dcfbb24895f0a15125acfaae4859b303d8a77c542ee14881ac86ff3d419ef9e3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 14.9MB
Sample260629-d4k6escs8s
SHA256 dcfbb24895f0a15125acfaae4859b303d8a77c542ee14881ac86ff3d419ef9e3
MD5 b84b3c6c935a8d5f6bcc4cde971810af
SHA1 8d6865f6ddf505da7b2954f1d77a94e446610371
SHA512 7cb130f66a7d107809ff485693c2025bdb5dea942b3341f3c2113bf00404cdf8061b66e731dcf039c7953495eecb337046fd1e8967db56c57ccb557addb0216c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+:Ce
TLSH
T16BF64A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5412	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2408	2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5412

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-27_b84b3c6c935a8d5f6bcc4cde971810af_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 14.9MB
SHA256 22ebd4785beca0e8ab03f077db85b08efb00501e6df298ba1c4facdf88ccc3f0
MD5 6d01fe7df2152cc86009f52a5da07185
SHA1 896eb5ec22b95a1ba3a45f466a19751f8976cdc2
SHA512 f40b5fc8ac2f6c1d68980e531d275fe4ad2d63458f93bdcfe9f3cf7d87957b2350767d9ef570b14ca8242c7559438260e17219953ce51babcbe23e8d7e131487
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+9b:Ces
TLSH
T13DF64A51F5A08272D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 33.9MB
SHA256 c60a2a0129213e5ba1a243c292fa8ef7b7473b6b2024bfd4bab0b1a0ca553a3c
MD5 177ccbb8d47b9ad1e555cd2541a93229
SHA1 7a09018dcc8bcb95f80b28ccc565184a79729cae
SHA512 1e38c7fcab184f3073c6392334ab555feabfec50afc3a4a433f40db738bc3f224a4d47fa345c96fcc7a2b8b7e08e51b11c1a594a0090ffcd6957ea449cef0f2a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwl:CeUeEvyEYKbi
TLSH
T1C9775B51F6A481B1D07A8075C6A6A77AFA3378411B308BC75386DB3D2F372D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 30.1MB
SHA256 0d6fa0b02158753aa619cc1d21ee312df617271d6fb014deabe27c1eeba1e62b
MD5 066325cd37a13a4f3585cbc49d96b5ad
SHA1 13692aef75042953a738db4dc2122cc635e1be59
SHA512 803b8d774dfad13b85eaa3036c2b8c0b3a8cca23e2c687bbf842ca8246f353c188536da3f10311a7be907f5c2cbc9183b23f9d913bffa4ce143f20e16bd84f57
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwo:CeUeg
TLSH
T19F675A61F5A08172D07A8471C6D6A77AFA3378415B708AC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 53.2MB
SHA256 9b7a4c1700ad3f9cb97b7c211c81d595a76869ae7172704277e2090c25f5478d
MD5 7e4b1e409b987106b7748926098c0966
SHA1 fe8062032b629cd197be17a13be432880383e0b3
SHA512 afa494ccd392f176a422101dea96b273b51e32b52edbaa7a1f9eb85e6ba6d4980b68b8886078a7b2aaeecdd524db28fb8beddce06f9f85f98b363a1e0c3c27d4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwk:CeUetUEtQevvqc2W1cpV2XI32i
TLSH
T1BBC76C91F6E483B2D2768434C5B29676FA727C091B3187AB4275F62D1F372909E36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 17.0MB
SHA256 5fa52d869ef9b15f868b4393a73a719df6caf7d5eaff6fd8bc173fa3602a90bf
MD5 5a97dca308d7347e0641d9eaca1fd93c
SHA1 61e8b526767cdacff8095ee3019c58172c7acaff
SHA512 f3f45589f9480b91898456a6b0f2315b94461643159efe722ec9dec12ff93d27150e693e693a4640f82d7de394c122c15292b0c39b8f0ffa345f9088db128482
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+IGn:CehG
TLSH
T118076B55F5A48171D0BA8074C6D6A77AFA3378411B308BCB9386DB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 29.9MB
SHA256 f46c103825cbe96b653a3e42fe960dc1a74875be03ee04e06a08c18624e6062b
MD5 851c34c1dcf93f73f7629d62b7efe1eb
SHA1 65d16d11e9c6558ffc0107bf9032e6bf6ed21b56
SHA512 4eab4ae9b493a04369bf4f3920eae3fb701688a824b57c137599dac0efb045bbe12d8e7f414fdd49738f510dc33e815e5678fe183dbe513e41945bd6373dd2eb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw+:CeUe2
TLSH
T179674A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 35.8MB
SHA256 6faabac0d431061e98e9c9fb3e0929454da49bc5dea2d0d445e2e80ee94b8c3a
MD5 fbbdcaa88d533ea84309ca088034702e
SHA1 e6e23cf9d592780584d480253b2a060ad05615c1
SHA512 6771785e09b621ae42074d47366ca5d68487cda852c5d0b81ab29ce9025589c9d8accd69a04eb9f004bd512260a5486554f197679d40e3d0cc972c136fa78a65
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw2:CeUecQsas+PS
TLSH
T120875B52F2A08175D07AC470C6A6A776EA337C414B7086CB5385EB7C2F376D1AA36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 31.5MB
SHA256 6fbb1bdc25c18cd0116f3ed93faf7cd477fe7f7e4738c2d1e50340a7332819d0
MD5 58774769159db84bf7031228b148ee3b
SHA1 020e55f38e66ce4542281a68c815fefd9767293d
SHA512 1bba9cfbf0278a386da931b9e3e21487aece2427de8720a79b700adcb5f54f5dbfe3fe51c86f6f8105435174396dc1b80eca6d65b18308f02fdc82d66e766a1d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwk:CeUeI/
TLSH
T1E8774A61F5A08171D07A8071C696A77AFA737C415B708AC79386EB2C2F372D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 33.2MB
SHA256 e7f6d4ef7b751d434c1f37727e956515e515a2d12f9ccba81ce515e768fdb80a
MD5 16ed85e3d94d540ae17e09523a1a0dda
SHA1 56caee6b6e97eb63fbd52ee3600df770cd2af468
SHA512 deaf50b708801306616e4b9073bc5775592546c2c9d8037e6d0b207503886ced2d6b91124e76dbd8e0b579089f44c6a20a3a8d01b97c03d2789ecf527b0ae688
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwc:CeUeu+6
TLSH
T13C775B52F5A481B1D07A8075C696A77AFA337C411B308ACB5385EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 32.0MB
SHA256 08c35a38dbbb61d7784c91a204f75ca079697a0f78c8b09e7b2e1405272fa92c
MD5 e982732c69448a31165878c456bffec1
SHA1 408304593b275e82b14e3d027efdeaa2f0c3574a
SHA512 b8a65c31137976d7b645ea3a08d643d9a605ee36e987c3e8912ef86162831ae33e75fb955e90605de687555bcb0997b9251827e09dc3d6f787e8747853439018
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwo:CeUewl0G
TLSH
T139775A52F5A08171D07A8475C696A77AFA337C411B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 31.4MB
SHA256 a299a466652629e372e1dd40ca672a4dad422cdacf486ad4c272dfb28f617b2d
MD5 c0b635ad15d387b9dd6e169ae43044e8
SHA1 1aa601b17bd1ce54407b49206387941ffb7d2d98
SHA512 7a667c145b87197f27fa2b3523a585327f77fd5eb88c6fea15584168add57384455e9c5f1618dddbe2b1c7e3e2eccd51132d92ba15d3d076deb7e7123bc7c055
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwf:CeUevf
TLSH
T1A4774A51F5A08172D07A8475C696A77AFA337C411B308AC79386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 31.6MB
SHA256 c0c56c7bb942b0a69a7110c9347c1e97ff9550cfc8ed83da2b762800d9b3649b
MD5 4e2b44f93354ebc5eaf6b0439404a81a
SHA1 a740afb449c98fa0ab7dbd8ee70d27043018e574
SHA512 877aeaa6b72ebf65af76cd31d2e5c453d9f928d7e14e8513b1f23136a994249e1e533b1add7b2ed4db080505b7b3b14df7739cc144078071a89c06350d6d9533
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwL:CeUeBC16
TLSH
T1EA774A52F5A08171D07A8471C696A77AFA337C415B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 32.8MB
SHA256 d4df6be7012856303954fc50b885785bb91f0b2164b548210f2f6474bbce1c93
MD5 849b88f325aac46dd37f9bef5283d197
SHA1 87057a5476df3bdb7d70bea1f231e0060d420b43
SHA512 00ca565bec474009378b0d3a9e6bab3e8301ecd8138fe830e5a1eec3805d7a5f80d24a36ec7ac88609da04d9c6d94b880887d39375acb45a4431f0603d3f261e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwK:CeUejO
TLSH
T1B1775A52F5A08171D07A8471C696A77AFA337C415B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 31.2MB
SHA256 80e2f1853dcf8bb806021caed5280de064c2c93aa43d270f7caa1cfd89186fc5
MD5 e651baba848f0fdd28fc38e3450ee8a2
SHA1 21686195bdc8c051dc01e28aaf89e1fc0fbf332f
SHA512 b12a2d02c1c9070b25742fc62c0d8ec378ab142cf8b82bc5a7b3bfa749ff0eddbc688a5cbf2a842b51521a8dc78d5b03b25e2a575b079921797fc08197bace55
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwY:CeUej0
TLSH
T1DB674A51F5A08172D07A8475C696A77AFA337C411B308AC79386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 29.8MB
SHA256 0ee5b6d3930ad5f392408c47cd835df6fdce3ac39162be4931a8172fbd29780d
MD5 5b43cea8a69d284d055d529e6eb80bf8
SHA1 2eed9c4216f1b536b703505b3b3d0d00b654ecc9
SHA512 2e6a76c0d35fd86e4d8ffbaf543d5ca303805e28a54819cb8070e762a166a246ac2abb51be6d35cf11e039a54e465430e8fa7d7ebafa2e2685f273780727ec27
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwU:CeUes
TLSH
T198675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 29.8MB
SHA256 74a2ce372a67ab7506967fc5f891dbcef69fc78c5ae598a10f89a18ff0940824
MD5 44fdf9d7f97899fa27a50e790ebfd887
SHA1 e5b8c651d118c37b173fc0015f35858e69cecbfe
SHA512 74ecca7c77e97e1465fb18724468257c15166c87d1093ed56570bc6d5e530e765cc78a1d0fef48fcdc2b17f5b428e246f2a03855bf4df95ad01da4b928971f31
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw8:CeUe0
TLSH
T1B9675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 29.8MB
SHA256 381d9963c7248eff3cb84f7159af55bf4c0afcee3f368ef4ca820e6e8cad314a
MD5 31806b808c5b5b2666c4031eb8e6cce8
SHA1 0cb9cccf56a683f8320c3e9be109c3d65b75aa1e
SHA512 c1eaa5cefd2ba79a4531760c565df776187f8c1cb2ce09363ee79c2e1c54b0c4b778a00969ae32a11d99a421271f09988ae760d882f4c9e8b1ecb8f4c716aa27
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwv:CeUe3
TLSH
T1A4675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 29.8MB
SHA256 a1fa4b5dd8ad2f3e3faf52da6677338c1d60e364d3949fa44415fd4139f9c894
MD5 27644a30a884c81fed9d16e149e777d8
SHA1 b3d8e93336ae7c4cdc378b0da41df1cbcd12f070
SHA512 e4547f2b29d56dc08ed0c6330eb4dcfc49d93eeb16cd6afa05c2be93f71cf358bf1e56cda144841f67a02dd56d597a53a5c3888855639b1d180472ecf852fe21
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw7:CeUej
TLSH
T152675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 64KB
SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
MD5 071d69befc4545d16c8415ee31c5afdc
SHA1 98106920c20562db4df0d21c498f51369d927ad9
SHA512 994fdea351d7be4c5434f4840958dad54941761c7132fb3cdc5aa3821de5c697829bc462ca8428d6341e9076d304a231f945e48f12c618c86ab01045a26eda17
SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0UeG9ODBZHlsP:2sXDsmJDZzgyQsRDptkar4Vyg/B
TLSH
T14D530EF819C0F18AF8D1D571A0C9B33926EACDE5BB5047DB7C172B429EAE4800397D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 29.8MB
SHA256 dc7a88ef51208bdc1e2027ee7a422d123db61d0adc79d02e9dbb41cea79e4b1e
MD5 9f42bacf8d840132d552bcc0d1fa22bf
SHA1 c54dae5ba233e4cf14563d4dfba8f4e355a34c55
SHA512 fa58ca51b16382bd9921f6f9d429423cc25c5a15bd920acd78dcbdb5d331808903b8ec466cf1638ea2deb91d1dcb22982664d0464b9aa8db07030dfe81eb787a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw/:CeUeX
TLSH
T10B675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 30.0MB
SHA256 92e7ded483e57e5082142ea0a4b203968ea07ba0ceba73ed313649a7ae894e9a
MD5 84421042e04b6eb1eaba94634760985f
SHA1 50d51d1f0eb974aeca9020dc39ccbf8ac37f9ada
SHA512 cf901df5ef943ec2025c7a11aefbb1fdf35e68c0d423e5209aede3c1558685571f758cb4ac84f16e33e5d811a6ba8154d3ec6e85da95b3ed05f2acc34d8e08c8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwJ:CeUeGm
TLSH
T11F675A61F5A08172D07A8471C6D6A77AFA3378415B708AC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 29.8MB
SHA256 818a207e7b059e8aadeaba039bec7cfc0939c5845db642e3985bed3c102ed68a
MD5 6b500a786dc81f54a2d1956abca261e1
SHA1 62c0cfd76b6f0038de16ba34d03dcec407c16d5a
SHA512 2710a5ed5d665a213f7d31a75041278eb1dab7bb76dec68567e0efa929ff2aa14573efd1b48608f01cf05baf79ab68702374e7a71ca16ef8d99522664316c635
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwi:CeUeq
TLSH
T1EE675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 29.8MB
SHA256 bbca749877a68e334ce58353fecb0c9a4bee879a1fbebc8f3a4105b1252b4a6f
MD5 cf0ba710bbf53057ace2ab35217de5e1
SHA1 e20b8a4a3d7369b327bbd0180c92f394de4a91a7
SHA512 ffc4f360dc35b9ebd59bf89123ee08cf1f0e2e2d8df42c64966ea9104e38a290a4bace0f169a991d458ee26384ac7b104f03c3ed1df05977c8d6e479522cea15
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwe:CeUeG
TLSH
T13A675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 29.9MB
SHA256 769bfa4d887dd28b0a1e7cf5a772d88bd8ab4a15741055796b0e967f0767ff4d
MD5 1e910cf3c310ac3147b882efafb7ba8a
SHA1 d9bd331b7c7a06e258f3c4ee26599e5082e333af
SHA512 65f3453efb6034e0bfeaa8cad8917d02d55b8f16053829ac6c24d5ebbd757ecb11dfbde87265c1c3a83a42629d2d626222c0b9c80a4cdb4d60d86f3b4b32428e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwK:CeUeC
TLSH
T11A675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 29.9MB
SHA256 1377daf94eb31c3fb00823a058afae05eb641b63607b7f949e308f7611edb53f
MD5 021a497ffa9b80843b88167399ce7fba
SHA1 2228cce77a6711b899242f2b29ad7cdf043957a2
SHA512 20b9dc30c62c56ebe1d3c96c03e8af6660d5cb37e8a9309064a8161627374c7ce2e3724f42c48c4d82a6458a71aee2ce9f60ebda1ec8b0e80a51484b15ed4cff
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwS:CeUeK
TLSH
T154675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 30.0MB
SHA256 589119b8b56e000c52eaf48f40c0f985f47741e0f763465b460e42c10ff18f38
MD5 1eeb6294add77f5d1ed5e8d1186723d9
SHA1 5e9f5d8a5f9b3d1342b285054064b03285a82a56
SHA512 a5bd23f6b8d9516c830181b984bc4cb482395b779abc749703841dca4ed1f80b70675daf43d575f6f4d63d4a6cba5e5e42db6e5c38b7c22769f454d2a15b731c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw+:CeUe87
TLSH
T11E675A61F5A08172D07A8471C6D6A77AFA3378415B708AC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 30.2MB
SHA256 73447b817c9ed6c56dbc65011b7712db289e4989af53efa3f9ca2daf8622986c
MD5 ca5e767d0c6d86a199c38db7c41a49d5
SHA1 d7269d834bc45a283f284bd414c338b8dabf8069
SHA512 00fff6777fa8cc0d52da25af2e0f25b669e01df2332afdb19253ee65218c7eb82884f9b0231834b6a078c6b27f692d4d067c79b5bbd4a5dfcec26d40349821ec
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwd:CeUe/d
TLSH
T1D9675A91F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 29.8MB
SHA256 ea6494c1fe02af3348474b8b285d73e530aae7c578943628d2c1c25f044d33c2
MD5 c31fbce96811243a6740d0543b5ff3ff
SHA1 8d140c3818c646faf1df6e3418678b0610476956
SHA512 4ee51d4d76d0cc499dd8a451f588fc7f036cb222029dfef0493988b2e154c03c425fa3871091fad774e74ea7b2e3bc93bc3c3f75f3d8c876d5aadd06668aa53b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qws:CeUek
TLSH
T1EB675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 29.8MB
SHA256 cc6ad0333dbe1a90720eeb78af7981a4660addc61a1dd8c30affd3f7f41ee6e2
MD5 0240d7e13e03ed3215dcf11f13a120fc
SHA1 2b882bbcd9999174f3099c8ff9eea10471cfa389
SHA512 f27f990ac22a4c015cd6ca85c82feeede455c32e56cf8e8353c952f3e70d4b1a1cf067d4550880f5810d49095b8533f51fdf28af0048534e1776eea647a0efcb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwL:CeUeT
TLSH
T18E675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 29.8MB
SHA256 bdecd4c294dab12a560afd1ce57ca9686d6f933acdb108c6e5c77fe5942512b7
MD5 10c855c55503ab30609219c4705acda7
SHA1 cef34f0a247912f28d3d90449b13c5c9527ed367
SHA512 37fa837104b91e27b78aee12b3cb8e38d15ee2a8f58c63ff1ae224e42c93db8c2af7ce586a4d4d021d2bc8e7c97142294196f5a041abb2d6c6c47ec459e9f02d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qww:CeUeo
TLSH
T18E675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 29.8MB
SHA256 f3fb205419fa51d8ffb651aefec597d0d3c5f78b69d453b28b1c24132cd98596
MD5 dfb4d205e2f90540479e1ee9651191bd
SHA1 4cda145e66284bbf020dfc31e0e74c181449a90c
SHA512 fedd9d8ff19af9c7c12abaacf6eeb3951648325b9051c2d9840151835064e92bf176a098efa380b8a0512aa5884f6adb89d046da2b8e0c0b4bdb3a1ca22b2e19
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwm:CeUe+
TLSH
T1C8675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 29.8MB
SHA256 38ddf7b7eed40a4814eae3aead36d0e12fbae055d84969e7348c0cba9c82ce28
MD5 efcbc178017e2d9ba04cb87102e6058d
SHA1 d8af906faf7a011929d406218df496cbeb56f5a5
SHA512 033a63eb16d341f0deaa1226751160d03077d5aced00ba6b9088065a70caea5d4909553d0544e55f3ae7f13de8fcaca79e0960d6e49bcebb294a3bb2d677310c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwi:CeUea
TLSH
T1C0675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 29.8MB
SHA256 641caa207b68e57be5280d0ed3063d6817dc4687e414bc6acb1b5577f0546fa8
MD5 052d484699beb91471e8806e025de6cf
SHA1 9ef243b3b56d8d3abd825c6cf2c4d0f02ca0077c
SHA512 455cc97b64b37e6f438c7f5884b7f24ca98cb2dca5cb22d49481638f8f6f450bf06f22bfd54f74a34793015d8fe151b59ebbff1557d986c6c42c8100921502f7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwz:CeUeL
TLSH
T1CC675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 29.8MB
SHA256 2be4ef1f9b58436c916a78f055f7d632a6536511288ae13e65313131b0d820db
MD5 feb6ac517013c4cd7b3a15c9b96a4d4e
SHA1 c81fef1f5527ddad28ceea85c209890a2ff17b53
SHA512 5ec30540a64f86e5e19821f1d78ef5f40e857fe9eede1725f219aacc939c3a0e710ff289127d7dd4f55169ff4519baadf39765072e065bd13f3ed79c1004f3c8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwk:CeUeM
TLSH
T165675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 29.8MB
SHA256 fd1aa8211d61b7d08e8c74b87fef9b9b30c6023157bc9f4918513b9a3428b546
MD5 740fe99db7734ea1be45040305bef3ef
SHA1 754e0d4e26ad45a00b09818cabcb28d89bb88401
SHA512 a8c3a3066568e0f74e54d75f68549895f44ad3da1b4037fc742db12d55856b839bf5f46416ab82febc47615e9788b855bcc5967fb44d40b0f9330eebd6d72871
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwN:CeUel
TLSH
T17F675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 29.8MB
SHA256 a8af606195937be94bb2c440ec7223c42c307430d2bb0edf3137e5f5355983df
MD5 7c647cdc923b00feb9617d580331ba0c
SHA1 14dfd2e65ce2ecd2aa794742863e8b49ad48abb1
SHA512 3e07971db2993cb99c5d500afc0c4159182b0e0e9270a66f982f50f142c965c7a9e8a3b80889b917a7449fe80aaac3f72d291f0c559fcea43c901e0c55a1d6e3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw1:CeUed
TLSH
T16A675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 29.8MB
SHA256 52408dc43e7aea6d6ff59cc8be37b1a310ae208d3371d9265f259435aebe776b
MD5 accbb7cd92c77d8d287b2b4b9bdd104c
SHA1 ca7520abae094959de56aa17d6eb9ef8323742c7
SHA512 bcecdb4a94980ec74b3f6be6e109619cc37ac118e366dd1b690ce984ef3bb1c8608ee793ecda4e62ca026387554acafbbb797ce997cfa6cb83823f5264e75594
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwc:CeUe0
TLSH
T124675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 29.8MB
SHA256 230380eb79663225ae02852309a76e9f3262cf06022539a8867936e3a28f2e09
MD5 47a2e28c5b4ec03e8d5faf67cdb48184
SHA1 96d8de792c7f2dec61e03d1b68f843361727dc18
SHA512 4574137bb68be8964676dc9bd9f448d54dd77bfdceb84278501db881ae03b389baae958fec24194912e04372e85930eff5cb7d2009a2d5f6a7c048a8da15a7bf
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwV:CeUe9
TLSH
T122675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 320KB
SHA256 21e9dd8769a39db9165211e397543c288db6cfea67fb378fdcbfa803d9a215f4
MD5 c327c226d2b8652d8d59cf6f4c12ddc3
SHA1 703ef0e4755a0c2db825474322a600a18871b156
SHA512 c997fe535823ce72b0bd6f532f8d29304d9bb54c7bf4d79045091fc950bd66655bf9bce828fb784f7b576d4905ee52a85b15334d6e19dda147bdcbca4d0a8d30
SSDEEP 3072:8Eee83fH0MnNlPubxrrCbJl6yLVKDz6iENvnk2GM1tVPuTXpX:8ExovdPwkll9vNvnJGMjNubF
TLSH
T1DE644BD1C6C190F1EBC1A17020EDB73AA679CED577008B8BE767EF224E6A101531799E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 128KB
SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
MD5 a26921a2be71501221e21df53cef9cd3
SHA1 f58e1fd814a722e7fdcbd77df79336fe2f60519a
SHA512 e9a5eaa327fa536a571cae56fbadab067bcd3db12b607ad340ddf414ba73deed772c7da529acc9952b51473dd0ff62d3653212042b44d84c55d5bc4fe39087f7
SSDEEP 768:PKLnZ+GdNGPezMrItSQGT6dK1kK5oI/8Zvd:8ZHGPeg2Sv83fr
TLSH
T1F6D335F549C0E09AF5E0D171A0D8B33825AACDE1BB5047DBBE17AF628EAE5400397C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 29.8MB
SHA256 635034da5da1c5e03b08754b6b09160a65f9e14ed9abfefdb214699f59d11126
MD5 492b7573da9b2a3117e252439b743b03
SHA1 901cbf11db66e4b1d1fa124fdd8f88d872a8142a
SHA512 b52c646ad19ff2b8664c74dd954d512201070df914030a628ec704c9d4c2eba118e51b243da9d92f52e4be9575fdeee4631036a20c5abffa6417c8d1be8fffb6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwA:CeUeo
TLSH
T193675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 29.8MB
SHA256 ed1dcd100fcb86986701ba53afa6ba6b141cbcc0cbd65e3797d72bb1cdc7b9dc
MD5 2f927a45d11e27ffb94d81b69c2f0886
SHA1 c7ab335267c98c0dad284f7406a2c7e576956f96
SHA512 61777ad103df1bf00d4807908a30dea11d0b9202f6a7a85e75456bb9a6c4dfbb6b79bc667b8ad667358d3cf81aabf57c254f7d62e00d628a1df18c9a81696653
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwG:CeUe+
TLSH
T111675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 29.8MB
SHA256 dd173b79631899b038e6fffc178e40d60da096f7a35aab4be858152a4de8058f
MD5 1e1e4610e07e5244d290efc151a0bbfe
SHA1 a4314459623892dc80b017ad5bc81460c60c081e
SHA512 c8099b154fa19542b89b0bf8422878e28a1075e6f99ab868e3f804d40c42878b7180740a2be7e5181b71939637bce3f83366708de095b793c447fc07335607e9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw9:CeUe1
TLSH
T180675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 29.8MB
SHA256 b58be431100f71d9a681fbb4a075a683a433be29a36e37b8e9a98fef8083f030
MD5 9276d17d4db49c0bdd614bd8a2265737
SHA1 7d8f945449e65fceb7278514a95b429b248116e9
SHA512 ee196930b61ea89a6967753eb8022263133a4e1d2fc7b631d5a085b9cd54e61256fcb8307708d995dbd3c32c8fa45e79b71cf26d69cc3923362b16ff6660919c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qws:CeUe0
TLSH
T12C675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 29.8MB
SHA256 b0e1c1c3d9f8ce44a66958dc42178537698c272a0cfaf326c7a58ce44256dee5
MD5 461dd41c7e8fe0072a8b4bb01e371407
SHA1 f26082397e1f4b640428a5c03032892ed9d528e2
SHA512 4664738933ab6c811fdd5f12f8f98e980794cf1e04592668e3dc116eb722909e62f133d8777969ffadf68127a152cf76d5df1962eaaa734bf83fb4603f1ca31e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwn:CeUe/
TLSH
T13A675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 29.8MB
SHA256 0ff8ee665d6cbb0533820170280ea7885858eb1adb023db215e34134cafafb09
MD5 5e4364f2faac7ea186936f05df68db38
SHA1 0d0d104ffefa86acfcc6335fb26a8a4e4e66b819
SHA512 fa654cc4fbf3199ded57983af750a05f39992457998ce2807af675ab15a681ba1358b0b91fee738dc21c1bde2ec6254668dd16d003747fe7dc31fcb6c1c93b42
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwq:CeUey
TLSH
T1E3675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 29.8MB
SHA256 c727e1847943dca80ebf8a73d28d032ecc53b8d090e4f18f7cafdbdea6b808a9
MD5 97847b51b02fd6f30cbd17fe1350a31a
SHA1 b241866bc0c071414c16b11cce4dc507a9e89076
SHA512 852407956300c77427b49186ba48886d981eb270f67f2b42030375830f268741dfc7cdebdd08de03bbb6cbfbaba034e2838d20a33d34d7608570d092ff5a45c5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwk:CeUes
TLSH
T189675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 29.8MB
SHA256 0c1f34f9c2aaa80071a90b20ef362477852066dc720a8380f0c0a0b399b181cd
MD5 d1774bcae0a7ebc00d41149d92bd0d4e
SHA1 23dbb8f8f0ad1b240b8486d7b97a20cbf748d757
SHA512 cfeb0b03bdce2e435b86ec12250edfa2e880036844986a162cc73769d9c595362af39da092136885e3a514eb35ea5f8995d986e6406cca4778023e722b9618cd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qws:CeUek
TLSH
T162675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 29.8MB
SHA256 6f348c0de1449f44e4e0a087f5e031186954dffcc7c3a8d53e86283a68da541e
MD5 ceb581af28d76854b81e5cf2c2f9d1a3
SHA1 50fd00150c08c206e71b0b14e7c8f66552541b25
SHA512 b5b6f0355d59a7b4caa3f8b62fe570c1492d4504b5ab7ab36090cbec3da7348b507de207b4d73ccf8e0acebacca736129fde5829403988b485a87f23d4c651ef
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwT:CeUer
TLSH
T114675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 29.8MB
SHA256 d864f7bb1b772322f5954d300994df9ee10c381de244fdb0fb1095284b148c84
MD5 ed08dd3dac5b21dc69fbc8480c65908a
SHA1 6990f06959b1fa2dbd09c108765ec6836fadf9c8
SHA512 e9c9266c8b65a54f2f45a5838e5159370de63494ca97f20e8a948d7024ebc736c9ed2f5d6135379b2bc5ee22e88b775134b1a5a6bced2b677562361a1df495df
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qw2:CeUeu
TLSH
T17A675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 29.8MB
SHA256 1bb59ab91cf0b37c0094c1533d8ecb2e6403ab1501529f256d2e7af02660a6ea
MD5 36f8da9097ebbb86feacc4a53ee69ac2
SHA1 b806fef98847b26514500be2e7f5194faf5f0829
SHA512 43c291945e6bb4430fe273ee9c574af03fab8276af798a7e0f93ef98747378e6ec9eda10f21f4e40c6cedeed6b7669b05ec49e56d628862590d5477576c99c35
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwy:CeUea
TLSH
T141675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 29.8MB
SHA256 c5a96386e023f48b37747b1a9af1ae148494138f0b26476ef6c55ac88f091c33
MD5 a4a8df58e4419cf81e7afc814aee7215
SHA1 37854ec77bc06f0a2d6d13414f64382def1a6cf2
SHA512 c4ba25a0edbe27933af868d3f6b6eb8e9a64f4a179962ad71c4501b0e696058f15b80b0f4771ba1309dfdad1df4269f98cf2f9a3da346167042eb04426114c9f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qwi:CeUeK
TLSH
T13E675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 30.0MB
SHA256 8623c0ac6f694483613a19d6da6324e96a77feeae2f8d17a45f518d75ef574b8
MD5 c6e3ab019a46366294b48cb4fa87bb2f
SHA1 68f115bf88d28fe5d3f63dfbe9242c9be552df39
SHA512 38c930fa1b4d45e7abc65dfdfbd3dfdeaa5d0eb349558fca63b116941fcfd613507ee4c4941d431573790c7c8fa00253cbc258ebd967ecd8523c675e8694f68d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwM:CeUek
TLSH
T1DB675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 29.9MB
SHA256 3a93d8cf25dffe96fe8d724153aaae6e31525119b8347bb43f2b904f779fa3d2
MD5 2c1ea07012ea403ee7e7d13b5f00e445
SHA1 1358831926d1207ba3e861183a550dd5b600225e
SHA512 12298c0e87a52bfb0f6975af65855fa1d4bf364b86a54fd0b80e62a3ddb9eafcbcf45eb113177a0ab9b63ecbbbe28d81ecbbb2a1b2f39412a6ccd23408d11547
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qww:CeUeY
TLSH
T15B674A51F5A08272D07A8471C6D6A77AFA3378415B708AC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 29.8MB
SHA256 5f128033b213fbf2caf47bbeb6bf966a5be16a61602725452de4421533969ca1
MD5 1d0de9df50622ae30f2051442994231d
SHA1 cf6e3bc7ade6e5acda317f4931a0ad2574e8f157
SHA512 4ab70cc62aa801c63d9d3545e7a2d0b5057001b005d67b140b6e937613e4847a30d59b8bb876c7be5a94c58428f47399a227b8bcfc13f7f4b6b9f26def3161e1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwY:CeUeQ
TLSH
T1F7675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 29.8MB
SHA256 70a923446b303fca71cca6be0333d2f40f9b2f4876c93fdd654070d8f7587a4a
MD5 f36540883f16d083d7594aae9603e85d
SHA1 4f68258524fffef15722e279381f1fccd07000ef
SHA512 17a890a059c91765fd95052643ff9bb1ff1ae8491c3f95f4f04314ef632cf2144b17b4662b5f4fe0448f09040a97f466e4cf733d244f0944fa060c6fee8e823e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+QwO:CeUeUj
TLSH
T1EA675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 29.8MB
SHA256 c1e284ba3f2aa98f2cdb8fead02e6d7684ab2267f123b83f42b96c8ef4b587c7
MD5 dd2919b0ab554c13951f72c316dee650
SHA1 037e7e6794f3bae69a1ae324c5caa684a51aebdf
SHA512 41d8d91f5a87c6258042e3a65a69046452398ed5cf50eabb13916a024c308e065be3daa0318243490eb0b2fc16d1feed04479819782ec4c21468da39471c9600
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+bJ/h1+Qw/h1+Qww:CeUeGD
TLSH
T15F675A61F5A08172D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2408-102-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5412-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5412-85-0x0000000000400000-0x00000000004E4000-memory.dmp

Download