1a97f7ee50ffcd39d4a355504ea242deae38dfc4dd47bd000ca6f1bb4680edd0

Analysis

max time kernel
38s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 18.3MB
Sample260629-e5mw3sc141
SHA256 1a97f7ee50ffcd39d4a355504ea242deae38dfc4dd47bd000ca6f1bb4680edd0
MD5 a082b9c55dcdaf9d23273b2fa1c949fb
SHA1 6815e8c427689791647e45f9197f9ecf3461c44a
SHA512 4ac331547df10ebfae9a9ab01b69e8e6408e03cfab0e1f51d2bb37ff0626c961d0cead274b12b805735f2c0f581e28af7c9d548e589d0f983eff633c61a32cd6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8O:evyEYKbi
TLSH
T13E175B51F6A481B1D07A8074C6A6A776FA3378421B308BCB5385DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1756	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2464	2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1756

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-27_a082b9c55dcdaf9d23273b2fa1c949fb_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 18.5MB
SHA256 330f54a8dddb782437f3edd6c0fe2e0c6ebf9107197067f9c6da918d54c1dd9a
MD5 bdf963d4b0cf2adacca4c66f19570a93
SHA1 1ab52a9474b79f0bad0159ac07d4dad0704e3e35
SHA512 604da13f231ff6631ebe29071eeec30bcca7741cd30f3f0ac1e56a04b5b61112e0efa7b9f5a08c3a40d6c8690503af949d6bc7018487e1027eec4ceee2a774bb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8W:evyEYKbq
TLSH
T1FA176B51F6A481B1D07A8074C6A6A776FA3378421B308BCB5385DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 20.4MB
SHA256 ecc981e96ab0c58c90ccad15d92bae8c40679f034f2afc6fe01adcf952858909
MD5 cd622c32069dac0bc85178f898072573
SHA1 ddc82266b612d7f20415f080cba4a547e67a67e6
SHA512 4323342ade131e917ff88676072ba5cf7650eaa8fddcb615c3983cf761dee82289a5f9bccae51e2eefc46a6bcd1e2b2bc07a0a2c9f12ea4429e3a83ff1907ebc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8OGn:evyEYKbaG
TLSH
T1BA276B55F6A481B1D1BAC174C6A69776FA7378411B308BCB4285CB2D2F336D09E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 18.3MB
SHA256 16659dacc5d4a9c47d7d6586ff7b51f71a109efc215b8b84b106d810c4602421
MD5 043890737b54bb435b3facf88119d7de
SHA1 eb14e39d249a9047eb76b422d76cdc4a40045c9d
SHA512 dec00efbd57b372b75150151b57212c9f8e638a2cbc676ad01361a67250633f662d5bdefa301e93d4dc1446a108d1cea32fe2027afce6ec3fb166688cd83cfc9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8R:evyEYKbl
TLSH
T15A175B51F6A481B1D07A8074C6A6A776FA3378421B308BCB5385DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 36.7MB
SHA256 1c79799000acd4593f4aeaa3f8cf418b6e1858a8f3c4d2746f4d9f0940e02dd8
MD5 8159d962c9a237fa797d4c1d3d7be14c
SHA1 10f8e2353122591f49cb9584580021eca4612e19
SHA512 b3606d7fe3ac971ee931cebdbc59666abd6e2996470740e9b60a1bd92c50f01c01732c988604d3ae3a1f3a9c3addc6f5c43553fc70a5dd4553a775f015263f05
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wD:evyEYKbRvyEYKbh
TLSH
T1CB875B51F6A481B1D07A8074C6A6A776FA3378421B308BCB5385DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 35.1MB
SHA256 ed2abea7a4917d40e5e64dc5231d2a182ad4750c055e288f0a4a85c4eac61d52
MD5 46a3ce8e114feaa8dc9411581334b51d
SHA1 fdcbb40b952ecc891bf032fdde5eb22604c89180
SHA512 77a84672b9eb16af5bd73fd1f714958d95c018cea40c6e4df2a301de383d6b07f373f8851626c23f73bfc793819f0626b13f53aa7ecc65964d97655965f6463d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wQ:evyEYKbRvyEYKbS
TLSH
T178876B51F6A481B1D17A8074C6A6A776FA3378411B308BC74386DB3D2F376D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 36.4MB
SHA256 7cad98ea8079b44271144b1c37084a89bfdf9172e96b3bb0565f6d97af61360c
MD5 e7fd445d65f04a1a776f2443fa2b3672
SHA1 e19e3ebb14df41664a94fdab5d3873832490d201
SHA512 231c6f12e0d15dc422bc438415113651ff4881471158b4feb76d332d2d1465877802a259ad80cfa307ec5da6ff30f48cde0ccefdeb38ed48c8aef2e40f738e11
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wG:evyEYKbRvyEYKbo
TLSH
T128875B51F6A481B1D07A8074C6A6A776FA7378421B308BCB5385DB2D2F376D09E36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 35.2MB
SHA256 7312267c5f5a6a9bf8e728285d13f4aeb821a46a6cb3b6754501278c4dfc6148
MD5 c36a55e6c40b4dc09f15ad0df80d70f3
SHA1 fd185d06cd9d18747a4edb4d749b3878a35272dd
SHA512 258e272c6c6188f59e6954da13b986fbb76000e5e1e348b7f20a9cfc066f5e76d541bbfa86a788d6cb5ae030953d342db7ebae860c76cb600fe902214c152b3e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wX:evyEYKbRvyEYKbh
TLSH
T1A9875B51F6A481B1D17A8074C6A6A776FA3378411B308BC74386DB3D2F376D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 37.7MB
SHA256 a297f76a66e2079a7725aaa30e0fa95fb2fd10b51748079be939f001e8bc6572
MD5 578bb6fd15944b13d65ac363f45ff204
SHA1 64828d7a9c265e1145cf1aa6ee397d0debbfe5e3
SHA512 9705719ee377444c11ea6ceb66a97867f5c64039cb8c0244445898bdf4ef0f395e4eca5a476b6a616713525713d6dfbd72b48b26b9570a06a728709cafea092f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wZ:evyEYKbRvyEYKb/l5
TLSH
T126876B51F6A481B1D07A8074C6A6A776FA7378421B308BCB4385DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 35.6MB
SHA256 f7a597550ab2713033f06c19117a99baf6e72af8ffbb63f04198970217999645
MD5 fcf4c9fed08de8262cc140eb93d3ea54
SHA1 67de2c3c1c7d56eea991b5f6ed7fa698662a4132
SHA512 9fe2a804065d10c2f5b9e7e221392b9f1e428cc2f555929ba6a95ba161924fd43fc6869618a823616d85b916b2851d2addfef9ff13d7f35f45f91db6be5ce108
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wJ:evyEYKbRvyEYKbX
TLSH
T147875B51F6A481B1D1BA8474C6A6A776FA3378411B308BCB4385DB2D2F376D09E36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 36.0MB
SHA256 2ab4386017b923009757715a716591b99821da4b76766c17b81e563433c030ca
MD5 443f9ad9fb95a70e08fa382c2d8f9220
SHA1 e6a5f53ea4c9a1ac53d58b34a60ca7f6f80d4d47
SHA512 7531341af491c3df8b97d79521e7f348010f6f6276370371fb78d21ec05796ce8f09cadc6d210fe8892ecbc7ffa12b0468eb07275b705af1a6f5bc100f475646
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wi:evyEYKbRvyEYKb0
TLSH
T1D8875B51F6A481B1D17A8074C6A6A776FA3378421B308BCB5385DB2D2F376D09E36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 34.1MB
SHA256 dbcdebed5dc73d728707cde2fa2919c9e8bc908d14381ca2d3d21e5aed9f1bd8
MD5 4f0b9f6ada4ea9e7c6f2885decfbaa9a
SHA1 456c8f326db3540875a520bfd9ee790c63d8ce71
SHA512 0e4d7f4cd778760214726b24e917a7ea5b7837817e43398ba5a952268a3cb6b6bb13903c03f8979596b5d314d8515fd0b1879f226d31aaaa70a2356df30de460
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+we:evyEYKbRvyEYn
TLSH
T101775B51F6A481B1D17A8074C6A6A77AFA3378411B308BC75386DB3D2F372D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 34.0MB
SHA256 9a8d207728f481bdb4b573fb5acc6c2663651b5a7bf9e4c4af7c130cbbd80f7b
MD5 440ab699d41d6e4eaae26e4caf41385f
SHA1 1db4138f7ec1a32b78e140960724d26b2311db07
SHA512 83ff30d5df5ae309e1814edb1532ff58874848265696990ef410949042116190ceb1a368d5abd874051492e05f76acace9ce8d56d3782a466f19bdcf9d9cc911
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wz:evyEYKbRvyEYi
TLSH
T1B5775B51F6A481B1D17A8074C6A6A77AFA3378411B308BC75386DB3D2F372D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 35.0MB
SHA256 1504d2f919c8a479242a04ca5b3ae0490507e3bbbcd4eb268296764da15a0023
MD5 420916a3f9ad17acd6404dcce5fd6283
SHA1 b9e11552f5b922ae7646fd53333bff89c817e654
SHA512 5299c2d63f1a4e6132893b2c604896b68123bf14c597c9d454020f50cabeec469b72273ccc81007ca19db4a74fecb871d8636e57661850d0161a2e0455a78326
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wJ:evyEYKbRvyEYKbj
TLSH
T16C876B51F6A481B1D17A8074C6A6A776FA3378411B308BC74386DB3D2F376D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 34.1MB
SHA256 d96868c2039d949fe6808dc9e72bb2a7f32f28992ade23cbbafed90d180991e5
MD5 0824db7a8ad7106fb6babf8cf466c17c
SHA1 7790520bed3245a74a8311e415d14809c61b9de6
SHA512 842b65207aaebe62fc19cd3494eb6e1a3ad20d60e28ba34ea67fd98e1c95afaef564ba034ffda51b27d8f0ada72cdbecf2fe8b09585ed7aa3a511ff27eb31088
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wq:evyEYKbRvyEY/
TLSH
T131775B51F6A481B1D17A8074C6A6A77AFA3378411B308BC75386DB3D2F372D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 34.7MB
SHA256 1a32865d192c5ff9cfa6d28e9dc7896ca39b4391867658afcfe67dbebb91ba52
MD5 2b9d46681e577b0590cc8920817e7828
SHA1 d148ffab9e1450f46bf6928a9c54d157a218bf38
SHA512 dcedd1d5b46325f15177f06ec42df0af30c54dabdb48e0056c3f7ee9120756199a8f680bbde2422e97bcd7d924d15c887e9b3bf4507917d242dc860183f91a84
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wM:evyEYKbRvyEYKW
TLSH
T101876B51F6A481B1D17A8074C6A6A776FA3378411B308BC74386DB3D2F376D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 34.4MB
SHA256 6b4fa5eff1714a7e45bc07d20a58802903a9a4244f42b54c74048fa1a13ee51f
MD5 f34d8583397b1509e425ccdf17ad4857
SHA1 eedfa7aba29d3845281e991890466a3bb544fc62
SHA512 113d406785777eb30062fd11d52d9a2294b431ff01a506678ef7cc4662c2c6c8c4c510d255b97729aeca27f39e0260cfb557043c7dff342ea40fcc2c17fc10c1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+w3:evyEYKbRvyEY6
TLSH
T1B7876B51F6A481B1D07A8074C6A6A77AFA3378411B308BC75386DB3D2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 33.0MB
SHA256 d0f58185b7f55d1c538bfb2606f77c0410c8b10fe6ddc22dea43d91659dada7b
MD5 66aa333b4d354f4dafb1a6fe0462eb0a
SHA1 a7484fac9f9515b06791803731f641be5a7638dc
SHA512 87d59f1d0989e8e9e52ba56ec73c4e32f8b643364bc728a02c085d95a4a7f5fd8e8fe1018e92077c6da361c6a78bd83aa254fc86a59da31f48157317d8e62477
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+w2:evyEYKbRvK
TLSH
T16C775A51F6A481B1D17A8070C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 31.6MB
SHA256 3b57b23732796e4b8d7f8280b05cc443399745948ecfc790721019f641eba3e7
MD5 e5a7ddb3ed9a177c9e2ca47c02cd2de1
SHA1 464b2b2e70fff95e4301b6489ab2676b37782468
SHA512 968fb0803fee80b87fb6b2b08b15c83a59e1452c216087e7b79a8080cf714df1980fe5844fdd56eec1a9267159c5b03ff8272a5f1af382753e095ae30b837f70
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wW:evyEYKbI
TLSH
T1B0775B51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 31.6MB
SHA256 49bd4da04f57182d350b55432767e0a5f90a26d71cd73e858e2bb4ed497ac2bf
MD5 5a886247e1dbcf87998134527f0124f7
SHA1 09a835f936c588d10d353087965a0fd2a7c5f4ff
SHA512 704c7fa3a4a22146ca7b31cca418bf5cd786f303139f1cbb933e256c0c2df6d85439a813d2edcc662b75be12fbce221eb45eb7277b04f6c34f6b90664b97f9d8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+w/:evyEYKbF
TLSH
T1F8775B51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 32.1MB
SHA256 6232cdbaa19b4f4433a08a5d04cfe52691c8a420f9c37d90a52d247af671d795
MD5 78051b451ea6db42ba89012c1ee3b258
SHA1 251d1de6a7950e264272378c3a594234373655ea
SHA512 140e2a1b615a6f50dd25fb946c9021a668e65315c2df7da0b64c8480689075d1f055d8cc53ada106dbbb6e2cc92b406441fa4df6a5d527b5638ee83762251e9e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wA:evyEYKbW
TLSH
T167774A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 32.1MB
SHA256 2a0d8323f06b518f6bc30893982398393da7ec7f70e7ec5ab5d22e9ca2393e0f
MD5 95433f1534b261f3314ba0549fc0415e
SHA1 c8cbc958c4d6ea947e1650705ac918ef5274138e
SHA512 0304cce529e59d8097948aa24927bf76df7c10dc6ac217b2ec374b86b8ced5255097b63290ca0e268fda54620f2f1652721b14342bb62375be2bef608f470f0d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wc:evyEYKb+
TLSH
T152774A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 32.4MB
SHA256 9317bb5b8d04f450c421743248d00194f89540b8a90f51508c65af83f48a561f
MD5 8848a6946cb044950b45eb3420cf9ebe
SHA1 f0b5e3cf10a88046fe9d6a0dfa853468a4745960
SHA512 37395c57130a76efb17e6db2cc6f1013737ba83f40ea9d90ced7d931001ae561d413a410ca12004a41f46b2f336fdc4dc4879429ecc75f2ccf188a006390997e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wC:evyEYKbA
TLSH
T17F775A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 32.6MB
SHA256 561796403ec1289aefb8b26eb4d5ca8e1e88253f82b39b3ff7c42174cb23195b
MD5 e5f6ce33dec2e852f037c67df141f2ed
SHA1 77bf5e15b872336595f5be5e21719dede50075d6
SHA512 f2ccddc71ce595394567c6c7725e59a74b26f897aee9ba66d7079704b14711b7f73e559397fc967b4d7440b5d2705530b13cda06d7edc4dfe9488d95df3c24eb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wb:evyEYKbRP
TLSH
T155775A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 30.4MB
SHA256 533088d16602a42ba28a34eb9975f78433dc182406848a91865dbf0463ea25e1
MD5 8d98fe82602ef2a003ae5a3b133b5d4b
SHA1 f84ab569c5c92b86e8308034241c1016abbff921
SHA512 dd8eaafb7a4bcfd45a949103932dd376b9d7ab610699e5db2fced9999ca800c366e4edd2b792107cb0e7d3543c185c668770d52dfbfb42c6be029b94f62350ea
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+w9:evyEYKb
TLSH
T12D675A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 31.1MB
SHA256 6d87bd382d5f1c26cd35207b50a186b68a2545e8988c4ccff73162e4220e297d
MD5 b62f7fc70b1bc0b3369ac9c2eb6c3c19
SHA1 e741237bb209f96d48cc16ca09243066a7587773
SHA512 8c6fdd80d9c05ef2672d82914c490c27ff9550d0aa3f2745637b809bd8c248be89f20e960f870c77e1b9486024f171cd1370514db7d18879c344842f9eb2ce00
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wz:evyEYKbN
TLSH
T15C675B51F6A081B1D17A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 31.6MB
SHA256 98c0c3d3ef35e244fc9db33e5c5dadda97501595590c910ffef023e18193ab60
MD5 95387f5be4bf3ef0283343b57556e1df
SHA1 270c174c21369bdd583859b9daea6883703d2853
SHA512 46d7a05b04daa8576a2b2fe525b65769c188037b0898ab65c712f32594ef940324b735eaa18aa899b2016c24f23bd95e3d4ff79a2ea6c35fbc7aa8ae949052ad
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+ws:evyEYKbK
TLSH
T113775B51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 33.6MB
SHA256 b42a9b34e4462ad9b4541bb729c590ef7be97aac9cf277c74ca3f83751a78434
MD5 9f6eee5427f1ce140934659c2a08ec07
SHA1 aa79ec2dc8eeca175ecc081642e41f5f26a0e726
SHA512 b19c0489b551fcfd847a1d39e3cc0f1ed1c3bce0bbc213074f332e48112fecdd23fe77105f539f913cf116d47d921d58365f89210f17f363d799da872488e40f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wk:evyEYKbRvyEy
TLSH
T129775B51F6A481B1D07A8074C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 31.9MB
SHA256 5881c4fab55f86d853eeb4d84c0a238b3233048e065f4684dcd91216c5668d09
MD5 82cb5a521900d21340cccd0a258013c9
SHA1 b1eb1ae374a2fed0484c165eadb5f2b6714443bc
SHA512 16fa7d0fdfbe0db2ebdf91b3acdb54b5c5fcd34215f109d712979277592da50da44f0c43b362707b6c7423774085c8e501a6ddc71abcda46ac52b95f164f466a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+w3:evyEYKbl
TLSH
T1B9775B51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 31.6MB
SHA256 5a8ef8777bd6e1c8f8d652562c027aa8b05829705e56819584c876a5162da799
MD5 98f145d01b9c8b82645dccf0e37ba612
SHA1 90569eeb5644fb6d7da7caed1fac6e50fa79768b
SHA512 755887f9963c0885b7a641a1d506499543e768e41d13272aa907b7e9ee323fd7390ba46d668dc000e0f0589c4bb9cdec75885a7ab18c4dd224a09a6626739355
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wu:evyEYKbk
TLSH
T1A3775B51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 32.9MB
SHA256 6a619b5d29e42a911b8d9b19592a90ae788c3bf593adb04e7ab663cc253ea77d
MD5 1cd722c146c823c94b3406393733e0a3
SHA1 e086ff28cebe915444a009ea91ed3c126744e7a0
SHA512 7711fa5e3ada58a93b59fbeffb79a8af03e82fcc03aeb0c32d052b81969c65756f2256c32cd7c2a14339bdfd6dd9e1c0041b81d83b8169f57bdb210d4ce82f32
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wS:evyEYKbRvG
TLSH
T12F775A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 32.4MB
SHA256 0d74f861bb16a88ebaabb4e38419e8259d0191f0f586abf9e6ffca944eb2ba46
MD5 bfda8e553cdf641071b9d462d24e73e0
SHA1 6e6b0e77f593cb7ddad6e20a2a4a52b7640564b0
SHA512 3825c33abd25a47bcc5f5edcc50e05d7159c839eb06c0617e19c93438c150431a7306b29dd02e65fb26f5ada3025502c103a38d70f36ec365a7a6cf8dded71a5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wA:evyEYKbu
TLSH
T172775A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 31.9MB
SHA256 dec4dbcdad69b778a35f128ffc526716bd2b726f9aefb2a847d7f0db57571f73
MD5 eb3591a7c98c18db137c07a375064875
SHA1 bd9ea4a61ca14633669a40fec4b81492b6d752f5
SHA512 3afadb5ea62be8526271b224c1e5ebd6bd793614cd2d970874ccbc6e02cae6c18f92426b24ebaab255cb5d8125af4bb405427dad286a2746f50b72453e5120f7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wJ:evyEYKbL
TLSH
T139775B51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 31.9MB
SHA256 76b788b21d78aa719a382a975c8de0a413313850ed71a3aafda238f1da47bb4b
MD5 8f91e5777d9b76b85c4b7544d5e0199a
SHA1 d944295c5283efcdc1c55454bcb0140bb87683d2
SHA512 6156011ae4aeaa23f027c098f9174b9124cdfc4eab9801efe79be4d1389b75d7d42aafd3bd39e13c72800e85fd71a3c362bb7417f15d0cdf37b129d9247e3d72
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wg:evyEYKby
TLSH
T19A775B51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 35.4MB
SHA256 2a3e0f71ae615d3baf6f2d396846d3f585f62a2fa7df1882c1b425bc8611f46e
MD5 23d6ed3a8b77784f4fe1957a684e7204
SHA1 b453a1e84cef00fc62e2865e6b13cdefb866e65a
SHA512 08ce38b5db6e91357f9ef6e1d60851cbcba2748c17c2a3fa487bfec61485f96a658c1ff746bb5cd462c86acc78019cac4caf7346aeddf811e7055e155de00fb8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wj:evyEYKbRvyEYKb5
TLSH
T1FB875A51F6A481B1D17A8074C6A6A776FA3378421B308BCB4385DB3D2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 33.4MB
SHA256 4fbfda9083cbbab7a9a0779397409edd6bc35234bbe363315f56ddaff2942b82
MD5 390b602a8577ede1194ef8383e049aa4
SHA1 325fd991c0b47a2676b62f6a6e04e8ae79aab013
SHA512 7a2013a1147ebcf7930059ed804ecad092919c325b8b87f87ed7c4d3a27c4187baf2ffb9121f44c958aee7bd35c8a4e60d4a82214408a7ab23e90d13ee86180d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+we:evyEYKbRvyj
TLSH
T11E775A51F6A481B1D17A8074C6A6A77AFA3378411B308BC75386DB3D2F372D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 24.8MB
SHA256 323eda7966fcf0a0075227c0c0228bce392d5731ab39b9b190d0a0188b49cb0e
MD5 5fa151b0998c79d51346a32f3cf138bd
SHA1 9c44922a1d90a6136950c382e4904ed8c37a7249
SHA512 aa41db22f57175b0dcf7c7b5a95375a66f06bd8c33251c912e53834a1aeecabed98edba6a021401f4f2e6c6b473bf369819c5237a8e549854587d048e9dee00a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wm:evyEYKbE
TLSH
T10F476B51F6A481B1D07A8074C5A6A77AFA3378411B308BCB5386DB2D2F372D19E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 32.9MB
SHA256 0857ae9be7adcb952ad8f60916fa9405d856538811d0b313cf65643eb021ade3
MD5 19a34d26865e57c8c8a5a2d16f2132ff
SHA1 ca81e0284f0675f51cf586894704ebae0316955c
SHA512 13ac1501b49a281b86340b2bf2a5f9bb13fdf80a3444943c48d228f56c539353dd10c4f1bb8670385ec9748bd3d5ab7df6a2b1a572c896221aae23cb50550696
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wM:evyEYKbRvA
TLSH
T12F775A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 32.9MB
SHA256 bd35749deb259ef570413e519479536f1e5a3b85aff60a06b90a3b45a940fbcc
MD5 b0f2d3f4c09d1bc6c6a3b19d40ba5c8c
SHA1 407a586fdf837013ae1371c0ae8fd7bbfb467488
SHA512 92e7d438c5b31f43da4b5f365072789d911fb58d34e554824be3d58c563d0e74ac46f0a11877503b64c955719b6e1f43fc0b0fd2fc817c65c497591aaec69a12
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wL:evyEYKbRv3
TLSH
T1D5775A51F6A481B1D17A8070C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 29.9MB
SHA256 1206c3ca32174e4a65bdf064fe0f65f166077ec926e9c04f37426a337688d5f6
MD5 a14be55e2f858afae90a97bfe29b3fc5
SHA1 ec96d6c80a041e9075598b18e1742b8bfee7891b
SHA512 c8298b90d7bb0736ef761cfe57c1368905ca7fe1d186abe37b5dc0799bda321a612f452090e1c1eb5b620f6e4e153bd8d8da039b82099d6f292c468acbebe098
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wF:evyEYKbj
TLSH
T1F9675A51F6A481B1D07A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 31.4MB
SHA256 e42b6cdf588c9fde427b98365f08932ef0b174c056b8a1775a07d60940ca8f27
MD5 fe79b7c9d777fa8f3681934073c012f9
SHA1 28a324f7feb145cd706ce2ad1f053873d24da6f0
SHA512 2c480612ba9ac4d3ef05751efccfa4a01e21c999d3cca5e865e5d17d98d0a952d92dc5f1beefde4a9a590604be0a375a99b572a69db281b1358d3358b4fa28b2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wr:evyEYKbJ
TLSH
T195775B51F6A081B1D17A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 33.4MB
SHA256 5d2885b790b2c605ab44bbde239af91e3826313d748db5264c7fc20d6b88e49c
MD5 ec33704c394f35c56e968c0c0ef21223
SHA1 4e809a56579f4c48bc524ca082d0e1528f4aeee8
SHA512 c5e759965301e56177360f623d3706fd5b0cfceb202c3cdc1791214b94819c909086f05f566fba39b5254440871b80cc4058497cd9f50ae4f5f3e5fa84da9a10
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wI:evyEYKbRvyd
TLSH
T1CD775A51F6A481B1D17A8074C6A6A77AFA3378411B308BC75386DB3D2F372D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 31.4MB
SHA256 36ccd70f1975f82f9a2cb33e12909f1f34748dad70baf5d2c82ee73de162602c
MD5 37131599bc96b8d7ef8c2b41abf34e8e
SHA1 587868b301e2520471c67135961114d61c25db7b
SHA512 0cc4a7f8c17ed1d26e048e8856d30fa94a53486f73394ff6b09779aab5e16c5bc4dd00bebb3832cd446ab7af2d80eb5ee36647f7fb76eb905ad04405db36dff6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wX:evyEYKbx
TLSH
T15E775B51F6A081B1D17A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 30.9MB
SHA256 b5292e1b6c484df697e0c618006fd23489f7851bb838b601c9078ce0bb0617e9
MD5 8c9e6d02202631907dd18f57878945db
SHA1 880a56f84af4645a3c2744e1702caff86ff82cfe
SHA512 19c0af37ba3b3a9781e77931572cfafec23c9510f3cac5e50c215886cd436c3dd5a891c213e4d0a671ffe90c49491a40fe74268b90f08c825192d6ad11c4fc1d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+wC:evyEYKbM
TLSH
T1CA675B51F6A081B1D17A8470C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 64KB
SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
MD5 071d69befc4545d16c8415ee31c5afdc
SHA1 98106920c20562db4df0d21c498f51369d927ad9
SHA512 994fdea351d7be4c5434f4840958dad54941761c7132fb3cdc5aa3821de5c697829bc462ca8428d6341e9076d304a231f945e48f12c618c86ab01045a26eda17
SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0UeG9ODBZHlsP:2sXDsmJDZzgyQsRDptkar4Vyg/B
TLSH
T14D530EF819C0F18AF8D1D571A0C9B33926EACDE5BB5047DB7C172B429EAE4800397D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 128KB
SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
MD5 a26921a2be71501221e21df53cef9cd3
SHA1 f58e1fd814a722e7fdcbd77df79336fe2f60519a
SHA512 e9a5eaa327fa536a571cae56fbadab067bcd3db12b607ad340ddf414ba73deed772c7da529acc9952b51473dd0ff62d3653212042b44d84c55d5bc4fe39087f7
SSDEEP 768:PKLnZ+GdNGPezMrItSQGT6dK1kK5oI/8Zvd:8ZHGPeg2Sv83fr
TLSH
T1F6D335F549C0E09AF5E0D171A0D8B33825AACDE1BB5047DBBE17AF628EAE5400397C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 18.3MB
SHA256 1a97f7ee50ffcd39d4a355504ea242deae38dfc4dd47bd000ca6f1bb4680edd0
MD5 a082b9c55dcdaf9d23273b2fa1c949fb
SHA1 6815e8c427689791647e45f9197f9ecf3461c44a
SHA512 4ac331547df10ebfae9a9ab01b69e8e6408e03cfab0e1f51d2bb37ff0626c961d0cead274b12b805735f2c0f581e28af7c9d548e589d0f983eff633c61a32cd6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8O:evyEYKbi
TLSH
T13E175B51F6A481B1D07A8074C6A6A776FA3378421B308BCB5385DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 18.3MB
SHA256 ae56507da1d874c8dad49fe3fdf93c19ba79f5f9803bdeffba26716695e9a629
MD5 3cf06b0ffab60c0ed55f3a12731d7635
SHA1 56443289511e6eaf1496781bd67bd2542a841cbf
SHA512 cfbaf9cfc5d0e1ab0592fce0d4533e3041a413735441809e563d2fe06fb17d3d7bee5c345b83731c63fd47c1a51efb931b31c4684f8cd75484d65d4be81c4cb4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w87:evyEYKbn
TLSH
T174175B51F6A481B1D07A8074C6A6A776FA3378421B308BCB5385DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 36.6MB
SHA256 cb82f1c9d7cd3b86c1b92e8bd2ce65200f2be54fbb2cbc7a57a9541398f020a6
MD5 43fadf77660bd03b25dd9a5ca709f8e1
SHA1 6b3e1cd38635a9b34b10b3c0a4c32c90f0ff762f
SHA512 5b684079b3aa85decc5f02d3adc7373469eac7a2092c5a5a1a5963cfd310046405c4ac87d5557adfe432a93ae428568efa9244cb5e8039f9ca4e7fc33fe12ede
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5KvyEYc/b3w8+w1:evyEYKbRvyEYKbfD
TLSH
T175875B51F6A481B1D07A8074C6A6A776FA3378421B308BCB5385DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1756-63-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/1756-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2464-81-0x0000000000400000-0x00000000004E4000-memory.dmp

Download