Analysis
- max time kernel
95s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 08:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
- Size 31.1MB
- Sample260727-kd64jayyfv
- SHA256 bfd2b0116a26a93f6f455f7ffcd8f6430c469aad4532a120b0ac6faeee2b3c31
- MD5 4a929e36107c03564d7fd75e51967e1d
- SHA1 511dfdd47314ecaad192a6a18b8e1ce8caba2335
- SHA512 5e9e543f09009ad7d2d6ad806411aee7667589f51753094756c9c1d110695198f8c4742d1e455780a951dd8cd5cc08cb3443917dfa2da47bf09275b8449d9928
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw6:UI+o
- TLSH T164674951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe" 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe" 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp" 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop\TileWallpaper = "2" 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 3212 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe 6044 2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exeC:\Users\Admin\AppData\Local\Temp/2026-07-27_4a929e36107c03564d7fd75e51967e1d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 31.1MB
- SHA256 bfd2b0116a26a93f6f455f7ffcd8f6430c469aad4532a120b0ac6faeee2b3c31
- MD5 4a929e36107c03564d7fd75e51967e1d
- SHA1 511dfdd47314ecaad192a6a18b8e1ce8caba2335
- SHA512 5e9e543f09009ad7d2d6ad806411aee7667589f51753094756c9c1d110695198f8c4742d1e455780a951dd8cd5cc08cb3443917dfa2da47bf09275b8449d9928
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw6:UI+o
- TLSH T164674951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 35.2MB
- SHA256 4b3fa31aa3fd36cd0312e484686f50c7a50ab6f69884d93694922b200258932a
- MD5 2a32441dd71a220ea726ddb097b73beb
- SHA1 62deb73daa03f43e92fb1bf716c2b96f01c08e79
- SHA512 5c9ba6c93826df4a66e9caea55cf878ea5bc6773f23bbc49267729f35cfb4f1189eba53ce130d3c21e88833524814802046239174d01ffe617a6588dee60905b
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwr:UI+okvyEYKbi
- TLSH T18A875A51F6A481B1D07A8070C6A6A776FA337C411B708ACB5385EB3D2F376D09A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 62.5MB
- SHA256 5096a2ad91ea4621f13e3edc6f32adc933d0af1bd4a1cd8aef0e2aba2407b49a
- MD5 9b73b9deaa8d4e94a5eab41a9013821f
- SHA1 15dbfd15117cf5c187135976ce7c81fd60838026
- SHA512 f8b144006c60f273bd88866875087b8571e801a6f8c9318958ccf3c5440a4884b1dc50ff3fd8a607797ced1b7d7c392b4f82606617b9dd999ec011347fa200a1
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw4:UI+oqI+oA
- TLSH T115E74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 33.2MB
- SHA256 46850ebdb831d33c62eb3340d9e60db6abe3222a79735e830615d5f118d91967
- MD5 36058516b482a4e2365e7c9f516524af
- SHA1 83fdd43fa75365bcd0b05627b352c1e35dc288c8
- SHA512 3ec92c4f9dd58f1fe87fd40aefbaaf16411eddd6dec7093ce37d83277d336d691d48117e99e63ad786c483331b6932eb87f5caa134850b7414bba94d1167a2d8
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwK:UI+oBG
- TLSH T190775A51F5A08171D0BA8071C696A77AFA337C411B708ACB5386EB3C2F376D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 62.2MB
- SHA256 70afbefe3f51b381725feb8d8702a217113e148ef18eaaa0dffe7482b5d4b0cf
- MD5 220fadca70f7d75773a7e7eba997f495
- SHA1 d0ba3b61fe1cf6aa280dad24d96ab2fe519c5684
- SHA512 caf79b9f9c56ccfe38201cdf82f1f25a70797b19e3291f6fa28543a77fac39ab3e68b78108ca480804a3fd3a99edb57d8e83f86d80f3281ee498963032c94204
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwu:UI+oqI+oW
- TLSH T1ECE74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 68.2MB
- SHA256 07f48991ac525e5905c76f9c9c1b1ac521c767246ef70ce3efcd0b63fc357226
- MD5 6f2fa09fb1a82d48fee45eff576bb875
- SHA1 73703456b9a85fcdaaabd5f3bad05d1b3a294fad
- SHA512 35b658bd2ab05ad1cca416dfa50c45df4c4f480684341ea4869e63217e03f15cf5c521ee55c948ae154a6164673b9f4cab864d26ae884de4d2858bf3e3b47d7d
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwG:UI+oqI+o8Qsas+PS
- TLSH T146F75A52F6A081B1D07A8470C696A776FA337C411B708ACB5385EB7C2F376D09A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 67.2MB
- SHA256 36cc22534ab3ee819f7d24aea2b152bf6602f64b16efe37ac29fe84ec7556faa
- MD5 f0a953158c52cf6c0c425b1393a5e1c7
- SHA1 5da021cb4f1ff6e69755f6a01509fc10c4712e5a
- SHA512 2566bf9978c54a9c1e12502376102065a05dd8cf2234fdf7ca112608f3583b1a8de382fbd22effcab201734a70da3b9c283921b20a920c816e935151b8f9410a
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwq:UI+oqI+o8Qsasv
- TLSH T19DF75A52F5A081B1D07A8470C696A77AFA337C411B708ACB5385EB7C2F376C19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 63.9MB
- SHA256 8754649a7121d72e5d38cc09406ce07d16bd2f7a98b8a6577f9deead4eb3fd48
- MD5 c46680d31c1a67ff63eeef4daadfaa7a
- SHA1 461ccb62ac87e78044a6059c18cb1313149d43b4
- SHA512 6549edad0d632782fb4105469fd9dc2adda5eecbf8537f3d0b00fc3fde99c25aea4b0eac96af84315dfd3b47b6fe1481dfb4cb6c89dcc1f2e05fc8d4edabf212
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwU:UI+oqI+oo/
- TLSH T174E75A52F5A08171D07A8471C696A77AFA337C411B708AC79386EB3C2F372D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 65.6MB
- SHA256 0214620b3862a2e105e2f15cf0d97debe18232103a369c5e7f1ca1976dfe3dba
- MD5 776247acf95567b5cb89b6e1ac4d8b4c
- SHA1 c8f1ececb716423b625be33fae98c6295c0b159f
- SHA512 40b99c0c21ee3d76123b5ee4b6bf74514a3f263ae14cb4bca5b855c9256cc04e04b15a18590b8a56a017f529c728ece46c9f751e644e4def45c3683c3eacf16e
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwM:UI+oqI+oO+6
- TLSH T140E75A52F5A081B1D07A8071C696A77AFA337C411B708ACB5385EB3C2F376D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 64.4MB
- SHA256 4dd455001447884bdafa266d64620b63c5308aedc66e0e8379857ecf9aa06a5b
- MD5 965806a05ea4172cd8897e5cf7e5f738
- SHA1 173e21493916a4b9b3d48dc8ace4ff12a1a94f12
- SHA512 0f07f6faf7871191a2db5266139cd34a32193e36e58a0f1d3add8d265cbe9e44367e8bbfc90d64f2f941bb5143de5dc56dff4f2da78aa7b1c6ad99c037c58348
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw4:UI+oqI+oQl0G
- TLSH T111E75A52F5A081B1D07A8071C696A77AFA337C411B708AC75386EB3C2F376D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 63.8MB
- SHA256 c972c7484b6f008dd87c0277b5a5954983fa7bbc482ad6ace90dd138364aa064
- MD5 6f303c60060238c16af105dfc336fc42
- SHA1 509c0853ba0bec209467fa6d95324ea326a01701
- SHA512 f6ef1d3214992d06e02ae6edee4983831b9e8df1ab92823a9e25bf3adb55d402199b3385f0aa9d937d0db15f35737fa3ee4ab2477974a81eeac04bb58426f6b2
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwP:UI+oqI+oPf
- TLSH T146E75A51F5A081B1D07A8471C696A77AFA337C411B708ACB5386EB3C2F372D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 64.0MB
- SHA256 1f2adfa7611fd66257d29ad1e98186eb41aa77f4d3b0a76c42c7250de54035c5
- MD5 3825670234b693f0b87f5210b915c12e
- SHA1 17e0721e48c5d57e69b7b66f56868d00f7ac4685
- SHA512 3be491c6cbcaee51b81b5b6a8439765a1373046a911274ab417ada38e4a1a97961ee8333cd60086612e61ad3dc381b0e2f1a0bec361dcecc26bc46bfebf67482
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw7:UI+oqI+ohC16
- TLSH T162E75A52F5A08171D07A8471C696A77AFA337C411B708ACB5386EB3C2F372D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 63.1MB
- SHA256 9418d17ee8087567eebec029b81acbf1f6ec3b68c9d9e78fc07909deec81bd88
- MD5 954b5837640690c48aee974f6615e670
- SHA1 0f651f3b0e108f93196221f77c042282edb106ec
- SHA512 6955b8143cad8f17389e9b33c685886bd7f9f1bde24531cacb2a7af9893ad5c4587c7177a7b830f81f576fcd6f276f5045905fc56895ae9fe5320736d0a1c5e2
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw2:UI+oqI+o+
- TLSH T1CFE75952F5A08171D07A8471C696A77AFA337C411B708AC79386EB3C2F372D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 63.2MB
- SHA256 4fabf364a8c6f502efdad4fac412f52d39471f9517570d14b6d6c87e5f4b815c
- MD5 cedd16c0ff78f8c4670191766dda34b1
- SHA1 56b35efc007d9d625e6e66fbfa1744f3ef0aeda3
- SHA512 566d5c5112c370e3d5693beca6a363bab4f9a79cfc28ab0124f57e63ae1df21c5f630321115531d0102cc37dbc2c24c14cdb4eb657ddca61395a66145cd6cbdf
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwM:UI+oqI+oDg
- TLSH T105E75A52F5A08171D07A8471C696A77AFA337C411B708AC79386EB3C2F372D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 61.9MB
- SHA256 4131a2a52a9095bf96fd74fa8297e36a893f4dfb4d06a988bb878cf9cc28d194
- MD5 ee1d57e54a36a80f492d64bfd24cdf63
- SHA1 26e02559a5698968f683eb52126c60f09a3fbbb5
- SHA512 5dfa24b03b9bef1b3ea4e364a9d407c8384327cd167127016902bff4f3f781e9c8d1936f8abed8bc9c563b746aaf61930f85cfbd429b0939e240e94ff55c69fa
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwe:UI+oqI+oG
- TLSH T11AE74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 60.8MB
- SHA256 110df2a3acb9cc37da17ed22d1359c595c39ff4aa7ba98f41749131eb81ff68f
- MD5 f776d3456bee884d0897394d5424a8cf
- SHA1 f04a43072bb19eaf12db8a004aa971d81e3b30f8
- SHA512 ccba5801cca68769d955f6f674e3184d9fb0eaa6196954c81f70177da6b89ccb87b914f8185570e99a6bc33a6a40fd8de642cf7dfbbce7e8ce0cef09f4fbf76f
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwX:UI+oqI+ov
- TLSH T17FE74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 61.6MB
- SHA256 131f8b611674d4f2c0e0bd200334e1990dd5f5bc0188fa0ce986535ea031199b
- MD5 5f13c83bc6c4e780d96e834b1ce1f3da
- SHA1 a55b66b21d4ffadace192b4a012f5658156de5d3
- SHA512 7908a773f66afde2d8dc9e5b57ae73377f4ba608466d80a00e1b689596beb95be5a5cf0192b41082b4bf830f8e100f778df7924f8534741625e5cff9d9c058d7
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw/:UI+oqI+oX
- TLSH T1ECE74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 61.8MB
- SHA256 2ea6d4a678b7c153fd06bcf288611d9e1aada2bda0c1fb2d03a1172b3bfa361b
- MD5 9c7b813e99c214777c66407504b5b02e
- SHA1 7715eb689df1af6861f17b0f9ff22e3de7d318db
- SHA512 48a334cb4eec887412403c98f8339eda4654d2828b008e5a4af4e785e564224b3d08ea9c3c6c152860037204d459ff64f3df6ee8fc3290816fd79d8aae6e65bb
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwm:UI+oqI+oe
- TLSH T1E0E74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 62.2MB
- SHA256 4b1d23e857352c73e77b1873276a8d56102b6126ef732ca1bbe85b5646a3ddb6
- MD5 31282de3c3a62ccc8a28ba19d3912fe2
- SHA1 10f9812bfc1b33313ed3cfda99a493fe8af898b3
- SHA512 ad6e80d0f48a972ccf1c11ff1428f9fe168bfb54aa16056487290ddd13907d6e9164026093032ac6321c90d3245fd6f4d4f84d524aba64247299f3c36a854f61
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwL:UI+oqI+oD
- TLSH T100E74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 55.0MB
- SHA256 edf2ad8e255e9b55c80c98e5569922303b909b9ab373f4a26ffe2b8d682c7491
- MD5 37373cf300ed286e8385fb4233f57475
- SHA1 c71d8524309cfc58ab5a3e13f018ada82e364fc5
- SHA512 8f8d013efc81af2bfa5d0435fba210f75d57e95286e4d5b8f8df773da39b4993ba01edf614e68a31db912a41d25a80c505033c6484e534cbcef57f9333cabcaa
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwz:UI+oqK
- TLSH T17EC74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 53.6MB
- SHA256 5a63c493be0aa1d30746f33733f6c043ba132535b4d9c1dc8d5936a54d616ccc
- MD5 7c1e138d300eefa9c55d7ece4bb40084
- SHA1 02af240235a0a2d098b2a20e537d1919282752a6
- SHA512 7868634ec4d68686fd63c08294d7a48a4facef38c1bf257e1857824a750fc9d4e01ffdae88b4204b815fac00d9ee5a2f0dbfaf93575b3f7192b33f9d4e812749
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwl:UI+oqM
- TLSH T196C74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 53.1MB
- SHA256 06baa8dedebdaf89bfde8b513651d16a9b82722fee46c028034896c18c6210a5
- MD5 92fbac9ee29eacece9f7eae40c9837dd
- SHA1 1ae57e7502195d1d917592eda1af274fa308efee
- SHA512 ebaeb8e96c529d4c9fc98dbf5984cf040138c6abda388c3ad22d2685423d8163394142b654b8a7366bf0bde72708fca25f7512d7e5840885ee978a63889f058f
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwZ:UI+oq4
- TLSH T1E0C74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 53.1MB
- SHA256 adaac382df4697e32592132016b640a847cb0e2f907979d06370909802804e89
- MD5 6003713ea5dece0fbe3cf01860d00dea
- SHA1 cf44ff55f8f99947e6feef9449f672128501df22
- SHA512 5f042d69b352e94b886dd59ff0db2acc71828f452a28686383e8325b6051c0d88a616226124f7b943bae7ed721dd285579db399ea383b991d9b551c544f3154f
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwB:UI+oq0
- TLSH T150C74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 52.4MB
- SHA256 60b3b91bf75c7704210f99d9d5cd0071649ce8e1b44eef5d509c5191a38249f7
- MD5 50c47ae319808c3e3fbb05f998a8fb98
- SHA1 d17dc57580595a0627267758d451c69b3d768ef7
- SHA512 d5b6d32b989b0a7554071016c1c162cb53d6ad7e72ae06b3133f0b81617416803b111bc4a822d544e1f288a9fae4fc5578db01bf2fc61e2782f80e74f264173e
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cw0:UI+oqF
- TLSH T1DDC74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 49.8MB
- SHA256 520acd986547d65a433f414209a2333b09245924a1eae4ddd1906c3b1445bd7a
- MD5 24e02a6caa21015fc10ba22c1129f3eb
- SHA1 3dcd791b86bd0c7227042592811fb292ab1de98e
- SHA512 3b822eb31ddca41a0b3a48529dbdfc36af56b2633652c33f99fdcb2ffd593129388dd878e8a0e1f3661a6979cd7a61a5bb142a1ba4c3d08940395560f45d05e5
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwG:UI+oq
- TLSH T14BB74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 50.8MB
- SHA256 324dbfdc09ea805d8612b7f63908b686c797ab53d8640424b8bf5e313a0ce3a9
- MD5 f07ce65247f2f895dd88ef59fd7d6aba
- SHA1 d463cace23e7a7b938c276cd72b0bb5d3679225e
- SHA512 c2df73eb05ca6c87ea40fc7e11f30e52702ae1125a14dd8fced182449c996d5f8ceb930f49b83d6566655c2d5fb9026ba9bd7080c834677d2ca3804134acda9f
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwC:UI+oq/
- TLSH T192C74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 49.1MB
- SHA256 bc6ca459bbacc55a84eb9ba47e99b02346a6284e21b0959b1d3d3c8c4c519d23
- MD5 fb90711f7290a59de76d06236a82262a
- SHA1 89b44d56e331618861a3540755e5877d4c23582c
- SHA512 af44a33fe5711c765022e3ea0cf934acb4bff198f5c07872c28841e08f1490e0e3b8cff54a284be65050a1d2ef3cc8fc8c69837712212806feba0c1628466f5c
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwK:UI+oqr
- TLSH T1F1B74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 49.7MB
- SHA256 2f4a69f76655ab449009afbe4188f5c001a214c0953bcc360c94250ee48fd962
- MD5 b06a4af49d1cb0e9b23ea90529063bc8
- SHA1 90951558b32f74e0d32323be73d3beb95a4aba06
- SHA512 088e1f9c321accef604c9c4dc41162b9854b3b87506d01cde1174c9638485de96971d12bfa261eed6928ab160e5a3e29f5042825338a22d5c1bc69aa97f80065
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwn:UI+oq6
- TLSH T124B74A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 30.9MB
- SHA256 fa60a529494c070192fa7af1b34831d616dabf3598ced585bf41aa8adcf522d0
- MD5 62392249be4cc859dad3e607766acdb3
- SHA1 61c8544a7f4d3ad11133e19e58e9d7b97e34aca3
- SHA512 14e92327d37d6c59eda0c8c32315581a24c3ad6808571ee279a44ef8472fc06edf853e22f5dcea17f88160f5351e80d0f9f171061207dab5849095f4db5fdd06
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwc:UI+om
- TLSH T167674951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 44.1MB
- SHA256 ed84e1c6a739fc8e659efc5e8e071efffe029112229e221c74c8e2edcc44bad3
- MD5 04b50c05f014fdccf0311e43e6f865d2
- SHA1 2bc2ac894890f466673f808b7ab2461e24467281
- SHA512 81bd4adeeedba592fdcfb0f615ab6421a93f484cd38fdb0b5e07e5f0757460c3d4be8cc3a7e0325b6f1e1c9042d958e6b1c050644fb0bd78cb8289466927aeb5
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwK:UI+oo
- TLSH T1ABA74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 45.4MB
- SHA256 9ec7fa6e8b9c93e8134d841b1f8d35eb6181872db5400a483b225dea69efc50f
- MD5 36102124e41965aca13bcc53e9c02cb9
- SHA1 dc4056bd7862224a42c2fe2e913aa246a95ed99e
- SHA512 6bb23321287479cb7f934c4e045ae24e7cd36e9e14af556d8ecc5e6ac95eaf4a8c686ea0483b3b1266139e08f5709ac0fb3873a530940633d98e7050fe58b5fc
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwy:UI+ok
- TLSH T194A74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 46.1MB
- SHA256 63a5c6cead445515cba1bbc04d8a9bbd26adece78a4083d3f0fd7c35a53c3462
- MD5 a630678d8ab842555b2658cf1905a6ad
- SHA1 eae2b692ce5a87bfcc9fae5548cfa5b982d4a829
- SHA512 178452235372cb89256d1e6b5500ffefb88844fa0dcb369ec1bd569c72b91405ed0cef042764cf1f1d321b765537bd3ca90bab2fe74cc5c4d40a12d00cd36762
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwf:UI+oqG
- TLSH T13DB74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 43.6MB
- SHA256 214646310310efd71c5a34809cb2f357c606b620b97a094e0a2ff6dc6f44fa56
- MD5 39b814dd06c70982810c59fd44e062b2
- SHA1 87bf2ca41cea17790f7134a789dc751451c2e3a7
- SHA512 aecc8ffaec82548d5357b75d5862926d91e2cb0f5816db1d2640da3d8e24dafe72f7db7accb7c3458774f4dab9e6d23e8274ea6470e34f0e3146e38b37e8de6e
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwd:UI+o7
- TLSH T156A74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 32.4MB
- SHA256 e986622161e46e2d4d13a2359e5f6af05784278405586ee0f3b24f5f06f0c764
- MD5 971d5061ee638fac8d838b339bd2a847
- SHA1 871a640f1bf2bc8da951fb63f8a504e5140640ea
- SHA512 46f3755cafc9054050323b721beaa25114f08baaf649e5b60b6f944a42386a86fd231d396a2220924307b3c98e0e6287a9d41a13d85e1f12eee6e28daec38c7e
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwJ:UI+ob
- TLSH T156774951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
- Size 62.2MB
- SHA256 73aec03f01f087094708af22deaed839e92c2cb3f97c4b59d50b7ef03b30afc8
- MD5 690bf271fe09e4dbf344ae54f8ce400e
- SHA1 b5654dfd675a3ac697e4ed49d445849891e8967f
- SHA512 506b31d6e9596ea3a6720929f6d7d562fc15e3f0fd2497ec9103bb6d8eedc09737603c6999fde8de8d9e090a41f412e8fceaa26f72a85040907842818c865ef8
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwe:UI+oqI+o0j
- TLSH T182E74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 62.2MB
- SHA256 fc569592ed635587a5ec202c5c9cd8b3f6000c758d869442cc96cfc69399f426
- MD5 0e304ae6aced90a106712bb5814a8195
- SHA1 d6a43a25689d00374a346159d752a78163593d82
- SHA512 09ff9a3b138f82a93f3392ee5fb761c8cde46054bf3fad409a650528f5666d6a89e329968a49da95bd7c2229ae25da60c19f684de33c9da0a9369b22c8c8cdd9
- SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Dw/h1+Qw/h1+cw/h1+Qw/h1+Kdw/h1+Qw/h1+cwA:UI+oqI+omD
- TLSH T171E74951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A76733
- MD5 SHA1 SHA512 SSDEEP TLSH