Analysis
- max time kernel
34s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
- Size 39.1MB
- Sample260707-cgjteacy2m
- SHA256 3c3998e9d94642b1c1fed65f9347915ef14e2bf35e2a7a354b8f6faf3471fd89
- MD5 9b3a251705e7aed5e86844ac620d24d0
- SHA1 03babe8570118456655672178e85d28dafeeb779
- SHA512 7c873af627b0571244b7409748e58cf39dc820c2de3d500ce0185c533d9eaf9d622deb7eb130febb2c3a327df59c2684afaa97d8f4b6beaab47febd1b9b659ef
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68m:2cD2cDtcD2cDulucD2cDtcD2cDuli
- TLSH T190979E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe" 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe" 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3052 sihost.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 5944 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 4752 2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5944
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exeC:\Users\Admin\AppData\Local\Temp/2026-07-06_9b3a251705e7aed5e86844ac620d24d0_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4752
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:3052 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:5080
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:704
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:5032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 39.4MB
- SHA256 91057d43cefef7ca3cdff37a8264dd4249ee8813a3b5232d7040832f70d59d74
- MD5 bd7ddab054b410a3c860159ba10a7635
- SHA1 ec39d7f40e9e1875aa7b29c116c369abb29ed442
- SHA512 c8ea02c3d9d200e5186b4f6949e28d325e59d8c60e6469bde771ca7cf875051bca0f7cb37d0f7635e4bd5d90169a52654180449ed70e92188bb1e175bdaa0c49
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68O:2cD2cDtcD2cDulucD2cDtcD2cDulq
- TLSH T187979E17F6A444F5D17A99308A669332EB72BC110B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 77.3MB
- SHA256 d07b4efa05cf6f8e4fe4ac360150d376322ebc5986bc51da9e53e383e399dcec
- MD5 8cc4cdb4195179f3a174799cf0a3e6d6
- SHA1 4bde9eeea64836cf210d6d1e5e0e06f44df1bb1c
- SHA512 ae74a0cccf2381694656690597d95421e590b49678f50c77f1926d7ae75b67ac8ec064ef797a7cd9a11e53b7fba2d1ee9d373e00ac0d2eb5a27b1cf02ba1dc92
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2cDtcD2cDuh:tZ6ZyllZ6ZylYZ6ZyllZ6Zyh
- TLSH T1C4089E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 78.1MB
- SHA256 baa474f68eb7d5a495144fd9d257524663227a87c0b721c74cd690cff1cf61b0
- MD5 1a9f272d5b258905fd549ce1dd959b5b
- SHA1 68888ceb83916766b7edaa583f86c394e530f97b
- SHA512 ffcb5eac254ba51d837c7f42b81ae9695abaf57838bf84c2dcc1f14d3a6e8b915afc60de5c3530b50b98baaf46e803bf67cf70439744bce5911fa374f301d525
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2cDtcD2cDulh:tZ6ZyllZ6ZylYZ6ZyllZ6Zylh
- TLSH T1E4089E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 72.9MB
- SHA256 1767a69058f56fa25aa7ee38d04a728618668f55e37bafc24b1a69fa8c355c33
- MD5 7aecfc098c26c337e441cb24b86c119b
- SHA1 d05cf6b2df1f3e943b9d2374ebb2fdd273638f86
- SHA512 675614d5e79db43ac3454f0911b5c0514db07da9b9dbb3dfa7665dae1c35b5f84609d907e6187f6ec07b23a9885821d107691cd81a35319c1c9f686eaaa2a1c4
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2cDtcD:tZ6ZyllZ6ZylYZ6ZyllZ6
- TLSH T1DEF79E17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 41.3MB
- SHA256 e7858e7e97163061f4da86a0edac02451d9ff81f3ef2212e5d1e950d5ae5dcd3
- MD5 1ed2caeb99c245384e308f3ff826aea9
- SHA1 5e8087b4e1d0866b752dbe9901638e1fe3630d66
- SHA512 9aa8d9050a03b34ba055491657b52f677adb6de0f03423866724b11b90fe2b3a8c1ab798c0d4c149ca0f9debf5846f8a5d6d2e0159c09ca881416d903b2c8964
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68t:2cD2cDtcD2cDulucD2cDtcD2cDulaG
- TLSH T1E5979E17F6A444F5D1BA99308A669332EB72BC110B3197CB43A4F61D1F336D06E3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 69.3MB
- SHA256 d50b2cd6ae0a3eb025ebfea4eda8f7bafba6bc8aea83f15d57bea9b782ac9829
- MD5 dc54447430693fc20d51b79239563ffd
- SHA1 2bc135acf0828243d3f2a8f351b5cd50d0a1ae14
- SHA512 014e1a3f1296cbc8b40d87ddccf652401037a3c760a81ec9179091b82ed5656ce4f6918c9a0cf38e19bfd27f5868a23754fe66d0251d3d30c4081ace892333fe
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2cDtU:tZ6ZyllZ6ZylYZ6ZyllZ2
- TLSH T14DF79E17F69444F5D17A99308A669332EB72BC110B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 61.5MB
- SHA256 c289d4878edf545259511a175788a1896b3fe113a7eed74b56e9dae13cebd9b2
- MD5 0e4421ae264dfa6afd159d1fa161c997
- SHA1 32ab149343bd9c4dcbe7ffbec0a2c87988f30ab7
- SHA512 99e8cdac56ff2d65eb49da8914da569294e9b933d54863f25c1e60905595792696b380af980938484c6d13ce4a195d6fcc2dc17709343d4a1ed07795ddb198ff
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucT:tZ6ZyllZ6ZylYZ6ZyllT
- TLSH T1FDE79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 63.9MB
- SHA256 c57403d74a8c83387fb67a522d9fbb2504950490b9bbad8f153b004a050cb422
- MD5 c979e510a2a6858bcf4d764b66acd4b9
- SHA1 d1897d5be01248db89ee5796a1d125233c24f674
- SHA512 b7654acb66ebf779d4e3e335dbdf619a53954c1a585fdbef18305d525fd9ac298bd88347fbe3beda4131ca3d2a49aaebad32e9f912b1f1d7fe0ff8cc8d48f358
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucDd:tZ6ZyllZ6ZylYZ6ZyllJ
- TLSH T1A8E79E17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 66.1MB
- SHA256 95e4d0dbc37d3ec482d1baa390d078e8333fa1c490cc0e1a7e4352d0534d2f6c
- MD5 ec057468c78a0da7149e88e3a3e2df7d
- SHA1 48f6c81b15758359a577a93aff45c98aadbfff4b
- SHA512 3d234e3af49816501d2816115fd5206bdba872fa4a92e87094eb33a095ecf7dde0a90bba19fc7343cc794e3c5fba20ad60e8b480d78fcfd624534fb5c2d43818
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2cx:tZ6ZyllZ6ZylYZ6ZyllZx
- TLSH T16EE79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 62.2MB
- SHA256 65697caf4108cf5c7a278967142c49cbdcfc5d7f8aae1e5cae25fb76a8730c2a
- MD5 52ee95c3a2f73183ef8efb59701a9bd3
- SHA1 5232f8b1657d507cef49da8cf79624e2bd9bad57
- SHA512 62e17eba71bd62a542c23fa926d4b0fdb60eea169d5c7a02b97e0f99443a93b816ff0837b506387e2a8f9404952cbaf4c5006e0d5f56f7c9f13c90e85625be59
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucf:tZ6ZyllZ6ZylYZ6Zyllf
- TLSH T15CE79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 62.4MB
- SHA256 e530bed5fcfcbd5b8b6c1012c142592ef4646b4e6a4422fe339dc62250bccee2
- MD5 e794a2fa03ad4b7e2a45dd0b19444d21
- SHA1 6801a00c7eb6851191653494bc6ef9c434616342
- SHA512 e1d7d51c191810b2bd24079a2f31cad1c1232b07dada891d64c5a6ccd4c18aa3eb7d3f055e58ead5d6d4f0d07589a073fb3951b2143447ec4346b6937dd432d3
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDuluc5:tZ6ZyllZ6ZylYZ6Zyll5
- TLSH T108E79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 57.9MB
- SHA256 830573183a226e0ed02b61cbdccd6034af2110cc143bfd335b5815b9fb7fd966
- MD5 d68c2cde71353efef2edf9e6738a2b08
- SHA1 f4abba16b6a760730b29f220ffe55e3b00331697
- SHA512 8e1137b72cd273e0f15576e9a4cb44122324d2ab8ea865768b01d8802ff50dc9d56ae928bc862f41995b18bcff010c23e127efb4608743a9681771f500b719db
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDul:tZ6ZyllZ6ZylYZ6Zyl
- TLSH T150D79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 57.4MB
- SHA256 33766c09e5e83ddb373fc09888edcfb93c0288931917f2b92bd69628d29408e3
- MD5 94577e303b42ba61dcb8dd5aeec1757e
- SHA1 ea024c9946b517b1330d8f8b27f012c59ef6398f
- SHA512 ea1c4d55333d6d1ea0dbfb5488da6ee47e1551ff5aea27e6c1ba2d99765f053ffdd59fa16950fedc71d1c6a4685aaee457cb875512f1f4d31c926fe96d46f2b8
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDg:tZ6ZyllZ6ZylYZ6ZE
- TLSH T1C3D7AE17F69444F5D17A99308A669332EB72BC110B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 54.9MB
- SHA256 b66a74221ba1890a3362c949974aa63d4b91d03597808491db20637cdb245eda
- MD5 83daf16d3d0a10f4936bf72e820d4d56
- SHA1 aa095d2db11da209b03284366c91571d4fa86c2a
- SHA512 e4641a4964fbab5efc96dc96b948226106e7d1cf0a6d4f59c299df62b623aaf0c16de519e153a51e19ab4a91ddba1585886f077937ec0f97bff423e1fdd65a3b
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cp:tZ6ZyllZ6ZylYZ6Zp
- TLSH T11CC7AE17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 52.2MB
- SHA256 548487318daefa304f937f12f7543e737640ee5622a190155053521173073d6a
- MD5 5ac5ed4093b4c9b2ad20bd2da66b1667
- SHA1 11ef85f6337fa84d7352c2f921e52e42cc200066
- SHA512 ae6acc1f573922f0a58d65622f481ad64e783de81c0da1719147fd208a8435c36882ff47a33842f935b2605ba5b6017bbae371874b45a7fe818d2cc62378d464
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcS:tZ6ZyllZ6ZylYZ6S
- TLSH T16BC79E17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 50.3MB
- SHA256 6790679470f0a2320601f756a7be50f0c2937d7e9bb29a42e7fa7f5511c9adfa
- MD5 3393bd1674067eb7dbda7250af390866
- SHA1 7a702f6e8ceb1544f5b36fc28d9ce029b4b74dc4
- SHA512 8d999d4679ec5c8cf0fa384cf9c6343250075a7548c837346a594136ea04d3e04ac92307754fc80531ef356c8c49a1a34100b18d4a1cc520c443ed3b0e5e2f92
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtt:tZ6ZyllZ6ZylYZj
- TLSH T11EC7AE17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 48.4MB
- SHA256 735f91822fc21f933bcf80be4a268ce4cadd24ec62c9d98cc09c32c32de777d9
- MD5 5555066668b310f6adfec13204784654
- SHA1 67032366c1e59043b1994444198422c44a68ad9d
- SHA512 4f7d8172ea935b61c583993f1936ba7fb434bbbe0c05a14b872f4f82adc4db5d64d2628157fb39447f4d7076f2a3afaf1c548907a0823feca7d0b22a619291bf
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDl:tZ6ZyllZ6ZylYZR
- TLSH T15FB7AE17F69444F5D17A99308A669332EB72BC110B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 52.4MB
- SHA256 95f705d10952b835492db42e03f06a601b5eec08a8c2a2b3f472bdad06c47f4a
- MD5 b39af2fd3fc6f0cf2b268e9ce56aea53
- SHA1 83b660df4d788d15d29fdb716328f632f8f812b3
- SHA512 618b885e57fcf0424e5b0ebdc81873c340b37d448b0a3a66145e3bcb85f8de91c6243ee4e85f94879aa5b6af9d656732908ddf3566c91464eb5272a19bce96ad
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcDq:tZ6ZyllZ6ZylYZ6u
- TLSH T18BC7AE17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 47.6MB
- SHA256 163917801bf4bdbd8a5c69415e7477118dad553cd4e543f2daa06c33566d3047
- MD5 84b701be9f93891aba22afc8f6c2d9a8
- SHA1 ca8f1622f82a5e9cbf3aa1cfc7bc26de24334a78
- SHA512 dbc63ff30c8ff7989482792cda8617d9df42b71c2b59d9d7d5a8de66baf4759f9e286630a4fd636e6fee2a433d4e1eb1127864c0b3870bea90ffaf151e477ef4
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cD4:tZ6ZyllZ6ZylYZs
- TLSH T191B79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 51.6MB
- SHA256 44efdf326b678ffbb327ceea526996ac5f34ebb11f1d6d9665137152ddd4151f
- MD5 7fab0992d1b1f70311630a6b71788e7f
- SHA1 bffb71973f866e2582039e8784c71e07de3dbab3
- SHA512 e25440d49727f5ff0d387404cfe7f181754b450cf1c632416f65eab8101200f9432d8bede0a8ef4ad7807f66a112ad31bdc2cc0609bfc464af69bbea34053831
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcL:tZ6ZyllZ6ZylYZ6L
- TLSH T1B4C79E17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 45.8MB
- SHA256 9e7b2b1e2b47c6ae655772b543f1c0986b8204c289328eb536ee9de580ff4d75
- MD5 113ce2e44aa460b15e5a56fb30e736dc
- SHA1 ae3ec13137025fbcaa20a0842c4f6a72cc693b61
- SHA512 cb8c8bd5f53a6428bae9ad124015b2f51e749fd987ee713bbc16a63c8e2d8dd385d65bb6ccff9e1daecc273b5e22c338d70cac105a55af09c78bf27657d912ea
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cL:tZ6ZyllZ6ZylYZL
- TLSH T174B79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 44.8MB
- SHA256 24782bce0a127ea4b15c823c39e581e2f265dbf956a3941e1e6111f6826a4231
- MD5 028454dcf3448788c258d8623be663ef
- SHA1 d3a04d12894ff8cc4e9e4292b58ecd33cbfaf9f0
- SHA512 da557cf58b9fe8e0d2ae4ebc855cab723a953cb3082ca20b9b8da9376b132e7ec21e21dcbcdba484da898f7c63d243e342c02b78b5da0a4a34a2d7e6ab71ca55
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2k:tZ6ZyllZ6ZylYh
- TLSH T182A79E17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 42.8MB
- SHA256 658609073af9ed049626d73531f84f685df5addfc2988064eba1d81e9b63cb74
- MD5 0138507905a9e8848b6552df8080804a
- SHA1 c1129a10894969ddcc084f624275344033a88f4f
- SHA512 c23aecb9736b1625e68ae15c07e22ebad2085a747bd54902e493e7a2266df45424635640996c3bda402fa897c88a397f9afca8e68be18c7d63ffae5001dd43a9
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68W:2cD2cDtcD2cDulucD2cDtcD2cDul7cV
- TLSH T1EFA79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 46.2MB
- SHA256 6300ed8a03bab85b7151a2026899242b9aefed18b5be87760a8a6af4119db552
- MD5 5c09e78a152c70f7f3576ceb1828d931
- SHA1 d05e82f7580b662cf2a5dd8f1471afdbc1b38a86
- SHA512 e42ab8c490e8213fc3d363a1aabae5ea045cfe875ed51fa3e07ec9d3dcba58dcb4c7194b18440cdbbc4778859159105bb7891ed469c3093734ff4cf4af8a56cf
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cx:tZ6ZyllZ6ZylYZx
- TLSH T136B79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 39.5MB
- SHA256 53d7968a526292d069f08d825b2ffb077523ba41684ecb8c407895c3da6b34ba
- MD5 a81d72058a782479a9f82902f074f033
- SHA1 d0e8b168dfaa9e5978abe38f4795a2cb9d12d15a
- SHA512 29e6dc92d6bb63cb11832f5c7443f1b19333be78af3d918bc005331e73eba9f78c817ac569af370b8fa47a44f5f6794c886cfc75c80475928fe97b8a5d042286
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68J:2cD2cDtcD2cDulucD2cDtcD2cDuld
- TLSH T189979E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 39.9MB
- SHA256 3f006278d75cb7edac07d9d860233bae3be0db436637dc717ef4d4dd444c5c9a
- MD5 af4d743cfca13b421d1e1c145f5272da
- SHA1 966f5d810dc05944149fe16c0bcaaee33519f707
- SHA512 7cbde95a78c3d7e57b30fa2130fd7b87b2f99f4f481072f429fe53cf4566b5807f2e42656fc0884bdc68073b7dc9b13b01c969e86041f60f845de9eaa027c46d
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68i:2cD2cDtcD2cDulucD2cDtcD2cDulW
- TLSH T16C979E17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 39.3MB
- SHA256 f2ba9193043f82017bbb774a5e848363548f5ee70d8ada2f2a91dfea6970d9a6
- MD5 117e1c87229604d9e05e6334892e5d6b
- SHA1 1f8d37ecbdba60f96b93fd575aed5cb52e627c1c
- SHA512 e5bd81e02adcd890c124a81b6184431397849acefe4a009921b27c567aa2861c9e8b8c7e310c9d55bb6d4a233958bc9f41fb5d09bf2df40d20f72cbed4aa5a14
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68h:2cD2cDtcD2cDulucD2cDtcD2cDull
- TLSH T1D9979E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 38.1MB
- SHA256 7687a6091730b90dfd022f10a111c883f44c0253896b376672e865ef8d483bc5
- MD5 8a2953ac936aa9d1f7dda3a121d487e1
- SHA1 e72dcf3ddb68dc81f6fc4c1bfee6319353ccdb1a
- SHA512 cdc6d027494a8d797fbee6e36fe10e004c756a7cb6a6bfa5cefe1a57f8a6d540e9330c6484663c9a2a7f76ec71d06df0b7c82f6f1d0765004e20761828101522
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68Q:2cD2cDtcD2cDulucD2cDtcD2cDuG
- TLSH T1E597AE17F69444F5D17A99308A669332EB72BC110B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 37.2MB
- SHA256 d129cc811d44b26b9cd9da011f16fb8fde16f6aa9c577de91ba7d4c464dee21a
- MD5 8a1285023e8b4aaf76e3785311434a6f
- SHA1 1f5318020f30bce9844018283b644343d961871d
- SHA512 92f3fd8daaf4d6c5b2aef88127ed9adeb728ef07a47ffb029345dd3b2fd11b62ffe26e31d43cf2d9e1bf777c8b9cd3b9e83f12deb57568908f71f980ce8d28aa
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68n:2cD2cDtcD2cDulucD2cDtcD2cDi
- TLSH T1A087AE17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 36.0MB
- SHA256 2b9b385d3e46e4c294a27a30aafb74b4850eb31f3c6cd91c9185d7e73d80eb0c
- MD5 03fa8a77ae154bc502f7aa97ae0828f4
- SHA1 07ebc5f94df703620e63f4547b80ceb7aa5749bc
- SHA512 77eb5c5ec5d1540c25ed3fd4838df106ee98cf4d1e22dc685a7604754bb3ec014996164a03afd1b8723719a4312e52ecf3da4b518d94f51cb278d3e3c68ce9b7
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68s:2cD2cDtcD2cDulucD2cDtcD2ct
- TLSH T1E487AE17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 34.0MB
- SHA256 3cd65e579f9015facd8bcbdf420d28179606d0fc5646d2221d58925c3262875b
- MD5 5741704e3b828abc93ed430c5165077b
- SHA1 ca21fe7666f39105a4790e2fe549f868921fbe47
- SHA512 581cd52f3e8667a3df5aee2f64fae501a3af63a6028216ed7529a3cd0645cbea1809ef13e8a75757868b87370c28eedb1c620df2d9d6a8c0d8c8c993e782afbd
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68h:2cD2cDtcD2cDulucD2cDtcDe
- TLSH T1BE77AE17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 33.1MB
- SHA256 4a63c636cbbff0380242f493864c81c16f191ab6e4c22ef22c0bc76cce2492a7
- MD5 d1b33832eac697cb40a8ad1509a5629b
- SHA1 4c8212a26ef50db20a9422f0aac0856e89095da8
- SHA512 4232414bee6d9f6aec19ff4efec7b952425e23902e1323eaddfe364160d8ea4835ee1685dd3fc435281db04491b75d7b3bc023c227abd495d4d01cfd3e19c6ab
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68X:2cD2cDtcD2cDulucD2cDtcDY
- TLSH T1B777AE17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 32.0MB
- SHA256 93ecdde3dbcdc3925162d14779c511d822a62146229f530718b2c9a57ef1f6e9
- MD5 91ee6f2a5acd86fc46416a88512d27da
- SHA1 874614daa103a742d356eb8f80c54ff76862be1d
- SHA512 69d19ddb9ef9a698d438805250ccd8bbd56eaa811f9db1e5ca103d6ac70b3e053960aada701963a6f5ec4d901d71f8cd0b54dcf05c967523f1267b2d8c0a8762
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68v:2cD2cDtcD2cDulucD2cDtcg
- TLSH T15E77AE17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 31.8MB
- SHA256 a216caac3b931536ac771c0f2e15c062a4963d5256afe0cb863a889e5c92fe9e
- MD5 b020de2a6138a6d0e6d3d8c138f677c5
- SHA1 3e3d3c34c49ebd452e132c9ecbb61b3bd887976e
- SHA512 aed129eeddf7527961f1397c9550d2da80622091e5931381720bcb3996e3339e472cebd3d960d73ea7702e9a31fb8f08d6eb4b9901cab1a5602637bf0ff41650
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U687:2cD2cDtcD2cDulucD2cDtck
- TLSH T17877AE17F69444F5D17A99304A669332EB72BC120B3197CB83A4F6191F336D0AF3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 31.4MB
- SHA256 76ce8eaa03ef70d60210fe107ac5e23837b0be9c7f402a861af3a732a53e5152
- MD5 27cc0d9e52d514e21f4de1d13c0a0bf8
- SHA1 e8086cb703e86328917842d93e1ac72046ee446b
- SHA512 3034cd4649b96024710abcc8df331090657ea85a49a1450d6cc64e5c2d26c573caf0797c61d4cc08b0bd2104a56804bf03b9c57c6cf067c86d2b099cd1e064ec
- SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbC/8Vb618U68Vbb8Vb618U68VbCZlyQ8Vb618U68e:2cD2cDtcD2cDulucD2cDtc5
- TLSH T16C779E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 66.8MB
- SHA256 7e2e40d7ce1a640759456813309916fc6cd69efbb6ad94759a46ac4805b99919
- MD5 78eda6b63ab17beccc5a939be6d794c8
- SHA1 243b812928a67ab6916927fdc584c679479bfc43
- SHA512 0c6ddaa2bc9b75ce42e8b900e74aa6ab94ba47fe4990698649f17b9d334a845b3baf5bb79763de64dd6d4b345fb01f6c87d7123303e877f2be55a9307a869b82
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2cm:tZ6ZyllZ6ZylYZ6ZyllZm
- TLSH T109E79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
- Size 70.1MB
- SHA256 33fc1149cb4ba3a5a0620de623a2a648df3d37a3c47c1938170bdfb19cf61e53
- MD5 7f013c2440bf0e0e11ccaef3fbd7abb2
- SHA1 1ad6d5671168389ba6a12730be41d71eea8a8179
- SHA512 2bea75478b84debd25f193227c09b567c6e43343775886fd72ddc663692387b8fc7cfbda4d2abe2c925c7f1bd03627fccdda3d1ca40a59160f9b006708e2ad66
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2cDtc3:tZ6ZyllZ6ZylYZ6ZyllZ63
- TLSH T1E6F79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
- Size 65.1MB
- SHA256 781c16bb901ceea35c6d07853aefff324e7e7dfc08fe2defbbd058e0a39a05ce
- MD5 b489e9708e1c1b622c9f2adcc9a9c06c
- SHA1 68d001eb91091115b8bdd33e2c1b01abeca418c2
- SHA512 8754ba5a4cfdf488c812ec6a08f9eae48b05f91c15d0b2cceeb8bf76ae57cadb629757a153372ff01319a4f67ba4d42cb588848d1930443665af1563f22d2903
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2cP:tZ6ZyllZ6ZylYZ6ZyllZP
- TLSH T1B8E79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 66.7MB
- SHA256 cbe1d7a2944d098b6905489ff6b84d35a4c4c4f881896f8b8407a390fede6893
- MD5 9a8c15a14b98fa464a0db639cc2a2867
- SHA1 15db896b66f73ff2dd4720e88c1ec709f8210ac6
- SHA512 e17be28e941eeb4351c2a50a6c1ed861555e46c866233b29f86bf8438f1fa6053481767fbf52cf94d9c64199df18dd6dbc54fcad98cd715020b4775f1ccf1b67
- SSDEEP 393216:2cD2cDtcD2cDulucD2cDtcD2cDul7cD2cDtcD2cDulucD2c5:tZ6ZyllZ6ZylYZ6ZyllZ5
- TLSH T1F9E79E17F69444F5D17A99308A669332EB72BC120B3197CB83A4F6191F336D06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH