e44fe064e1857b723651f3c6e0f6dd2e821858522ca73b3bd4190979451e3864

Analysis

max time kernel
112s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 916KB
Sample260811-17ffnsshjd
SHA256 e44fe064e1857b723651f3c6e0f6dd2e821858522ca73b3bd4190979451e3864
MD5 c75a180a416ebd52c552125c42a8a277
SHA1 21cfdb33110eb1c4e81aa0c421d7fc5349caf473
SHA512 eef8a2680a0d8c2bab0dc1c8554d3f853b509d92eb6b77857587106129bdcbc4cca195de76e1977b399ada8df4751e23b725bae385bdc339cce5d8301c569ab6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTN:A3mnXoZjzyaT4aewsAjxTc6KaoTN
TLSH
T1FD15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 31 IoCs

resource	yara_rule
behavioral2/memory/2900-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c534-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2900-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3240-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198f4-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-629.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-826.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-876.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1022.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1126.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018935-1515.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 28 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c534-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-330.dat	aspack_v212_v242
behavioral2/files/0x00040000000198f4-475.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-500.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-591.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-629.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-826.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-876.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-895.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-908.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-921.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-954.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-985.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1022.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1065.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1126.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1151.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1176.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1184.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1222.dat	aspack_v212_v242
behavioral2/files/0x0008000000018935-1515.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3240	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2900	2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
3240	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_c75a180a416ebd52c552125c42a8a277_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2900

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 916KB
SHA256 e44fe064e1857b723651f3c6e0f6dd2e821858522ca73b3bd4190979451e3864
MD5 c75a180a416ebd52c552125c42a8a277
SHA1 21cfdb33110eb1c4e81aa0c421d7fc5349caf473
SHA512 eef8a2680a0d8c2bab0dc1c8554d3f853b509d92eb6b77857587106129bdcbc4cca195de76e1977b399ada8df4751e23b725bae385bdc339cce5d8301c569ab6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTN:A3mnXoZjzyaT4aewsAjxTc6KaoTN
TLSH
T1FD15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 968KB
SHA256 70a24017f55f40aeb51b7acaf317c39717aeaa710892f132978e10254b3d5a5e
MD5 cd7e3949fcf35ed5a3af3e927a34740c
SHA1 75e8884513d5f5c7d311e6310e97d0e0dfcb9159
SHA512 7079d4afc8e87fbb2bc742fcb4114b554e9b1d80bc41ce5e80dcef71c0224f160f91953988e99b3a292d02361912532e5094849d8032acd0c33a96189472add7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTmFfj:A3mnXoZjzyaT4aewsAjxTc6KaoTsfj
TLSH
T1AC25B023FB7090B5D23B49705BA5C722EB79BC210B6056CBE36886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 827b4d8b7e1a1ab83e75c3ffa0f500bc7481306b9925caa7c1a2e06c3709433b
MD5 c5fc46cd627303f452eefc481d2d2adb
SHA1 92c978a2bc373693e43564d898a11f89d7faf94a
SHA512 14f46816485ab681219723c01b615f5b5fa2f7436f79bf52b7f3e241060884f3ea28a4d1b83eed5088593b4e83107ca8b3bdae9350ea6c13b930ae8681a65183
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6KaoTZ0Le5ji0hmxNrM:A3kMPljgPji0Aj
TLSH
T17C658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 4c7d519bb2131cb28245876dacc4a28258c2fd75d897b219c3f068ff56e95b28
MD5 22b35f88e7764c75c348b60d73187bf9
SHA1 db5712ef745fd6edc7b07487083bbb5f985f7b06
SHA512 2de9def1d7bfd5c24cb4cafaae467d8a97b7741029127733ce8a2447d45c12b877bf17f92de0ee46ce8d3eab988ae3e7e71a2ab600a4f2082e26dae4a2ead012
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTLa:A3mnXoZjzyaT4aewsAjxTc6KaoTLa
TLSH
T17A15B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A88A591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 963KB
SHA256 ecded19e3e2419dd50ad114e714a78e42a52a821afcfe7da6bdc13f04c8f4438
MD5 ed2e07ecfbecf43320c272a42cf8d93d
SHA1 e87faec90f335dfad326493be38784b0315f4d30
SHA512 3c6664712e72a3e82adec23f354f6fa27cee08375a67a3db4f53075501e8387d8945c1408ec9149bab77873f01727f2ae1f92fed2aa6e8b6366c1b7ab7047041
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTIb:A3mnXoZjzyaT4aewsAjxTc6KaoTIb
TLSH
T19525B023FBB09075D23B49705BA5C712EB387D610B6056CBE3A886591F317C06F3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 7d5ae21ad0c28462c35a7206bbc119582a6956a8bc27b18a801fcaa310a7f7bb
MD5 fec9de7fdd11f531f04e30db0cc4911b
SHA1 4b0448ed0aa00a8f5dacc43289b3a819952db75b
SHA512 e0d98e80cabbfe30ff73277877556d9fab74810f10728e70c19c83dcc84d692c96e32a32ff1d6bd2192ede09f7aff787324712b544e2284d0a40d6bdfd67e11b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTDb:A3mnXoZjzyaT4aewsAjxTc6KaoTDb
TLSH
T1B325B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 9f8e8a3e618aa9643aa7cd006dbe131bfb4e185c2ac7dfdce79dfa90dc736de4
MD5 eb48279823cdc316e3d2e18a2b2a8cbe
SHA1 ab046dcc8805489e1e91024d7fda7dec9d325e74
SHA512 12b4e9010acca15ac2e7ba693511150bb23f8782c0c58e7ed8a197f3847fa47dbcd537cc84e8a7bc3b163dd88be83880d8b208b80ab8a59c596d2d7c6229407e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTXf:A3mnXoZjzyaT4aewsAjxTc6KaoTXf
TLSH
T16725B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 a1c11e81b1ee5cb98b5bcac9ff6d8d68e505ebfb12324622d4a8e7eb4b061045
MD5 9df5faf7df72a9e723aa29c83fcce1a2
SHA1 ccf88070ef4d3e93bd5dc2913e446f962aa4cd43
SHA512 c1e5c0bb1872e5ea524180ffbf20b58f4d25ceab87f8ccdede5d92b47f3cf6949f75018e90992ee48e9abde9c39fc775530455e651cc5abe85c10bb8bc058ae6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTgK:A3mnXoZjzyaT4aewsAjxTc6KaoTgK
TLSH
T1A425B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 b9c2d8fc6812c2cc5a360f7051811562339600f8ddc5221950e0dff6e2a962fd
MD5 f9a9314cead674e9bd928499ab5e2740
SHA1 1f3fe75d10759e26f21a15f896beda6398800ffb
SHA512 e848c5c216a95fa71e6c785fd0d28e54df2a67da0069266f6a62e74b50fcf76fe370b11ea73e06909efa27d31ee54a5c50c797f26a44be2178330d6334b0e0cf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTdk:A3mnXoZjzyaT4aewsAjxTc6KaoTdk
TLSH
T1B125B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 e3f52284ec0b58221db2f53e79acfee1ca52db2729835f12c432f467bed82930
MD5 be91818d394a73c4b89f793654a6888d
SHA1 2760b3d996574aa86903cd5ae16290c64db835c5
SHA512 9c0a352061e39c147a8aa106e8a00f7d5befbb1c1e9f197d0ada176a736c661ef83e704f52f0a5587659537cc9259955e56b44bfa82b70177e4f2bcc15d3ed40
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTC0:A3mnXoZjzyaT4aewsAjxTc6KaoTC0
TLSH
T19825B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 00e6ef2e908f4afc2072b1e488cf37ed6d8e07bc9bc772db916390c6a98bf4e4
MD5 5f2bcfe4c44f2810c3c17510a90b1eaf
SHA1 6c85e814db58abc810d30dd293ba18fb4706d497
SHA512 98ae1cd1df8782a13c7a5272e633f11292803a538a4d8917a840883d7739c0ec13db5575e39bfb3a85fc2b5ed9da2d7ddc783b718ebff74744d4058de6cd0cb5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTR70:A3mnXoZjzyaT4aewsAjxTc6KaoTRg
TLSH
T16D25B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 4ff4a48543e6f43a90c0499cfd873352895868ad83c9a92a68188ff216c5c8d7
MD5 d650321698d15873b1635ca28d867182
SHA1 2e8630635347beaca60e12db1b0f6a886565974c
SHA512 bf88d05b25e23baeb20aae0f68dbc8afa8b2cfe2b266a3846c29a26f6248e69cb0d933dabb88652fbb06ff065e6b8f2fc475fdbae4032653526788f15d363fdb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoT4r:A3mnXoZjzyaT4aewsAjxTc6KaoT4r
TLSH
T1E525B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 ab5dec3e8079a70727788f7ba73f3c25a716354ab8cb9ec4f712a8cb2416e977
MD5 d33ce5e7a2ddc5d0da293f18e11ab4b4
SHA1 a1ce71664c7a0de9aea9d6cbbba854395b075b19
SHA512 5292789643d43e94c8ec123bff2d03e9b368d7dcf1b8b5639c819de592f1e7c7ee632405974cd6f42a370f63951428354fc7750608b5eebe88e92bbb63833dbc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTWn:A3mnXoZjzyaT4aewsAjxTc6KaoTWn
TLSH
T18F25B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 2c81349a239bbe1d5f75856f0a370d7c8165c101a0300ceee53769b4a325e2ae
MD5 301c002d4dd3d5372cfaf8e1c42d8e7d
SHA1 36bb7070619e8d8e2c98f7936ce49dc77f54d441
SHA512 a86809dc64b738550fb19c8fdb668e1194e5382793dfdcbd69892b1e96375e967dae99f6c9469104486994627a4fbca1508c34e4065920258a5b8c016401c5dc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoT8x:A3mnXoZjzyaT4aewsAjxTc6KaoT8x
TLSH
T18F25B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 5bb13cf78126eaea24ce77ed900b6b30b62a45a77b948d9df4e56ce05016f3d0
MD5 84cdcc56d16711e43be312b2ce1bbe6c
SHA1 16300b98cee9cf3512c69ae0ae1e202683e1d580
SHA512 3ed470c234a2ef5980f319ac5b4aa0f5e953491589c512924b153be2849e8fbdb61d982bce55ee4ca4d9560bb719ff7d143d5928f433ff5ee4fd57b6d880305e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoT2A:A3mnXoZjzyaT4aewsAjxTc6KaoT2A
TLSH
T1C525B023FBB090B5D23B49705BA5C712EB787C210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 efd846cd52a6ed3908bd455c5546b7fe841f153aca74547cc08ab7f48be4e348
MD5 6097b422c6f078f7f118a24f1ab2ea04
SHA1 68495a7af4408769ee2f096f207c844c9c419d3c
SHA512 a286b7f475f3f62899b1d0132858c1dc10ecbed0ccbdbc6d8161a2e4034511ba394a016bff09397cf0bcc72285e1e1d69d02c95af45a65242ddde2b867e2bd24
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTv9Q:A3mnXoZjzyaT4aewsAjxTc6KaoTv9Q
TLSH
T13225B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 03a98e1c0110ffe3e966f30edc0e1dc279fcc0847eb9f553b08655a743dbf7da
MD5 674daf976a87a19ddd1d0096a2331f01
SHA1 4ddd8c452fa37b9b98a92a7042cb5a2cdc67c966
SHA512 53ada837bc5caa075d8699f1322c0151137793299caa3be8a20ff633fd9f7668bea7af567d440d627e036401b41f767e9ab351036923bcf2bde84b8e956019be
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTG4:A3mnXoZjzyaT4aewsAjxTc6KaoTG4
TLSH
T12325B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 f76e44fb9db17fb0ec355fc6417eaaaf5ced90ac7bf45b3cbfdc7cefd3715fe5
MD5 f21b17d93c153a32aa70cb0aea0794b0
SHA1 7ea77a5923ae9366ea231f79f0bd1e1513a8091b
SHA512 ab9dcd1f6beed590625f1479744c42c011f85d378eaf78c0f597d9fae18c007a9b27d05e9475cb75341a9800ef1f7021c58c163e9a4e8991b142e3db15966f0b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTVu:A3mnXoZjzyaT4aewsAjxTc6KaoTVu
TLSH
T14D25B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 e269ba79c776ada5818f8cfac31e86ee200557a61bf97c057fcb9474beca5b31
MD5 9390f993d0d1987f8513e99e700f8395
SHA1 0bcc70b0a113f0e13501f2be0e65b385d52160c5
SHA512 4a57382e1316032cf8880e2c36aac54f2e5fa4950b771b99305f8f39522ff5d8a4beef6f9e4750988ad1832766c04f9013ed4602ce89663b06a99d17becafc93
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTIj:A3mnXoZjzyaT4aewsAjxTc6KaoTIj
TLSH
T1DC25B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 ddf5185264c63cf25a92ea67e3498e2e0fa67a7af66da9ebd8b6bd5ec9abd1bf
MD5 074f9426dea2bb0a88646c8eff3db057
SHA1 08899a5ae2e940392792a6aa50ae015c74087fea
SHA512 13ef500179380a6c3eaf2edf10f5dd7d34123552ac9155aab0d93d4fefd39e55e5279c9b5db2544c2187389d9ef84575b10de9cb3999bdfd52c4c0dede69a053
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoT5g:A3mnXoZjzyaT4aewsAjxTc6KaoT5g
TLSH
T1C425B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 cbca761ed3e5979616b29f9e4fd8a48a02a567a5b268282e56a6c399960ea2a0
MD5 54406fd755b322d8a79e850a802d582c
SHA1 0803e19873accacd938806798079354eb292ae51
SHA512 1b6d0bb26e6c6d8fdf5760442fd6fa3bae22ed8545ab49a502d3873cce9c271e1b11316a45fedb82eb00e01b8f85a072808f089c81939e43a1b18f0debe91f9e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTgI:A3mnXoZjzyaT4aewsAjxTc6KaoTgI
TLSH
T1C025B023FBB090B5D23B49705BA5C712EB797C210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 f38f3f02d146e46ab242e9befd463e0a59a5acb5a067eb3788f58c68c04a4278
MD5 5c8a51706be6500c1936076fc1fb1c78
SHA1 b3e07b5041ad24311020c3fb18f9330a66810cfc
SHA512 6af1bf6881cd22ae2e0cce0237b0276dc5c17bc13adf4a76673e4e36231b456ecad7fc9acb82ce4c3dc9efd664dc10d1fa42e828052ac45aa83a3fddcf46f696
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTio:A3mnXoZjzyaT4aewsAjxTc6KaoTio
TLSH
T10D25B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 0bc156dea6f49308af1fc09ef570c69708fa845b691bde28c9b6b3adf4596b4b
MD5 2423c434a6a459c1e9505c466ca5545e
SHA1 08479437f72bb92cb539bda052214e831d7fb4ce
SHA512 229632a17b10cf81244247d0c60d6b5e71ff660c74028a1681943e8a682cefade045127b0335d668704f74da793c8fb5935ffbdeb310c74394a95eb468d42a9f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTZ+:A3mnXoZjzyaT4aewsAjxTc6KaoTZ+
TLSH
T19925B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 e1570a29a4dfb122392c8f8df84ef7f878621e9b32ca0e9c520f8bb3c611e5d0
MD5 8fee786e41e33afdd447038448333250
SHA1 61a5f49e1f56c0357e09c44e8db61d62dc45bce0
SHA512 29936c7decfc1bd727ff953b63069a97b53611fd9613385358f65d44cc0d161654b4789c3e39c251299ef16cdb74eb787f01a82015977bce876ff8bfe0d0bb4a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTHQ:A3mnXoZjzyaT4aewsAjxTc6KaoTHQ
TLSH
T1E125B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 d4d67a20b1e3a24fb72ca4608018b75f62a336be47604f035caf2bd5f1a74699
MD5 af5d2a0e28cd49b74b21eae8c72eac57
SHA1 6907ae60f9a81c6a17e47977ea655541ea7ac893
SHA512 821a92a8edc426010d00c4b5c3f0edd38e0de5f279a69a20b3db769bfe9dac8564a5b707f878059ef023a07cb5ae3373846c403fee486b04d1a6db39256590e1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTcX:A3mnXoZjzyaT4aewsAjxTc6KaoTcX
TLSH
T1A325B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 8a3dec01e95de0f98ff9e18f1dad2ced980d367e1c4657d8cc28a9ab73081b16
MD5 9d53974c8b58f53cb8b1455cff2c92f7
SHA1 559547240beb886d9f637662c1b4ae42b6c289a2
SHA512 a71d985374951f5e21c31ffe6a84ea7ff2cf71b8fe98bdb956b6e90ac54dd429c73fd5dcb9de7b306958dce502f9d90d3d8e0b0cab5c4b17f4991a143a39ef20
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTaL:A3mnXoZjzyaT4aewsAjxTc6KaoTaL
TLSH
T11E25B023FB7090B5D23B49705BA5C712EB797C210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 92df3976ad35a0debb8ece836a5b57b1a521e40612bcec748a9dbbdb38c315d8
MD5 d2b9cf0d9f638b2f4b74b303bb0c27ed
SHA1 190459c6bb41acb539a786a490cf02bed87d2b56
SHA512 621a90e0150f703dc5748be51bbb4e29401d53fdc560cdb8f1c916f633d024e5b8deed93339738aae9ec3603af0bd67f6719f985c4931b24e5717231fe352a81
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoT+FC:A3mnXoZjzyaT4aewsAjxTc6KaoT+M
TLSH
T1FA25B023FB7090B5D23B49705BA5C712EB787D210B6056CBE3A886592F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 5bc64931e0d3aba5586c43b06635078d8aee1978c8fc6e600efde98ec0188d2d
MD5 82fb18f7d061861b12bb5210968d7455
SHA1 1e9719e86f41eabede0cc4787f7896b581a3e56f
SHA512 622ea7d2fa84706f6cf3a76ed486cedd99bc103ccab8f98ff87ef0a9c09ffeaf6c02f1e161a59cdcb9453d35f0eb607cf098cc4a855569258c0f0a87b0ee9394
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6KaoTnh:A3mnXoZjzyaT4aewsAjxTc6KaoTnh
TLSH
T15525B023FBB090B5D23B49705BA5C712EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2900-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2900-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3240-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads