2594d8fc950a2d287541bd4ee5bfd765377c9fa3f2bad6a42f43200f260ef0ac

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 14.2MB
Sample260629-ejfwmsdy4n
SHA256 2594d8fc950a2d287541bd4ee5bfd765377c9fa3f2bad6a42f43200f260ef0ac
MD5 ad8ce6a0e87ed32b8ef7cfc3d1020c41
SHA1 d0e90a60398d741e1bdaa363253afb77332abb87
SHA512 05a2a25895495e5dbe40dd960406d6c6bb88d4cb5da1a2b2daa139ffcc59f8e1582a18dbde4c918177b42415437e8f0300331f384732e99c20af8a887d8bf8d8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5G:i
TLSH
T130E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2800	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
7092	2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2800

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-27_ad8ce6a0e87ed32b8ef7cfc3d1020c41_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:7092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 15.1MB
SHA256 f52e554ab958bd3dbaf674712b486a18e454752135be374108f9ebb60055468d
MD5 89e2b35604d833ef002a38ba3311d40d
SHA1 317143efb3888d5142d0af11c6d74f5c367707e4
SHA512 e3ee49a6774c6c5af9fe4ab33cdee5c4a1d78c66cd5921012e727d42ab47c0a8bd1b27c8bab8a4e772bca5c1a3c601fe2a3906ffcf2e750457463cb17b0ef5d7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5a:
TLSH
T1F9F65B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 14.2MB
SHA256 2594d8fc950a2d287541bd4ee5bfd765377c9fa3f2bad6a42f43200f260ef0ac
MD5 ad8ce6a0e87ed32b8ef7cfc3d1020c41
SHA1 d0e90a60398d741e1bdaa363253afb77332abb87
SHA512 05a2a25895495e5dbe40dd960406d6c6bb88d4cb5da1a2b2daa139ffcc59f8e1582a18dbde4c918177b42415437e8f0300331f384732e99c20af8a887d8bf8d8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5G:i
TLSH
T130E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14.2MB
SHA256 e79a5f72f64eb13e1609bf5537d0cbcbff09c8b64b72de577ebadcbb08e4fae5
MD5 fd3fdaffa1e37ea9d7702944dfe5deca
SHA1 f7a953034009e87e02c2b5848e307bab52249e0e
SHA512 75c03bcbf002014350e6319580f2d770bf4fbe124b33d873f0ecf7004f25f83670f8ff95f3edbad88b2e1214af26579a36177a007fde83cc77c3c974a83f56f0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5:
TLSH
T1BFE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 28.5MB
SHA256 94f5161357504dff07cc09da3f90b0e594a699de5c67d9d319bbfbdaafdba0b3
MD5 0eaaeccfbb0697fab4cdb17f9d9c70d2
SHA1 48942972708605a06710c63ce4ddb3366ff80d44
SHA512 c581931292e818953890c448228a754b2325891d346a34b05253e2d0c5474c4ff24e71f6af3c9fcfa2f2bec2d6e4ec4b2c02870e484265172f65255e9d19d998
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cB:S
TLSH
T11D675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 37.7MB
SHA256 d1ab6ca65dbab4f43fdc63985138a33f7b926e32770e355f70154b360e2ebe1b
MD5 2e8da888af2ad4a899fa47d383c89092
SHA1 90c731a77bfb39f87d6dc02819745d814db7b377
SHA512 218fd2f68418e11f52fd3a1f65a903df474b41e0a1683bd0093cfd53e9bce38e9c6b455fcf367baffbbdfab473af6a4e08ef62da004a2b242a9786afe6137182
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5YUEtQeTbvf2zlt:sUEtQevvqc2W1cpV2XI32i
TLSH
T1BB875A91F6E483E2D3669434C5B282B6FB727C0E1B3197BB4179F62E1E372905D25322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 16.3MB
SHA256 3aa20d1a7467f92d2acfb433ea5f9bce2375e10493fc643d6e797fbffbe31fa5
MD5 17a8429fd629a5f3c3464ba799cd9aa7
SHA1 dd232f5c5bb83001cef4a51774f0bb7776ea9034
SHA512 fbfb201e36ba8399bca227ffd1f2af284bd87e1e0458750e17d94673adb2444d68ff3d40e3d24f895453e1de5feccf95a8230e88fe528956e638514e427a1d4a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+52Gn:aG
TLSH
T1BD076B51F5A48171D1BA8470C696A77AFA3378411B308BCB9386DB2C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 34.5MB
SHA256 dc41d79a59f2df3129721f9e3630b98a98977d3d5444e18ed74861cd80656549
MD5 5f5f43a17e07be19d63c4554cc51c2da
SHA1 46dead0d6609d0683d5749e83873158d602d7aa1
SHA512 9c2c6223c1540f1d22d08a54f8b75228f75c3898b005e7449d500dd6a722f660244bf77ca4c7e4694689c8d9f39c8e41e993029b42290bb4a70617188e1e3ee4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cn:KQsas+PS
TLSH
T131876C52F6A08175D07A8470C6A6A776FA337C415B7087CB5385EB7C2F366C0AA36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 30.1MB
SHA256 d0523ab95924bbe758bd7990e8a396e2b6b2f8a291a08d8c868de595c31b6706
MD5 f1ce19f6e27dab5dca3e021d520a5e9b
SHA1 52328c8d6357db3b2ef62c8474f72709148f99d5
SHA512 e72588ffc3f1e00bb360a2f76d955dd6e60feb99e4ffe0a58d848626fe4a995f3d41cf0dd732105ceef5ffa34faf289094d078fa55e1c834e693d70e656fd372
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cx:i/
TLSH
T18B675A61F5A08171D07A8471C696A77AFA737C411B608BC79386EB3C2F362C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 31.9MB
SHA256 c5a2484a5852335058d89c0d366806d86a7d953b192dbc7afb2684d285ed3252
MD5 489ce815ab94c1c717eecc03b8d6fb96
SHA1 4262c77d5a726b16edf1ef5fc0c1ad8fae2a0853
SHA512 bab5509ba2dff3eb9af2227310ebd4a77dd41b4d0994c180f7b1ad6f2bed44fb4f16263c5ff3351f54daf63300180baa78e523768096d955e5832281b3727fe5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cp:w+6
TLSH
T14B775B52F5A481B1D07A8471C696A77AFA337C411B308ACB5385EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 30.7MB
SHA256 181272beced50ce140d83292814808899da8d2840cc2d932b326152341f5c0e9
MD5 fe5fa7ee98f6e76c5f62e0e05e997b86
SHA1 bc3d7f0bb423588d71bb8af425ba1e611e1dd58f
SHA512 b946a7cec7254220190f0a9089b66158a500fe7454e9c1f06e0d9fc2751f2f4e4dd88609387c3f839f5c8d88e623f29fbd65eca7461d12c92d06c751881f0f7b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cR:6l0G
TLSH
T132674A52F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 30.0MB
SHA256 9461d9f629f25f9ae98ecbfcb5fad888be8d996b4fbbe1a34a585ae5e491ae5c
MD5 1882ab7672f28614632a714e405e6870
SHA1 af5cf50e861c272674918b6dbf2006f4122ac6f4
SHA512 f75dee6449a93547bfbc20806c9802ee8d03c0c066975b39666355c578ccecc9408c2952751604b188aa5b663e85f6c3c52e3cd9dcf51e48c295eb15bb90eeec
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cS:Ff
TLSH
T184674A51F5A08172D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 30.3MB
SHA256 df7888cf6497bb9468176478fed4354938bcae97d46c4349f76b5c58d8b6ea72
MD5 daffa7d8855a6892b61dd63b8f5b4853
SHA1 eecf9529215ad4591a0978a58f4fb124610124cd
SHA512 dc52e76535625a9b1762c12b1a674874e3d446918797365ffd2741a8cb006d38b04c32610b687a084a699ff96913b26e61bacc9f3e276e1bf0e26371941c3b98
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cm:zC16
TLSH
T1C6674951F5A08171D0BA8471C696A77AFA337C411B708AC79386EB2C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 31.5MB
SHA256 a474a4ac4ec76fa5319d598d617c07c5e7b46d2ada5e880d5b136afc1d19adec
MD5 9a775696dfb489286829bfd583306c2d
SHA1 4da0449261b208ac0ca841a13320848ca37fe817
SHA512 13ecab5015484c69e0e51cde52d6236e84bfaafa293022a3317ccf3e861f05e59ed6d5f8725c0a881af25e3e7610d3d8e6354777d8abaa88d9a52f3990fa5674
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cP:lO
TLSH
T177775A52F5A081B1D07A8471C696A77AFA337C411B208AC75386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 29.8MB
SHA256 96f9800b9c216c0f3486d83ffa6045c22cbb7f0963e96daa85e5e10a689c433b
MD5 2a72ad998d62e1fae211c62739d24054
SHA1 93bfe4e0a84bc82add5e46460505368eb960976a
SHA512 fab5454c888a36d732f25a1b4900524cc72575ad45afa3d9fba14dc3e51000d769c8c92279731f2a59dda3af0aab648e0a23f796449a18d0ab801b601f2200a8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cJ:Z0
TLSH
T1A7674A51F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F372D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 28.4MB
SHA256 6035d9633e83c33d9fcbd60330f673aa86d1a35712762bf2c3985f9c2ce48ac7
MD5 35e4747aa3ea7588b484051a294f5d75
SHA1 b21e02287b16639dfb39432011f52210b0951734
SHA512 951ea3bce0a6dc813ed784d593c9c6c61f3aa6a82d8ef7b64b2fe0987ee40e42db3c6438fbaaed37b5d62330f13ef73ad57d8be507c91a47b5e2da4d990f7017
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+ct:+
TLSH
T14D675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 28.4MB
SHA256 7059a5abddcfbcc579ddd90a27680e86052aca477f9388202ec778b5d6b7af76
MD5 ae539dcf2f508a6dc6d36be0ea60b3b3
SHA1 94126e8a010f0ce8a745193a162608c75869d920
SHA512 5cc2bb0085c49252ff184f5dd3f882ab960260d916a7fcf14b6a0b52dc2a941be7476c407fe7683ed210f2ab678b6b2fd55a22d2511d6ef27d3c4c775bc4e02c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+c5:a
TLSH
T1AF675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 28.5MB
SHA256 b089ff754402ab237fd4892f78ebe3ce1a634035889ee339f49293b39372375d
MD5 a821b7581cf28611cb0f6dafa8619793
SHA1 c270bc2cd3d450aa7d1cd3fac8cebc68acfc7887
SHA512 1792e756bfc1d9d271cbd9e29577effa4cbb876d5d899aba1eaadc48abc9a1cb6db6bffb5008f36b66915619a879aed3d5d332aaea1076a4bf6a3e24e6ca3864
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cf:w
TLSH
T175675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 28.4MB
SHA256 e3aaae29c8de88d695fef0112210292680998d72a31f0e237d602b4fef1e2153
MD5 eba0b4dfcaee71ce5b47e5dae05861f1
SHA1 b82afb33f8cdee626f9639aba3cba3750d6d633a
SHA512 411119bb858fcb3f80cd19e9eb734d72d32e09ab573458230943364a15684d8d7fc5ef3d3e6a4ca91ef2f57fdd99e9400eea1b9701426182055537f9541394c6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+ca:d
TLSH
T10E675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 28.4MB
SHA256 771a13b5ffa1a792b0ec95a5737bc3f609bba2da76ff478e43467b0c679435e5
MD5 5d83b5c93391a9d038eb5692e124ed59
SHA1 6b1a2116e11157b5d41ee4a5946031309930e512
SHA512 06f3afbb5647feab44ab72c022c019ba950fa3ffcd39f61ab16bd06372dc4001240fdc678e9e02c53a8a13456d69bdec1b71b4aad4e502ffd3591332f5ecbee1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cC:1
TLSH
T1CC675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 28.7MB
SHA256 2f35b4cf3dd07d691b81b824f1ee5376b30663e1fb532cfd515c0b14531ffe0f
MD5 a5ded81c319bc979f7896955b38fd4d3
SHA1 82651ee1897e0cc45a984bcc9622dffa782a4a4e
SHA512 dba54ab93537ccfc09f6cebf43c29a0e0146d1e96ad3bbc5410793cb77603eac9b46952adbcd28b25c2be00abadb79a486ce2b061cb10d7615beef9d8a45df9a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cQ:4m
TLSH
T1B7675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 28.6MB
SHA256 333d3d13662a4c41bdae49982034e3aad65628c4c2091a00898c115ae0cd8f20
MD5 fa316ad453b041b25b0e9798a8bfbd43
SHA1 818b17fa91308ff9223397eace1255667ad126e8
SHA512 9f00b335056c0718a946c9f5950c469ca66b06eae446c1904fe9e954c7b96741bfe0510a293aa6c8a2c31ceb712c272dc10bbdcf5e677a1a075df83d5cfc149d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cX:Y
TLSH
T12C675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 28.4MB
SHA256 0b807347dcd0bb0ee41975524f0eac9b1b59bf01a821d4147f50542e1de310ea
MD5 5b39b6e81d01dd683084b60af40495f9
SHA1 b3adb54f965560383d263528674242dbeac91cc2
SHA512 da452b0b63bc9a56ceba85ad2fd7e5cd231aa21f928d5fd24e47c2e831527de8c066e2bd377e8d466fe05972356131760599b255cac336e53e32de142eb4a0b1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cm:Z
TLSH
T19B675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 28.4MB
SHA256 d9f37b6ded59f5ac5a99b0ca0ca26a8dfb941afc0bb45df331c6e212ca7cd03d
MD5 7397f572a4a8de21af8961a90fd8fd5d
SHA1 a7b4c92ed3aa2796e140b925edfd0d02377fe2a1
SHA512 4141336cfdd0a61c35b0f5bbffb00211569a32ee5963abbd0cdefb8dd11002e93993f9fb84317255480076b93bf955179fd7d41dc164fed358532eec4c6c566c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cw:b
TLSH
T199675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 384KB
SHA256 144c4713f378ec54938375c9433afb979bcdaf05350d70c3d422e883e7e60d15
MD5 b143f59ba0fa9cccda7ec81e4aaf99e4
SHA1 4b8bc1525c9fb2099f5a8bccfa80b179384ded70
SHA512 db0406aabd5430c7781287fad6c305ee64f9c2364fc2124bc1e433dd2d49adf6922c374fe1efb731fd9ba078e1ceef0c58b5698e396d1ab27b8d3f6b821e42a4
SSDEEP 6144:8ExovdPwkll9vNvnJGMjNubhWAqbZgVDFeX:8ESvdPZD/JGMj4IwG
TLSH
T13F845BD1D68190F1EBC1A17020FDB33AAA79CEC576108F87E767EF224E66101921799E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 28.9MB
SHA256 19a06c9d615f7afb00b5eed950267a41156c65e280460255b9a8893ee1417a67
MD5 badbe5b497ea95fce53a14fd36ca061f
SHA1 df12400a8aef4b5ac6c7e818a69821e76b83cbba
SHA512 098370be99cd228604999de8508d8d339596f1c99ddb6cd0300290eeb915fab018278aece208ac81152cec59531db897641bff2b048e22021eaa190ca9db9ad0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+c0:9d
TLSH
T18B675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 192KB
SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
MD5 e58d1ddcb93a535eaace748468f77af2
SHA1 34925438459a8705b0e90d9b5779633b073c175c
SHA512 5ea24026af3f98184d03eefb9c2fe551e9d91157d2a1a4467729f7e3982c0b73825c729048b92464920fd0c1127ab9b915019274710d1efd3facc314076a1c19
SSDEEP 1536:8ZHGPeg2Sv83fH+5MnNlP/2xbYqrDA0A3MR:8Eee83fH0MnNlPubxrL
TLSH
T14314A6E189C0A0E6FAD0A57060ECB33965BACEE5B70047CBBA17EF618E6E5005347D5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 28.4MB
SHA256 af3a5ae1265ca97859582c29705d9ae57b43de720bb5b5a4505b6f8382983ee9
MD5 0c207dcc418beaad28c9e06d8618896b
SHA1 8fce0621d9658dcb537ed18fda235a096daaf1c9
SHA512 bb929ca71cfd7679f546355ede75a13510cff189c60c5c95ca39eaee310181cc6dc3c1b68b12329eccb8d57e9337f7321bd84d1e15ab1c75667deb94ac3ec0a7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cA:3
TLSH
T156675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 28.4MB
SHA256 191cf0657f46a0de17de53bf788f611dde3adbd0c5b0d03bab82c0ad0735e5ca
MD5 7d23afa77dd546e0928c658cb8422014
SHA1 4331867609b0aaa6ecbc1e1ce4b7480073c29496
SHA512 d1a5ed2b70878a47062d786a0339319dee94c445212aa0fa517253173185182e2f04422610a8c2b39a55ddae9ca5588998174e8985f7f37bb229695f8baca0ac
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cW:t
TLSH
T140675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 28.4MB
SHA256 e5f9b1a32c3ad018e2817b437dd474b63b3689b82d586557549c61de00f3da63
MD5 f973c4b3b9144e14262eb8327e1f0a0a
SHA1 b6b227a4a903791ea8e7e54d49b23e46ee183308
SHA512 8e45261f78350e3e26611fcaf6ea685a7082c171cb2c16ac3b97785851d0d4c9c1f8bda81d082c0b7f6c17cd491c37e7b3552523e0b1b62e0ba7bd59090fab5b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cZ:W
TLSH
T18C675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 28.4MB
SHA256 b606e97ea9cb39d9a01e659c5d33cf3c68de4443b90a36f3de8fb076b0e49f36
MD5 615903a0008355ccb0a98fc0e9f03f27
SHA1 375f87a49a11ebc347d049b5bc7c3ae6b58992bd
SHA512 8c14b68ed332ea88eaeafd18de24b339efe188ca3baf7ca24f8361110f29d6b315f6103675a39c3a5720db591294bee5b995e2f9b558cc8987ddc516bf316145
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cL:0
TLSH
T1AA675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 28.4MB
SHA256 b4235818cec9fbc4557d364fe6299616964da07f599fddcf23af739cbcc8ef8a
MD5 ed736de42cc2b785bce0cfcd2d3ecca7
SHA1 514b87f0d94467c084d44ccfb73a1f908c34b4be
SHA512 29b085fdb020811c624e1a72811b2ba52bc0770389c03b9cc54d220ed1d4d928ee5122d5eff925393e53535f87e46f65af41f6a589b3c94a7dec3022c310e3e3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cn:g
TLSH
T138675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 28.4MB
SHA256 a436bc912f37ed5bde0544f03dc21c8aba77046f4b7df7a2390c8335b554797f
MD5 260ab0290dbce609d3bfe5fbb06c4557
SHA1 693cb479cdf9d14ce9ebdadef6a1e403a58423e3
SHA512 00f1636fa66d9cf8c66615d9df18b37884800d4955afcf0ab783cde20f85c7ac145c10779b4a363a1296f90d14d3242eb199e8e26fddc7a73bce0bfbbd3da9f0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cy:x
TLSH
T12E675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 28.4MB
SHA256 dfc40e449edb591a413e517a426bb40e81de7a059b374d3521617f80cb490dea
MD5 806bb4bf5ee15f9586bf7aab465d2183
SHA1 ec6efcda9cd73b80c22dafb4a8c2e7f8dc81759a
SHA512 ac6733e4ef3a78802009181b81674561187d3736218fb2d7a7aa70904b64968d9e0b5ecfab578d5801d2c5841ac979ffcb6f6f7ede4c5d407d91bad6dde65683
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+c9:m
TLSH
T1F0675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 28.4MB
SHA256 90d25b3b302e6e10597de6605f1504b40b3b3326bd03237cabcebd66cd02aa57
MD5 8af4e28dbde7f6924f710c878f54440e
SHA1 dab7b2387a458e7b0f27a7f6bf39230c6a258c27
SHA512 28aa89c7816f849ee6f96c970e37bb37612597d6de51d689bd7af0016743be134e2607b52671cd8b90dc78ecb5b056f6c0e44d86cc1bc889af4a23514c0e9a24
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cM:3
TLSH
T199675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 768KB
SHA256 32a4edcc850e91e49004e89b1caaea00d041d8b04cde89ebaa58552b8c82481d
MD5 e35847fc4d58c1ce07fb6d6888f62b19
SHA1 767fc2a730b6a0c410928c21ba09ff2ca5f12e01
SHA512 6b4831273d748be01660b6ce53a4b17eafc14ee563049556ce8f700f4619d670e4748b264645cd0fef7cd2555453bc8e69e8612c33dc235eddb3b96f7468a795
SSDEEP 12288:8ESvdPZD/JGMj4IwHfRlz6YIfrgueRug0:tEBDRGo4x5x6YXuqu
TLSH
T183F48CD1B5C280F6DBA0193014ADB736AA76DE852B148BC3E307DF256D26140AE3767F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 28.4MB
SHA256 643fd49064cee8bd7d9ec6fa83330931badd6bb9510f3ca766ec22e55bfca804
MD5 13b75d7b4d4759b23bb9ea832de36fe6
SHA1 df4e9c1adf46e55d3e04384eb9dcb483bd1af8a0
SHA512 44324078449af85c547868d28daa70063b98040c04c2b458326421dd5efe919f08b51330685a4f22a437bab9af52c2b5db3a46eb9ea00b83570d5bc89e9b8ddc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+c8:/
TLSH
T19B675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 28.4MB
SHA256 afc74dcebfddfdcb525a7b06b2f11252127e9557db72700de7bc14707eeb5877
MD5 39ce7ce94c84bc460c303061a02f99ad
SHA1 c18cfd84d675e7ffe7ebf7b22340a472b27aa013
SHA512 7bc8083910eee01333b8ac96628d3435f471997f521d05cc83187ef42fc6651905b2e2b4be4deb622daf4916fc27d4fc0bdd9d250ad0a4bb1788013b0ba0177c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cF:K
TLSH
T122675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 28.4MB
SHA256 ec56ef96a2817922ecb4b0c264e9d36e19671dc52509f8d5854cddda5f0a0f2a
MD5 a610ad733f01c606b2ab011c2d3d80e4
SHA1 99f6884e4870a2afbb5fd065fec9d88b1048d0e1
SHA512 9b0730ef09d2f38f4a8385867a69fa4c92a3ee9ebc0958be1d9cea93be578b26dd113b49d86a8fa4d79284cd61c312ac862c4527e8751da468bf0f6783640a0f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+c4:/
TLSH
T19E675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 28.4MB
SHA256 c309d32d6b3f2056cd56235cc6e9187a67b8c87b94698d0adb3e01b8caff4a1c
MD5 4bf090d5384b86b5502963ce1c20764a
SHA1 78b847fbf1b920fd162e0472f7fc7ce525dd545c
SHA512 30488cc82fe6c508023ec45c5b1bce78fdfde841b415b5ffc778fe369f7be0dc95fc3ae5a3eea6ab42c8876a05d717a28474256ef26dd3ada001707f084b6bec
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cd:i
TLSH
T108675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 28.4MB
SHA256 c0b4aea18615c03cff764ee5086489826623051ce01d064a093d96ef8fe417ee
MD5 c77dcd1486364fdd7d7950a6c5681658
SHA1 31ce9545b9c23978d7102335d5a1ba250b3c26a7
SHA512 7b80ef9bb0b10a12a7c9f217c872ed9b9b5418b47a404459206179afda864ddee7165fee8828dd710730a4698f4c43a64262b3991cc516dbaa0734ae28e58920
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cf:s
TLSH
T1CB675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 28.4MB
SHA256 3a4a289514c08a3fe54416268f81e844ee68449bc9c3e78873e8f993a3c00eb1
MD5 21a01795375240859476b13b021b63da
SHA1 f2bf95dde5cdffd059c904b3516eb3aae7a4a118
SHA512 a0eb6a8228fdeb867ffb7a5433db109ee2843a97aaae42e667d28331df49dce7fbf84b46a70730037f31927531fe78ca290b304cc56af370460a1653917a14be
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cZ:W
TLSH
T16E675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 28.4MB
SHA256 061e292dec599241bd08eba44ae8d0706b39f39f2c4de4344ab4c8ce1df2e228
MD5 1628fb3e6edaaacb086969c30fb65eda
SHA1 bc5c7d099dbafc5d7e48453a2a954c8fecd420d0
SHA512 11ef9aaf0298b7cfb48ca557482e5f257c1a6df10987b82e5604a4263a37b5f567cf8f8082ad415a8e8d1d0d5945b3f75a8bfacb212967d2900ae7a474ff4812
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+c4:X
TLSH
T1B2675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 28.4MB
SHA256 946aa61c13f3b4b2e4725bcc8323a7c2c94a17e30e4f2a671086b6b090d7b1b4
MD5 2193e011e6b71ce2d0b489342f0acc1f
SHA1 b7b728c137723bf5760813b919b53cebcb85e48e
SHA512 051dce16755cd971824206c0074ba2ff81c2b3c4bca7013eb4e56bb0ccd562f1957dceb0f65d442287a5f897793efff87e32db119ea0105f8d129b092ee33c6c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+ch:a
TLSH
T1FE675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 28.4MB
SHA256 59bd5ee577f4915dc14d3225aaeab640d079c9a236c128dc0631e095057df5a9
MD5 dffb914ced8a44ecbc4ad483b1572cfd
SHA1 5d175b7b0c27c320a198b3804b036ba27c5a1395
SHA512 04fc8f90cd44a28b9040cac010aa5fa22d3bb00cf148ff58f7f6d96b40411eb7f6cfeab4ea9bcbeac947f03138ae537cfccd5c88b987f2d7bdb36c48b7432031
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cG:5
TLSH
T17E675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 28.4MB
SHA256 632c0d44e538e962ea987135feb7618a4b9847c03c01e7779fd9352f65e23b40
MD5 65dcf9f8ac6ad73bda5cb0c015d70b2a
SHA1 2a4ede8bb837696e67d8be72268795b6b46db774
SHA512 2d81a03d7b795e9ae72a3767ca51cb70198a394800ad86f1dfbb72bc736a91af90084791c9d53b5d7b85b29c088033bfafa494a425002a1508b8a3e2ae96ab1f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cZ:G
TLSH
T193675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 28.4MB
SHA256 161b26e2293ff19916fcecdf74db2d77fa0b97ce6d7ecd70a83688326a4cb5e3
MD5 76414c2ca764fefc7f0825407cfe0330
SHA1 adf2a6c96884df936414eb9d1551919d3f9a1159
SHA512 d91040fc6572dd7ccffeb67a28d4c53821e803d6b44193249442295cca4c50cf51a09e114585d6ea22137e9262f3aefd3264634fdff8ad7ca390d2bba0436855
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+ct:q
TLSH
T165675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 28.4MB
SHA256 5b469d78e4b55ee39b8eadbee4c59c958295a0945fe434ec1a138cc0373289aa
MD5 306bf5fac3fee2559c50fbac4de2959a
SHA1 887b93902fac969ead49ac2e6b1188cf4a998a6e
SHA512 5bdc6fe939514e03020ab3fbb7fe05191cd94d14ad84f2068a2abd069b90ab927ab8a24c41ec0638d51f7a68f7bb8c4d1babb7efdc97f041af9f4fe48bdea61c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+ck:L
TLSH
T173675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 28.4MB
SHA256 08b7c6194b6d61d6368084c7255ca78d2f9d6cba1850cc3dd3c2935f8f0c3da7
MD5 873cd5584afea0cd55fb2bec44339861
SHA1 b4f00bb665e43e52d5771b2957470620a9404978
SHA512 ed45f1e770f0db1ef2d84593dcbf314f310b5ff50b2a66aa56c54401c26640b76933bda775abaa104c420e86706cdd6b3ef75e59850dc54a5e5fded4b9164a62
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cW:V
TLSH
T18B675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 28.4MB
SHA256 6ab91c1bca28a3addec7c8d4e068ce656d0c2a8c3e894f91546964a2f4ded01a
MD5 4ff153955a9164da14de598c0c6a5148
SHA1 cc460692b51135c519eed13b78feec6ee74b5f0c
SHA512 7ef571daf0f197f54558b5b3693fadda9ac304eadab064d1ea4f3c2432429838330aca96d31c5364e03dfd320e84b8d5cf7b83caf8836dc6bc85553062a51703
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cD:w
TLSH
T19D675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 28.4MB
SHA256 f479a0103b9bacf014e9d22fa07edd06516b23f0600d78fd2a95eaf99b20ae85
MD5 265fab0386faf370907729cae0865f87
SHA1 432872286315b962cb2434d59f1b802be4738fc6
SHA512 a6937166d4126ffaa284302fb0276aa3d9cf001ef133043a2fcd99bf14a0d8b584a859bb1b67f18e53a421723ee45d4c29bb68326d7b9d22e9aaf6dc85501a43
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cX:A
TLSH
T19B675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 28.6MB
SHA256 354339c454fbbac6e5f3e1fd1fb2ef4fb6bc2a46b7221ec5aefe77cc1e48516a
MD5 44ff5f6f16ed9aadec26ad9640c515f9
SHA1 d3cc408c2bec181f497d0726147e8f66819e4a2e
SHA512 7f5ae6036c17745915322eac9dc3bed32c1bbc2dbcedd7527b6d84fea24620212b55afb02e57167bcd3695ef239a8c226e8ba7f98a20660436659db292e1e0e6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cZ:C
TLSH
T17A675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 28.5MB
SHA256 f09b42268166e1bc806d37250fac9a9e8c8b4ead2782ea5e12a31b320e672ed5
MD5 5574e61d7afef1e900f559a440c47425
SHA1 fc0d0351121080f698a759fe7342b3abafecb19a
SHA512 a29af1541d2a680b27f0b54ec9f75a44cf714dd70a5b28a358e5926eb76eace06f105b0a6fe3715b796790695a5e83771a933c58936e579b99f5ce9defb45bc1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cl:y
TLSH
T190675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 28.5MB
SHA256 4a5a6810e0bc3306c9da0d5e6e06e0e3f84f0f04c295e6961eb722701050e48f
MD5 45579b0e3390c0313569b9e106e8ffc2
SHA1 5b0308bf3260adc59044afcac9c4ae7122010cb7
SHA512 27595c49da2ee7d3f59a9f360656215c2627b50f6780e8eba83f85453a846e3a2852bd67c5f8a5318cf23734f2aa6bf98a3b5a1b675f6843ee5e75d9e4b4cbfd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cT:qj
TLSH
T1B6675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 28.5MB
SHA256 b224ccca2a9359cfc1b7ffccb28f673738af74c4a7784e0d1254362184006795
MD5 147b99c6354b307765393ad1fe88d0b7
SHA1 b5e51af040a6cd917dcd94901e6036a2719e8c0b
SHA512 8e88f66e2c09266af3ff322510a916ad375673ea998d883e80e3a4890b1eb719da4b9f94094ffb56f4c9c4c80f26f53028ae5aa73e78b3dabd56c9171175d129
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5Gw/h1+Qw/h1+cV:YD
TLSH
T1EF675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2800-61-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2800-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/7092-81-0x0000000000400000-0x00000000004E4000-memory.dmp

Download