e257e1ca2c5cd7fcb91ff08af4f0309acc4bf7b73189c7a378b58b8dc6d017a1

Analysis

max time kernel
98s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Size 940KB
Sample260818-xbb7laag69
SHA256 e257e1ca2c5cd7fcb91ff08af4f0309acc4bf7b73189c7a378b58b8dc6d017a1
MD5 0909e1f95cbebac88a2c250c3a496dd6
SHA1 279ec08f9623a48dff77f81f134f4f22ec81ae59
SHA512 14fe5540370f045480c7768950a2f4fbcede3e825ba89fa03f6b1945f0799ffcc87a1027000b0c2870d9979ac5c5454e8765e0f951eba1141c3685a6e5e4984e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tp:A3mnXoZjzyaEFoeo+aewsAjVG6Tp
TLSH
T12225B023FBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5500-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c501-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5500-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4852-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-986.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1072.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1241.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c501-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-260.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-442.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-588.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-619.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-704.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-735.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-784.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-821.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-853.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-879.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-905.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-924.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-949.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-986.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1072.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1121.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1147.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1173.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1241.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1326.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1345.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1390.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4852	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5500	2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
4852	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_0909e1f95cbebac88a2c250c3a496dd6_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5500

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 e257e1ca2c5cd7fcb91ff08af4f0309acc4bf7b73189c7a378b58b8dc6d017a1
MD5 0909e1f95cbebac88a2c250c3a496dd6
SHA1 279ec08f9623a48dff77f81f134f4f22ec81ae59
SHA512 14fe5540370f045480c7768950a2f4fbcede3e825ba89fa03f6b1945f0799ffcc87a1027000b0c2870d9979ac5c5454e8765e0f951eba1141c3685a6e5e4984e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tp:A3mnXoZjzyaEFoeo+aewsAjVG6Tp
TLSH
T12225B023FBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 28f6361aff29549212b9088584861d63dbcc822cd8600233a8afd6a321e1d4dc
MD5 e562dbe8d19b842afd779a2281ff1f0e
SHA1 e58f2aae63530bcf3f75b146cdf3196146b34fb4
SHA512 ace37d242ec429aee689f75d81d5311e4b77762e2136bcd199bb8bdc66a60c0a161af263c891c85dbbe95acd64ab800ade4d596b0343bdeb0bad885b580da7cf
SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjVG6TV0Le5ji0hmxNrM:A3kMFlj/Pji0Aj
TLSH
T1DB658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F637D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 6f07c6d9370a5c04c43b9099c7306c3dbe84de0a57f8f818bd6ac3996c36ff62
MD5 22450299bafba87161eca38a1934d914
SHA1 3d77488afad6e8e9bb2f066fdd691caaf7f90e11
SHA512 0445097fe34e28b4b03c8600fb92729c1627174cbf9b809b11e6aed3ffec53a0ec0713759dc8572ebe2f32cc062c75fd32da04c1d811f5c76e155d37b4109301
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T3a:A3mnXoZjzyaEFoeo+aewsAjVG6T3a
TLSH
T16B25B023FBB090B5D23B49705BA58713EB797C210B6056CBE3A886591F317C06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 ae62f0d950990651b51a448644ed5301a0b022d99206860dba85b8b70c6d7437
MD5 286811f247ed761677df68ebd912649a
SHA1 34e6b37dbe5fbaec72aca5d00b57cfac1fb61bd2
SHA512 117b736ff4e414728c0ae3519b21115042c14d51675b8f8eeb7e5980765309089f7d0e8860b6362d500b791ec733ac85ea9e800c61562f4d19ca69f8a31905b4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T26:A3mnXoZjzyaEFoeo+aewsAjVG6T26
TLSH
T14C25B023EBB090B5D23B49705BA58712EB787D210B6056CBF36886592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 800ec1b0d4359172247f70ecf31d5eb06197aa071ddf07c480f6fee8722fdc08
MD5 2be93e2980eda27f611cab4032da3868
SHA1 fdd9e417747695af14690ea16dc3741b55de9829
SHA512 81eefa76591e5c2266aa71ed88dd53059898cfbba1dd328491cf1570e9c7088cff0b6a5709be784059add7f3c3e32810c88754564340e04ab27f369dda2004cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TmN:A3mnXoZjzyaEFoeo+aewsAjVG6TmN
TLSH
T13525B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 d3c07856b2fd50e0565d999c6f1763cc17de0466e5ef061dee820e7b322e4559
MD5 de360a71cdade83e824ed1a098978ce5
SHA1 7062fd5eb8fd31d0facfed420700e13cce213152
SHA512 515384dc76f68360801d9ad4d4ae63f8e397d79197d5f60c7c5fea79d3069c6f10ff14f3d625b1bfe1739b3dd7c65dc9cb1a5123e059077ccee2d3cf4723ab66
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tkf:A3mnXoZjzyaEFoeo+aewsAjVG6Tkf
TLSH
T1FA25B023EBB090B5D23B49705BA58712EB787D210B6056CBE36C86592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 34edd6381316bfd72bd84fecc77f97c4a1cead13f463d82f6aa81c734afdfa6f
MD5 476dc0e914ced630e464827b077d579d
SHA1 0f1d1ddeb07c70f989d8854725f09c5b5b41d7e2
SHA512 e67efd4cbd442df980a42748b9f45d4d85f75e4dfecdcfa10f824b11b59eed4c054e8e0570357aefc71a9883cf67224d47e8a4571001c08b86719dfec6e16b01
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TOo:A3mnXoZjzyaEFoeo+aewsAjVG6TOo
TLSH
T1E225B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 85af2a9139c71307598b980444242e22d8ef6a55de017a97ede2947f676c6b06
MD5 d91dec45f0ba05f4e2cade526231212c
SHA1 14ad5b0dcef7a05838b89c1d3ff856fe1fd16296
SHA512 bffcfc8041bf3b1608488baded3737ce328188609973d24975a5796c165e51fcc9770786763c18b5575196623def2610fa2d8b095ff6acb3d378ffcf01f3b5d1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tiu:A3mnXoZjzyaEFoeo+aewsAjVG6Tiu
TLSH
T1DB25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 f0700f6acae4e371bf512b04e9f3f264708620e58ebe393deb9c42e291ef34d2
MD5 0c9924a213a67c8b3b0f8fb535533488
SHA1 bcee66339970518d3d60bf66582c302d6ddbee8b
SHA512 1afb93be9b85d355dc09fb54f2a22deb204378f1321600b9152a3d0e46e851b496d072f00686260d4ff7d81f40911bd3548d408b3ee5c6d4fe327c82d90787f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T29:A3mnXoZjzyaEFoeo+aewsAjVG6T29
TLSH
T19425B023EBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 c2c050dc6d0cf35cd8108b8f4bdaa42847f362e24937edbf2a91b41a720306e0
MD5 670d5710ad267db88be6111c30e35185
SHA1 17d38d1eefbe2c20ffd5ce09a2ae446326625737
SHA512 2cbc77d85624c79da89488e0982063cdccaf576297a1e97b23c5dc25f4bcc24cb2905e0a52ef32231553339b4954bfc61534e5674d77fa56f61dd74e548a6cb0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T2c:A3mnXoZjzyaEFoeo+aewsAjVG6T2c
TLSH
T18525B023EBB090B5D23B49705BA58712EB787D210B6056CBF3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 4f92081976fe4bc6eb2a0bf3c6d8713c56714fa8454858bb8146523dbcce41ab
MD5 ff63f7bf43399f4f6f26a9af9445bc82
SHA1 793e80a52c5fd933f48f7a07b4ab4e87dc4adc67
SHA512 64a414a1c76f32ed93283cf26bb93311757f8b0b8eef43b360bfadadd22762ced1c1c3f2e1932da32c149f15f3d46ba8dbfd32200870baad07b436ba03aa8786
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tvp:A3mnXoZjzyaEFoeo+aewsAjVG6Tvp
TLSH
T1B825B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 5ceceeee77ad8098a14e8ea75936791d71036f7b8db17d0619d454f358a30301
MD5 ba3ee7779d827784185b9b2474822092
SHA1 3a9bf7f0efd0c087050f930430d65892114236dd
SHA512 411e01f4de4fe33cef3a27c35abc4317c48d1b3bf24030e94af812b3049b980ab4f1af78cd762c751ba5e83b054c3608586be9a263637df5c9160e97e80328b3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TQ0a:A3mnXoZjzyaEFoeo+aewsAjVG6TQN
TLSH
T1D525B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 3ae72425a3c21509379ff11baf68185845f1a454f5f1b89959105ecac3709d88
MD5 37c21b7e5acc6bc75b383bde61e39e6f
SHA1 d31756772a8ba3efaa216d3f3827bd235183ec3d
SHA512 a2f08d2667268ff626e284a68e1fdc5a348391353ee388b92f024f7507d843f046187290c5dcfe11f96747850132507986726e809b0da1a83ebfc101c141016f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TYF:A3mnXoZjzyaEFoeo+aewsAjVG6TYF
TLSH
T17125B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 40ef14498c2abef8359fe18cccbaabdc53c012bef8e1cedcab55863e71e94a7c
MD5 eb084febbfa14b40cd6dbbb09bcc0ba7
SHA1 2066ce7f73c77319b6c9e4e5fa362ac40a1c2e8a
SHA512 ac60e70ad2a73766695a06f3b70dbfba957c6f122cf0892661f50a49865c952947249b276c4491ab09b78322702f1a29d67b6e59420775064ddf131b78c7a4c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TNC:A3mnXoZjzyaEFoeo+aewsAjVG6TNC
TLSH
T1D425B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 10a85634d106c9c896138299d2cd96d1065df798791bfbe0e2c3464c96edf59f
MD5 6ab8be27931d84c811e45f21b152861a
SHA1 beaf6586d278cef97569273f33b9ca02a1540214
SHA512 808d9ee48827e904caa06f3b57085a1a27b962893b97b5d19894fef14270e421cb55b6159c85038790b20e33e8c21aa30a04197bfc31f48ff5557b8c9de38c0d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T2w:A3mnXoZjzyaEFoeo+aewsAjVG6T2w
TLSH
T14725B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 db2d50cf683efcbb801b6d6e7a7556634564c25e87ad02d12678837d4726627b
MD5 a7a643a25703fdf1cf1cce1f2565b79a
SHA1 c005d93aa595b69206ce80dbb9de8c96a89fd0cf
SHA512 abc8bd845dcecfca2f57afed1877d029ec9c807e003e779317f870ce24706a46d4d065b656bca1f8e5e0831368714d8a6bdfe3418e8c02a74824b7cb92102fe7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TlT:A3mnXoZjzyaEFoeo+aewsAjVG6TlT
TLSH
T1C625B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 80afb4cc35d9640cc905751a51597b7ad10e56fa6cf7209867cb6c76b43823b9
MD5 8d945359e256f9ccce45292576c1029c
SHA1 0b2fd24020b85592b4b7c2aee63b34c1d5b25dc6
SHA512 37b646eda3086f3a01c5c9b1329f7179a9ad46ae65de1f41589bd877ea54693372e43b4d42e96a296dc03903a4ea6ee9c0c15c651cef83a190f8acfaeef7d613
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T7u:A3mnXoZjzyaEFoeo+aewsAjVG6T7u
TLSH
T10425B023EBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 0f78e6d1fc4bf3bfc5b6b9652d5f0bfc757e9b35a6567bab0eaf1c52d0ec8c1f
MD5 dff14f002105aac80ac16431a891c31e
SHA1 654dc099ec4c18452e92754468221b091aafed70
SHA512 5423deb47ed095aa0171e1edc6569bb3a11cb72812027814a852af67f37d1ed80579f4be106e3346c70f1f1077ea910973544fdf0c641c1ac0041d4dc9a0db48
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tfb:A3mnXoZjzyaEFoeo+aewsAjVG6Tfb
TLSH
T1D025B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 268432ecf5c641356183b65a1122bd1e5568c0e9e51e97684ccaa682a61bcf5f
MD5 186d9cb77dcef362f63075631cc5a505
SHA1 e652ab7e70ae798f01cd232eba8ba551a934d963
SHA512 7558eb5582d2315b91b88b5c30e104199999b668ffabf70b90420e27f8aa135df6cb3b076dfc98c6b75d5fc28cb0e238c6e400fd64236c97822a3609e1e2a577
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tbf:A3mnXoZjzyaEFoeo+aewsAjVG6Tbf
TLSH
T1C025B023FBB090B5D23B49705BA58712EB787D210B6056CBE36886592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 fa60fceb5616b09efae472cd7c579796d04f0dac722024a88cbc56ba4a288892
MD5 c4fd4043adc635cc2eda57e7a2a28fc4
SHA1 a7a66766ca04e71712775e56e2fc4094c9c5d9c0
SHA512 72f80ea67a0c3a42ec70a8d91274f427187c43753d4bd76b292776a2a8b8e57c514438658578af085b5aad3620501afcd8ed17b38aa776211cd2f9b86f1cec02
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T0K:A3mnXoZjzyaEFoeo+aewsAjVG6T0K
TLSH
T16225B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 e0a80d605ddaa373a0983c2b442506f5f5c7327fa3310b076451901314a03f18
MD5 06e29265390812f5aadc0d126d4709b6
SHA1 120fb030b12db330965201ee930a5ec4ad89830e
SHA512 ffce27e52e597e48c6d40391f726343b97574b92043fc7ca4f01043beeac726760a307a400efd4ae94a930ff5c038a7ebbc5a0ae931aacab261b8b2e76045b6f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tpk:A3mnXoZjzyaEFoeo+aewsAjVG6Tpk
TLSH
T1C525B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 12c168fd4b664bc9049370d52618e5e19ed10f5b075a8143788e3dfa832caf2f
MD5 c3199779bc14b533240867ff83bf7751
SHA1 29a176de82c497d12e63a8ca3ef5d6031f99946e
SHA512 9f964c787f744322a51fea49410c0878a436946e5bcf512eeece88d46c32f124156fb216a0dbf24ebea1ab278df8b1e9289d08eb89ba02c34d62de6aac4a70e8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TG0:A3mnXoZjzyaEFoeo+aewsAjVG6TG0
TLSH
T15725B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 41f929f99716b75eae80afd531f90b51f058b4b5fb9e1318bbceec38b686a88c
MD5 ff4e7c742e3d729e82eafbba2d1f3c19
SHA1 098ecb1e7422ddcef1b59a05d8575e0bfed5e8ad
SHA512 b561a3585a1ac166ed5f9d43b984896286da6c4b28bedff194ba816927074eb798fcf53c430e67d05e71b69354df5ac14924f9ac4cfa38e9bf66410166e43ae1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TV70:A3mnXoZjzyaEFoeo+aewsAjVG6TVg
TLSH
T10F25B023FBB090B5D23B49705BA58712EB787D210B6056CBE36886592F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 734d509ca14f269753c8be8db1a4976159d65e4dc15ef1eda9179b3b4bb9910a
MD5 3da920581507ee118a44019fc40e5f75
SHA1 fe25bde49479032a210901218d87b633cb521665
SHA512 36121989b6fa4a0e84177eb77e63165c15e7ff02fda20cec5af7c56bd13c0def7a97ccd5879a53499432b7e14c36d9642baf2d5341bc889cd5814f17d4ec8e22
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tkr:A3mnXoZjzyaEFoeo+aewsAjVG6Tkr
TLSH
T10F25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 d0ad73725a6a6a21a6ffded05a4fd923da180a2766d048118dd392a78cb52555
MD5 03abfd87de81b03ca4274e0463b77a5b
SHA1 0e7e610348661bb30778901970711e9c454b5cbf
SHA512 4390dbad8f4c5aafab6503a57587570a20bf712aad380bc1618d72cbc07ad2530e0adf8868e6a9d23efc60a01b0c87a91fd1748ac2c0f693567c5db070ada236
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T6n:A3mnXoZjzyaEFoeo+aewsAjVG6T6n
TLSH
T12B25B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 9925e04e5f24838a00fab8a745473cf5dd194c976a11beeca3e0b889d2406c8f
MD5 3d1a3cb6e141ac315ac32834d71f77ae
SHA1 fdf47c34f756e02734b3c16796e5f6f80fd5e54c
SHA512 4891bf655252142e99d4c5e6212b043eb48a94d964d70624c1aeda36aa20cb16b229a30f1724b84f52ebbddd254f9e533170f2eededee251de228b5922089e79
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TQx:A3mnXoZjzyaEFoeo+aewsAjVG6TQx
TLSH
T1DB25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 bb212cc848edc356061d045fc62e680083a7b1064b8d678516ba103a2e15231d
MD5 feb53e1b10609b14d898d0ed706ef370
SHA1 23d0641e28201a9aa899da3185ed918356ae4c2e
SHA512 15312e71e0beab65d2d30226977345d2a67634783df477e3033d2b504457d4bae5b257a9abbae9151d4d521abf7b0f40587251a7211428477c52fcd76953bad5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TSA:A3mnXoZjzyaEFoeo+aewsAjVG6TSA
TLSH
T16B25B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 f0899b4dc6d92b13243ea11a7edd6cbb4d38671435c2633095b836e54015b231
MD5 1b3839792fc4aab0737c8cddb203f687
SHA1 5c8240076b856447159f59d5b08755f8fbcb2299
SHA512 ff8dc55be68dd6228e3ce34358bc5dc76ac890d4c573682a97a3483f2525c6a782145d9f031d811b12a70bc9d037025098ba09a651f201dd53bb0a09488ed79e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tr9Q:A3mnXoZjzyaEFoeo+aewsAjVG6Tr9Q
TLSH
T1B625B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 ce040464d46744a58b4be63d5b04a1309ccea32c58e73dbaba1aa3c1b0ba0091
MD5 1f4b3d984604412d1a8e9d72d9a84783
SHA1 5bb50be18ecd90d0fe288fc2722a4bf6811a30ca
SHA512 6d977981eb85cb82c30bb7a3ca65d48fe2747e8582f7da4cc346476e3b229358da9d952623f475ee0eccacd159562ca2b573959b078ad9bf35be06eeab3c9d66
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Ta4:A3mnXoZjzyaEFoeo+aewsAjVG6Ta4
TLSH
T1BC25B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 e3978d5753465f2a07516c4ed04e3dc828b54b5cd808238c6a6112888b66cfcb
MD5 ba723c47b55b073fc3320635ef7859c0
SHA1 85e5f3603c1df9ee1c93bfac8868697bdf845f33
SHA512 0d685ef50531d153e5d311a10206602c2380c8b2115f935ec537c5334efe04778c22fe4ababba327bbfdd4132d869cac5c5572b66932a498f1cfd8863cf4d40b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TBu:A3mnXoZjzyaEFoeo+aewsAjVG6TBu
TLSH
T19325B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 a4497689915e6b653f999f68acdd3ca14f0e2f53ed2da2fabe8b33dda5a8f758
MD5 9b5f9d25c5112575714d3964971dbd19
SHA1 fe9c14fe9c37812d35f656c6c2a4d609182d11b7
SHA512 85191f6ea827cdc20f43f8808588e679ae9a30b52c0f5b448be7355f1cebc5d9c0a29b91d6c35a83d4898213047601f53d8534db8f6b043d88e1463cd04f801a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T0j:A3mnXoZjzyaEFoeo+aewsAjVG6T0j
TLSH
T14825B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 ef9f445b0388aa1899d520985f0d3c36422066621d41a0dd5d10554d2ebdfa98
MD5 9fe2d900db801a53f2fb8ba9a9e17ff2
SHA1 ee7acd8bbb549f41870accf2c0eb6ef0880abc42
SHA512 49a479462ea3b8eddcf7b6408f378e1fe7202b7f48deed6cc82f470a360687ab3e1738762c10a5366ab2f3988917da2352909affe8239c99b3677f19b2ceee59
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T1g:A3mnXoZjzyaEFoeo+aewsAjVG6T1g
TLSH
T13F25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 da23cd5670cffa1796980c3873e963b546f5c2972911783100c3a15e710a201c
MD5 8a3337980f90802a4e077e0986cc7860
SHA1 1d2886d04d00253f048853e0a0f92db169bf2373
SHA512 fcb069e35d2b80b5889427e31aebdb94b51f64036ff7abe107ceeee7ccd40c07d312c2180d0df179726be19a8421b9429fe5f02cba5dbf57cc867da18e68cfd9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T0I:A3mnXoZjzyaEFoeo+aewsAjVG6T0I
TLSH
T16E25B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 77a1a749108869901fa6b346fdcdf94d2c2c28e20655025a5ea2d736e68a2c6b
MD5 d5ec7d6c3abc91303ac8c65fcf8dff4f
SHA1 b1e4ce1fbdb4e531a56828db2ec9aa913133e096
SHA512 3bd1acd66c8d71b85548a41500afdcb90b053356293232eff5def508a455406c58bee1b01b4761800e29edfff66ff5c647a5fbacdaf16eda83d53f2053d2d409
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6Tmo:A3mnXoZjzyaEFoeo+aewsAjVG6Tmo
TLSH
T17125B023EBB090B5D23B49705BA58712EB787D210B6056CBF3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 0238894374da9f1474571f94ed2132f4ae8b38ed43203ba8d4eb71d419b924a3
MD5 c48f8da9636f1c312e52174cd1f0c5ac
SHA1 17f6572e1ec4d143ebba07adb6a1187ef37d6d69
SHA512 ba809629c17816e15facef9b9b443cd946ecd67cec4f0d79594907ad4b4a86c127e33ef7f7c7dabde6172326d7911d804c7f752667f4bd88518dd1cc1de4a84b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TN+:A3mnXoZjzyaEFoeo+aewsAjVG6TN+
TLSH
T10125B023EBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 81d0dbefac2993ead4335589936bb78c0d7466a902329ee56d0ffb4216e5b0af
MD5 b6f5eb1f6a530c1769c9c5f0e366836c
SHA1 c8291e7ded5e6c18c0be617727c7433c7bf1fd46
SHA512 7efdc85491df5c6eb6d43afd4a2339ecbec192ac3674bf1db3fc44f280219b1f3ac4519aa334a84aeddce5ac1d8bbc2630045224f616d8953292e855cca48ffa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6T7Q:A3mnXoZjzyaEFoeo+aewsAjVG6T7Q
TLSH
T10E25B023EBB090B5D23B49705BA58713EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 8565b7b00a474bc64559e9616921fcea47559552fcc4563087ee15f5874a635b
MD5 94c4e11ef41459065c293f93c581f695
SHA1 1e8968eb20252f56e2b4a7767a16d3f90281482c
SHA512 8f77d99c464c5f66b9dcccedc71a0f25c55e0c4724ff0d4ef4dca88d5b9ea4f7dd92688ebde83fcc9216e2000a7a01ce7de2fc69fcb9a2887ed864bafb55921c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TwX:A3mnXoZjzyaEFoeo+aewsAjVG6TwX
TLSH
T16D25B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 1df05d2e014b28d64c457b47bb35a81c0fca979da7783de83015c9f226bb2edc
MD5 4ac20146ecfa574a7b27c93abc9ac48b
SHA1 07791dcdbdf34871bcb8d76adc328438b66a155c
SHA512 b8d8beaeca28ccca76c8c5de2d1ee8b9966d6471bdd99a19b88a4b1678aace100c5984f943f80d3b3358c6582057ddc51621cc2f303d2a6055bac3c59e8982b9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TGL:A3mnXoZjzyaEFoeo+aewsAjVG6TGL
TLSH
T13925B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 93148c85775ce26084a0efd4913c2eda6deb4760a2530ccd8d2b14be73c8d26e
MD5 8d9ce2eda99d3a8402f3277355ee99db
SHA1 ae90c320908dc7f861892df8767c433b033929fa
SHA512 3aa922f10c3bfa80c721d2d236a8bb37327d245ac5e2cef4ab74d1b3634c997ccaeaf29adc8ca51f3bec4688c606aa9a5fbaf4a4661bde171543fad1fbd89710
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TaFC:A3mnXoZjzyaEFoeo+aewsAjVG6TaM
TLSH
T12425B023EBB090B5D23B49705BA58712EB787D210B6056CBE3AC86591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 c7013fe64e58974dfb28c75d95bf7884dc823a4e574f9e978523f240593824ad
MD5 91543fb8108695a701090775fd24e6ab
SHA1 dc0f174125e2f6d778212100fe47d1536dc4a277
SHA512 2d34bfdbfce9077c5875eb47365c48b6fa60f309065e086d9c8679a56238f1ceaf930f42431fc3286f6b6cb28d0db870fab6d9af3e1497e24a7397c8d7399b1c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeoNAwSfxL/2Dc3jDLLmt0LDQewsAjRfG6TLh:A3mnXoZjzyaEFoeo+aewsAjVG6TLh
TLSH
T18C25B023FBB090B5D23B49705BA58712EB787D210B6056CBE3A886591F317C07F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4852-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5500-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5500-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads