Analysis
- max time kernel
29s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 12:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
- Size 30.4MB
- Sample260712-psc68ahz2p
- SHA256 6f45bb81c3e2a5af5cabe04e04c61bc5cc77bd7ed8c96ff3606e017a75a825af
- MD5 7f470ec6140fbc9a6af1d03ba7f2e683
- SHA1 61f497ed6771ff48b204f1a905b354925fd68ae8
- SHA512 7163d1954b8dc8ab37c8f44e52fc4151857c7d452d65321ed6ba276d80dd0921dd7344499a92053af9f922b8a35c757063cab156a23a68b87c665b2b2bef05c5
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwo:UI+o
- TLSH T187674A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe" 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe" 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3388 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3752 2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3388
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exeC:\Users\Admin\AppData\Local\Temp/2026-07-12_7f470ec6140fbc9a6af1d03ba7f2e683_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 30.7MB
- SHA256 271133ddd7071dd44f602cdf3409a23c7ffaff070bfe2f2ee0837cda56ed6553
- MD5 6b260cd79e7b3fc5c50c5a35ffd9cf7b
- SHA1 f41ee06bb3fbd172242bfe2bb62b20ca361ce736
- SHA512 d1018f5d795fe315f9f4036aa721ad9cca7e1ab30476e7500ba62d3a816964774f1a55daad1f16a13fec48258bfc4aaf23387ed2df585099900bc5205e306343
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwk:UI+oK
- TLSH T139675A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 60.8MB
- SHA256 2cd5f7c4ff9c1621faa33a4e502a2662726d6de1235d55413adc05d52cec5e30
- MD5 86e41f5575d12799c899f7b4d87216fe
- SHA1 2f6b66dcc42717abaa75117f8a66fc24c651cb35
- SHA512 5e086b92f0fb9483a236e61b44f7a8b21edc908bd29cbee20933bfb9061edc10c6fdf6cb118467c85912f9ae548d6277ecaef4ca277fdf1d9ca1d0a59db2bce2
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw4:UI+ojI+oX
- TLSH T126E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 64.9MB
- SHA256 7b9854dfddf1cf443e6575df31a9d5a073f6e67c53c842d5c1dc9ec88529322a
- MD5 22f6360cf1c083deccf1c98e16109ca1
- SHA1 af024dae9528a65a8c12bfd47d000d13760598ba
- SHA512 8f39afe55f18f09ab8f091fa1acd90b36e6ae874b52b49dcf870c2f0770044a51f48c1cc74a32f1eda51fa4ce7547c2e3dd6640d63a7b2f8569894f2e86897d4
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwB:UI+ojI+oJvyEYKbi
- TLSH T12AE75A51F6A081B1D07A8470C696A77AFA337C411B708AC75386EB3C2F376D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 61.1MB
- SHA256 2f345d55b4edaa291f1380811c6380099a844fde9ab7afd96108d7ae8ccfca2e
- MD5 374835980a0f6606443799dcbde353d9
- SHA1 652b674a3c6adc8c699403088677045a6eb1fb98
- SHA512 2770b0698c0aab0f51779edcc318ea0c6494aa25fb6ab6af178d4a6299eb42fcc92fcdbe714e8b8aa01bdeb72777a4a03c2686b41049215363fc191ebb5af8c5
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwU:UI+ojI+oT
- TLSH T10DE74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 32.5MB
- SHA256 d59600280530bd78c21d4c6467275c6212187559621ef84b4c22c65f30e4fce1
- MD5 4bf48c46f3c6ec3d8d16d23e3f373bc8
- SHA1 906e08c02c61bf673e505ae0dafcedddd57aa4b3
- SHA512 58359c1a8a1cdb387c72c5b9c0cbb742dd9e827316d4d313a4d1c25a3e6c9bba6975f47bd64c9bbfd257dfde1598fdaf544104ab238db6dadb845cb7bcf1145d
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwj:UI+o6G
- TLSH T143775A51F5A081B1D07A8470C696A77AFA337C411B708ACB5386EB3C2F376D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 60.9MB
- SHA256 0a567d5326d2f1be3bd0ac4a987556f12dd7d449854e6738987fb18c921989b7
- MD5 b3b30235a3a62cbe1c2511eaa32b7e08
- SHA1 8561ea76b3ea027e4b79c3ac32bdd6effcee275f
- SHA512 c407fcc48295319b1bfdc10ff5879d57d7d58fc932b94696de8228aef6ad94f192c1d8c6822c7b20e93bbc7feba6d9655a659d82deb7f7645c63886c70b9576d
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwC:UI+ojI+oF
- TLSH T169E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 66.8MB
- SHA256 e93eb00cc86b6cbeb2eb926f8931e71b24ee4e50aac9258340be40d12f5f9ac4
- MD5 7f5167bc4710730394aca480b79d5313
- SHA1 ce5654b79668d74321a1ca6357ee1d6337d5f491
- SHA512 762c916c0cedfcbb85878c2262a772a9bfd96659602737e82494127da17184786daec9fcd95e1064db46b9f0a0cb8026c7839d29744f9cbf4f7f6b47fcda3d3d
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwy:UI+ojI+oHQsas+PS
- TLSH T161E75A52F6A081B1D07A8470C696A776FA337C411B708ACB53C5EB7C2F366D09A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 62.5MB
- SHA256 b31ed6fea5dc2f1b76be57e96121d1aa3901027eb301bda55b315d82438b311d
- MD5 ffad78a9a38ee0e341afcdfd4bd4ae27
- SHA1 934c882930c9756b4b3a5cf13cb4cdc0100b1fd7
- SHA512 ce718181397e92fec9e88188434ed6a219ff03455a9a211d0687f0ce6c8d3cd3da4a43c555f283299828f012e220b6b1866d125325d39c55d1af49824b4dde15
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwQ:UI+ojI+oD/
- TLSH T19CE75A52F5A08171D07A8471C696A77AFA337C411B608BC79386EB3C2F372D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 64.2MB
- SHA256 e516fefa16524dae036c62a5b0d7c59628c5f5a1194b239ab55297f851e7d8f2
- MD5 0518c7b349e68a1bf29247887ee88cf3
- SHA1 1f435804c228697b3f291324bd44a82ce171fe7c
- SHA512 5ed4caa324332e8471f6d5a39eef0a20296d7d2f16b8e6cbb0557a2ff037ad4bafaa03fcfc7beb8bf8743d2c1b0359b9eb9951db533d98e2805a50f70e437a46
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwY:UI+ojI+on+6
- TLSH T194E75B52F5A081B1D07A8470C696A77AFA337C411B708ACB5385EB3C2F376D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 60.8MB
- SHA256 a064302d348af014ea6c1e142a7ffffde7626fb8e332796d79ec3737d148f985
- MD5 0565ee8d2e8ab04fde9e629597c3b89f
- SHA1 71d26cd38a049e6e52f7fc2ef7c57b6d593c10e7
- SHA512 ece2d01a076fcc6192c20d30779f543cc0e8b99aa407be55e46b7cc4ceba83fb5fd960dd0173df0950219fc4b5e9702d85dc8ad9f730c351dcd31097c4f2e123
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw4:UI+ojI+o3
- TLSH T1B1E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 60.8MB
- SHA256 63d05fe8908a9d9beb47706ace7cd72f2e820ea5f5180d133f39ef05b760cce5
- MD5 9cc6349d2c108da99feb802e2be8c3c5
- SHA1 72a01dc895a1ee516a2aaf7a073139e3e392b5c3
- SHA512 465b651744581a55e6bbc87374f4e13a133c2e5019174fe7c5f93b6a371a2fd34acc233046de8e77ef4114f31ea6138c64162ddf2b8bde2f4fe44b751171c633
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwQ:UI+ojI+of
- TLSH T1EFE74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 60.8MB
- SHA256 225d2a514f758073e300bc07c28796a6b7d6d520507f3f63c96ad5377ad1bc31
- MD5 e983b01b8de956e57d7810f31ad235d1
- SHA1 ed0f151c0557f38c3b0ce785e715925a9d2f6372
- SHA512 29530440859de8917c104c79a6a566a3d7ce1890bb5e381aa7cc43bb9545782c302fe77f39fea328ffebc6799e3b02f2277f93703ed3242186c55a51f5f61ac6
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwj:UI+ojI+oQ
- TLSH T13AE74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 60.8MB
- SHA256 e238a1488bcf1fc212cd6298579ae50984fb3f28b051c28adfb6a90b8e8727c3
- MD5 7cf3fe725c88356833e426c7c48efc61
- SHA1 da90a2d71ae3aa54aa2d076bafc5cf90397a6ceb
- SHA512 f75e51c96baafa20f96c5ba9ac68349cf5754b8dad3a6b539c5207edac0edf012640edc382fb8bedd17c90b1a068e7bd0b30e97276d5d6a86f8eb8c83e9dbd7f
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw3:UI+ojI+oE
- TLSH T1C0E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 60.8MB
- SHA256 fe590b85d758e5d6c5955884e592b5d20386c114b4c4b1d4b0b050742925bd1c
- MD5 2827143df38f4c1747b38c5448dc5ba5
- SHA1 6e8b369bc7da0b0bda0ff93915b037afe127fb11
- SHA512 93103f6bfbc423f9d908c2da0b955a86158de9484a219f5ae7822321dbcaa231ec58103c7c9f7680280e478d531fd980ed0ad3e8cddce4186ba2107224362354
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cww:UI+ojI+ob
- TLSH T174E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 576KB
- SHA256 f3bd2dab7382b72175192fb3e9f89598203ba5c57a724633b594102fdf17e510
- MD5 9abfe7c728d3eb2b710a21c9b49c9d58
- SHA1 b141c06ca2fa12bb6f1c2c733d42aa8ecf923d32
- SHA512 539164fb042c4479ea8cf911fb536378ba09ecf39b0df118883dd84496f1110e9751cd6e652a5cebc9922a6c354b7130825e44f798823c83100edd69798e60b8
- SSDEEP 6144:8ExovdPwkll9vNvnJGMjNubhWAqbZgVDFeDuf4sl2QExhTcItxg5+rgurkZ9O:8ESvdPZD/JGMj4IwHfRlz6YIfrgueg
- TLSH T19CC48DD1E6C280F1EBC1657024BDB73BAA79CF862214CF87E367EF615E22101921765E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 61.1MB
- SHA256 50b0d5b975c8e6af5e29a13efbda496671ddf7d62d66afc70a5386fc77194f3d
- MD5 bc5ae1ffcae7a25eace9dbd253c518c2
- SHA1 c12a9bfcd378fc89fab268e962e9bd422b6e11b5
- SHA512 4ce2f0d1c891df7a77f804736e2fca200e13dd42f02d226ea297d66e409701792b43b6e6120de285bee480694c66945fe1d0c231ae86bbb7c1c7f4215c3f14b6
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwd:UI+ojI+onm
- TLSH T128E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 60.8MB
- SHA256 bb4bc21a73c46cf1bbcf0560bb24de1a02ac2c364a608825f363196d1d5e6cd5
- MD5 457dbd0fe462f3b368c11a64612ebfc7
- SHA1 0e7a1f9cf286daeaa932777fe314991db59c2abf
- SHA512 b49d1bada28de8784bf63bf2d999118fe9d3509421809a2042a6598e158970f1002b64e6e84563a207ba0a2ba92fd174c5ff41196624e3fe9861ce87573b3364
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw2:UI+ojI+oN
- TLSH T1B1E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 60.8MB
- SHA256 498d19fbaf63a7d081253b8431d1f0613bba5e0679f384e52ad5fa10aea14476
- MD5 4d4e4bc9c762e0d9c6facdfe3fdab37e
- SHA1 901012436f9ad9c29c0176d346b666dd62637dd3
- SHA512 eb339bbbbd7a9152380d77c520620bc8370b25b25cf244aafef568e0dff9ffcc115626a7b1c4e34c46b98dbd9304980e3888590760c1c37cf331c7f4fdcf6d4c
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwK:UI+ojI+ol
- TLSH T107E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 60.9MB
- SHA256 1c1dcc06272059b57dd4e047599cc2bbfb77e45da74f4e0d0fbcbace15473776
- MD5 651c3b4cdae10e9572743faa44e84fe1
- SHA1 d1cad560b0b596980a1e051bb63751386ae7db00
- SHA512 6015d15079af0717a74f029cb5aa3e31059c95f472ad126929e715e2367bed44a37728b7aecee2e3fda0186f438e3610a519094d0b2803b01bfd951e7e21151d
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwm:UI+ojI+oN
- TLSH T193E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 60.8MB
- SHA256 39665cfb8bb5bfd279df89d473b6837fc11487bcf73350574addf3f70195d610
- MD5 b6e130364e9095b3d39c38580db8ded1
- SHA1 a6851a100e8cbd6a863dfe0a02fd8c7d0b2678f1
- SHA512 8ff120ac9081e7e05598c5e1db6861e6e6950c1b2843afdd7648764de1f3b37b7579a4b85f234444c8bf9fd005ee6f51bb69c54a1d1aab7d9bcd50a546968f90
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwT:UI+ojI+ow
- TLSH T148E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 448KB
- SHA256 30fda89260062596f8473df15f576de632ea44d623bd575d46ec46d32766b91b
- MD5 cfd5917b65cccb055c7106f525a21bda
- SHA1 7e0ade8692b34214dc4409927d60a1bff08bd0b8
- SHA512 1d11a6a9813f857b2a660034a5fb600b355de93893b2a4702e6d55a16aa0de0754e146628595663737e4b865cf763f23ba4e7a745185f6a0de69081be59d234c
- SSDEEP 6144:8ExovdPwkll9vNvnJGMjNubhWAqbZgVDFeDuf4sl2QExh9:8ESvdPZD/JGMj4IwHfRlz69
- TLSH T150A48DD1D68180F1EBC1A53020FDB33AAA79CFC676148F87E767EF625E26100921765E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 60.1MB
- SHA256 725e1836f95b49b360fba05654eeaef49ecf7a6bed635521771dc1a71947dd05
- MD5 acfc2d4f83b3e581f23b4a84d9ca612f
- SHA1 9105aee50cc1a6dfbfb85fee7a58087bde1fdf99
- SHA512 8374de828fe0583bbd0175145de969044e0dbbae517559801c9d1a496d9d7c9217f5ba612e2e0d2770dbadf853095946f2db72f829120ad6d9389455c135f967
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwj:UI+ojI+ow
- TLSH T121D74951F5A08172D07A8471C696A77AFA337C411B608AC793C6EB3C2F362D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 58.7MB
- SHA256 090b748cf5f9affeebad69ec9e1a1b590a5c3c04f98556b50d9960f225bdc9f2
- MD5 74de3199df041bd76142ed57c7760141
- SHA1 7d37b6a3ecf9aed428481188371d93c77711f50a
- SHA512 007fcd33e8d04d98eef3c83823a90ad5fb25dbea3417cde0f2330b5b010b6681c496f577ce240994ee06bd45c5fdda01bfc751f871be902c2b99c4a796816db7
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwd:UI+ojT
- TLSH T110D74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 58.2MB
- SHA256 57547540cdb00ec97dd0782aa555a14aabcbded981a014f7982a08458457aa12
- MD5 3f139e5553f785616e2fc7e8e76b73f4
- SHA1 3af65e7e7b722431b86f46815f2914ba8d80dc7f
- SHA512 149ffd6e96e34451f26753170043c2aed322ff660dfb317f7a13e8271c61037614f11046075b19cf5f8bc243649eb44285b610b7484f5d26ac72d50f54f09f8a
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw6:UI+ojU
- TLSH T104D74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 57.4MB
- SHA256 192faa2b8f77c808e8e9401835268be1582c4c9c8c015cf800f3f5b5724ce700
- MD5 1bbf965aaf4bd1062a5f395ba5148291
- SHA1 23cae07548c0e355ea7244b11b08fde190124c7e
- SHA512 ba10dec2622677ea42af168a01c31f07ae950432488ebf4096e6deb19f843e1dd081e110fd87fefa88cd177bf66a9cf722fb67f6de7b441ae9d104009ca26194
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwU:UI+ojG
- TLSH T1B1D74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 55.2MB
- SHA256 27cc72cad8387918a4969d5bd41718603080af2d6b9fdd61df0e0463b2bd01ba
- MD5 6a5c99d1c164c0899d29bfadadcc4efa
- SHA1 1adac744b5df2274ebc3b078e655a3ac8f919f99
- SHA512 04fbc310fc29346ab7f55f552a68692804a6f0f0d6e1db27598fccf2c2ba472410d6b8fac335890d55b4a6bc9344f61f0ebaf0106fab38b1c31ce656eb9e5acd
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwb:UI+ojt
- TLSH T1B5C74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 54.1MB
- SHA256 05e05fc8338ac7fc7481418a791a91908ab089978e96fff6247ed51fceabee54
- MD5 c4b65b95392a2cd3160e672d7ddbb177
- SHA1 89e03a71e04146f8293143ddb1ffdef1f41a80f0
- SHA512 a2485187981e1a89e729b8e29a18b8cfa70dc0f9a20acdce8ade19e908ec6f9b4e16ed5897639c16ef0e1d048ef753b6417087b0c7b9dd121aa4ee5844f0bf73
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw3:UI+ojF
- TLSH T13DC74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 55.0MB
- SHA256 bd2b1dcc05ad6527e5b4d44c76fba4e8ab7ee341f17b050c0ef08d92a3ff9e37
- MD5 91b8ba510cc3dc4c2463b2b627f56828
- SHA1 cac292fd4a1e88837c9f90b0e018b81accb57683
- SHA512 b39daeadb58e117a78ec465f2446c8a1aaec30951c4f8c9f3285aab5954de1d586fcbd6baa5954fd826f9449e290a3389ee9be544f53b958b9f84e106da2d97c
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwF:UI+ojT
- TLSH T12DC74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 53.0MB
- SHA256 a145873ff360f4cc5bf6419ace4b660e2c3842a4f257fc7160bf14dc6f0b0926
- MD5 4257f990a2d5cf28e33396e90cbaca21
- SHA1 069960468675d23e19c6f6c85d9399d61d842896
- SHA512 e7f35a819aff16c21bc6b3a94789cd909393c6c3ca876b7078cd30d169255c530494a4cdecdc747a916e2c39d68be10577ab0bd88c661937d5deafb4f47b97f5
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwm:UI+ojA
- TLSH T13AC74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 52.6MB
- SHA256 7f2bf7b11cbabb2d2edef82e9761c50dd90c768a75861b530143c15219a3434d
- MD5 bfcca32fda562bcac451e6df2627cb8b
- SHA1 389a3a416055a26d413f8cd9e4b366b830bde3de
- SHA512 30dbccca4ae4af4be2a71c8e77986192ab96be17194468fd384f393217fdb35a48778dca25c0cfe5e46f8634d358ea2778f9e7635c7896faea8b5357988709d4
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwA:UI+ojK
- TLSH T1C9C74A51F5A08172D07A8471C696A77AFA337C411B608AC793C6EB3C2F362D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 52.1MB
- SHA256 9bab1c7b9c878804f87b4720c8f97d332f9d7e7135e6021828506beabc75210f
- MD5 0520fddf6c78fc680c0ef2d9316e73ab
- SHA1 1a600ddc4a2b749284f3d7a09d0979d9e1d80952
- SHA512 b04011ebbac5a360bd7005863d800424cca3695ec56a7c41a72009802dcf80115194748d43c242cdf4610d75305ee0bbf696e7701323fcd6011da401e04faa54
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwZ:UI+ojf
- TLSH T1F8C74A51F5A08172D07A8471C696A77AFA337C411B608AC793C6EB3C2F362D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 51.9MB
- SHA256 5ddb5cf59df6426fef711815e4b50639d30733c7ba2ad983fda3318c1549c4fc
- MD5 a9d9e9636955dff98ae6276520eca870
- SHA1 a66e6f5995fc9a53aa677b0962bc33698414cc6b
- SHA512 d94d7b933e12cec38a31593777f9964710d88ed50a2a7190e72915a647cc271c1b8fe01e973a8318bb0b7d42e346d816eb18ba164390ca20a4c9c4205ea558f5
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwV:UI+ojP
- TLSH T1E1C74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 51.6MB
- SHA256 51d255ac7df4d894e09ac6e111c38d576e1f6d2bea1784b581b401f8ae5a4cc2
- MD5 0b2835dff8ba95d000654984b502cad5
- SHA1 08477053892869a1008f07a256ce736cb1731742
- SHA512 d5eb67290e9f7c299bf673c77c35420a589c5624a40191bfd48d946f59cadb14e6b6ac8cd28d53b11d986df93e299e3e849daabafc9a90f4efed0daecf1ede5a
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwu:UI+ojM
- TLSH T1ACC74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 51.2MB
- SHA256 9b1121bf7882c0a427cf6393e3b35e0da78c173620803628c5367292dca92a67
- MD5 49a59d67fc28915f373c962e8c99c779
- SHA1 381b7503b7d6d0859ffde6618d1e09935e2c7be6
- SHA512 da73fad997a1572ead45c823395cb13247fce39661adcfba90dd42e1cad13ea82f283468a977de1a307cec0bcedf339c344bfb9c0561a3402752a6ec1b775035
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwU:UI+ojy
- TLSH T1D4C74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 51.1MB
- SHA256 2d1895ee37ac851b3c4b54db4022600a26711c949ef52dea62d8bde1b2cc71c6
- MD5 bfe6911d051b1cef25fbe59662852aa2
- SHA1 a535c75e3fbf7b4e4b613f089aa3d554ed1b72d5
- SHA512 20d6a5510e297c5f77f35997b70d831af5e72962d631c9c72aa041a5082548db9487f3a608f627807a288f15e0d19035480c9c868f9b744557fa3209fa2cd8e5
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw3:UI+ojl
- TLSH T136C74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 60.9MB
- SHA256 b43a6a24720d26acb60f1cb7544f487122cd724d4dd5c1ce171e712e3a2818af
- MD5 c19b75a4ec6421e30dff5d43899b1663
- SHA1 8558bbd7008850ea1ee157c981a29e76d93e92e5
- SHA512 2d4ac60735f0045373306412cf105436a129914aa73081c94e1389ee7a2fdd3cc25f2e70461f3958d1803dedff743e7d043017a3eeec4cd24c944824991a2936
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwk:UI+ojI+ob
- TLSH T14CE74A51F5A081B1D07A8471C696A77AFA337C411B608AC793C6EB3C2F372D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
- Size 60.8MB
- SHA256 47149c1c5c3743f931fc7509d9f04f6c5496653aa81ab4e19ca54eb8b6b8ee27
- MD5 4dee11373cad282815925336f3303ca9
- SHA1 dfe892d2ada420a7d2ecb7023ce0bf855061f9dc
- SHA512 dec02dcfc590be882026d42a9c1c1fae41c8335e9dc3f63e31e525c7e574c6d33f6e637a5f15734988b453b1a4e0226f4661f65d78cb6d9be31deb05631dbd69
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw0:UI+ojI+oH
- TLSH T124E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
- Size 60.9MB
- SHA256 f7e5af336d34cc179cfc83e512093d0b0c142774cd66b86c56e44d2f754297fc
- MD5 b6212ee8dbf30fa2f71529788c38f423
- SHA1 07635c15a54f4e3feba1ed6035da8ce51bb32b5f
- SHA512 7bc9b28a6427361c0128529022e81fa6ae22a264b0a3dd2c1dfde3d66ff91d59f055ef25e40821ef0097c86eadfc97fdb340a06fc820d86a5f5e5b7c22d88a1d
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw6:UI+ojI+odj
- TLSH T18EE74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 60.8MB
- SHA256 6e122c19257e748b1b5363d139609f2e7836ed17f34e21e8b35adb1c53a3ac1c
- MD5 d54b9676276f807f86c661fbf1603222
- SHA1 da46262263bc3365712145cbbe40a1b1629a16a0
- SHA512 0c7fd219d54a84e0eab9a7f8d9d0cc195b6b176295dea188eed545e1f662bec08076b5fe36b8432abfca102abae3f85af434d28ad1e2e07c0c0cf1987e90285e
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw8:UI+ojI+o/D
- TLSH T113E74A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH