b989796b5186a6ef971b82855393f841a0578247b65da107661fb0c33e0547eb

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 7.8MB
Sample260629-evxcrscy9v
SHA256 b989796b5186a6ef971b82855393f841a0578247b65da107661fb0c33e0547eb
MD5 a6bf8111cce63f5d583e13f54f27dbb5
SHA1 6100a8917cff5b065158816cc65e4a0931e2496a
SHA512 a5fedfd7f46082dc22842534da42a5009fc27f7e36e22d0d1a73caea451fae0bb4c21fc2150b15f07a4b642b65775f07d75588518deff4ee8f52481d79ac025a
SSDEEP 98304:Su5x6M1c/h1+nu5x6M1c/h1+Tu5x6M1c/h1+nu5x6M1c/h1+56/h1+:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+
TLSH
T1C8865B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Mail\wab.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5532	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1392	2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5532

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-27_a6bf8111cce63f5d583e13f54f27dbb5_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 8.0MB
SHA256 11a5a7149bbcb0959302c50e0b3239b267f3a3089c8de4f8116c96b401347aba
MD5 23252bbbee68ae799adf03cc1bb4c073
SHA1 8f2f6bc1aaf4c39ea507e100dc0ccde9817b873a
SHA512 7b714bb2498ed1ce6d78eea87043a04a9c805c4d9f299fa55059f09abd701c7e7de602272d5945cf6a0818d87005240078ccaeeec7e033fa46d7f7945c9a3b87
SSDEEP 98304:Su5x6M1c/h1+nu5x6M1c/h1+Tu5x6M1c/h1+nu5x6M1c/h1+56/h1+4:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+4
TLSH
T1FE865A65F5A08271D07A8475C6D6A77AFA3378411B308BC79386DB3C2F272D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 15.6MB
SHA256 7cceb0ac173120d23e9c49261c97ac4d76314d49fd635c128f749657ee4dde31
MD5 d1c9e07efa3b6bf7f55f84a86ecf639b
SHA1 3684d30b86693956be6e4f9b57dbbac07e1cc8bd
SHA512 22219f5e2da1f24f4cd81cf383e6f8c85556892513e61e805e8895491a76f75c9d7ca1745b91561106053513ee2fd1f546c5acdbd83189a8c1e9eaee2e8846e7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+9b:e
TLSH
T1EAF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 19.6MB
SHA256 f289d55f6b1286ea24f5dc9e89d0468d5db976482ed79d4f1629fdaa4663544e
MD5 6e668cdb4213fa976987e937a39eb3d8
SHA1 202a10e9c4fe2f2937a36d6a4692d161f2a02aac
SHA512 b67826782df167dd1a7a4e1145e881f50d7e62d96bc4af75f5ebdcce397c15b83db87a07dfefeb13c3a0fec5e8380d53acf6cfb34e40e706935c46e17f806aed
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+fvy9:6vyEYKbi
TLSH
T156275B51F6A481B1D07A8074C6A6A776FA3378421B318BCB4385DB2D2F376D19E36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 15.9MB
SHA256 694bf707f50e168101481efaabb80bb23975aa4349241c77dfad542d9026a47a
MD5 424a51b7f044f576fff1b59ab4ffec43
SHA1 adf6149418dc3d27b0a624eb29104a90c624a7d9
SHA512 b74f3accada11108d92a818763880cf07a46ffb918d30e855aae4cc3c8361619eac4ef637f16b417f126dfea516a8b1961ada5e3f75b1817553ce95b9bd7476f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+V:q
TLSH
T1C0F65B61F5A08271D07A8475C6D6A77AFA3378415B308AC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 9.9MB
SHA256 8e03b4687e4ffa3472b95527cc40c7acd7cb660d4cf66a9782ec0985bdddd2bf
MD5 afd04c90e3e06eae9b923d324b840ace
SHA1 bf0089f81a18e5dfe7ff86fc278077fc5b68b19d
SHA512 49560e2eddbd50fba89260de9c688b1294e7b81c9b6f9ede76a6269199513a757fdc3b8aa26fcdf5aa55db406165079a046caf03a6aad5cd2cc3333edaf7d67b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+IGn:pG
TLSH
T1E8A66B55F6A48271D0B6C174C6D6977AFA3278414B308BCB5386CB2D2F336D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 21.6MB
SHA256 48c999295646d9c8261071359a3c45c6673cc2d356b46888513ee4e798142775
MD5 a004c6209de704253a03da2deae5b7f4
SHA1 694f80895c509dfdb107a04371e5d45f773fff58
SHA512 6ded0ae9da5a2f52986e271b2c70c86a8ab8346bf2650402ee966e7082c0542e58f174bae36767205e0dc22e0a125380da1313a6c0b9c4ffce67f83a14918558
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+xQyX:2Qsas+PS
TLSH
T1C1377D52F2A48175D07AC474C6A6A736EA327C424B7087CB5285E77C2F376D0AB36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 17.2MB
SHA256 471ef58bb6799c24dfff0b8a63409c68356716436e3526863a87702ba0568fba
MD5 712fcd851718979912bd1a44098cc545
SHA1 75b061d8387d570b00c526bfa38b06836bc01aa9
SHA512 e76e41a564a3a3116854cdc8c87d58c74a623ac549bb4ca520c0246e64c88f025bc2124dcd963635a52697f3e3caa8c0261c8e9e3833eafdf4b44ef924957101
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+9th/:m/
TLSH
T1D0075B62F5A08171D07A8071C696A77AEA737C414B708BC74386EB2C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 19.0MB
SHA256 b73ef99d14c0dd6fcc8e27b9cd6a648a66f504609180333140d19ffef9ba8540
MD5 3a1368bce801f104a320c525828ab99e
SHA1 6e363494be24bde40de5928b8e30bab7c0c8da2d
SHA512 ac16d45222e050be319ab03f0bb4ddd090dd4f1a808a4d1a778ea305dad71df479068b560b6755349583d5b8d4835941ba2dad10080c0e581f2fb3fc3cb4d2dc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+NLIa:0+6
TLSH
T134175B52F5A481B5D07AC075C696A776FA327C420B308ACB5385EB2C2F376D19B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 17.8MB
SHA256 bf105260beb8599732b2c502d1b5ba91f4c3a23674d2776ad1d20adf41aa7697
MD5 d57c33f657dfc4d52014386ab29a322e
SHA1 c57c162f11b7d3815c8e52144b8e87db0a2494e9
SHA512 2676a7efa668df29764e4bf18468c7322b2dfc3d609209f0d8881cc00f69882ff55496d1f18251e80e0f9336be8a6afd5d6d456df847001bb15357cd4d3f0fc7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+F6Jk:2l0G
TLSH
T175175B52F5A48171D07AC075C696A77AFA337C411B308ACB5386EB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 17.1MB
SHA256 cfd6c89c139e37ffc32550cb7872223d92aea5e0a36853082a6c2ebf551ac904
MD5 2f807430d0ffe04f48fbeb6465701b97
SHA1 6d36e984d00b30d732457c0a0c90a88ef1833f71
SHA512 951dcd7baf7ba0d48721aae316ee400fbc8bbdbeb1d589dfc6d60fd35352cff7faa711141e6eaee2fbb31874a10326f0d3b9fefcdc28ca360a497747871e67be
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1++fPf:5f
TLSH
T1DA075A52F5A48171D07A8075C696A77AFA337C411B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 17.4MB
SHA256 c6d42aa21eb18ec406030886a506bd3ef33b87786a47571b00812ab5d350dc30
MD5 5254af502907a947f6de476351a5b24d
SHA1 8c5ea8b8369abe1857b69336df8540d4a05a3492
SHA512 8a6909906d6914e94465adc73b339e99fca16611fa652d091409640f21420cd5bce0e64daf0240ab1a860d4839986697c862826b6b9758f8c0e8430186bf1b2e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+7dKF:PC16
TLSH
T100075A52F5A48171D07A8075C696A77AFA337C411B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 18.6MB
SHA256 348a9b1536c8044418aa038ba94160a53cfc3d42c81f187a3f309b898ccbf6be
MD5 86fa55220c105332510dbe4010cbdbb0
SHA1 161d3e8cc51ae2c72f3edb75170ed0d4a2ece2cf
SHA512 c7e7bde61638c2896a0e7b2b801c47e511f218e8e0fe23611a3c1e89c8eaac98795c288f651bd24bfb4102e9155960a9137994dac2d6e6d45a2fc651dab2956d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+ujnS:hO
TLSH
T117175A52F5A481B1D07A8075C696A77AFA337C414B308ACB5385FB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 16.9MB
SHA256 82c4818dca1af7ad7f594a32061a35663dfa5e186a1b1534cd24d2f6841266c3
MD5 63a14d85600bcfcd619cb16b41dea63a
SHA1 9e5636513c89010d14f23d9bde90875d1374ad62
SHA512 ad3210435bf05ea2ed692c372e86a6767d04ff162a89b7619aedfdf1cdd7b84a81f00e83db13854dc248d68d3393381c128ded03c1ee693482fa7a75f5c9b01d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+U2i0:V0
TLSH
T175075A52F5A48271D07A8075C696A77AFA337C411B308AC75386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 15.5MB
SHA256 96a6a10ef1b5c09b5878bfccca1d7327437c76ba57db2ee08dd11dc3198e605d
MD5 f09403c5d9548ce4e1c01914332d834c
SHA1 3540c9368d702c83ba59f0de31f69bab5ae21c40
SHA512 8395d3394c1af36903b9c3430733d363a3f4e274c182ca07d8fc42778a421ec94f325e69c572f02b243b9e166f108cc489b315b2299f11ff04c8a55c72c2a7e2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+t:K
TLSH
T116F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 15.5MB
SHA256 2481539002d8a594e21765300eb8809868ee8fc2608d7d1227df2a2824574bf0
MD5 8883f7763a262e71deb23a351d012984
SHA1 d7ace2aa256d31acc38cea102829d2ad545ed01b
SHA512 9903c29c7f06ff888c5f7e2d966ae831f41d1652f0b600b4bce21ef0054c04ed81317ca7e119c2e5599decc515dcdd2a317ee59b73d47e4989b5109dca7ceb97
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+5:m
TLSH
T110F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 15.5MB
SHA256 5c37bf741a5de46685cde914ff56ccce9bf0568d47380caf5e0b7e1d9bd4a3eb
MD5 650cca264b93ff479e0e95d0c5a210b4
SHA1 e7512006406296b4d1d16f4217ef16c65464b1a5
SHA512 df04c8dc37526212c8606a1d76cd4c07c700e6d08669124f0fe91a296fb4133fc658cfc12da658f9ae84a5c69b5c82286cb01a60822943c9319b2ab68f809e7b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+i:R
TLSH
T1BEF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 15.5MB
SHA256 71ab9bccefff9b774b84bb500ab5ae01af3d7917f15c78024ac693bbec6f9429
MD5 0d7ee2718642c488df7a467bbca8215f
SHA1 c35d0085ada766606ef81c1c1d734664eb5add9e
SHA512 4362e2e1cf98aba5f1094afa58eca043f098981e8915fadbf200f2368869987b641d66bf5c45c89c5cd39a816c4e9138a9f8f852781bc3aaec4031a7170ec9e3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+f:k
TLSH
T199F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 15.5MB
SHA256 44270b72d0a822c27a8a74ba67953a5c7e29f66bed008bc5eb857e78109b6cfe
MD5 60296f7924274cac9de18383e1554f1b
SHA1 660a02faa16236426aa236b430a65fefb91de068
SHA512 1b9c468dc89934a52c598c90194b69f67343ba8e42eeafed66c5c22a4de04715180a9f75d71054852aea1dab12fa6157c0880faaca57bee2271064abd568649a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+a:B
TLSH
T150F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 15.5MB
SHA256 ca819bbe0c2fba4bb4ee7ad1be6c6469d825b442d276f4013780eeafcac34f9e
MD5 2dc3dfbd17bd43cccc459d8dbe640c7b
SHA1 19fd7c9c19182feef443cd2c4dc0ce69fd81ab6a
SHA512 318592d253374f260f9486b7ffad0853076635ec46c5835f1bb2bcc8e3137d00ef06fa1f774e566768ca05bcd40c984d3382721e6353073326538c4199d054ce
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+1:O
TLSH
T10FF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 15.5MB
SHA256 5b982cdd70a0e9dca5397d226cb93ac0f0cfa6dd01209de5fec8801f8ab9e035
MD5 beb1863ea81a55307d6cabac55e4e23b
SHA1 734bc1bb115c39548df862227bd1bcbfe9d64b77
SHA512 d83ff02d8a4bcae2e45cff3b08b9f5ce5c0b8ae0cdb07280d1352f91aae415df964ef483bc1398db1979e88d590460b29d6452466ee25181889fffaf5e82f007
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+C:J
TLSH
T1C8F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 15.8MB
SHA256 d352d7b0035c13a4d34a85cd5e5708e13c80bfddd423207ac1ace2625342c44e
MD5 319b48931d7e87dff43a1785d9b9e9c3
SHA1 73ad78b7c835631b4c33e358fb440272760d97ba
SHA512 a4864646fd7d2586e5901f838042c5461aa5fe885c56e8e786eb70da28e0419dd1fc4d5e47df2bb09cfed1c61afeb2cc8a05205a85583e01e6bc31249a1804f4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+dfu:sm
TLSH
T1FEF65B61F5A08271D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 15.5MB
SHA256 a620821fbda76bc3b98e55900b2882356c60b943453ee3e3ffc1071bc4351d84
MD5 de5d22313ab48faa6d1a96ee586ee32d
SHA1 f651e341435fc6fbc9cbd4d9a3f14e65ddfab8ae
SHA512 6c8930f18ded694187efe8635b1a2e914402a312c0f0ffc82419a59e40f2b9a7c8e399f099a5104d25263e65b4cbebeacf1ae5d9d65757edd187736a64d50e92
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+r:w
TLSH
T1C1F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 15.5MB
SHA256 ef75cb58b7eb0e00d28da97cfcd83aeb1919fbf7b2e7f8494dc6f3aee1d639be
MD5 af8dd82012d92a2f7d47a29c69d46005
SHA1 7ad44335403a003e7d8b8e7287001c59a031b8d8
SHA512 05e25080e5eddf255c245b7ace7e047fb2ef16b1e413013bcad9d48ae0a64a47489c7ef10c8db7f93f88b2850816da5791880a46f51232b0430100b8184deaf8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+v:o
TLSH
T10DF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 15.7MB
SHA256 703e99b66e415c1cd7f9b5423d64714cce383507f7af1831301d016e10734cdc
MD5 e6f2dc04a8243f897739fd00fe13223c
SHA1 cd3ab28b68006f3a35a0a03637a0887acb117477
SHA512 8f0bcb0ccaf692614210a63f055cbcd906d19eeb078a11a9c6139ed7da430fb35b6ffe8cb58e25608ec21374be55e12368affd38858fbba005f76096f0cedfab
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1++s:M
TLSH
T1C6F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 15.5MB
SHA256 c6e5e69289e393b88307b85f3234431bfd0511c086033aa7674f152596f99ec4
MD5 f99eeb80a4c7cf976416fd0235bb3c6c
SHA1 3c65d34a20b7dcbabff319b766ff257faa3ff30c
SHA512 a7cc0b1a693bc1619a1ddea56793c408c2100f79790d4a2582ab8e8465835ec0d8bea2d4554dedd842bd5392fb6b8d4a2e973ed4b58d7657bc9bae4c40f39aa0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+m:V
TLSH
T1AFF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 15.5MB
SHA256 1e6dcb97e460da3ca76eb882b6be922a8cfe9c5d3bbc15564d28852aed8bea9f
MD5 12c6a031027422d2ec4077c5b28f7652
SHA1 adefd2aea53d19f544dd84b5395831bf399fd62f
SHA512 5fe66179f1c1fa25b15f22f70d5787d4410dfd103e8711e6db5657da07201695ec4fbde9ad9d8f31806acd352c1036aadeedb136c1c072e0c59451396d1c848c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+w:X
TLSH
T190F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 15.7MB
SHA256 d7e2ecd3dba79f5fe2e01d8334a3b437afe49c4fe508f7dd3a0f623f9aab0276
MD5 3ff52b8fb23cec145a901cb787894282
SHA1 bb77eedee8078e67831f8b2f8e6dcc3bbba1190c
SHA512 d149213b705e3e89538d8fd9737e4c75b99cdb50cf519a60ed8d519f88ebd185643b781efe141d734d7587386e39db45264050f5ae428a517074b71449abe176
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+7T:8
TLSH
T120F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 15.8MB
SHA256 e3f0c7ef17ed852c913f191115c89cd8d45adfb76f1f49521aaab6d40686db58
MD5 b212d5019697ae26b3aa839cdd3bce13
SHA1 e284fb1f518e708518c4b08a376ef8c58c84acd2
SHA512 e22e1434133e32a35a1f16978057e1ef94b424341c6111a9f85927cb2b77a192cd6ccb217104cf01b6dfe879f7f5523831315f01b8021829d88d447300fb070b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+DtB:+7
TLSH
T1EDF65B61F5A08271D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 16.0MB
SHA256 3f968ebdb3a15a9899b55ba6b1d349e9f607e2d57da9d1d864902c8ce7afacd3
MD5 3d29c94b7b509fa8fdd320deeba14046
SHA1 bf5938e419ee04bc08be20135aa17fac2b435383
SHA512 1663bffe1ead50fe143d5f36b809a1835fd517290316ebca4cd69e8c178a800c79519b0c7ee40f68402e3d964233ef5c81b1a9fca1a9b82f5c55c555898e5a08
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+0q6:Zd
TLSH
T167F65A61F5A08271D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 15.5MB
SHA256 b37b26192adfed5e943deacc80e1ed5868bb1a9c2f1e6fea71f733fb8c305156
MD5 aa49066faf55aaa9146dd256698fc98d
SHA1 6f4b6e291c5bd67bf67d693fab6f4aa7e4a190b6
SHA512 b54a9e18c480eec637b71746b7b0b70c1b23554112abcae9487f2bef65839259f18149c2bb991fc439a39bf0dba6eb3b5c6c11dc88cf6e29b5244a8051fb046e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+F:2
TLSH
T181F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 15.5MB
SHA256 b2f69a0a421afd31b6e638891c759e70d8d430ee0f599de3db670ab13ab9ef6f
MD5 4ba4de02ce4fff11e66e7858b8d1ef74
SHA1 ab88e0cad52c4405286e74c6d147b43d94392f8a
SHA512 c8caed5fb9edf735f7ac9ec3652391959427d723dd2fe4329d6bb9bd33e9c846ae79240747a794b6810c40692eb563de2066bf4a1393a3d0a4c6e8df92f30d06
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+A:b
TLSH
T1C7F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 15.5MB
SHA256 772572bfef3b61a8d36b13a30fe114f973ea6507191d63a12dc3ddcbc1b93274
MD5 55a86dcf0d255dc5dca07829e5e921e8
SHA1 964aee3e1e8ef64cf4b1e80166abe6e14399a4b8
SHA512 2e01b2d3a019acd225ebbd5a5b1b00a690863bdc84fa5e9790a14cb1be36aa6fc240414d439b550cc07bc9da12c2c53722618d46e465fcc602e0de2500b4fad7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+W:Z
TLSH
T14CF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 15.5MB
SHA256 ce2ccd33df0a7a6ab0965ccbd4302371253d46396a79520b9d4500fec8de16d0
MD5 8778fc2882279a561ca1358b5c87db7a
SHA1 7fe16ce0ec32ef7b252e81d2ea823a075e615b7f
SHA512 1ef4f1cf6702679833f1252774779234c5fdc05773aeb8970d743c76b167a08b34d1cd19d530d381eb730185fcd972f1dbf599f1d5fb1b564c835c2e9ef9183a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Z:C
TLSH
T142F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 15.5MB
SHA256 749ca084866d0b9338fe4922e1f5c22eb34f3641070737c9b8a2c3073ddde644
MD5 21d4c031af0e4e314c6078f151bf2891
SHA1 41d4ea2caf4294cccf31454da4cf776f9156dda6
SHA512 ce94b2b8171d66fa4ea4ce7d5f5a355cdfbacfd573b2248ccb5d9dcb33ad1e5467a128aeea76fd1530c6a1b29bc735c730b3228707659e4406f1c2980721a7a8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+L:o
TLSH
T17AF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 15.5MB
SHA256 df169cd4d71469716cba07de44bfefa28c95097c7d0c93d512a48dd225c97dc8
MD5 027dfc2818f10f5d038c07810ba75e93
SHA1 c6f9288dfd16f50a56b59c27e17848dd3f0a7c7c
SHA512 9fea88c8229d26dbf2dba531f778e23530b4f70f6c0e000907ed822b0e57012d95fd105f45afb34bf59816b0cd4b5ed0e29f8e058f8be5d413ce2c07f7d3ca03
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+n:8
TLSH
T133F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 15.5MB
SHA256 0d6361235635c5839d9decb790a0d19384f7c7298509e60ab9008418bf56d5fe
MD5 05b8b40c7e77caf73738cc4e4f00c83d
SHA1 2bc5a2d09bc64ac57a25cbc6c44048111a4358da
SHA512 c456a122e2dde78c874771a7e5f019f514c8aafecd7acb2eae0ce80a6a578e2dcf9144ffde7aa187a5874cbb9e0718669fb7fe26a5b35f76c9ba67de0aecafbe
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+C:x
TLSH
T144F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 15.5MB
SHA256 006990e8952a8b9adb89fb20fd00f10aa604d54e9a097670f5ca5dc3931ec7c8
MD5 674c35c93c254f02e5336575b45d704a
SHA1 719cc4493ce5f342c06dcb822f8476e933cbcc5c
SHA512 7bffa6f889c6750e822cd882e21697479df76f7937c51798ef2fd83dc717f9e277ad6edaf08a5923fef9ef4af36681cd0151f0443af80c370f218c5474b7cf91
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+y:l
TLSH
T188F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 15.5MB
SHA256 4fbd1230fa04309761b4a5640811413a0a942881dc626bbbeba7cfbd103d4b0e
MD5 176543ddcea27e60929443aa0111a781
SHA1 146e9e204b4e8f2dc19947220d9608f467c6f4fd
SHA512 d4831dfcb1d80483b0ef9b103efd152b678187d8787f2f37c33df5e6e51fddb1f624cfc056e612cbc4d2172cf48d5ee642f90917ed38958ac666f2f0a1a1f59c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+9:a
TLSH
T15DF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 15.5MB
SHA256 1b532d8962bb36ec910e91d16aa1744067c687ca2d8949ed79000813130957fc
MD5 f8420cc803f2d416aa1fd7b998a25c82
SHA1 06c291be07dd25378c6f11422ab27080d3004d7d
SHA512 556110b3abe6ce09952e745752fb8182c33232e88bd15b5cc5c749e18364614b678ef502bf6135313613dd3b08e9f5af55dd5ec667fbcff1d58228e46938c87a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+M:7
TLSH
T17AF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 15.5MB
SHA256 d571f6301115676db4e7897f7daafb9d6bef6f82455dbc38bd99b27aa81eaa61
MD5 e4ef2f674416163c9963ef4d288e671f
SHA1 4e6d14e31d9998859ab6a28e779012fec8b2331f
SHA512 9a6eb5b67385bff46a90d895e90f1ae3d6e794045929ca1e8f7e140a4b3c797f1465d729ea510eb3a598a850ca3c191384b2d33ab9aaf471aefdcb8ac429ebab
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+M:D
TLSH
T193F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 15.5MB
SHA256 7a38a1db01541b08e0198ea5dfdbbc22a9f81af5886b94fa2f7c844778bf5a62
MD5 5884d63b63652346568578cb36b57e22
SHA1 d5ff26c051eb9f70cc862e957e03aacd457e63f9
SHA512 108998b414d4055729a0a49824391a73b9ded78a3b278d42bad95d5850c936678989873cbb97a6fb9310ae458773d46e667e47f4bdf27b5d03f0d753639a8f23
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+8:z
TLSH
T109F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 15.5MB
SHA256 88de74d6a80190a4f550c4953af5b637489c53c22088b4f7cc0d30b74b5ef804
MD5 9b49537a909cdf5b36941b79e6d4f184
SHA1 f39701af0a6b4b30e5399961be44c75f7935ae8e
SHA512 ac3c06d2995cd7b0f4b3c57129c51ace4e192ee87da5e0e836b590c9529a2011e9231c1e76a74007a7237a9223f9cc9ccfa9e7531a71678bdc1bbdc63ca93b07
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+F:e
TLSH
T1AEF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 15.5MB
SHA256 93c59bccb43f358cb638eea0ec1401afd055022c61ffa2c3e8538f08a7bc9b07
MD5 68b806887388287fec914fc4b7da6077
SHA1 014dcb69c1f8c1e69ad36699b25dea68f4676df7
SHA512 6b5b45e0f7f4a100f057a8dd994170945f1635eb46d9eeea07de6fee7be948aa73c3dfe4bce73e91e2ade7fff98d05c1b3181f02d61723b406004eabd89ca904
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+4:D
TLSH
T15BF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 15.5MB
SHA256 36b79c7e29c6b3ec4decfda3bdcb6564f192b529720728236aae70070f609c98
MD5 b8b0c0732e4282556d3365f1f1b9d45a
SHA1 a56ff20ae6a0b8600088c30ee374c9f6fbd7c2e5
SHA512 ff77e7b435631263a88af261c250cb42cb13aa114d34db6d0d387348cda6856cf80bc63d397823803470196ced782db90d573334dd5af35054e1ad4f149d8a79
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+d:m
TLSH
T1B0F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 15.5MB
SHA256 c0ded91b6f7dfa320a4a0592c213dfa4dd5dd86b9abb64aa8f4460b2057c57fa
MD5 b99ed9da487f821aa82535d843e5857f
SHA1 71d4ef9f6a0260d0af897fd778d28792ab223249
SHA512 21866b332d658cad632ff745f3d401618e86dfc215478edcdbfb7c79c3c7dbd992f4b59f17970442cd880bf8e7019cfda539a1d28592fbef1aac9c37c009b3de
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+f:o
TLSH
T1CEF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 15.5MB
SHA256 97916d14c79f2e6a41d2bdfddc386b8fd3932f26da155f554c1c614d370f4fe5
MD5 11d91682de2ecf02bde94963a8657638
SHA1 2eecd9d8026b95cae533c1f0cc1647fecf1ce7d2
SHA512 02ab3012f8cb67b56fffda4128a5291d5388bf6f3232636bcdef158eae261312109f9e7a3949ddc2a3f7c09a8a64edc657c6ee1bc058c68ee931b846d7a1c538
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Z:K
TLSH
T1B3F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 15.5MB
SHA256 6655e0fcb519c7709f812747e9cc751abef4ea3f03aade287e94c9b2201c95e5
MD5 5b2f138cbc69b77249eb7fab75830272
SHA1 003a46f589bb22041bcfe931349bb0bc72938072
SHA512 13732d59d58e2317410b2382f4bb91d8f72d924b3f9b3bffb04edb5cece65e5986b28377f3045b00112453b4601d777bcf2358021742e473fea505c95bc4746a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+3:o
TLSH
T1F7F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 15.5MB
SHA256 85313a80a01ae8d4ddf5789c948cabffe43c14bcbd45bbe34619c79d65cf86db
MD5 49e2057ae29ebee20df1973966ad3462
SHA1 c223497eca6a1b218a85910e9963d7f398cbc1ee
SHA512 9d03b0d83ab91a030ec83508622d1040667ab68ed5a15c161d7ddf87ca756a5b07b35173f7278aae34d4273683891edce2adb147e94cbe29a9a90472f4208db4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+4:r
TLSH
T183F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 15.5MB
SHA256 106d3006b550213eaabd09f1d64a84e2b85c2a65e8e85e7e6c1e149f1e47f70c
MD5 c47bc68717889a4e68bc1988470b2de8
SHA1 2aad31bd5e00ea2611f425da793309cd7bc13a63
SHA512 8ea9eee07a74dd9d93f24af4f7c6c25754c8c689bf70f42588373ddc9a8bd4a8473dd8dbbed845f700936b48d38d62352982f0007de6753ad597c6c6333b462d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+h:m
TLSH
T1E0F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 15.5MB
SHA256 182033895981262c0e8f6e3de177b6c7b1d0d12357862de1462ed932f0045c13
MD5 1d9f4d009e9f7b9419cdc1c8a0a1e914
SHA1 fc4998b88849a806ebf3a6f4c084fe5d435dafb4
SHA512 5bae8ef70667c59ba14d90e266259f9c87d5787b666c778f2617db01a7cb7ad2d4d5fb4dbdd4c2cb539091438c81fb4e29d6c338b9b7c4bf21da9240f30cbda1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+G:1
TLSH
T14AF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 15.5MB
SHA256 68bbcf147f2920eafe19871ed082036fb9e72e91591816027aa2340b6d581395
MD5 66173650a250c4127532d84666a973e5
SHA1 bb4fe8807e9f2253d8cb69c89c25ef4f65289184
SHA512 5821733937ed352ea6bf7c1f74b9d5546e0424e4f8b59803356742354ac13a9efc49a462d843ba7c8d10f6e8b3413b4f6cabc1ca3f21e481acef1cf28dd15753
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+X:g
TLSH
T1B3F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 15.5MB
SHA256 244bebfc42d9953c989a5f0a322fe510521835fe342b4e67e3089b33225eb559
MD5 c1fa0849b464c68d21b37ab56c8a29f6
SHA1 ad861407dbb25495c0a3baecbbcf505d2b2b5127
SHA512 fff49921c6ab917ab3477a66b6a6d97840255d20d90a0a8a071cba95c9ff1c00aa9e7bc08ef59bc400f19e100013069560555bbd0cd8cf931e475817e4f7ef51
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Z:6
TLSH
T188F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 15.5MB
SHA256 03d7512fb484aeef9e6acf65023ec47974a225f2e557790b91f2950759bb5609
MD5 b2d3b14f8f3dcb66d474ecb0831a2343
SHA1 af0a2bc1a24def391048ce53e33c156f29a6a5d2
SHA512 022f41ef919de7ae65d75c248f8d6b4f36b12221fe5fe0cf19d48567b72d8a15d84f98bf2bafad79d721a52debe4a00ed95df152e9f566e1d4f5b3f062ea02fe
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+t:O
TLSH
T167F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 15.5MB
SHA256 476ed1d4a43085eb6bfdcaa4310791e1fc52e115695810d195024a96f3cfe110
MD5 bee7b29f29d409eeae4932e869360a4b
SHA1 c8d902c482766fa37390bcb3a84ddc73241dac27
SHA512 b0db75e209f42ae8c7fc2a323f21ab28fa11fcae8ac35d661b473232900eb7dbd580153b8deb06199f0a7a64fd3c15beb083c688e67b0d75764c860d125d575a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+k:H
TLSH
T1C4F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 15.5MB
SHA256 078b1494719f5bb1b99baad4112c4f753197abe179f0396001432c30abad700c
MD5 9f0e92ebdf97da98eb4644aecb298143
SHA1 1d6d1e09058df555fbd5791cd2a68999ce5883cb
SHA512 aa0824ee4ea5a61050d5f132c9ceaa9c78c1bce622e9048aebe0680570a0e6fc858d178f1ed3244464a62f41a37331d074c7d487c06a2fb9ae607669636655ef
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+W:B
TLSH
T1ACF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 15.5MB
SHA256 235d85cb832b4552ca86fb7c123b26f5213b156ab2b4629e23fc5c29278466c2
MD5 54003a2f67cf1204431e9f86e85ed7b3
SHA1 85ceaac23af7a3ca2ce66330ad1b1474cdde4b1a
SHA512 4ad3d21d757e960bd878361d555f354ac0920e549a91af43f49334962e33ce27d35cacda3a118824d2e03727dce0b1e01da14fa4da66ea8f2ba2a025059c029e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+D:E
TLSH
T111F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 15.5MB
SHA256 3a8c44efb59bf8cf152c0f3f96d8c21bba7e28ca7403ff5c270f5999bf0c46c4
MD5 6f6451201a6916315b19c1384a5c116d
SHA1 db14ba035e1895440d175c92f9dfbffe3a164f76
SHA512 9592e573ac69d4270ddedeb3ec81b3ec3bfe7c664b6d03918c0e67ad50d0fabed4d353e7b3a485520983a6fd9f55b94952aa2cc5ec14d0627ae9b25f83b2fde2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+X:M
TLSH
T106F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 15.5MB
SHA256 aa098a038967c8cbd00eff40dbbd0d8991584b63988a0f38d265162598eef905
MD5 31901e04ed755206a417347035a15210
SHA1 086a2d6fa1c477ef0d152c8be4077bf550e6fe90
SHA512 60c52f40740428d4f9b6e86c8061707fa614c0090da92e35a1896e1c0a89e174af02b10bf4f166ac6b957ecc64a728978cfcadbbfe464739fe471b8badd6368d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+L:M
TLSH
T19EF65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 15.7MB
SHA256 465ddc1b324782cf1f560a679db07bd452df5ff369fb5447019c2d7aa21fd30c
MD5 05f09998606696addbefeadb40a7d522
SHA1 5c38eaec05b4c6578d0b05aff5f782bd56ca1d58
SHA512 a375807ca20196bad42e0b8233ee581cab464b4459567918930d45a127e176db7273a8e7dc6ad5fd440599dbcf172f8fceee49f84e670df5d744be7f561e474e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+B:e
TLSH
T1B5F65B51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 15.6MB
SHA256 403d7a38750788a4535402a259303ea1f2563c90873ceecd8b1e166e08a759de
MD5 c7a88e30754f891bc4739660dace7c2c
SHA1 16da2abe4a495492ee02c0870e7b8b01ff72c4e3
SHA512 83bde7f952fcaa1a26faeed7eba265856e7c62ad51eff04ba4ac19d8338634999ce92be39f5d8bb52ee8031009b6fe349507bb502a43adc7a5fadeeddfc49ba9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Qw/h1+Qw/h1+cw/h1+Qw/h1+56/h1+Z:u
TLSH
T187F65A61F5A08271D07A8475C6D6A77AFA3378411B708AC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-202-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5532-168-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5532-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download