98b058aafa3709dc2f740d94b0a13844c266692ea32952bae4bf7b1c67aa5bdc

Analysis

max time kernel
21s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 22.1MB
Sample260715-mb3dnsc19x
SHA256 98b058aafa3709dc2f740d94b0a13844c266692ea32952bae4bf7b1c67aa5bdc
MD5 3a9c869c5ff1464275f952dee3be8e02
SHA1 24d427fd9c335269598cf7d2e0739edfadd864f6
SHA512 4154044cae0a509d3c8cb8ac83019fb00ef58b24b4d634e1acdb2c5844cd1717dfc528abbd7cc3f981bf2d2e519ed43724e9ac294b94b0cbf256295851c17d18
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/w:Wo
TLSH
T1E6374A91F5A081B1D07A8471C696A77AFA337C411B708AC75386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3128	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4132	2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3128

C:\Users\Admin\AppData\Local\Temp\2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-15_3a9c869c5ff1464275f952dee3be8e02_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 22.8MB
SHA256 f1e89d2086a9d5dc2389417aa0900c3674172cad2cb2da0c63c975798006c76d
MD5 dac685daa9c70e7b4ccf4a6c258894b8
SHA1 c7666f1ca2ffc7b94ff70d4d4394159c4f97b399
SHA512 2ae05c31bd922ed4e6ab0d0450174852129e2612cc1320a864dab7c0074c35d44ec2c8645f9b1e0f79f6618e3b9fe53b3b693529fe204eec8d062867ca2abe93
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/C:Wo
TLSH
T1A6374A91F5A08171D07A8475C696A77AFA337C411B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 44.3MB
SHA256 44d882ffae6cb832ffbcf5ad8746600d7632c872d6f2b061439cbda425b30405
MD5 26fd08b604df14dbe1c6d2e42c85cc13
SHA1 729eed9c9e5ff803f413b49936f778307d6519ed
SHA512 cf88be481cac550866e24577afa365f8aac20dca94b1b9d99a479d8be56a035cbe71a31975df324c07100a91778b508f578632bd769080448c806e8f8c93ced1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/D:WoJo
TLSH
T1E3A74A91F5A081B1D07A8471C696A77AFA337C411B708AC75386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 44.5MB
SHA256 36c315c218cd59063583aaff5bd46e16c60052023789e7fe45b6374134664951
MD5 278c45b2db5c64f08c1a1bd618503d85
SHA1 7a28e2c83b5216a3c4dee5a6dac954bb3b4bba96
SHA512 34dff56df7fbb91d7b15f90f36795d21b2a2e43b9556109f8089afb79a5ba056588c5dbc43afebf447407a55f63fecd119309ee562348ad7e73946ae46a5f989
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/F:WoJoK
TLSH
T1C6A74A91F5A081B1D07A8471C696A77AFA337C411B308AC75386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 44.3MB
SHA256 709494956419bd8fd961b8b24cdeb89c392a9973e48266316244b6a7e15092dd
MD5 977ebb25abdb4e1bb736f21e9f98bb1c
SHA1 7208ec24766ad3b2476e29abd03eb461de2257e1
SHA512 d4ecfe78f8493c963d9c7cd38aa0da172b7e1ef13623d3856e3663b054421ffcf1576c15606951810118b95b95604d5f79cabcb79dc3469b80ec0897dae60bcc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/8:WoJoX
TLSH
T12FA74A91F5A081B1D07A8471C696A77AFA337C411B308AC75386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 48.3MB
SHA256 44049bb4a6d0a1d5628c0dc6ead034a2609ead55d3addb39ecc3fafbc259f6c3
MD5 86aec4677ac4a0a4a6a0932d06f1f3e1
SHA1 3c481b3cfc801bcf34c674cf32f96958942b7bef
SHA512 6052ad697ed4e42cb565f6c7ebea533c42b43533dc9d2cecfdad1100fbca6d198540c9c34c87d09608fbb53ce32f93e43474563baf66ec6d7c3026b18387dca9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/t:WoJoJvyEYKbi
TLSH
T10CB74A51F5A481B1D07A8070C696A77AFA337C411B308BCB5386EB2D2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 44.6MB
SHA256 6a446f0c75f824aef660e6790a5b56e10990c48e205ae2285477981fa974ffcb
MD5 2001cdb0c1af062ace5cee88096a0168
SHA1 156ac508515dcfbe021566a4d6305a6a38d3b895
SHA512 4a316286bea40a9de8db68cddd22957dd5ed524f4aef63abad80a877c9380a76c21547aabab31c96e892efc308bf94e3de3c0c26f2c21753e838b185ab0ad0a3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/w:WoJoT
TLSH
T15DA74A91F5A08171D07A8471C696A77AFA337C411B708AC79386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 48.3MB
SHA256 8ffd7f219e3a837cf02856c8aaae14588e083874389b7201887a614ebea95e64
MD5 c04e688e935b07fc66b52168afc161fd
SHA1 4af81bfd333d7bc5a1843662ce667985712af2c6
SHA512 2ae11afaa85c809cf7a049590458640d6eb376b06883ba3287811f03ad612b75f539f71b6e137e7db1d232dd0908c7911cbc39c0dffeb9dae5c850204a21c83b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/G:WoJoMUEtQeQ
TLSH
T13EB75B51F5A081B1D07A8071C696A77AFA737C411B308BC75386EB3D2F376D19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 46.4MB
SHA256 228d33382f67842ec367fa137120f095e12e45f94dba65e23bc415b46f7c6185
MD5 0cde848c8b27aa1b943605f4c69b7219
SHA1 d7c8c9548ce2e38d6df57766f005c2b599e47525
SHA512 7212ee163dce6a369e601db6208cd9ff84bf141f83d272b37889493c007d35f7231180d3303aa85cdcf4e77e6c508055386c8766577a67a6889a770288613eda
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/g:WoJo6G
TLSH
T1D6B74A55F5A081B1D07A8471C696A77AFA337C411B308BCB5386EB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 45.1MB
SHA256 21a29269dcf3b2209b647c3aaff451b59a1074a5c8939ed54c885bb1fb8635ee
MD5 30fb7561577e47dffcf2d8e690623acb
SHA1 d70b6262dd451eca05511145aed979e0b71407ce
SHA512 85c47ab4b16e9da52f8eb6f817b56348cf9057cd0521afcd75a3daf75bd4c5bc0e34f9e74e6fd43544c5eac75393647ee9ef523596616bc57133af1512f8396a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/D:WoJoI
TLSH
T137A74A91F5A08175D07A8471C696A77AFA337C411B208BCB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 43.6MB
SHA256 a8c5b0d139d625c277ea540fbdda9d5a6aa4bff85efc1094d306b41b9fe47dd7
MD5 7b0de5609c7fccee8748c2f5bac528ae
SHA1 55405fdb206a6a7e067eaabda17de176aac2670d
SHA512 91ccf0de2c7e77d2d9662cf0c17979223be34facd801dfdcf96813e3b6b00339c6c0d1a4afde6847ff3e50244ab371fa057b561a7056b40fcbd1afb2d11af8c8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/U:WoJoH
TLSH
T1EBA74A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 45.9MB
SHA256 91142542ecf2a01b378589e37992b4cd10242268d2aa5e9c6de34a8f6436b2c1
MD5 fbeef8edfcdb81696e2c30cc09730462
SHA1 e1e4b2b91e5339cb49fd7f116dac31c8c8b97983
SHA512 4d2aa9a942326fdf003d5ec1239a68c6b5f758f007a5d74ae62ea06982067f96e6e2c72038ffbf2afa3231b791b046c4271dab390331d6ea893f7940c83536dd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/E:WoJonP
TLSH
T106B74B52F5A08175D07A8471C696A77AFA337C411B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 39.8MB
SHA256 3cf0f7b7f38f271ce1f953f47f876e41f0e9cb8ce89046137f71456152c23eb0
MD5 62a6f27c6be7213a66e0cdedd88cb54c
SHA1 95ac2e2afbeb08bd2400ec141a67dd57102c7876
SHA512 e8f2d466d221e18b576efb76723b48aedb385fdffc7d5e51ad0d7a2232686d6de4a819390b91070a315003f53864282727b624afc0542a5535334ad43e113145
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/l:Wov
TLSH
T19E974A91F5A08171D07A8471C696A77AFA337C411B208BC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 42.1MB
SHA256 30778b247a13c39bb83a13303e4acfb2fc9d394f87db0dd955f4bff9c48713f6
MD5 fe92a467859d6ea5c6bb97c5fc65b49b
SHA1 150ee2b1839874fb03e18bc8e59681f206f2a6b1
SHA512 4f3fcfadb46e0cf6fbed1138487ddbbfa897e772399892b12712375463202dc5f2110639ae9e4637c40c02f2b135e137dd3639f3ea2cb7661840e13d223faa58
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/z:Wop
TLSH
T183A74A91F5A08171D07A8471C696A77AFA337C411B208BC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 40.8MB
SHA256 b7d6fc356cf51316d9a1c12c0f92405fc84b2add70c7069d67e88fa43d1baa09
MD5 db5952f25c5e2a57c71487b93a6fa945
SHA1 3e20890310991721919c9843214196eb2076a239
SHA512 e580cc59c7c583be8899090a231f47bfe5906333088bc5128e8098197c867a2e73d9e49d3a77a2c1448c2e27b25aa6b9f6777ad0901663c9e786446e4c4cad0e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/m:Woo
TLSH
T19D974A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 40.4MB
SHA256 502deab364b6271c70042dfbac4b9325767646543f940cec71af4d1c88f6c213
MD5 179c07a24228b6518d7c67c82ee3e07a
SHA1 65cb81291c20ae7cb13a9f6b27d15ef3afaada9f
SHA512 7d8bec26e39417156b97c32656bac4b0cb7544d525fa57e8b9fc40f49e39b8ab7ccddcd73742c9100658a4c8c68ee633109e499fa253072a10609c11a48a7d1c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/E:Wom
TLSH
T124974A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 41.5MB
SHA256 c527967b885f02ab64b568f9d0c6c4817dbb54e189b7dd944b09e3c9a3eaa10a
MD5 23d932ddfba29e702fb42be0c4120067
SHA1 4d4219e16c64b7dbe03705a25a2dad6bf2dd8cee
SHA512 1c9ce11504c98e03b75aed5ddc4ff39340406969a16dd0b123fa4a488d65cbd9c0d53e3cdae24dab638eb48a203d6964fed80cb7d614a30afa9cd2749ebb7361
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/X:Wop
TLSH
T1DD974A91F5A08171D07A8471C696A77AFA337C411B208BC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 39.2MB
SHA256 304c51dd37f041d16683f6517436218cf2a91356d3ee303635be4b1b3351edd4
MD5 e0a5fa9c60fd188adcd164c0b6e32d03
SHA1 7c7c427880137c101699d195f08c2870fbeb956a
SHA512 3338cc95afe55779be3b757739df01fe92dd2fe93d300fc5b72c68671692e6a410bfc135ba34d7675f303b1432ba3388f4275c45fc76ae16373e7cbf6c016c31
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/+:Wo8
TLSH
T18A974A91F5A08171D07A8471C696A77AFA337C411B208BC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 35.4MB
SHA256 2dfa64ea6bfdfcfd4527058e0a3141892e570ac09a70e26bb758936bd36b0286
MD5 181bc2ceeb0d8fdb03462694ff93da23
SHA1 21333c1dbbe5499406a3088d06e5573063b1fecb
SHA512 f7d71e4f0f2c74f6527b3f4c265fb73f9c5497ba37cc4d33b1cce287dc991003f120dc52d6a3863ff87a1d4d784da546f34c99fe79dad8146df2dc71114c8e2e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/b:WoR
TLSH
T1F6874A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 38.9MB
SHA256 fd76a45ac4e0b323e89e638f5076615653544922199935b6c97dad0a99d0fe25
MD5 ef6dd815447990fadb2207706cafbcc9
SHA1 936092fbe72958ab8f722948ef41c2ae84a604e1
SHA512 4d490ab1b38d6923008026945374c35b59b2b4e8339f5103fd0af522649f7c8f9f36015efb67ed2afa8dee629e895e6629d37d0f71f91cc2a9a4d45f50f4812c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/R:Wo/
TLSH
T1EB974A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 35.2MB
SHA256 66caafcc415e4f9663f4ff90a31251b7c8ac5224062b9d53edb81997b08ecf03
MD5 90a34ce818b078b7ab5656e15d8749c9
SHA1 1c137aa2c0e6108e0eb0a3e844524196d57303f3
SHA512 f7367162158a23410db500bc92ee134f50cdfe5c6d0ff66b2ea97056795ffe479971b82cdbac0c42180fe6fbe02d286b3791c3c6880da6c949e13a6d683a1c4b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/z:WoF
TLSH
T1FF874A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 36.6MB
SHA256 94986b2228b8ad5ca1d97238b8b4796ddfcbf401fdbaa0b21ab1a11ad9c7b67e
MD5 e830eead6480344a1a805e9b7824161e
SHA1 418bed18d92c696d18a704227a82da628859b494
SHA512 07cc5ad66939029bd7ea78cd6914e134f7b86cad958dbf8657bc6896c7fb32cf1df109eb0a61b42c66a67bd303086c98e8f97c2f8d368ee13a31c0786c26273e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/W:Woo
TLSH
T156874A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 36.5MB
SHA256 e00f6919efd48b08898e6fc52492fc6e6c5ea011472d75560e2b42fabc9978e2
MD5 be1ad54215ffab0ab47827b47dcab8f2
SHA1 0b40b44019e98af00bdb8b1459fd0874ab73106b
SHA512 b909a160bf5f869e9673c740c71c63bf5dbe65058752924bf00964afefb77df163d8e0347ada509985fb677a788c3fa19d8d24c7add963a772b1984adbe8ac7a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/r:Wod
TLSH
T1BF874A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 35.8MB
SHA256 3061b41697f394d8f099604fcd3aafd5b1a270b83d0a341f97b357f9398158ad
MD5 dcb00eb03fab391b5ce67cf372679d02
SHA1 98cab51ff99bab047f6f00813fcb4180122fcbb4
SHA512 6df6dcc3aedeae9b307848eb486404bc3f446997d77ba923704fef61d68ca711683c5fd0378a52e523f5cb08bd78735e11e14818df5b4ff42b6c6b7bda46ecbb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/1:Wo3
TLSH
T1FF874A91F5A08171D07A8471C696A77AFA337C411B608AC79386EB3C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 35.3MB
SHA256 e0549228728338cab94f7f58fcffc550fd2dea44874c59c6b5f331537d782d93
MD5 371601efd4b8b686eac5ee64f0c1d9e3
SHA1 e06872c82f9bba5b40f99eda185d757154e83f89
SHA512 489b8a81735df24a95e021d6841fbc7b2937ef302e60e5dcb52eec8ce30777841da30645c67ae91d401a615503096384db2cb293aa32afcc92a0227fb24dfeae
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/w:Woi
TLSH
T116874A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 34.6MB
SHA256 03d9b087078a7908733a2027bcf79225a4b480e0cc2c8eaaa765a9295b14615f
MD5 f52be19392bfc466e2adafed942a1cb4
SHA1 44c87ee76b74292aee5e576aeb1786a5f1517fe2
SHA512 37db9374196de826daf931c484eff247b90c44819dc35a62f44dd6a682068ae38c8fe2c3f61690bf90a3a54948b3182e4c86cf1afdd818c3758438431bee8a0d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/2:WoQ
TLSH
T144874A91F5A08171D07A8471C696A77AFA337C411B208BC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 34.0MB
SHA256 d261b5b7a5387a126293c9e793b3b1173e734bd375cbc8248c419c42c2f24a05
MD5 2fb6e2dcac15c9bbb18ea5625b7c2dda
SHA1 ca24e73c2d60eb827d129f952fe9f9df98d9420c
SHA512 42ea1db2610662ad7bf0561d355752a5d8e3f3b64ee8456fba04c70e817ea7ed572fa9dac864b0fb7710ea11ae1ca1a711322ef5c5a685536a7ea8c0da692101
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/Y:WoS
TLSH
T102774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 34.1MB
SHA256 361ef9ba41c85c9c9a424adf3afd71e7de9f173261d1ecef4d85a5fe6a888695
MD5 5c097f9db49082a1525e992af24fd062
SHA1 4dabc45f549c69ad95ba6250bb6faec73e60607e
SHA512 6c62e936c7015792daf551a06762f1854704de112f5afcf1dac17930c431cac1944aff6a6b0140b250c6e171d850b30180ccefc78592bfe7146fa4bc84b1546b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/9:WoL
TLSH
T1F2774A91F5A08171D07A8471C696A77AFA337C411B208BC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 30.5MB
SHA256 28e7ba2f1261e7db0e097b3f952a62a5f8e694242845341d5eee8cda3c5ee830
MD5 52db061ffaea0040361576c084515a70
SHA1 ea1dacb3203dfd5bb8363ae09026afe077de76e0
SHA512 d1896d42a8178ffeb0b50b4c700bb2dead00a540f42b934d83a6a62459ae756b5b482aedc793a0137403435c5929688dbc47be8d224cb31c5f8ef327ac44e8d8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/H:WoR
TLSH
T184674A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 33.8MB
SHA256 fde02b21a8ba61035947e985da52ae34f2209ac09ba5c01a3ba69b3954243fbc
MD5 e7487c8cb019febf51f630c2dc26bd71
SHA1 0917779ea02d75143042dff3bc150f7b3469fb7f
SHA512 d6b162df75c2fdda202eadcdb006ad792d147151c06c2bae916b2d3269934651f5b8f189953218c2576fb6bd9619cc6cde807fc9bd423fd39e25d021e7187cb5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/e:WoY
TLSH
T171774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 33.8MB
SHA256 8f951683759bcc2a9d1e714de0b257a4e08c3c89287da929ba38852cbc09c0c9
MD5 01e85d985b2a8c76eaf26ee3fb39d5e3
SHA1 11a72c7f9353a16f612bb41cc5ac0d4543d8cc3c
SHA512 3582c990f3d4c8faa54c62e2161302ee43ea4a26720bb5743269213b30f4b84b6462a3a7db136abd00ea5e4398bc6ff8d9e04621ea84345e8814ed296b43aeaf
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/z:Wot
TLSH
T128774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 33.4MB
SHA256 8dbd7933b6a654e2a876c2744828554b7e672c6dbcdcc9a13e4f320759808cb1
MD5 fb4ca35ec3e8b2b2abc9f73810c94cdc
SHA1 9ec6c3cc93750eae47dfb276edf6a8a88ca26331
SHA512 9c5fb5787613072c70feeb7918e2e38186b6b78edf96fb53d62821a1ae2d6c15befc447c2d2f198fa664a1f5f4bfdf6cb4e872bb5a8a45f2ef98229be4f50e10
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/V:Won
TLSH
T138774A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 33.2MB
SHA256 ea3f9c83802c245750681cbd2483e3314267f0c7917e00c9fc38dfa9a16bccc2
MD5 5f2e3f8b33a5325dce4cfe35519a83f9
SHA1 3a67b39750e22fb77a7cabf05e11b9cff3ea7de7
SHA512 0e0dc548fc9e876dd86b7418b578a74d69b397b9a5d58ef3c97b7cf9c4e8a20460361d862c163efad5423eedb12d98c00f401be54546b2ffe19e0c32099cb43c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/6:Wow
TLSH
T13F774A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 33.2MB
SHA256 031651d97c02c2a99a561a9c1211d4a1cc3ab94cbc8685278e2f9eb2d1a473d9
MD5 52667943d75e0ffa1f843054aab6103e
SHA1 b2359c7d98e430e6109dedd36748857927e6f981
SHA512 736d8986c0b54e4b79dbfcfc8ee9a9fa1d10b23c4c3ceba682296d0fa0cb443bbda94ebe1e3bc108ebe0123a18c390c4c386e041c6a58d684d44a64c8d6dc901
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/0:WoO
TLSH
T1AA774A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 33.0MB
SHA256 1e83e44ac6141b593dee9845efbafbe7d042c69c73560919e4d0cb7731a347e9
MD5 4fd056e85a97644c011546c373cc37ce
SHA1 826be47291c5060eaeb25c637ee8b9bdb204ff43
SHA512 ea060239590fd3b8fccde824264d7e2b56675dbc92dcce73aa31f56d267e00573790275f4c2ce46e7872a92a3f9ec2b10dd5137e30505fbf25b1792ce73a1828
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/a:Woo
TLSH
T101774A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 32.9MB
SHA256 38f96b8be9a4d517598eff032810aee59dad318d5f52f95d09f9c9709caed247
MD5 89f9ab5232660a4edc7fca9a3ea5f89e
SHA1 8737bd76b7c13194ab0e06156e710589ad0c5863
SHA512 b6093729850fd7fdb81b498d59a0c0614fbdda99d1efb554c0a892125ab1cd9af5b51506a482b66422ed82c1b5d949a52752760afbec6ffe987e9db848f1cc41
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/E:Wo2
TLSH
T120774A91F5A08171D07A8471C696A77AFA337C411B208AC79386EB3C2F376D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 29.2MB
SHA256 ded72608c1b095bb069507234c008fd4104046825942e95f20822df866fb4b63
MD5 478b7644cdd107c7aa635c4a0043ed3d
SHA1 ae033f27210eabd7b39f756b932923b6eba0e684
SHA512 67086d701654f797b5f7c74a4dc6990bc4ef5eff2c310d3662b0fa1b22dbd4d2f8bfc57d9e8298415aae4d6c0e59c30cd9e227a1f0975712a7ddb8743b801b34
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/G:Woc
TLSH
T100674A91F5A08171D07A8471C696A77AFA337C411B308BC79386EB2C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 32.4MB
SHA256 cd47416f161d6c2b2ff4a2146c5f48791e79cd9fcb70883b0135a7db8251afc8
MD5 6a7aaeab769092d0318beae404c844fd
SHA1 755d7b1821af0538349ee34aff0f323782275fed
SHA512 077d3dc62ca32fdcb8c94cb7ab96b58ec072a94c48a234a710258078ca268b8662ef94882f87136e20dd3808a317877858ba06aec549a1a9a2c999f0aef13251
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/P:Woh
TLSH
T103774A91F5A08171D07A8471C696A77AFA337C411B608AC79386EB3C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 32.4MB
SHA256 1eb5fc4252173970cd0a5b0459839d547905e5da1e943bc7849625ce38a76fac
MD5 f254e0e04b5278f17e3148e9419877b3
SHA1 aedef39156b27ec85ab0d1d1741789506eb15f27
SHA512 7db5c53a0e1c6fbd791224785761ac86fd4715a54cf78c5defb8d359f5ee668cb3e0b5af40591a595d8219cd24bb1ed71816647de48cbd1c8a98a695df2c75f4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw//:Wo
TLSH
T103774A91F5A08171D07A8471C696A77AFA337C411B608AC79386EB3C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 32.3MB
SHA256 7964d2cb1eef3761370d0620b6798a334d867bf5e34bb496242c17154555637a
MD5 e0caf6005837b566be1a83e7e1ee5df3
SHA1 b0a4801661c4296ebb514b6dd0c43a95e14bfd29
SHA512 73224e4b22e3928f1c32c4ce08f6d4f27b13cfe0f373431faeda581dffc2315db723fd69fac23e8afb30b821c42f26b3a5d3c475390b3487b6c19d327ef64fff
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/s:Woq
TLSH
T1F2774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 32.3MB
SHA256 e207576e49d272f11c9cd692b180a52d5e2d81f7caf8539d439fe13bb3e7ba74
MD5 d6c1e367f5a2118bd7787c20444cb1fc
SHA1 071a88b459877c6e2ba66dcdf85dac2057a31b6f
SHA512 37763d347ce906b4f7e506c36c52de79d5862f9f03e07faf920e9295aec9119a93c1de466a8a012216dec8b88c312dd363dd991be0e625826d6961301e60f561
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/s:Wo2
TLSH
T1FE774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 32.1MB
SHA256 50a05aef9f4b2f78d42f5ca2df8588a97057aa951b8e4473d199f73f19b619a4
MD5 01960f9887ea6a19ba0d52c600e87553
SHA1 f24cf993820aa0fe33f8b30180d1e2cda5b1c11d
SHA512 d3e1aea4d1ac6d363069d806926c339e7c68fc0794124734114fc756a19232e959d7bc67f87cea44d9cb960b63350cdd7738f48894a83b712bfbbfd2a256d458
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/r:Wot
TLSH
T138774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 28.7MB
SHA256 2c865ebae4ca353df3881a7d8643ea1a817aaa111840d34ef3f74295a53be91f
MD5 a0a3a1b00aad8524379f3317ee57fd08
SHA1 c47e1a511e48805019aa097ff9b039748ada983c
SHA512 b965948696749ee4de52b658b41440457d4e837a8663748b3350d234d14a8d8d53167d6995854b2c5cd724611a97ca77e37b5573fed2e92def1733dd236c9981
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/S:Wos
TLSH
T173674A91F5A08171D07A8471C696A77AFA337C411B308BC79386EB2C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 32.0MB
SHA256 df1db31d593114b54d5283093be02cdd30268b0d2b65a7b31b499a412a742df5
MD5 c2976d7f58db91c96e5d383e6f547d69
SHA1 c982db68092f5b27f572ac8cc556593dd3adddf9
SHA512 6452a764a9317d6a1541c26811e521438f180574c0486e15667c3c418b1ea849d5fc831dceaadb7feb31d78f48c39703cd95a93951fd9ef5f0edcc8dfa12854f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/S:Wo0
TLSH
T1B0774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 31.9MB
SHA256 375ee7c49799114d247963b1d5f77015710c10bc6f90c63408cf09a7264f2981
MD5 210e31a98613e1168ad89ceaa1560245
SHA1 944bb062708debce070ad49bb21ac6012fec988e
SHA512 38b929273e4f7c504323e3411630f5e7c36865cbfa50b2212c871eea3490bde69ad2927ce72a3880dce133c1154e5fd167f1aa219011a7f8abd4b124e4699f81
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/3:WoR
TLSH
T1E4774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 28.4MB
SHA256 f973ec1a9749dd050b7dbbdc88388e727bb9f484e38f7042b01355a9f4cfa33b
MD5 65de6fdc32e3bf6c875c05d738225db0
SHA1 d0035a412814fb9393420790b11682a54da0936d
SHA512 cd4d6b23a4ddf116b7c3cecf8656a12d2ba070b4ad8412ed5112d5f9260aea4af334e5b41c569ae4ecda26f24ad761a56039a63cc0955fa85c3e158e097acf72
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/x:WoD
TLSH
T15C674A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 31.8MB
SHA256 bf5258810aafde50ad0e7cf45ad604844137a64537f576b013ff367ac66d8e57
MD5 eb22b5fc1e3d09239f10f529f9c9a6f2
SHA1 4aea53cac6ab1726676b91841babd6bbbf4ca2fc
SHA512 b9ae7379af5827b29233b35756ace1b1d5dde480db2f422fe14c828e75b6e7386aaffb6fee86ec66c2a36dbbc8909f074962196dff1110523d6614574957f529
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/d:Wo7
TLSH
T17C774A91F5A08171D07A8471C696A77AFA337C411B308AC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 31.7MB
SHA256 0e73ccaa2406f636ccfa22e974bd51389a4527b7f238fc56f4602ba00028e9e2
MD5 fe38d1b680fe833b8e200fb9ffed503b
SHA1 512b5d4bf726067f8cbcd418dbf8ae5b7260a1e8
SHA512 e5553d908f640cd352736672d8e54a7051df81bc9d391f4df54b7d6516579f63a9564db3c78f10448cc195bdb7e0d8c7693337acea4243723326688b8caec37c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/1:Woz
TLSH
T12C774A91F5A08171D07A8471C696A77AFA337C411B208BC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 31.6MB
SHA256 f63230b62f048ac3447701cf9a9adc84b623a1bbe33c4027f445bc19fe0da8f3
MD5 d0d99c2cefea4cc4d896ac229b9303ee
SHA1 7bb87c3faf63ad5e602a7be31ba85b3a7b78dfd9
SHA512 e7f63f09b1c179a6cd58251c01b301d8408f8fbbe34d22173d396522e0136150b2c19c3bdce9a1415ee452508b67729b257148758e4cd1f41c57d3ff2251cf53
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/3:Wot
TLSH
T1BC774A91F5A08171D07A8471C696A77AFA337C411B208BC79386EB3C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 44.4MB
SHA256 deba52af26e8539f09c284bb19a67f9581b8e28c29e8a5285adb879f12ae6d78
MD5 a945dc7cab57d6c3e15497b957e61b39
SHA1 e452f97d496b7eeb06957aee676ebe82861526e7
SHA512 11c2c5f43dfdd7d586b455473feb981556207a1babe80b929819b79c1fea010e62725fdc6f1d2f2d700dea8ef086f75a3c89771e573f4e17c133919011c7c54f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/I:WoJob
TLSH
T105A74A91F5A081B1D07A8471C696A77AFA337C411B608AC75386EB3C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 44.3MB
SHA256 73873d0927c4444499a0d7b82d8476fa5de2e99beb184e440593cc1f5bdd5157
MD5 dee8d842b923c5cfff04f58266e7856e
SHA1 6b0a0e6ef85502b442b3aa81820e966457403052
SHA512 09adb5f1558afa029fea4f7ada6846f8a2c8d86c2de117d45b8d4f95ba5ee69a243168ea610a499a93b46d2421338e3ee975f2f02f28f77ac67efacb9fe7fcd5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/g:WoJoH
TLSH
T11AA74A91F5A081B1D07A8471C696A77AFA337C411B708AC75386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 44.3MB
SHA256 2ba4c6cb3fe80a38b11c5d3db01c5a5de90fcfe8f8d6885182217222294a9765
MD5 eb2ca561c8e55e2b213918341a143275
SHA1 3fc968c3d602ba2973cc6bea222ada00e636a4d8
SHA512 f4791e3667f172717e0d21f9b7868a86945bd3e8ff8d80dfa72557b50df29f4edd1c99196db26d4322e39a9883321bb151955050fae5e0736326643a1da80822
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+Qw/h1+cw/h1+3w/h1+Qw/h1+cw/h1+Qw/h1+Qw/o:WoJo/D
TLSH
T12AA74A91F5A081B1D07A8471C696A77AFA337C411B708AC75386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3128-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3128-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4132-3-0x0000000000400000-0x00000000004E4000-memory.dmp

Download