5 2a4cd01e956e0538034a524ae0606f72
- SHA1 41951ca52f7c0c702977dec8838e495809075571
- SHA512 3c044219f72d87b4446998ef72d5aca3bf416e5a44e89566e8eb564f598ef1305e915d86d5c32f12b99b7af433e30c243a84913d80e093e4e3a255980374f2a1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00d6:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0K6
- TLSH T1D025B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 969KB
- SHA256 494e41ff6f9adca47b3872478d809e74257ce1dd5dd2d0ad7ef7c75a19ac5f23
- MD5 a8e0af05358b6573226bc78850d38002
- SHA1 ff5c8f272f95aa83cdddb4a6dd6dbdc68eca19b2
- SHA512 879e346f4076d0d960f05ec94a88612e15e993838e15007a5d3698df37a5efa9df1ec46c198162dd12a19ef56ac99a645b482c4f1c745200fd19afdd94c6a0e0
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00zN:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0iN
- TLSH T1D925B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 969KB
- SHA256 63d84d077e2464b0d4d57a73993fc8b9455fa0309ba617d491f24994e4fae3b3
- MD5 cc342e0edda3cb8d1588dc5e21dd59bc
- SHA1 335797715a7ba32c5fc89a8cc21cb49f53e3f2d0
- SHA512 96b507a9c0c5a75eba4c3e0172b5a8dce3fa79b67882d4788a246a0098b3294388b28522414eaa361da4a4a4967650754501567ffa4c4b781a31ae9c5c096068
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00Bf:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Yf
- TLSH T16925B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 969KB
- SHA256 78accd56a498e5609133cddc4405c071be15a92a640309cfca1877bea1a0b247
- MD5 c4734540a5ce66a68509350efa177790
- SHA1 3117e263506b192fcabbd3474ea0ff6f137f1f95
- SHA512 39a04c1f6e4b2acb10f41a89216ad0ceeb66ffdd9399b46e537df08ecb00951cc10315c900576eccce32bb1d9be41f1777ce110b1dcd5264b6f32c9bc7bd6ba3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00jo:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0yo
- TLSH T17525B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 969KB
- SHA256 17726f792b63629ebbae0b8af7fa5f95f8e35af7784f391644dfd610f7696c83
- MD5 ad3cd8a17d91bee71e52690466a7af4a
- SHA1 5312b53c73a2c8f7b454072095866e3d17a3d3d0
- SHA512 3b2dcba5ec47bc0a81d14b3aa697050eb4bd607684559b30ec52e1c29c80a6039417ec3ce70ea9e5527713f2f05f3ad542570c00e9e1006f6685c44f1b761e00
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00Xu:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0mu
- TLSH T19125B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 969KB
- SHA256 feb4eeecfd95fdf55d80312d4840e60a49b1d5609882574d6fbffe875c863159
- MD5 71d38620509ffa39271efa93c1481cfb
- SHA1 3e7bb15d5208d7112f4e112155ddeb8bb157d4f7
- SHA512 09b3009d349c8177f08c371c12d26deb35100836e65a1689decc91159c028a34ea22d9cf219ba9ece73b4d27cc61311526ad0c054277b09bee9e7f67c0c80c9b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00l9:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0a9
- TLSH T13525B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 969KB
- SHA256 8f9292d6578dbad1996004b36fbface9140ca004331c3adad2c0d67e78b9ced3
- MD5 e64359738477f10129eebd80b2fa7de1
- SHA1 be0cb8e49a675c6a36d4e7f1aabfe5f726865067
- SHA512 de1ac2328fd15909036db512be3d59c953d0c6cdfb6f697bcd3c70caa092e46ec5f52f9852eff04457dd4e274b1db4b6f0c8b6f177fc6cc2ac77a5f1f1fdce6a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00Bc:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0ac
- TLSH T1E025B023EBB090B5D23B49705BB58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 969KB
- SHA256 92cc6fa7437572d2156fc8fcf967df438ba16e991e7a416baf41a3dc6acfb565
- MD5 c7e06d878ea9bbf2e7901bf42be629fd
- SHA1 5c9eef466b4986f7ed631f1afbde9d2b5c2e01a8
- SHA512 0039bb145a4a3bc2f4e65c85070f87e9d728d69d4324274c0e9c6b079ec59c654e2fb3df0dd8fa7d0e82983a5eea83423a860a48a4d0cc51eca3adaff7ea51ea
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00qp:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Tp
- TLSH T1E225B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 969KB
- SHA256 d1497d0555868921e092a9019875e1ef4f6e075f1379e7dab803258a59539953
- MD5 448864b60f096ade70d41aad6161a19d
- SHA1 dcccd915c466d3ce337a654fda58e129cda6d111
- SHA512 4213f298382005852583abbb90a1bc4c7ac988fe28c45485294ae64bd59a0873a5e760ad47558b2be4378fd682f9677b18c3ea6c28068fe6ebe9bec72a0fe60d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00N0a:A3mnXoZjzyaEFoHaewsAjYaEg6Ti00N
- TLSH T1F225B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 969KB
- SHA256 0c8367dcf2b60e99ddd8fe3ca5fb91927a73a49e137e2e7b30ef19b0ec2b508d
- MD5 a4e69362ed092cd511aa9cfae4d6c263
- SHA1 123ae2649a22749946d2e820442cc937cb8edda5
- SHA512 21f6c5914d29da2ca8a95a2e245b589ee6472bb10f405d4613809d71a327473fafcd312f722bd21ae9f5432c6065ac4e21a707b0987347456196f89d3b6e172b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00/F:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0cF
- TLSH T14325B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 969KB
- SHA256 d4afff9a0b491a5230ad450e2d82af983ac2c393426e243a223a79f132c8f833
- MD5 5042520630fd63c6e08f7a814a05b3a7
- SHA1 dd7557a9fa8294c6dc3a77d186955d772086a81a
- SHA512 69748c502ad5a7b37de0d7340ba39ffb75f720763d65262641f9897fbd3dc451f0093ae3e62ecfd635bfb3fb6c88471f7c47e8a3a72d33772606dada7e0c7172
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00gC:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0JC
- TLSH T13425B023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 969KB
- SHA256 8257f980fa6dd3481509eb306bb9a5249f2fbd788be720674ebf1d2dd2f11d64
- MD5 aeb1c055a40152df622c7e65bc4e7564
- SHA1 871e257ed0d68a7206e80ae9008ec95cb944db31
- SHA512 78e30403c1fff72f5e390459aec0991bc1ab842b476e6fbcebfa4dc74b7c51be5e62be02f5f4aeae3b52c214f60a873242a31061351962dea573fe69d155f1fe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00zw:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0qw
- TLSH T1A425B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 969KB
- SHA256 3d9b047db47011fa10329e0eea0593b4aabe9773714cc72d53ab111b556e0b5a
- MD5 41ca3dad629f342a67c10e0a28d4c35b
- SHA1 0904ca6868141171502b7dd351ade9702089e12b
- SHA512 25ada38dc52406cf9e53ca5261253f737bf0a06d85e7e255a96c6b99a01166fb04ead633f31cf67765c2e8631debe6a7044bc69d73fa028f0a3565f4a39e6455
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti006T:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0xT
- TLSH T14D25B023FBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 969KB
- SHA256 356de4206144bc33049a1520ed677dd63d89758505620a4c249470d602539045
- MD5 13f87adf96463ee5f10e1faf08e5a7af
- SHA1 d770e22b90b5b35cebeff6c5e9b192d31ec9b904
- SHA512 52ed27fb7627ba1c0f30e31d386710924836f32f7aa09ed798752a69fa0fc8112f7ad5a64d50c9694d4b7e4d63cfea66c479a1a74574c48892794e3cfd79cdae
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00au:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0fu
- TLSH T12925B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 969KB
- SHA256 3361bc6285c5ac86b168c67aed44172f46f12e61fd8b37e31704e69f26fe3ff5
- MD5 d6019f29f5825713864aa7d6d537bc95
- SHA1 2e5264ea6ec228c7b67a929c9307e9db7ea6a89d
- SHA512 41eaf9c6d0ccd34d65e3569fd68033a84a3219951c9ac344031ca86f0b444b16d3d46852b39c20ff979b3f470561ad5680def413ee7b18e63910c5ebc649192d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00kb:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Db
- TLSH T16525B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 969KB
- SHA256 7baca3cae214d56f204136866ea930fd06dbde07eee315fd1b5128971013d3cd
- MD5 9f43f56e294d8d73f8f54bf695927356
- SHA1 dc8827c9a4557b0eca6607536e5cd94365d4737a
- SHA512 6222bd0a41f29461b17dffc4ee32718f6f588f5ec489e8c5b363111d0fdcd54029d6801862e426de0fffe3e1ee09690209ca0f4e275c36dff6ff97b9d24503a7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00qf:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Xf
- TLSH T1B825B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 969KB
- SHA256 94b21d24af05b43177c9a11afbedc572fb1ef78bcd48d979acaa9e017c5f7fbe
- MD5 86918fed3c99e230a0094f9b4dd669c2
- SHA1 b27f88dc4363986dfbd54f2fad7ad6b94e588eac
- SHA512 733d17e7a92599c256b7942f82659b1f546a11ddb914b0da2049f443d9a77bf7c88e16a1244f55411731fde993a9fa72e3e75da11eca8c5d3676549eee1e5e6f
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti003K:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0gK
- TLSH T11225B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 969KB
- SHA256 743ffed68ae57c638864673ff774110dfadc6580edab47104a3f5f09257a67ac
- MD5 0aa0f04df750d626b2961b5069f2a0ae
- SHA1 d133083d0d9f70c4b5ded09a47b615c3ca628516
- SHA512 6df8ba9b92da02077da492c56640f160a99ad7173759aba6703ee808483428fa95088f14e8e6b7dd0bfcc4c24d1d7d2f9971ffdbdab9228c0fc1ea543bb95834
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00Ak:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0dk
- TLSH T1D625B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 969KB
- SHA256 b1b8fdedb096874fcb003a89ab7841f316b5c8c6e1379a43d8c699189c3d8a52
- MD5 600427cc9a4d93ceef6e75246fd0df95
- SHA1 64001aa207f928f7d1f302b0db208379c49f5329
- SHA512 bde3cc45e21224113c82b325bc4c21b94c17a1091c6f860ffc69c6827db62ee838afadc9e5d8cbc500d9df754fa7e773418e1089bbeb10beac3c6c8d45f7a7d2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00x0:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0C0
- TLSH T13D25B023EBB090B5D23B49705BA58713EB397C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 969KB
- SHA256 219f3eade9a17b4147188f14483325261293a4e847841acb2ac629209f522a65
- MD5 7ba8d2e4af5da2665d8037e4ee9e7245
- SHA1 bf78305877abe86f324c744165d791bfcab6e635
- SHA512 7b5b10122d7f945205169d0e64c61fd68670b5764aa7f60cb67be4717ee10d6ff9679b25a39c5ec4d409b4995756823d5a638b78e5a298bb9dc11ad3de139b16
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00k70:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Rg
- TLSH T19B25B023EBB090B5D23B49705BA58713EB397C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 969KB
- SHA256 60ba8182da58f276af1978153161b60a40bd2e452d7db0a36708099c591c09b4
- MD5 d60cd36a42f86061b52ec26b8495e97f
- SHA1 b72f6d4e8ed7a81281e5110facc0c594a9c7f274
- SHA512 bb5c0904326b2b4f839fdeb3e5cd4bf15827c52f158dfdf52efff0c8a6141afd69664306c5f8a3e8c99dad845088f78fb4bbb99baf93d5eebda9acb1fe4ee253
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00Br:A3mnXoZjzyaEFoHaewsAjYaEg6Ti04r
- TLSH T1EE25B023EBB090B5D23B49705BB58713EB797C210B6056CBE36886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 969KB
- SHA256 a16a1fa3d7f1bd74e549c981102a4a57a884a19681d6a3423b6dce4cde49b5be
- MD5 82c0e5fe14646750fc915e5e09bc69d4
- SHA1 65d5ff91386a3bbc180b4873133fa23209da3595
- SHA512 fc7430b8f87cc70df10ac6909f1f9d3caa774f5d0ab5325071e3f397f123a3d76afef58a566224384530d42df8e241732771afedced5be450840ceb90ce9c467
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00Dn:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Wn
- TLSH T11425B023EBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 969KB
- SHA256 e870646320834ed10ac16c51300c21a2a2a771eeb6ddf6cfcb1f2d8471eaf1d0
- MD5 4b32b2a18b2d674cca786b25dfcb0ae3
- SHA1 206c2dca8096de565ecf0892419fe20a377ff189
- SHA512 3edacdf4fd266bc247f9c0af8cef8537d004f92c09db7a25765a53af99c251e1935d60b9238e5e87df7bff21ddd372e4152b2e69e03736e7f1b5289b8ce81aa2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00fx:A3mnXoZjzyaEFoHaewsAjYaEg6Ti08x
- TLSH T19C25B023EBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C07F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 969KB
- SHA256 a10ba93641d87f727005327efdaaef984838647120dea225f8dd4956b85cad90
- MD5 b20dedad3b9522267b6b701ec1a08ed9
- SHA1 f0c118e6cbf328144e6aaa42f09041526386d9dc
- SHA512 a96fed25a0ac280271d87ccb765f2175ab481208d7b16ce3d0aa152e599a3324954bbf804845adb97051f6d9af9252177a820299679540062b4e32edf1db24f1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00FA:A3mnXoZjzyaEFoHaewsAjYaEg6Ti02A
- TLSH T16325B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 969KB
- SHA256 3760d3e06e917be613ee16acdcaa09d14a206194077610513ea4694921cc57bb
- MD5 e94d3638b0deb575ae0c051393bfd5b6
- SHA1 63e92570834c89259333dad363060cf2efcdd5b9
- SHA512 1de2a5f23428c30f2024ab6a75481b7a66aa21986bf858902713dde0068845f71c5c33cd03c9b5dd264e68a4a5b0215f82e3d6a583d6b25f2668b4ddc2bcc973
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00+9Q:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0v9Q
- TLSH T19425B023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 969KB
- SHA256 29deefd61a74e0ce24f4bbd39e3df72c777c35079de3a3c4014f87d2900d3423
- MD5 cd613897839197596fcbd6fa3529a60f
- SHA1 eebc93bec5d48bc83786227fafd1e31c026c1500
- SHA512 e7a4279fb752d0a1b330949b3ca6592832f7f9475db0f0daa11288a0a17741f83d84c4af05f4531e0a4ce36413a401e35bc1aa8a6f293cad24380610deb754fa
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00r4:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0G4
- TLSH T1C125B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 969KB
- SHA256 85638b9880bb6cba3b85c12118f9a4722e5775bb6c1aface709dea9323c0cf54
- MD5 6bd5147b1ea46b2ed7df51ecfa0ad8fd
- SHA1 3bebef76c8d0cb61ee000de0f6ee1f9a8bc045ae
- SHA512 309243a5f2609a9e6cea74617c3fb0ef9bbf2acb9b199de8d08caab6d3ffb275f0e7ac6539d54a37db7f220dc17e86ddd90b330584ce143a343c0c78752b5bc3
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00iu:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Vu
- TLSH T10725B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 969KB
- SHA256 3be10ae397a27951015f16d366320be24eb1f6c699efa4579b5681bd36d95c95
- MD5 d4bb7ecbe94c88876e263ef2da9a0608
- SHA1 3ea749979f0432927adeaf85bbd4242dcc4edba5
- SHA512 462db425bc44782d20bac7b3fb87b0e52aa2c12422c8e38b96ebd6f711f1f633414afc48d83716bceec6a03042c21636d8bbdc55123495f1b313ec78211f4d2a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00zj:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Ij
- TLSH T1EE25B023EBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 969KB
- SHA256 302144f081243b8dc5eb0f5bab04dc73d7e93b304dfdfffa35adf8a294501258
- MD5 f774db56dbfc1ff3bfdb3726aaa16156
- SHA1 c52edbe517c194b174db6af24be05f752a097233
- SHA512 34870a77ad525fe9d44454b75741d0f88c3c54ab663ad721e9c5f5c3124b6e22b72168e237bda85ae3ef17834c0eb551279229ded15eb83ed370aa26b5fbf577
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00+g:A3mnXoZjzyaEFoHaewsAjYaEg6Ti05g
- TLSH T1E925B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 969KB
- SHA256 6534efa83ff95a045f86a6eaca9119cd9d014179e886a9e6bb5447ca50518b2c
- MD5 9b0683c30b64c78571e205b28f28f2b5
- SHA1 11589046c86e00089bd1d320183b7147766cf944
- SHA512 7e9b27520cac2cd8742c5c8ba79e8da818aa64ebda88c8765f1a1a48ca96627a2a208f9697b2123b68868a75e1e9cdecb2b8b6e2d605c2030f7dde0ed10bb0a7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00xI:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0gI
- TLSH T11E25B023EBB090B5D27B49705BA58713EB397C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 969KB
- SHA256 cae6d017775dbbaa8d4ad74e980b3e5c2ba142d73c0a1f4394c3cf51111b7315
- MD5 76f442c118b3b60685e668a6a076b2ca
- SHA1 a6ad97257fc9117f5d559f233751f3fb7a1d8c91
- SHA512 d78f91fb41f2aacaf5913a1ac8a9af08cf6c05b734794730964df833a666e4009f1ac4429f3ffd99ec48a6ca124be4d5d86ac1282f2066d28565cc444481c76d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00zo:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0io
- TLSH T12C25B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 969KB
- SHA256 767e3343bb57e8b5d73d20060c8a8ffefa0602100fdb5e0fd39bd4fa77795eda
- MD5 4a7486bd1bf9e58cd50a5bb3c4dc9cb7
- SHA1 b81199a672ab491f9ffc65b68acc9f5abfbd07fa
- SHA512 236e461ba4999d41d92d89f3b90388dd180fd7d9c6fdcd9446314666c4da4e110175d7684d27084493a08cf1996d49da07afbb57a97681f5b3dc21ea88527da8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti004+:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0Z+
- TLSH T14D25B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 969KB
- SHA256 e90150a8e74f9850333e019eb7720daa7a9dee6d2e1a4e9c53ddb2c3cf58fd2f
- MD5 b713fbb8f5c3c070e2f44ba877b5b306
- SHA1 ec3e2481c5e33d3e8bb2f20a3bfc500c57f4b417
- SHA512 7b354ca17d37589a4a308c8a47eeb5c732819e52f898746ee8006c6372996f949adb0c6371a605827ccb7a7991dea79df04f1465a9193494613c5e677d71707a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00QQ:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0HQ
- TLSH T13F25B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 969KB
- SHA256 92280bd5dcaffbf4a688927d691695f3bd128618bb6ac6963c492f110fe74783
- MD5 dbad0287d870578bf20494db665c3ca4
- SHA1 7d958996f4f8d7ab395435475831b32f3d762f64
- SHA512 e3d4ccf7e99b12d42e964893b08090f3e751bf7112a9635e8b67adbef71291a8719063c0e2f78ff7b537458f274bc21469618db424549b3448bac70331e97588
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti005X:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0cX
- TLSH T1E325B023EBB090B5D23B49705BA58713EB787D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 969KB
- SHA256 102e8451cedd51e1c1bdf5c773717bb5c498b524bf0950a979687864a66834df
- MD5 a26b07771962fae7114d9c048fd80cb0
- SHA1 39efb52bac9ae654f9fa48386336199a6cb523f7
- SHA512 3c70eea29d51f35a8c2dfca17024d34f0d9512508015a2cde016dd360de81d1473db1ff8492efdbaa7ac3f09c557027a870c63eccc65f6195a74ad012702d430
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00TL:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0aL
- TLSH T16425B023EBB090B5D23B49705BB58713EB797C210B6056CBE3A886591F317C06F3AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 969KB
- SHA256 42dc8295e6b9db118000b791c327a6f9df6d7fac7f9657cab9ba386b735c47c4
- MD5 917244001f1fad9f94076698c2944657
- SHA1 f9610d285e7ad22227639219fbbbd34d9824b313
- SHA512 2d2c30fba8a5bd1b3061fb09a70b3759b036022b866dc422102994788bc95bc18c1e69af7ca71734bcfdcda21b6f969ad7e1e7c04e5963cf686090a678d04550
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti005FC:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0+M
- TLSH T14825B023EBB090B5D23B49705BA58713EB397D210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 969KB
- SHA256 ab6b966396373b33c60b4838031c32da37724bc02009a3d7303b56d5d723df34
- MD5 47d2add3d814ec56b2acc3d3c916e863
- SHA1 dc557ad40195ba9f8a1e0dea3b2b3aa76371a0f5
- SHA512 6e8ada16a64f56b9d917e38168d57b36163a94ebab2c3413443d00daae0d430519d2f25f98fb48e76b10dfbb7150f6053cf1ad61cc9258aed0d6fdc629920c70
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6Ti00Ch:A3mnXoZjzyaEFoHaewsAjYaEg6Ti0nh
- TLSH T1D625B023EBB090B5D23B49705BA58713EB797C210B6056CBE36886591F317C07F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH