875d6c85ee8d14f4f47b500d2b7c2c51e22193c94840562d87689a6a69278963

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 28.9MB
Sample260629-begetshz8y
SHA256 875d6c85ee8d14f4f47b500d2b7c2c51e22193c94840562d87689a6a69278963
MD5 fbd8f433006eb835609b4a25982c8477
SHA1 629d184648eb35269942a2e9b3bfe8b1a75f544c
SHA512 eea0d6454b774830bf2a10aeffea4108c41131e940227aba15592faa361f46ce5904f4bad001bf207f7a201286e5fe3828c707d678c5696e0f59d480db85bb84
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/6:aj
TLSH
T13E674991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4924	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4904	2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4924

C:\Users\Admin\AppData\Local\Temp\2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-27_fbd8f433006eb835609b4a25982c8477_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 28.9MB
SHA256 875d6c85ee8d14f4f47b500d2b7c2c51e22193c94840562d87689a6a69278963
MD5 fbd8f433006eb835609b4a25982c8477
SHA1 629d184648eb35269942a2e9b3bfe8b1a75f544c
SHA512 eea0d6454b774830bf2a10aeffea4108c41131e940227aba15592faa361f46ce5904f4bad001bf207f7a201286e5fe3828c707d678c5696e0f59d480db85bb84
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/6:aj
TLSH
T13E674991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 58.0MB
SHA256 0639e9970655d3f6598f886964157d72e38aa825b48605acedfbeffeab756ff5
MD5 9bae691f6e72b52a679bde9060dc8631
SHA1 35c0c976b36c96bc64549392247027d048f0f021
SHA512 44d21b7841c494218043832706a65457bb326099826e41b491699bd190c66f62f38b0e2f9d7e1c3c94d5cf8522e092ca805f420ccdeb9aca9d346e6a877a4340
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/l:aGz
TLSH
T18BD74A91F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 57.8MB
SHA256 ca085aa968b5af92a78a54bac7060792e34b72fc80d4ea22b4e3c8e4242adc7d
MD5 9f255ea3cdeec242965b33501b21fe18
SHA1 3386c42094d74c2d392c05b0cd02546be7b04962
SHA512 678620d23f908578c28fa79542d1d13f4d3cf55749bb63e6c538fb56753169913160dedbb73f67ef6690b45e2bafc9844f9290977044187252e96208ccd4df4b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/c:aGm
TLSH
T1D2D74991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 61.8MB
SHA256 8b87e1b57520ae48312613a95a7ee1d530f3ec199b1668b10a56dc07385cde6f
MD5 4aba7fa4871fd6ed9d17612d391b1eba
SHA1 dedcf89c3a38415bc58c6fb8dc680c7bf13d9f39
SHA512 6ddaf5436e83b3cf0395d20bc7a143914ac5a8e9bee74843ab1ea38ff3b33016913024479d5561912e9ff7294aa9cc44881f66ed918da0a53df27d7da6cbbd27
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/N:aGyvyEYKbi
TLSH
T14FE74A51F5A081B1D07A8471C6A6A77AFA3378411B708AC79386DB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 29.2MB
SHA256 6565d89b02fea9e7ea6a535dec21674f3f5114523fb63116cb1629d797b174ac
MD5 710a49bdd731d265c11c371a4a43cf61
SHA1 da8da921afee66a647729d2818f103129fb8301f
SHA512 5d0470488b272a6ed9b0dbd8da2f77842568915206e376cb4a9cf2271695e60174ef38bd3870554aff0e041d6af0200a8715ab7d316362749c5d0df84895c9d3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/r:ai
TLSH
T187674A91F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 57.8MB
SHA256 65a1653b59d12eeffebbccaff54d83a7829137e8c8fb331ecfe67b588ae9bc79
MD5 cd9be6172315101ef01bb5f98ab79214
SHA1 1f0198cc2ee211bb3805d54290839fa24d6cf516
SHA512 99c59f0db290b70a85f170c06c762e3c0fa94e6e85deb7935475c511b5e1aa092b46ffc829f6dba34d5f7d25bd000d6c0144d56c3ef92bb28f5c9439bc314e10
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/G:aGE
TLSH
T1E8D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectUnblock.htm

Path C:\Program Files\ConnectUnblock.htm
Size 58.3MB
SHA256 649d6377e5c4f440ef21b8e0f1e884851dacbb80cb009dcdb805fa8a0db572e3
MD5 7712305acbdf2c07d1846d6d00e5420b
SHA1 7090ed84a0a99c7cf43ea77ff9c4f3ecfacf63f8
SHA512 d566c4357ff4f0bcd14794b1e262e06bb41edf2125502ee734c8fa774f20d70bfe14aaddc176aa7ca804d3e221d781d37cb1ccd7184b38cf8d130030f1a8ffdd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/A:aGdg
TLSH
T135D74A91F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 63.8MB
SHA256 8c33ac5f1dd32c9c755968e5224cc1933788b7d89b5813633daf90db41a93a30
MD5 dd279991ad44b84e2d2945d16ed94330
SHA1 aecada7c23a064f0b39590d9df8d0ac3f624282e
SHA512 603037dd5a5024ccd205770b36f7db80d82d0e5a059e00d44efc50b4b7ca60d61cfc75067e882a71bd6762c784534b1019375a0456dc959494432ae71b903b1a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/e:aGuQsas+PS
TLSH
T17CE75A52F6A08171D07A8470C6A6A776FA337C415B708ACB53C5EB7C2F366C09A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 59.4MB
SHA256 608bfc942145c22756b4bdf386e28dfb05dc35cf351c79320c3266130dc46032
MD5 40f4fc5e74e69f3a4cc1738f5a64225c
SHA1 8e13ba0a210268dc6c05048fa8d0d440062c3985
SHA512 e70c8c74a163d4e960b6ea61633d1c0bc37fb66381cf90ef0dcc589278e290801f1e531b0f2273705538c87c693314550dae40a9beb497a8d47b31c05f540335
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/M:aGe/
TLSH
T17CD75A61F5A08171D07A8471C696A77AFA337C415B608BC79386EB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 61.2MB
SHA256 0b02708aa5bd26a28e3b28308c596c1ce93113c893b1deb00ffa26c44c1b74bc
MD5 08a98ba42fd3d3ef5082b12c7f4e1a84
SHA1 afba229f6e909c7ee09bd3ce638736e4c13b6c36
SHA512 8d75491e43dd68e2d84053174b8f5e11bed70e79b87337a9d7b20bc0866e3a2dfd8b0d471f48723e9d164f01249f72a43ad41c35cff3565eaa98d02f91eef9bd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/k:aG8+6
TLSH
T143E75A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 59.6MB
SHA256 58333c55a03d9d612c1536f88781a5bb03f9144e17f2053dff39c5b6513962aa
MD5 906b2d641bc6bb1b3a33b3448fd9fe4a
SHA1 8b97aa27d154b755ab886fb5203f228cc1a64b81
SHA512 08dccd43a1e4f4919bc562456c4f2f2b88466f6943e27e82ad26585cd7de42907e276e0ac0bc9dff12adf12e1299a51c4d0f751c18be0705ca1a07b4b23b6f29
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/T:aGHC16
TLSH
T1BCD74951F5A08172D07A8471C696A77AFA337C411B708AC79386EB3C2F362D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 59.1MB
SHA256 49255e6233a4485b8065436f946550307230610586619c4b26ad5c99293e7238
MD5 9516dc76014a24860d3431c8fdef7bba
SHA1 501498b3e39a87db6f5a10c150e85950246b6717
SHA512 76908efeb07cf43b774e64baee0b2e74689fe3874aded451439aaa4459d255269216d5d188a470765e9fcf795278f35fa33897b3ee55ad1445423fb2af5ee339
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/A:aG90
TLSH
T196D74951F5A08172D07A8471C696A77AFA337C411B608AC793C6EB3C2F362D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 57.7MB
SHA256 737bb12201e10b80b87f6da8b4187e37754eb90f6fe50bd321d33c360f22ee53
MD5 d8ad71754d7bfe23a38001144a47b672
SHA1 46109eb9c73e1e69714b9dc8613e6d335e074a18
SHA512 6238119c5b29f827343077016036455cdd59e9edc5ee23db0c296d21ece792709ffb6401167caa7a555d5c78cd99233e8d8b126647d5be30542774a37b37b839
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/H:aGZ
TLSH
T193D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 57.8MB
SHA256 2187dbccd221b503ff05ae2a117e8f9a68a9ad61d0c851f130b98f4863215bc7
MD5 fb587ffd22c986f536944828032b6c00
SHA1 a33f287fcb840a67c31b5814c76ae4e046a4570a
SHA512 e0f31030805d7c46b8a403b0e3b044b18074b125890476e38c25d560fccfac1e03402de7a7ae6af0e7eab7b5d15f02092fd7de332d5cc0149e8bb60b28050abb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/2:aGs
TLSH
T1A2D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 57.7MB
SHA256 7e3d92d9711b8ed8221f04f625e06f12efc529ed8f728511199bea14f8774f00
MD5 ce59f6be923a8421fa292e63eb6a9932
SHA1 9962281945e8e59240cf3de10041ce43d544b9ec
SHA512 2819f709ac37edb5a2b8f34b6992148b5742d360efeb7f3a6ff41bcdb7776383c03441bcd147bd0fe30a911598068690e7ef6f936b7eb7b0e7e7cdeac617bce6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/T:aGJ
TLSH
T1A6D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 57.7MB
SHA256 21acc6ab1695b082ee53bf379a3b85d6960b97ea48435a0fa2b733b44eb81eca
MD5 5d5dc4c39cb5b82f6fc663043ee8d9fb
SHA1 c53a94f89ad29dd382db5ec10b4b8c972a1d0591
SHA512 9b1cb31065e43c35b96e85f6a9e2e04803014db36d0849c3d8fd02b67e630484b0ae3724ba053b15cc900207f6a2292a55e7959688be1ce4442c0b4a720c46b0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/8:aGW
TLSH
T1DDD74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 192KB
SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
MD5 e58d1ddcb93a535eaace748468f77af2
SHA1 34925438459a8705b0e90d9b5779633b073c175c
SHA512 5ea24026af3f98184d03eefb9c2fe551e9d91157d2a1a4467729f7e3982c0b73825c729048b92464920fd0c1127ab9b915019274710d1efd3facc314076a1c19
SSDEEP 1536:8ZHGPeg2Sv83fH+5MnNlP/2xbYqrDA0A3MR:8Eee83fH0MnNlPubxrL
TLSH
T14314A6E189C0A0E6FAD0A57060ECB33965BACEE5B70047CBBA17EF618E6E5005347D5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 58.0MB
SHA256 1159767b29953e440719f4a04c7364b855a2d36952b42ca8e586ff2290a16cd0
MD5 2d51d3fc0de3dc64e4f7be6190a65902
SHA1 31ed633686d68cd6b2a0614a4fa17ebcfc449cc7
SHA512 632fd40d12538cb21ff6ea40ece379fe08ff3bd7378e12b0fb568926e04abff22e1d3ba3f16127f9807027dd7ca559ba7d55c151a932a4be3edc1a149d58a012
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/B:aGkm
TLSH
T1FBD74991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 57.7MB
SHA256 1a10a4903e2b79736e554236d2513d2cc773514a613b25fef39dec0e144dc06e
MD5 2e48dab956d11ec2216fc0cd43fd230f
SHA1 aba334755eb2ff3d11f2250d531658ab3889f327
SHA512 a154406855fa967f95ef82e3fb03004dd67cb9b74c99bb094f768186adc1f5bc4764ac3b4cf0f80b2aac0eeb0e5693a0031ecb2f4fc1b40375f1f95a0f5ba424
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/6:aGY
TLSH
T113D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1024KB
SHA256 ff483a46d7ca4d215c9269250cf9b843c1e1c633c44403f8a0c686c9140cbd01
MD5 49c5bbee32eb3955073aca223a66fb32
SHA1 8e5d65a62d33d5aad5e2a815047cdbdbb7f2c8d1
SHA512 fd5cece5c57d159545c720e0ba137ebbcf52b39c80c799c7004148960893f56386cf189ae0e63a8ff8375de04f8907d36061d606c54006ce1894aa298416bb43
SSDEEP 12288:8ESvdPZD/JGMj4IwHfRlz6YIfrgueRug09fkVJjBq33vb5O8q:tEBDRGo4x5x6YXuquvkVbqPb88q
TLSH
T10D258ED1B5D180B6D6A5553084D9B736EA76FE8227208BC7D353CF182E272809E3773A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 57.9MB
SHA256 2d122c3dd2f40564e281eaff2b577318bafbffe8baf485af8a857c92a44a34a1
MD5 1dd68c3b709cbe757de4460ab495c215
SHA1 47c2aceee000085d95930a85055588dabadabc43
SHA512 b10d4f31c04ff150a4b6c5e1822c2d887ac85931ed6a27ade8c22d22afa556ef6b30a7c6d5d324f29e373af586a17c0accbb798c7bc6882142769d450802c89e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/S:aGk
TLSH
T126D74991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 57.7MB
SHA256 02c42d947ed5814199407548fe607289dd772df4962cef6412299014416ead4d
MD5 de60e457cd4b726ff51eb99260942c77
SHA1 2c871c25e555e7b2064e9963ba40cbf778300afd
SHA512 cda0a674e903e3242ee1a02a7a7732783ccd8c2a1c2920c92e4643001595ae3dc37fd99dd6da47b42bf83ee865b41d38a534befd3620f99ee6fd742c080c0d38
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/X:aGd
TLSH
T18BD74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 57.9MB
SHA256 538e4d48ae1ded316a39f9a5afd80166e5a4a29c3df649d81dd040286cbb597b
MD5 b492f44e9201ac747715bb98a8dd9074
SHA1 192962d266442dbc5d3b76c832e12bcea10c09ed
SHA512 6da81c5cd92944ab3e32100f6fbf8a1444d965c2bbacbc2036b28dd9ef39d7ab450069a7a6631a4070d7e031b4409ef488589c385dab9786135561793363f71d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/6:aG0
TLSH
T197D74991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 58.0MB
SHA256 ebda7b54631c842f039c214e1db2213b89e018dd1f4ec82600238cd0e80f8122
MD5 95ccd4a6fd14d65fc07c687f2e432603
SHA1 1b64c5dd46b08f4486f9415cd15fb4dee4cf2a12
SHA512 aa7bc61a623a5ca2eeed1e6a16042a63fd19d232140dfe0327abc923c29915bd50cea6a5df2c08c5be21a4db580e155541884e02c677fca585aeb9d8329d70cf
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/W:aGG7
TLSH
T1C0D74991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 58.2MB
SHA256 f9917a3b9107ef22059de9d0f0c309cc54faa6233a9303ed7a5677fd1be21a0b
MD5 09b692e2d99f47047c18de0d0b2e59c0
SHA1 dd9c85be1a6737d136a9284f453a4f7aa3e0ab80
SHA512 439e890328d99f99fabc772fff5a3036c15fee7d5ffb4440b683a0ecc4082112253bdd377369bd960df574fad87f0be35a2f5bbbdff4a59dd0ae16ab4687da4c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/1:aGRd
TLSH
T174D74991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 57.7MB
SHA256 2a6131581e652d7cc3e8719b88ca531521955efc69c121a1cbdb6b4a5111d03e
MD5 a921ba9ec262e13d1c542e15fbc82714
SHA1 d608b0f3a6388a0bd1c1945ceb96e2dd5fd66b63
SHA512 d91c11994855204e53db3a46e071dae96a79f0de2e7fe93ae25f36250cf6237bf33c5cb8c3577d773e78283512627148527d476fb89f26e54015bdd537736ca7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/U:aGO
TLSH
T18ED74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 57.7MB
SHA256 e60a423038977b0273cc0f18f3fb960d66d7283f84ae3e42817f2635d64db9a7
MD5 1a2ddbf7e514870b91b3f1ef6676b0e5
SHA1 6813e1ae8ce20266b29e6986840330a7ae846108
SHA512 648bdef531e4d9ab2ecaef7ec322092bc1aac4904805199c4e391c7d4678802840da19046be10afc41ed8d4329ad6fa3d77159650d9d06763834a98728d0b8b4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/9:aGj
TLSH
T19AD74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 57.7MB
SHA256 4dc62f51b584a7ab0a82920ecb961e5f88e5b56567218d058fcba952caf02590
MD5 634dee0d1f2e081967708dc83a6cc7ad
SHA1 9096b5d10b8321bd2e3a6296ee67efc8750bf88f
SHA512 9861c3fca285befb5e81ad3a99d068b7c5f98d9228d0a44d1650474cbf1d26b03a0626c12a215c743efa2e5a7f1429d383f68f35305619d73a21c4a63a2d5f82
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/8:aGi
TLSH
T1C1D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 57.7MB
SHA256 2710bd707cc956627385598542fb57a76698510d6622d179962cdb058df82dc8
MD5 51535b18d0ea010d83d8db2d1f07fa2b
SHA1 9801f745852b2b20461956d7bb864deb86b4ee8b
SHA512 0d47b0291644202eeaf6d66a67d776c8aff49afbecc6e19653e5b0d1e1bfde64fb99c7afbc1e20dac04c4a47d1648e6b7602b4682f9157de1643811358b42912
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/V:aGT
TLSH
T1BED74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 57.7MB
SHA256 d7e54993ce547fa7ec3b56ba8213f0e75d97bc647e8d0519cb22a48fe6e6def4
MD5 068969c9a2163e76be3c9dfa2da4f403
SHA1 43f15f1a86fff6a5840b6c0e719d9c470be9e9fa
SHA512 df334fa63eac6d8e3eb9719b9494c76ceecdbedcde58dfe3eecf3992aba5f5b1843c24fe6cb8a4d48e33966782d1f514f14d7d92f44853ee77fb80788531fbfa
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/O:aGA
TLSH
T10AD74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 57.7MB
SHA256 e5ced0ff42191b825507f12f5b192141be292b1380ef9ff2f676e4cb178ab830
MD5 f575492242886387c232bd608e84acc1
SHA1 7a22e5e1dccb7a915415c99db0d364910c18398f
SHA512 9061a9675fd9860d35b5a6ba355a2fa0cac31bf55166161c08ad16d0b6f16147a2366446190c27b2b3db357595cb365d0e05d58b0d5d39aa0cab7222a7f57886
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/4:aGS
TLSH
T19ED74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 57.7MB
SHA256 06f065b6ac1640b61c4a9a2b2fc82cc5141458974a1b1e77125ffb9ed1aee19e
MD5 3f8ea75e18dd74b7f8d8b3ca24669d3e
SHA1 c6072103c6d2007efea0499a6550277451e610ad
SHA512 70feea2ef716dc4f1760ab37ad5cf6920064e4bfcf6e432da41ee091a27ac7a12b64c1cdc4003003de1d3cb1da6b670091167f1710394a8ad3d636bdff666cfe
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/u:aGg
TLSH
T1B0D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 57.9MB
SHA256 c95eb5c533af26fdb705ad05c66822b4d117803c5ce8904e2edc02e6e4dc01f4
MD5 2be15a19b58a5631d8544e6b3e98e8f3
SHA1 104566d22ae951bff804ee22d8bcedc5d80f6241
SHA512 8e91ab725c76ff0f3a11e125714a5f8a85b25e73c0d81e22b66f85ddec0e6041728cbc35a0f0835c06d6c910673640e34d3eaafa48dd31b0667d650b538d1d79
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/o:aGW
TLSH
T176D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 57.8MB
SHA256 2781a7742d25f44e11b2ebba742c5e76327e4365d48c9190f13f07dd57f37980
MD5 3953566b0fdff67a63a911b3e7b1e564
SHA1 147c98100c9d3bb993a4716dbf0cdb1726ee11f9
SHA512 fac0ef3b18c29a715aeabfbfba3d619626550e989953353931e9ed1ecbdc276c774016265279072129718db26780d3dcbcfa811418b09447a68d262db3b3f6bb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/A:aGu
TLSH
T1FCD74991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 57.8MB
SHA256 2da335cf0cf2641946c886fb1233e2ea2154ac846ee7996c3be506a9de439f19
MD5 18e0ecd8707ef9a1fe7943b981fb94d3
SHA1 48b630d8a280a85f4d40df7f1079eeb65272262c
SHA512 6c2f626e88e15900977e4099ce4cf09c86bff19b4dadf19f7d22612bbefe69b13ee500eb0bb31e900530621ebc9f60cf061a2459fe73228da9a2d76f607e4002
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/G:aGej
TLSH
T151D74991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 57.8MB
SHA256 b00b683696cf525e236c86e7b09e4f4a053fc2658d13decfc0134920b263541e
MD5 ee9306e39ab6ad42a3319ebf258a9676
SHA1 483f2f5dd5d366fc3815836ac52603b663d4af19
SHA512 0cfcf841a0a95472679c1da6152e918060d961ef9ae4913f68b9c26bab86510116b1a40ba09b257f2980d51afe27896298133b3a5f375adae046763d5a18bef1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+Qw/h1+cw/I:aGED
TLSH
T1E0D74991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4904-23-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4924-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4924-4-0x0000000000400000-0x00000000004E4000-memory.dmp

Download