bfd2b0116a26a93f6f455f7ffcd8f6430c469aad4532a120b0ac6faeee2b3c31

Analysis

max time kernel
66s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 31.1MB
Sample260727-kd64jayyfv
SHA256 bfd2b0116a26a93f6f455f7ffcd8f6430c469aad4532a120b0ac6faeee2b3c31
MD5 4a929e36107c03564d7fd75e51967e1d
SHA1 511dfdd47314ecaad192a6a18b8e1ce8caba2335
SHA512 5e9e543f09009ad7d2d6ad806411aee7667589f51753094756c9c1d110695198f8c4742d1e455780a951dd8cd5cc08cb3443917dfa2da47bf09275b8449d9928
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw6:UI+o
TLSH
T164674951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2952	2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3244

C:\Users\Admin\AppData\Local\Temp\2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 31.7MB
SHA256 9ea33db7626dbb245e22611d92e8ef183eb2e00d9d4a541699d2a8652ba58838
MD5 b25e2ef478ed9efa04cd95384a1bd14b
SHA1 34fd1b8e760849ec7a12e8279499d417764dfe12
SHA512 041a56a701e53f560b7e6d6b7591ef3a2fe5488e55c51064e2452d81f945c22d41d1b2fa193edea9ac930b5f0b8546f2c4df18c85dcc303a06ced15c5c73f2c2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwn:UI+o
TLSH
T12B774951F5A08271D07A8071C696A77AFA337C411B708AC79386EB3C2F376D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 33.2MB
SHA256 46850ebdb831d33c62eb3340d9e60db6abe3222a79735e830615d5f118d91967
MD5 36058516b482a4e2365e7c9f516524af
SHA1 83fdd43fa75365bcd0b05627b352c1e35dc288c8
SHA512 3ec92c4f9dd58f1fe87fd40aefbaaf16411eddd6dec7093ce37d83277d336d691d48117e99e63ad786c483331b6932eb87f5caa134850b7414bba94d1167a2d8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwK:UI+oBG
TLSH
T190775A51F5A08171D0BA8071C696A77AFA337C411B708ACB5386EB3C2F376D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 34.5MB
SHA256 0997902970d78db923667c79e2d1c25351662368ffe2f203d4268c8adffc126a
MD5 262eded72d187bb808197aa5a04c0b15
SHA1 f38a7dd4ebb203a8018a13cba92e3d1715a40def
SHA512 0265b2b1e4b6190868132b068f2dc586a210561beaa87fbfe15f0b5d18b62fdf5952f8a841fcd54f763c9ede423a5e5ad4c0d1079a84e7af9748c3e2f4762df4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwO:UI+oO+6
TLSH
T138875A52F5A481B1D07A8071C696A77AFA337C410B708ACB5385EB3C2F376D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 33.3MB
SHA256 e1df628709959ff18e10271fbc44f2b8c57608d8248195a6cf72df6a180f7605
MD5 89d37c3ad774cb32a5f2d4b04186f86d
SHA1 fb588be107ab02bdc930bb07375838671da13784
SHA512 3510cf7e568ed0db1978f9e9b41ca9a92248f771823b693f2edf9d7e56fa41d84c8ad806d0d33169ea592cf64c3518e9ad0a3f7fee9ede50cff637bfc4161297
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw6:UI+oQl0G
TLSH
T184775A52F5A081B1D07A8071C696A77AFA337C411B708ACB5385EB3C2F376D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 63.8MB
SHA256 c972c7484b6f008dd87c0277b5a5954983fa7bbc482ad6ace90dd138364aa064
MD5 6f303c60060238c16af105dfc336fc42
SHA1 509c0853ba0bec209467fa6d95324ea326a01701
SHA512 f6ef1d3214992d06e02ae6edee4983831b9e8df1ab92823a9e25bf3adb55d402199b3385f0aa9d937d0db15f35737fa3ee4ab2477974a81eeac04bb58426f6b2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwP:UI+oqI+oPf
TLSH
T146E75A51F5A081B1D07A8471C696A77AFA337C411B708ACB5386EB3C2F372D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 64.0MB
SHA256 1f2adfa7611fd66257d29ad1e98186eb41aa77f4d3b0a76c42c7250de54035c5
MD5 3825670234b693f0b87f5210b915c12e
SHA1 17e0721e48c5d57e69b7b66f56868d00f7ac4685
SHA512 3be491c6cbcaee51b81b5b6a8439765a1373046a911274ab417ada38e4a1a97961ee8333cd60086612e61ad3dc381b0e2f1a0bec361dcecc26bc46bfebf67482
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw7:UI+oqI+ohC16
TLSH
T162E75A52F5A08171D07A8471C696A77AFA337C411B708ACB5386EB3C2F372D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 65.2MB
SHA256 4e34f16f1980370f032bfb580e6a11a781f68af283a40677db318eb0ded8b25b
MD5 d860ed373fb4f9dde37baa8803723668
SHA1 ef9d9d23a7c5b5c18c4f85d425b0ca3a14183d79
SHA512 ba5f10bff910e995c984606a2c462231cdf3b32d9636a6e10e4c81f848c3560e6293673bd340a50c9683013eb7675db493ab3306c6671fdf90174c1add6ba50b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw6:UI+oqI+oDO
TLSH
T12BE75A52F5A081B1D07A8071C696A77AFA337C411B708AC75386EB3C2F376D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 63.6MB
SHA256 1d3d354997d791e2ac3869caf307288f585ef9c42ea275a4216f2154d94e9598
MD5 511eb6df0606cd7862d5aa91a4c5c4c5
SHA1 92658e930a97eacc3cb830a3a09bdb9465062711
SHA512 c865ad6237514ac0e248bb8bd103afe244adfe156c875d315d676e849d86afcade54e68fb1fd8b38ea16c441e4e7d1ed5415c68435da04152d9cb2a1b033c1b4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwo:UI+oqI+oD0
TLSH
T132E75A51F5A081B1D07A8471C696A77AFA337C411B708AC79386EB3C2F372D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 62.2MB
SHA256 adb91ec1e9a712df1586759bc3d4a11ce0555f8dc741477fbcf46dc3398d8eb4
MD5 bd43f0b83f465f9a0767d1f7abbf20f2
SHA1 c45e42f61e62d7efe5a3b1074036ea051ccc863e
SHA512 a1f3d82ca81964c3b5ab14ddaea90b8e7e9fb2d10cecc1b11742d3fc7478d0ba702b665e6553c97187375271b1506fdd2a410676436730fcb2bfddf5f33685f7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwE:UI+oqI+oM
TLSH
T160E74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 62.2MB
SHA256 01e71844ff2a34d93ea64d13527b6e389b308c83c4a60560f7f398f77c30966f
MD5 d5587dc839b4ac4289c717e038ae433b
SHA1 5857ed5b4f497cc7269fab94b4726d55447841c2
SHA512 8edc787b326ec308c9237e6afb747a9741e8e6204e5a802a6d6afb4af228a5a6d6507ed0fa816f62abed16b6cbacef7c32f8a63ddff9a1656a62f3bb7e2a8b2b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwM:UI+oqI+oU
TLSH
T180E74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 45.2MB
SHA256 b78c1cffca9b381048fda6ab306c7d2c79d09242510deb01c00be7f9f9280221
MD5 3a0ebe2c8ef5c108ab4710c56e1c4ad6
SHA1 9a0c2285b02d71fb48febb101a8f0cdf26d5f720
SHA512 2069425a193ca05f9f77530cc138a51a97e5c961e6d309a105944ac346a34fc6ab68b09c170c8ec4f0e45a2a811334d2d36cc901e5a2c1596d846d3dd78e0f0f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwh:UI+oD
TLSH
T12DA74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 40.7MB
SHA256 e251331d6a15af17e3781ffff50991bd5e4f6887e3fb6ba2b47355f9ab5b13dd
MD5 7ed1a22b4ef194ed353b176536c0352a
SHA1 77884ebae52043ad617c1d7c3c3bcfdf576d955c
SHA512 6e5147b959b8a7bc9281ef14454801bc5933ede60a4e381a27f4aa0e613aee12dfa1b2176a5e8869a4b33dab7968a12588e8e6ea7e305238d2f7102bd6e3a479
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwx:UI+oL
TLSH
T1DD974951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 39.0MB
SHA256 4a261bafe04709755b3fd0dba698f0a70992e5e202eba327a47fc2cf9a953aea
MD5 7db7081b62a8cdea4315cf2421994fc6
SHA1 17ceb6d530d055fbd23bff4ece05a28ffc1f8cf1
SHA512 ce07dc8744ad58023614e1ff6b6fc33834f29a8122ea13bb6a0df5fa4a007c9851358eb3c75e570ae03e3e69174ef64fcb75c7974c09d1196faa66a10c4217e5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwh:UI+ob
TLSH
T1AD974951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 35.8MB
SHA256 72608cacdd0e7569a2c8973da32e182180caaef57bb0f116be60be5338336b7a
MD5 318b8466cf2a17e1d825435a8364c490
SHA1 3ea49c6f89dc08b2f1d7cff51a594a2e3123e139
SHA512 fc03fe3d9f3078ee6426d8d4812ab50aab21eebfbf8a2c464f4d3866ff91104e5582da38c25512f7c193ab35adb58c192608367d1991fe59e58ba1b88e3db193
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwf:UI+oF
TLSH
T1E0874951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 34.1MB
SHA256 6bd9f0a38207545b6297f8cde3741b26c33e4fff0ff38d8c730cc8de08b91a97
MD5 eb9ec75ebd236ce2e52bf9cb0c684f53
SHA1 022b93d221b305d63d5a1b836f711a514ac1c166
SHA512 70ba473bad0d4c0aa23845a82bad9a62becc02ed8e29deb424437eba2758df6810f6385b13874a2646c54d721284ae0e1e106cb1d2da2eead8b9fc7839896564
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwH:UI+oB
TLSH
T12F774951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 31.6MB
SHA256 fee7f983155ce11fe3c1534e6f811ebb34877f71d0a37f9a74a7be37e7dffce9
MD5 5a18f1dee25366387b8eb2915d1d045e
SHA1 4eed64e5e52673258f4cf4f1571eccc3267aa5ea
SHA512 914334e7b2eed0ac258712fa2028f8267b60961ea3cab8028ef1c35d720c2ba291273a7d005afbfdffc00948412d063e6d3494aa5b9f458ede10ca8297d618f4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwM:UI+oy
TLSH
T1A5774951F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 31.4MB
SHA256 15a82c1b189ff361dcd50997f5b28c47d1608b352e9f259e18613958e3d3ccb9
MD5 17f4a6467117c393a9f5e6b14008da22
SHA1 6ad178613d849dbff1d30f38562a8eb7a5a97910
SHA512 5f35eb7163912d7a17e410fa50059bb53b7d5461e4fb0b3156ac8cd591b80d1af54f3ebf5e501ef1175d92cecdcbdde8cfc29c648bfaf654b928e75823c7aea1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwm:UI+oE
TLSH
T1DE774951F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 32.6MB
SHA256 272435d3a79f509c08891d333913ae098a90209bbf1cb987b3c8a1474ae1e588
MD5 d3f9e597e7cfcefd71391e3cb6383236
SHA1 db4881e8a8052f2bbf925b32be3db5d61ed085ca
SHA512 0e63d66a54893e230fb68579779a30d2a2eed2d3415c51cfb5d308e0e0b9afc02543409dc217272ad9dc90aded9035c6b020d2d2aba9ef52a7a7d5e1c443cf8a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cws:UI+oG
TLSH
T116774951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 32.5MB
SHA256 057895a75335bdef21bb0b7887022234f4da1fff07e3ea0ee89c3165381ce02c
MD5 79e2a97df1f37ceb8415d4dd3c035740
SHA1 be7fa3a08901a0ad9aec18198b13e9aab37cc933
SHA512 9a166aa8e58126f0c7e0adf1a77350974085b7f5f5f984592a67fa37e577b6e37ceb20572c62f8ab617ac1f73fa6b54c6596aaf69d2086eec9b7bfee585b6496
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwH:UI+ox
TLSH
T1FA774951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 32.2MB
SHA256 3048554db345360440cde5ca6c8bbcd5b14c60e6d326adc14e35c225f604e895
MD5 1979cda8019d75a10a294d06029eeaa0
SHA1 a8c192c958b579edd1417a826358d2159fcb4f27
SHA512 f55c7ddd3cea33d8e7dd795d49b419574ed8302c76208b2e11a02112721c3e995bcd0402ad4bfa93e5a8e421c5d1092026307bd69181ef84c600e2246a8de0b7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwY:UI+ou
TLSH
T1ED774951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 29.2MB
SHA256 02919c2e4c45fc6b42e8a0e0ece8cbbe7a3351bb12297c8a95e4bd083f399760
MD5 b63fa4adff962f662db28815ec008fcd
SHA1 7446cc0a5de83a439bc5bc3fcf88e451a6f087d2
SHA512 2957795d0ada5b588aef676012ced7b4228749b42c0d3f2155d8c95a7626f51bae7f540b6ae82f60b522306d499e30e2738be976d0316c7858e97cd8ecc6e29c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw7:UIF
TLSH
T11D674991F5A08172D07A8471C696A77AFA3378411B608AC793C6DB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 32.0MB
SHA256 356ad25209d8787498810766b772b84ea47611d1e423ff32ed564d3ec74c708e
MD5 ff151eba51d1545282ff4e012aef8484
SHA1 42bc03bdb44f2d6796eb8fe1c24237ad622bc3c1
SHA512 5fca599e6fcfd7021a2c3c1580ca66a2f8bed4056e69b445447823fc25314187ff16864df6e64033ecf2b4073c824c157659f92dee3245214a9edd43fc4f4475
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwr:UI+o9
TLSH
T1EA774A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 31.8MB
SHA256 eec6f651ff30999f8e3788f06f9edca0b45be4df73b72ee4eae4ec487a3e118d
MD5 ae1ba943b2348f3c54a7922fb1edc3aa
SHA1 02f928f78ad64d72ba64e054a94ef7284ccf2c8f
SHA512 4e48657670468a6fcd1d2ef505833d905cde2f5211dc857f86e5cf9d3484c4934aaf5ec95d1b26234c15493f9f17592c9601b23892ecf8607b7706ee35f73bf4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwL:UI+oZ
TLSH
T15D774A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 31.2MB
SHA256 140bc828ba98d1346e828202e284966a3604d318aaa4faf1b8cb0c560683339f
MD5 5d49a86c058d744d6549e119056e4eb2
SHA1 3e069e2cf3a1c22cc31fff7388543faf2c11a8c5
SHA512 b6ca1603cc14eba6338cf8fdcdd081a5097f6b8cdf14b21968f01403a155cee4b468d97cdcb97653991cdc328c1cd474fbd2e464f09a4801dd3267d5280d11fc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwJ:UI+ov
TLSH
T158774951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 31.2MB
SHA256 f5aa8efe27cf71c961a6475e3cf5f63e488c80968101f6954f015ca14bb545c4
MD5 97df711989e1e3fe52b062ecadc5658f
SHA1 2d63181ed95fe7d429ec4888c07f62392be9256f
SHA512 6419e45fa3f3f8770130292bb8c89b00bb5fd10482227dc636c74bf7f3c6fcaa1d51ce4447f9a3172f4c0feed32d977983daa59831de4e3f583d84a8acea9269
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwL:UI+ol
TLSH
T13D674951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 28.2MB
SHA256 0f409aed7af00b43c2e3ae6c6a4e039653bb68b11c3c1f75af8323f206748909
MD5 d062e9c16611473fa8c7a92b374127da
SHA1 5147523ee556d4968257149bbe4ef9eed2797ae7
SHA512 c591f7932c5ec8ff07b29de6181e0cbbabf3058f29a9ec747f80745b864df62e3b891df0c310eeed55c9ec12003faf9868458c4e3c2ad6207aa921cbbd156426
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwY:UD
TLSH
T164574991F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 30.6MB
SHA256 a9b77158d6dbb9ac38d28cacc685f1c676c3d1351074461b7a5d52ed51f26fb3
MD5 994798754e482c0927c2eb1c775e8a12
SHA1 506373b11772e8dfdef9bec8abd2714a2d36f4cd
SHA512 fdbb4a5b981c4ca747592940539d057413e5f66e5ce5f49eae43fff1b06ccc69374ad5332e97b52340852bfa927ea1b1a722fb3452f3ba7382abfa833c0b3f4e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwu:UI+og
TLSH
T1A9674A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 28.3MB
SHA256 205e678f05525c0be2beb9d23900d12a15680542daf574cb5047dbfc0d548059
MD5 2d1e327983995a229b701e540ad030ff
SHA1 6811bd2ae265acb96578a3f027a33946ebdee71b
SHA512 b0f5af2a0a3d2387b8e3827d4586a9c5f466820b7e0c7a208b23c47394d7642be8ae73d4d9e823e5c4444546f46b1e9f4744af0c7439d5134d9e3789dbae1767
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwC:UN
TLSH
T13E574991F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 30.7MB
SHA256 026ae41e58cd1da11c7ce1b3eb34d0ec16718112aef0bf21abe982668dec8849
MD5 3a65e823028dc0231c542890d8f49db1
SHA1 7cc17d84270e452b00f43a929d7da6882f960391
SHA512 c62d9ab3cfb4ef4f64aaacb32b1fb2ae7721c98fc21e6833541235c1e1ea354d625a45f0c358877045345eb79a3387c895cc4eb2aaeedc2d521326656e7c66e6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwo:UI+o6
TLSH
T11B674951F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 30.4MB
SHA256 9e19310047d4f83a92b2978b4fe241413b32136bfe2595ce84dfa2bf4b59f951
MD5 71f751200974cbee763f435e3cd0be6d
SHA1 62f1ceb2fb32f8b8d65522aae3433b3e4cc0735d
SHA512 0679730439b5f7b548dccf584dc36cf5c85df79f4ec263ad3164c991fc5e512806c292d12fced04cdd20e6e4339aea6a9a70833d7ca6eb9f84df6b95be30c51d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw0:UI+o2
TLSH
T1A1674A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 30.4MB
SHA256 8d2776cc6dfec426a40fbe11151d881e49c9977035f78605e47ed37a7d8a2f67
MD5 9d931e7c5c2f016003bc59d787667e0b
SHA1 c967e5b5d40307aeaf3ed397d69cd66b83609d55
SHA512 5256223682cdf8e6def1a314461963f2f17f198f7a267dcc09cb1522be3fdf62f774416db591161fb8a1c3d89e0b38164ee992232d958306100009fb981a77fb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwv:UI+oh
TLSH
T170674A51F5A081B1D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 30.3MB
SHA256 0161bd599802ba94157b3c1a10b9130c2ebac9e2915948f38cc54514da5531a3
MD5 75a2c36099a11d8cff522f63d2f8e8bc
SHA1 3ca526547c07ee690589c6a4d3041b0889ee0082
SHA512 e8a3c0006b8f2599a80cae51c1894b79915eef8f21c0cdc7193e568ee568600f177c43f26d0cbf50c364406cbb4614b86ca7db6ffae420965c32b806c94c65c0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwR:UI+oT
TLSH
T111675A51F5A081B2D07A8471C696A77AFA3378411B608AC793C6DB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 30.1MB
SHA256 b34a25846e4d1c9456221c12c5fa551d9854bca444cfb789022ee287dc9f3760
MD5 708220c768a939607d063071da971e08
SHA1 b18e40164fc3b180adebb8d5ec1c0cc24deaa21f
SHA512 9743cbc73a9fa71538da9c8e7da499ea30cd815d35f76fdc1dbbcdd12db922966d7f5599e91297b5d68bb482242d6cb66549709f9c2e3722d48d74e8aa0f499e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwW:UI+o0
TLSH
T178675A51F5A081B2D07A8471C696A77AFA3378411B608AC793C6DB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 26.0MB
SHA256 d266afae99633a534dcc359e7ff18fbb60e5894a172d67411fc54077c73d29e4
MD5 01aa10d859425eee033fc359f8b840ca
SHA1 a56451b4b46a7f8294e3e3b3c3e9a163d8aec60b
SHA512 418098d2340d76c10044cbd1a60fa12c54ec4a397604a030d92f7877374f7bf80f40624ed87a5dd09f0bc38736b7e91f839619625bf3649e5f6136a0a3e4261b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwP:UI
TLSH
T183575A91F5A08172D17A8471C696A77AFA3378411B608BC79386DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 27.2MB
SHA256 d679eff516bc58e19bc1ec4ccd6ceaff7d0169f603a4d6347f1f428b4b28bfce
MD5 74829549f031c9b90eb653a2709b12b8
SHA1 7ebbd039c0f7368d07deb051a07a33489f629a45
SHA512 aba8eb0d70b130995fb5a45727ad5aca334166fe6f9e145b384268f4d5400727297487a29605da8df614f613ce39053f662e3902d3753b76c6d9bc9d7408536d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwO:U5
TLSH
T175575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 29.9MB
SHA256 6568649f3ea8613faedbfb5b5147e48e4643c4ee92158a1d1b1e87431fdb5a19
MD5 ce0e685360b82041a527f5c55c08751d
SHA1 fb5490f5d762a9ad8a4b15d418b16941323074e3
SHA512 e5df7945af16d72c8899f6c930f03371ae33b8d08a845aeb19f2f8fb1c3a6ff6330d947adcf96aa7c4bcbf6a9411923e8829fd2388043ca60ec9decb97238ebc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw7:UI+oN
TLSH
T130674991F5A08172D07A8471C696A77AFA3378411B608AC793C6DB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 29.1MB
SHA256 54cf6abfe50e6a2b077016cdd8737160ad4e9047ea36cd4ebab13936e67e3a0b
MD5 f30f16a694543e5044ae487803b4979f
SHA1 2e6b41676e29bf14eaa2fa109dc3eacf69384519
SHA512 8d18db30052edf60b30516e97cd5b36773e32bccddc8a72b399213b32cd0ea5194b286669a7cc053a40c6d64090742a7ae6f6f466903a76c1304c5f6818e1e55
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw0:UIy
TLSH
T15A674A91F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 29.7MB
SHA256 87776521a06ab117140ab5d46d9da420129587684e77be778fc997f3ccef9ef7
MD5 c5f170867cc5ef74350be1c35d421dd0
SHA1 8aa9a020176174364ec22df7cec064192a37494a
SHA512 fc319bbc3a1f832496353efe8962b8689e98e2f19a7c504325b7f9c0fbcf93fe742d8d810414323a3b36374b0e2a0eefeafa4ead4fae2879eff8ceec9f88c461
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwF:UI+ob
TLSH
T1F5674A91F5A08172D07A8471C696A77AFA3378411B608AC793C6DB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 29.3MB
SHA256 662e50ce1ba5f18e8e7e5bd47830e432244f67b0b82d7a503b59542e0bbf14ef
MD5 d3295fcdb048e494135976e0db26b7a2
SHA1 55b0c915cfd29bbe8552b54cfb1140a32b8fb47f
SHA512 46e46351d87bbab0edd8a66351b6236689d8d6de4920324829141b088e0c5ddcf582af990bbd3063b9473531888e647f82b16b1b1609d9bf29d43ac567fce795
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwY:UIC
TLSH
T107674991F5A08172D07A8471C696A77AFA3378411B608AC793C6DB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spo0lve.exe

Path C:\windows\SysWOW64\drivers\spo0lve.exe
Size 31.1MB
SHA256 bfd2b0116a26a93f6f455f7ffcd8f6430c469aad4532a120b0ac6faeee2b3c31
MD5 4a929e36107c03564d7fd75e51967e1d
SHA1 511dfdd47314ecaad192a6a18b8e1ce8caba2335
SHA512 5e9e543f09009ad7d2d6ad806411aee7667589f51753094756c9c1d110695198f8c4742d1e455780a951dd8cd5cc08cb3443917dfa2da47bf09275b8449d9928
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw6:UI+o
TLSH
T164674951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2952-5-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3244-4-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3244-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download