6746f434d02a3edd3508b9461891ae9858691d5997f27177a3708948f3eb5a60

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 9.3MB
Sample260722-xtbc1ssfpb
SHA256 6746f434d02a3edd3508b9461891ae9858691d5997f27177a3708948f3eb5a60
MD5 ddcd9a9c72b932a5c74d2fe05d5813fe
SHA1 17ceddac7fff465fd9941cb25c086ad49f637b6a
SHA512 7bc76242cb9ee2c930967a988f57783ad73b8d29c58cfd831eea0b61887319cf15a24120042f1e192efeffd16d0b76cfdb122ef91fa16c31424eb376b541f639
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbC:l8Vb618U68Vbb8Vb618U68VbC
TLSH
T1EBA6AE17F6A444F5D17A99304AA59332EB72BC110B3197CB83A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4408	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2104	2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4408

C:\Users\Admin\AppData\Local\Temp\2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-22_ddcd9a9c72b932a5c74d2fe05d5813fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 10.0MB
SHA256 c0d89df021ab494e5b8c551656c782a4c46c4406e538e23ec6e8508edd8a3e9e
MD5 49e3a1298e67d2f5b6015c09af0dbdb3
SHA1 07199f856f24d606336ded887d1cbf9c7794cf6f
SHA512 cc4644e447adaf51a3e354485e0a933a2fa6951baa7bfc1812c429e293887b1a8e9cdc129adbd2bfcf1c84b8a31481b3a0bb0ac66e4eb4ab5ccbd15cad026450
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbCo/h1+:l8Vb618U68Vbb8Vb618U68VbCo/h1+
TLSH
T1B9B69E17F6A440F5D17A983086A69736EB727C120B3187CB9394F61D2F336D09E3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 9.3MB
SHA256 943b03180ea3a102fccbfae057cacaa343b8c23fa9923bacb05dffbc01dc6d01
MD5 2e730e9ea18109952b09d05b297cfc87
SHA1 c7cddb9a6ce8aabbe102662def03a9054281e0f2
SHA512 5d4668cf17a3ebdab9f9150157daaf3dfdea5c8333b25c4b67431019fb2f367d1e37a603380149b7f060be6de6bd7418353c4ff287d473a1c5e2a75e94fc5279
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbCm:l8Vb618U68Vbb8Vb618U68VbCm
TLSH
T19EA6AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 9.3MB
SHA256 07d6945ee0a52c996cb6c10ea3bd29840c0a4ae1ace77b2521cfcde83b2e7d49
MD5 8fc00cb87c00d1b8f872bbfe829be32f
SHA1 2cfbc3d997203733630ed3006752b610017397b0
SHA512 91b14a634da7b23d8658b7bc3e6194f670b422e97c0543d4212a98ca9eb38432ff4a8673d5e668151c42c2d35d7a99a78332c7f5cd739651598a3a02976f8f6d
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbCT:l8Vb618U68Vbb8Vb618U68VbCT
TLSH
T1EEA6AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F6191F336D0AF3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 9.3MB
SHA256 6746f434d02a3edd3508b9461891ae9858691d5997f27177a3708948f3eb5a60
MD5 ddcd9a9c72b932a5c74d2fe05d5813fe
SHA1 17ceddac7fff465fd9941cb25c086ad49f637b6a
SHA512 7bc76242cb9ee2c930967a988f57783ad73b8d29c58cfd831eea0b61887319cf15a24120042f1e192efeffd16d0b76cfdb122ef91fa16c31424eb376b541f639
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbC:l8Vb618U68Vbb8Vb618U68VbC
TLSH
T1EBA6AE17F6A444F5D17A99304AA59332EB72BC110B3197CB83A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 18.6MB
SHA256 4242e7a65d2be16a468ff421d68ec37a594e96108266643a80767d30241b8694
MD5 e4b69e340eb19101e33e5b9755981617
SHA1 af733da223daa381ce1231c3fd9a77ec615e1c6e
SHA512 bda1c2b30d2cdd5d5b92fb711be04647cb4a0f11cee97be15e0b8ad03c41196bd0046543749bea0729f574e196c598cc63fac033567a9595eedaffd5f3f1ce23
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC5:2cD2cDFcD2cDs
TLSH
T12A17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 18.6MB
SHA256 5a4c833521276e197ed5ff96ffa0c937802312384ca6fdd2127e48bc13ab74e7
MD5 d2cac30f445a890e48b81ae695843d57
SHA1 3d23a11d507efa79c3f4f5d57d86a7c644f21cd8
SHA512 54ffe9f95238e3d6c59cb12a76912a16383646c049dd2add489c93bfa4382e2ae7da2c20acb66b5844fed9644b50da0ee663602e072aaac4a03b6c5155bc5690
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCR:2cD2cDFcD2cDc
TLSH
T1A217AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 18.6MB
SHA256 43d260eb491e202b088dadc28554924003975c35146a4b01a53e5f7704481c02
MD5 dc0284aa2f355afaeb86534cdeea5539
SHA1 300cfa5377ca704b78cabb32447972f5fcfa58f7
SHA512 8b9121abd090545abad917866259b3c83765018bf08751a8c18d480db329c15435f695f8c4d84c51a7511ac68b58f550dc294d979ed77091761478c965903a88
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC4:2cD2cDFcD2cDl
TLSH
T17717AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 18.6MB
SHA256 6410e77c1682e5b1671d27a1c2fcf60017ca23f8085128abe31c559783b998b3
MD5 97612d773ab2297328838425dbcd1a86
SHA1 84c78b16e9c7044f2f5eb9bdf1f36b92b50526de
SHA512 2f19e6520f1ddd3fd2a77640bdedd7911b21eb1c5d3853775e6e2d3f6328eddc6f27f29b938690f8d72e9c38fb5e2766881a9eda3763ed24087f3659a48882e1
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCx:2cD2cDFcD2cDY
TLSH
T12D17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 18.6MB
SHA256 1ee4f6d4de2825fc9ad2528d037e19f730d93982ca9c25f801b7ae3a576a00c8
MD5 69d61f0221f5ae9cf64403534453852e
SHA1 b825bbda053a415113381f9d43343459f94c2f44
SHA512 c715167e2ee4224b1b0598c95f347d23dbbd55f7a603c8abad5d824847e1c552489ee03e463ff47d6faeaba28e97afbe0cace22a1c24168ecf3c0b0722945e2d
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCQ:2cD2cDFcD2cD9
TLSH
T18317AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 18.6MB
SHA256 b4a5fb47cf5f55cb5b450895d16ed0851d8c7c9a0c4c1b69b22ad0d2c17d6df5
MD5 7d0f7f733fb4692cc125b3de02a9be23
SHA1 1f984f20cf4a8bf020c4ea9f3fa95b9cf77cb1ea
SHA512 2a326f3aa914647af8eae6d5c361096261ee4556b0e868e6465c69593140f763f276b32eb41daec73aced54ac846c2ad400ae9a3b94e018d769cdf35ce978c36
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCa:2cD2cDFcD2cD/
TLSH
T1AB17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 18.6MB
SHA256 83ee82c4764190a810b3299a6f16ce1371e4e4ac56483fd00a6569539ab86bb8
MD5 7d9dc7f9edede840d4cdc747c1889eaf
SHA1 d28dd7a0fe8e5b2335638da2f7e0b95013ab8210
SHA512 42a283b0dc806c5f66f1022d86a255909f9eb676de51fa2fb6ed50337f54465c6e86f1e2ab74b4f639973d9d1c45dd1f4d70c8b9a4cf1353c26ca89ccf70b8e0
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC8:2cD2cDFcD2cD5
TLSH
T16717AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 18.6MB
SHA256 b62a92166747f0d1be1fc328d2e506ad035dd19d195ec20b5ee469ff2083ffc0
MD5 4a0db85e7ed11be0c787dc7d4b9b3729
SHA1 d5ff43f7384b1d03c12d1c6c2ee2b607fd586f4d
SHA512 bf9828989dc1cbb93ebcd695aa6e140a02c678d4395ea6c783a1faf0922e1fa0ccec55e607cdc4cd0ae4189edf8804b960ae4fbcc3b294de6a82cd2c0d0c3425
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCq:2cD2cDFcD2cDX
TLSH
T14317AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 18.6MB
SHA256 f6768680ed2bae2737b1dd2f7283ae12cb5bef1a77c28dca97462781d04e2e6a
MD5 76a852906cb911b4619a2b4c070cfb01
SHA1 b7214fc0deea0a1f035be85c094d1c83af568adf
SHA512 5760157fc72d87cbaff9ba8959d745db3075ce771552d3d17767e1c74e97f6ac0b404a38a89c91d71eb155ac1807a7737b59ac5876413411d838636f09aaf973
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCp:2cD2cDFcD2cDY
TLSH
T14617AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 18.6MB
SHA256 7432dcd7c3aa1b11bdf6c2532ff91a0ba9822b2d5966639af93a78199e9ad79f
MD5 0466d562206ead32a24a525062ca8c05
SHA1 6dd61ba0cc6698d89ae6c027d9b30ccb86158d72
SHA512 022b8621aa430a1b391207779b1b3ff3f1c7b5baca6ab8bec29335098c61392cb99e896cd99cd2399d319d93017b525f13f3ab2f7d56f440cdd4e501cfdf342c
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCw:2cD2cDFcD2cDB
TLSH
T15617AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 18.6MB
SHA256 c0f5d4c3100dcb654314d67701183192d8672cdf9fc4a7c8ef99d4d91158b45b
MD5 c7b0cdeb76e5d87c632d1fafb5e5a021
SHA1 e645dd7782906c5017a9b2d358ac8febb52385fb
SHA512 a9c7895e59bc6edb139eb7415f632ef12c78a05a83796115a2459927f6bf76973de10a2117f17434d3e5031c402cf2a71f22b17ce4939529efaf56eeb6aa3de0
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCr:2cD2cDFcD2cDm
TLSH
T1FE17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 18.6MB
SHA256 6a8a59819a7fa93950cc43daef78de4282f804e866ef56409ab0d5a4739be6db
MD5 b3dfecd11a7d94e2adf99df5ada31ac6
SHA1 f5d230fbe4a5ecc189b8b9c49c02e2219193877d
SHA512 5afa9fce44555c17b60dd85361a9837c302f6219cd36b1bb59af010a9071122f5bc653148d16d6202cda67e89bb1a5192b737aa09300201371c47f0322f00627
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCe:2cD2cDFcD2cD3
TLSH
T11117AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 18.6MB
SHA256 3029bc55df7ea622dced1e92af3f4987b8e0b9a85c5b5df7d7809ce8f422aa6f
MD5 9de7aa0c575796b11a35e7bf01c6d3ad
SHA1 55ff01c011493c400189168f8b9e54ba9bebca69
SHA512 23a22a28d597fb6b6b51a85226a393dad399d0ebfff20fef9648c5cd5d92dbf2d0caa04dff54defd252cb34376d87bbcd95baa71a7e9f2443eddb16855e28312
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCQ:2cD2cDFcD2cD5
TLSH
T1C717AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 18.6MB
SHA256 53dc4e2a7274d7a9bd17c66044ff289552cab525c5d2b3bfd6165d98a907eba2
MD5 8140f805600301bde202bba135813361
SHA1 d297db1c6a78d18e6efc5649fe449e5e01236ce7
SHA512 8377c4728be6875780217146fd345bfd1f240a9bfee600b12214bc15576b500777bc55344c4db9f414737735b8b2502cc17f89bd54f25641dd8e5e31a863ff8a
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCo:2cD2cDFcD2cDN
TLSH
T1FC17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 18.6MB
SHA256 45fa257f8f251b1258a202d5c0aa1518e98c96ae108016dd5e5e2584b1a99c5b
MD5 1b08e518d5c07a25bb9a9f87849f29da
SHA1 eb83660d22d133dc757769d6800440967cff8e63
SHA512 ef9fdc8b13c2840b3c189643c8a00e314863675cb2e87bfc858944852cd7e14df77f523cb0e81c267290d79db46cdfb832298d4a2af14e30eabe7ba3c7e06fcd
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCZ:2cD2cDFcD2cDE
TLSH
T18917AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 18.6MB
SHA256 e8b79392b2b29ae7a7d6b72fe39393aca3af664d18844c93726023d4d5d03ca9
MD5 9f937a9a6f4c845dda1805a266ee59c4
SHA1 24a547d94b152eecd1e3a230bdfdf5d8f32d96ab
SHA512 56890deb3665860a3a970f4e49c32de1142a03457b8c50d781f905f955bc20d30097fae3d95bd1246d0ae958a680b75f7af7bef2fe5eb8b37695ccee0b3ffafc
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCH:2cD2cDFcD2cD2
TLSH
T1C317AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 9.3MB
SHA256 66c694bcd144f97d320402f856f377977b224b8fe1221fc6a89792c7479fbca9
MD5 b383920389b8de74d1a23b6e35961445
SHA1 24f3797891aa63adf88c3a7227260f37cc936490
SHA512 6866a5a2ed0d4f5d7ea3e289a5bb6e1be76298b8d61442949cda17a9b8b2710a29390dc5d8c2fe8bffa08d887f0ea6c408ae8c09929c27d45bc8c1fbee361b07
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbCy:l8Vb618U68Vbb8Vb618U68VbCy
TLSH
T1CBA6AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F6191F336D0AF3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 18.6MB
SHA256 6eb98c669569ce95a6928231b9210b011e3edeaf93d033165aa0cdbb6f3dcba8
MD5 790ec1279f8367328adea209c211792c
SHA1 ac1fe682bab91d372e6bfd8a1012ad6e84902af5
SHA512 aa86f0af4ef15037aba150884927481fc0f83574eb27395876a67c6f404519ca11022ff791afbb479b742e1f1b4cc6c228625513b477443e01a30a2c57801029
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCm:2cD2cDFcD2cD3
TLSH
T18E17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 9.3MB
SHA256 b3e955f1479c07b3fa22867e38b23873543c30d098c4a86daaa2acedb1ce9274
MD5 87e5a7de958119c9c0fb255c6c61c9c4
SHA1 9c38fb7adb5946e549ce7c895ac7cd607284731a
SHA512 294b34f7504fa2fda89d2ab5d46887fd2efc90ee4e8d755a63379a7817ce47ed7d35ae426e0725df13ef90e18c51c38322e54e2473509109b01715bca64c3924
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbCG:l8Vb618U68Vbb8Vb618U68VbCG
TLSH
T15FA6AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 18.8MB
SHA256 d3aaa22be22f23e76925ca3f398c850fb2f50235c35dd12e9c3d47936d813d11
MD5 76644020fbfc7249708b29377dccac29
SHA1 8ca4142bf730a01e0fb503998a7cb2dfc46a938a
SHA512 2aad70bd5e17d3c9dbc19cbbffc080bb81966d4c0b90645cb75b5d34fe5ecbf1b4193d143d19640dc4c11204f99dc6480b9a6b445137a2f964655b633266070d
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCI:2cD2cDFcD2cDh
TLSH
T10A17AE17F6A444F5D17A99304AA59332EB72BC110B3197CB83A4F6191F336D0AF3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 18.6MB
SHA256 35b9c843f682bcfd5aa1646f16beb497ed528df8e94ef671975949a6ec2f106a
MD5 28afebe7c3736aec243fabe52513dc3d
SHA1 b506960c5f17f3bb681a94829dc3236a0e17346f
SHA512 270a0aa10c75c14f1b07a76979e379ecc632e95872ffa20a772e5fd8e4d6df1459c2cc23c44990767d37a1f6a94292cfad6f12ed9dee215066ed4b90730c3066
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCI:2cD2cDFcD2cDl
TLSH
T1D417AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 18.6MB
SHA256 dc23972cbe636c59402fa66cc879948f300cedca24c9ae5203b8bf04dac449a5
MD5 c3b0ab30eb35c7203f52d0cbf0470530
SHA1 bf31cba1004ab28ddcc76f23a51e5e1f305bf485
SHA512 d5a82f89f7ffdfb1495cdd8a3ca943e093c4b20b985571d391715b6637b7e3b1e32ed282f0c885fc407044c37e10f12878f478a7341914c0a062c545717ee42b
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCJ:2cD2cDFcD2cDc
TLSH
T11117AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 18.6MB
SHA256 04223ae26a59ec7526de77f7335f192396e7c3e7df6fa105b53a4e33e0cc0914
MD5 00ff82134ecc9fa4f9db1decd7a26f51
SHA1 c48caeb9e51fd5b61d3ecdfa686b34b133bd1be1
SHA512 35fd31aef0ec1d4fdb2161f90614cfb9f393b0641a7194c98ac79db64c5af1c88f95325145c9e04261a7c1c5cb11870df2238cd067df46aaabe1a13a70145f55
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC7:2cD2cDFcD2cDW
TLSH
T13D17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
Size 18.6MB
SHA256 686b074146f27903b3d7648b264ef1fa3967bdd9fe8c1d31912264c16895db34
MD5 93f204a4d683b9fa5a090d7cd8a708bc
SHA1 21ddd450e8881edc1974baee371fe50b04aba352
SHA512 1b0cc76184dca942473d3c03bc615860d4414c781aa0949bc80f7e383586deb0719955cc33a532c98edd8a923f85d426f93280de789ec3140f5623445d1371c9
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCu:2cD2cDFcD2cDz
TLSH
T1C517AE17F6A444F5D17A99304AA59332EB72BC110B3197CB83A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
Size 18.6MB
SHA256 7c4c6ca47177ecd405a563b135febbbead56c2758aa00f8522e92bdb596d1195
MD5 b54172d99f764fdf7a7930504d0e46a5
SHA1 3993b56595470b39ddc0eb187681cb5c9ef901e3
SHA512 9aefafd63dce31d98c8dc2ddc96893efa0bd9c4564b83cd34f61df5e7a429dd0063673352d9947b97ab9bbf9b83ed70acc21e5fcd2527b2dcd8e31f6ca426421
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC0:2cD2cDFcD2cDB
TLSH
T16917AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 18.8MB
SHA256 ab212ad90d115290c1f2a178941d0105b13d3c6fb9de313a41cc051bb4beafa7
MD5 ed12382707da66b89036cb3c3dd9a362
SHA1 247478f8758ab9d28bff95b495d1ef747ed7330f
SHA512 6e70007a84164a194dbe03235750663bd94ca2fb06b53a90e610ec0e8ffacaabf73d4c4aafb90797319ad868760c13c98d96098e78aa37736a05adf08c3e6434
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCyfa:2cD2cDFcD2cDpi
TLSH
T14217AE17F6A444F5D17A99308A659332EB72BC110B3097CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 18.7MB
SHA256 ef0cd50e8eb8c38ad1b1cc2b04399eac49e06697a7a727cac0bd38a88d41b40a
MD5 3e17e2823a1601ec71fb2ec2b550c178
SHA1 1e81adb211da770d33408e2067086a23c8a46dd6
SHA512 bed99269f61cdc9a68fd86fafe8a4b84e15d49aa7fbfcee64304c23ce74ec7a1c725dec6858125785911e75e60f484c1c5ca6246092234feae67e1d86c1be025
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCn:2cD2cDFcD2cDO
TLSH
T12917AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 18.8MB
SHA256 bc9d9e3c597f2ea65d083f7805294c52f3c10522a52b9694b84e79fe5cbe2977
MD5 d74d2efee9e33337777d8bb3bfd8bcc6
SHA1 b63de3a5615c7042254ecd8f04a01e1fe37d40e5
SHA512 26d3ea530b125a925e35a414acc32aa4f05ffcbac9d2a5e5f46ad79250c911b473c7dab4e0722333f5fb82ce16f798234fc187c5fd0f12d7f56f36b1ba0abc43
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCSti:2cD2cDFcD2cDBY
TLSH
T14717AE17F6A444F5D17A99308A659332EB72BC110B3097CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 19.0MB
SHA256 c8bd3950e3b0d06854f21f4188aa0f499adb25e9539e62049451c84e3ad5b2b5
MD5 e82518bcdc70d5710ee0564c670cfbbc
SHA1 9b03f9d720a087bf5324ea1fd6d5cf095a0a78a0
SHA512 02d6e9f0862aec828d2d8efd0b0dab85986e27ada4d7d5c13b2cbaf526774a76676625c5c76b5078d60dbe4771e1d7616089358912b302ed953dfff44fbe665b
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCCqL:2cD2cDFcD2cDhk
TLSH
T14517AE13F6A444F5D17A99308A659332EB72BC110B3197CF93A4F6191F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 9.3MB
SHA256 9ee541d9557bb3834868251e74fec37537970364a6706b0ea1ba7ee6b2831d5f
MD5 7454c9ef96a8d38055581d585c3a144b
SHA1 f62ad06d0390686f01db08af5569a936d98002ef
SHA512 2557aaa1c1edb8ed7e964cc948141ab2cd465b1b0aa301857c27bd53afb696a9c0e1db11b435d8f19b5dd5af8747b8c79b57ae42c406f8bec455b95ffdd462f0
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbCt:l8Vb618U68Vbb8Vb618U68VbCt
TLSH
T18DA6AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F6191F336D0AF3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 18.7MB
SHA256 a951b9b191727cd43baf3cdc14a6a9cbf3e4e03542a3783faa6b1c03b82573e9
MD5 2d556da9ae27d76f662b4b8b8a9f2346
SHA1 276bbc9689a49a7eb3b470af43dec17027d7ce8f
SHA512 b5ababe64bdac4f99378beadad378c319ace3b6c1834053f5c07bc3844c5a3468e228d126ca01cb7b737b662f821c779351e6abd4ec5b45f7d3bf0ecaf98bd14
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC0:2cD2cDFcD2cDF
TLSH
T10317AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
Size 18.6MB
SHA256 2044f8b01fa88a524412a6950ab2a1586b85ef93863ba7cced016fc123bcefe3
MD5 85a9e3e83df4654ab566f2f7516cee88
SHA1 d947398f52102a3297e375015d169fcb0513ff51
SHA512 02617bc312658b4ac814f9b4489604e12941530fddeceb2583ca5d0ecdf9b2ec06a82956df7c8349af4947f7eb584c14b5c76733e0efaeede9fa1814e870f0d1
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCJ:2cD2cDFcD2cDY
TLSH
T14317AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
Size 18.6MB
SHA256 9ee5cf5369fc6d2885ee161ac2cfdddf3d3c4fc77fff473e1417e1edf188b086
MD5 37315722fbcf0b18c3e334f89a8ebbda
SHA1 06ec27a520ced4c08c83342a0f9e7cf7a363d121
SHA512 bf13c077c93934338a0f583f7b87f415a2d97bb2ec04e3459a6d52ef77beaac5765a78c7a0252daa5f75220b1ea7198be23cf4a051d5bd1710f64c3eabe225e2
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCg:2cD2cDFcD2cD9
TLSH
T19417AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
Size 18.6MB
SHA256 fd585e2a9ec14e79f4c5b98c5298cbec839a6f1c7c60207c3275ae8a2dc51253
MD5 f63a7f357dec7943d1e604d92901f27d
SHA1 d344a1e6f56f108732012c867809bb2f775869cc
SHA512 6249bc28542cd38235cdcb2e1e25b47bebd1f79e38fd82476e810b5983bca72f92c2b126d454b0463b3dd429dd9bd5024139f1759429b03688e3d969a841b496
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCL:2cD2cDFcD2cD2
TLSH
T1A317AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 18.6MB
SHA256 df7822f4611f9f3f83b005b3238e79e7cebb81364a80c960b9e94f7e5fd9fbd0
MD5 fc4118e8f9b30d644c6cbe02ba49e5e0
SHA1 3284fa228bb7dacc1f3c7cd0291d21b364de2cf6
SHA512 d7d3f66ad8f7dfa20540c9ecafd9df39e284615cd5203697f8ba99d4f46aa2f31073d88a8e99c5f3df898a2716b509b79c9f78dabd5f5589a2e7f2f3dd0933ab
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCZ:2cD2cDFcD2cDQ
TLSH
T16B17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
Size 18.6MB
SHA256 6115de77eb5ec5f9b714257e69fb70beff14409ffde34eb6c8d8fdd9968523e8
MD5 fa6cadf9c66c523dc6f707ddac0e790d
SHA1 f12241693ef59be9a75e406db362d9b0bf0239c3
SHA512 de672acf4612d73cc8ac513f7c619a3b487e1194a177a6b5b6d04c0ba6e421fe6199fa8f503443a37390a9af30ac626620479a89934bdba048092085571e9512
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC5:2cD2cDFcD2cDc
TLSH
T1FB17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
Size 18.6MB
SHA256 f58a7f6231794ea2e93dd8dd7764dbaf6b0af2cd7347f6c1f7c4f199221af94c
MD5 1615ba51f36feb84aeb0105bf50621fa
SHA1 97dd5b287d8fdb441ce761e6576cd25f1abc40ae
SHA512 4019131400178fecda50efe104e0418888d2903b285d4d2bb423770f64c04b1172d4fc7ea65aea6e2dbdb5aca463e393a383ae53a7d568103d44620fbc4e216b
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC2:2cD2cDFcD2cDP
TLSH
T14817AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
Size 18.6MB
SHA256 b332f0f345547ba230d12d57127e031478fb544991758bcad71df3a938729e4a
MD5 e258c32edc70a33a273619c68a9f5af5
SHA1 6d6f96fa3ab97cd9513a1a30fa2d2f3935b1e030
SHA512 d61883dd48b75a8ab26601c7a983e5d099f30f9dbe9e063b3e7436e68235963d8920689b1354beb32fa75a73a4e34410481cb2a49c5342fb62a88bd9957cf0e8
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCj:2cD2cDFcD2cDe
TLSH
T19317AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
Size 18.6MB
SHA256 740a8f32f52fccbcbb6778abe8f09a1cbafd9f886db45dae2f4f599c33d500e4
MD5 c382cefad8a086cb36368d2c776323af
SHA1 a7ffd54d4875ad66348da5ccf9e10d59944b61ba
SHA512 d7f1fa9a6fb3934f9fd5142fea3dbb80861621b0a5019c6550ceaa1fac92a10fe95294d847752a87f1b9ddacde490ce89713cc9a69113845dfa193b0d5147b1a
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCD:2cD2cDFcD2cD+
TLSH
T19417AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
Size 18.6MB
SHA256 89b13d0758e12841360e6cf59a306b283956d3dddfb381d0dec6515cc79b8d1c
MD5 60bf14afbec42a995f2b580ff3f07284
SHA1 6a27edbf040de6d928c9bede8dee9b903532a298
SHA512 ba695e9c236c62f6b791dc64568d2bfa83e8653d444587b55ce30e03548c0ed91650b79e340aad4889911a7deb7f0575498ddb73fde666db3faaecfea287f9dd
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCi:2cD2cDFcD2cDL
TLSH
T1A617AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 18.7MB
SHA256 11ce98c263edba4fb1e41e8f0b51dff3f4ef682e29fb5092226ab1e256fbf813
MD5 6aaff390b2f014625ed5dccf8f797808
SHA1 463ba0a197515acacef273bb117d66760ea58020
SHA512 8385c60962c7949a44700f1983d6f674b7d681d16f5bb456018b4441d078a5d52b87f241d688e4fba44ed83e615dcefaac874552ff7771b5daa32a505cc5ebfb
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCr:2cD2cDFcD2cDK
TLSH
T11E17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 18.6MB
SHA256 a82546315539aafa87a260be7773b1d41cb3881f82ad0173e7f87858848bb4b7
MD5 f4c05b514ec532114c2778fe27318c2c
SHA1 6e867c9c663e278a01abfe615dba81b1e23aaebb
SHA512 9895e2eaf7aac05dc3843c5e6d8940deaf9f3e9adfc3ec7a9d6799920a0678f70eb4a4a23a9316eb3658934446c4b2fa79510ad1dc3cce5f22b1071d70efd9d4
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC9:2cD2cDFcD2cDE
TLSH
T17717AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
Size 18.8MB
SHA256 c48af7d3e00455e28094f7bede04c0fe1cacb03e6bd09f7eea989d5959c0b187
MD5 657a56d5e5794cc9c6e0be265af31e68
SHA1 ef11c4c471c1f9058cee59a184bee0e94a045057
SHA512 5dc8b4e1d0e75d05751d1997c52141129a2d00cf7985cf2f1d468e96ee561fdf8e62281365b363530f624baaa32f75708d1fa6fe24b545c2b01f9db206faee3e
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCv:2cD2cDFcD2cDa
TLSH
T1DE17AE17F6A444F5D17A99304AA59332EB72BC110B3197CB83A4F6191F336D0AF3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontconfig.properties.src

Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
Size 18.6MB
SHA256 20908644a04440e28268a5ff2810043c0564738a6872a4f86bae1be64e95f2ea
MD5 771b38f319c5803b66fb65a7dff25cd5
SHA1 e3e65351bbf8647d206c99ee8813474b931a241f
SHA512 6b1a47d409b312d806c2070a617060f72193b8d8531b91aba131eb4bd14ac8b658018def854d3e34070347fa7d3e471ac2a9d465f80d5200b354b6f50f6d25c4
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCT:2cD2cDFcD2cD+
TLSH
T10917AE17F6A444F5D17A99304AA59332EB72BC110B3197CB83A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
Size 18.6MB
SHA256 8e47835887e2cd0131db1a9e7102c7fd7531b1e24fb678b5b9eb66af00023d29
MD5 a8cdc0a8ab877bcd50eb72721c3cfe24
SHA1 24f10f42771df0c3e62445caebc479ec1759ac21
SHA512 135a5be798c794e31dc41b9cbbdf0f94d5eadd5652672018d5e312756e45c7f026d42c6a62b90a8d03393f60a16f173ecd5d824b1fbc02cbdb974d44261ff122
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC0:2cD2cDFcD2cDx
TLSH
T17317AE17F6A444F5D17A99304AA59332EB72BC110B3197CB83A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
Size 18.6MB
SHA256 599727c3ddac69fa8884c416f75ce64827ec14af0414ed025037ad2dfcd4afde
MD5 e9d896807afb927f66789dd5c4c2d240
SHA1 1c299c90788c27b0371b736e3adf94df06bcb2a9
SHA512 1af346d1d260b45561c56ecded145db3d6aee4c252a92636a926f8e8944c8d097cf03e18fff02b76d22547f11a5483acfdcdfb2f13184988c5b727287894c9fd
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCZ:2cD2cDFcD2cDc
TLSH
T17917AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jre-1.8\bin\java.exe
Size 18.8MB
SHA256 6219f558319270eec68c44abd2dde8171e2c5e557e271e30a048fa3df51bfb66
MD5 dc2443b0fdc374bbd03bb3a2719e0ec3
SHA1 95fe80c0f925b27e2c38951657e548df59bda99f
SHA512 8ebb8e5b672985bce552a83cd5babafcb172cb74a1b39cea80c525d9b3c9f2a2cba2246f9bdeeabb6f0569c274837283ef55c49692290ba99ce32a7a69bf6e27
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCBf7:2cD2cDFcD2cDyz
TLSH
T18517AE17F6A444F5D17A99308A659332EB72BC110B3097CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
Size 9.4MB
SHA256 65cda0b08a2e27010dcd8a772a486b93679109f9e557f9fcb199f5ad536a01ba
MD5 c3592eca0e49472e05060e76a706fe82
SHA1 df60b3e8adc74310de7538b8dd7fde027ab94a44
SHA512 3d1fabba363be83ba84b6ebfb64ef15996b56a6d77ad4f7c310d923efdf765bddd4c05f2b98753c88555894335317bf79e2e95743cf5111fe32d1c1ff1ef5cc5
SSDEEP 98304:+e5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbCf:l8Vb618U68Vbb8Vb618U68VbCf
TLSH
T17BA6AE13F6A444F5D17A99304AA59332EB72BC110B3197CF93A4F6191F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 18.8MB
SHA256 c6e1251de2976b8ccf511e6b02aabc72a3e179eb03b134989efd4cc8ad103a8e
MD5 4e3250b3241af148a9df4cf910a83b5b
SHA1 282234e7b911bf0fb6951edd041298fe60bc1f60
SHA512 aee435c997b2c6757f28b0b772580083bfd46ecca91ee9fb8e8f17b8f97a29aec80e45dd73dddeea4c71ab62af8f4418a1b971840d117341545ba93c4b8ffede
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCste:2cD2cDFcD2cD70
TLSH
T1D417AE17F6A444F5D17A99308A659332EB72BC110B3097CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
Size 18.6MB
SHA256 011d74fe3454e3a533534233ec4c68efa75d4dd9ddc4e782a8ce84380e451470
MD5 7f8b1dcd06c4b202313dfcbfae3da3ec
SHA1 ca252500044844f6996d010ea4422dfe2a73b32f
SHA512 0b5583dd333a77744f0b9bfd9d6e396f9b42e8f8a73dbd7913937f7f0d6cecd3f5e10db433c6a4a296ae540beeb678afa0bc786376814a8383dd9420cec9ca8c
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCc:2cD2cDFcD2cDl
TLSH
T1E117AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
Size 18.7MB
SHA256 03519bd5284f49fe193d1876bfded3825fe6e4b75d0e5774b9324f8c8677c8ce
MD5 bebcba78c6f7bc02a175f0d766b9a221
SHA1 0fe4b6eec7d528beccf950cca686ea829cca1f5a
SHA512 7d2cb9062097709976ac7438c421918e7f63775b025a85611b5f40ef249f59ad41e26d899efb2ea478d812c771afe1e26475232b33a9ad4ef950fa7be9c38dfc
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCn:2cD2cDFcD2cDG
TLSH
T16817AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
Size 18.6MB
SHA256 430bdb865643d41787cbd1ec337cc75d168ca3bf39ebb0bba87e190cfe7bacc7
MD5 ae6e74668d282c44ddd5c3dd96861987
SHA1 727a41ac438ae82182b6a06e1a81d918e32fbb5f
SHA512 fc3722d28937caae5f37b8a6d56814c8cbdb1f838c5760345889147895ed795f7dfaa6ed30eec44616b28aaf049f4ed7f63bb9b96af1ab59753285452f6b61f9
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCg:2cD2cDFcD2cDh
TLSH
T18317AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
Size 18.6MB
SHA256 2af9d8f1bb54ae4551be6d45f0a09fa8eefef6f6ffc71f46085e70fbb9a52319
MD5 04dfa106e392f91227041c8bd8e0099c
SHA1 4a1bcd7d0f43f70d680a78f81daafbf0c748950d
SHA512 f1e974dbf72550cfa93654d20114bdd0f0f047e5d1ae7d1550285941d23e680729cd33323471eff63974e3eedc2ef94741653c02dd98e2b7cf1d1ed1e9c29e6b
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCj:2cD2cDFcD2cDm
TLSH
T12C17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jre-1.8\bin\klist.exe
Size 18.6MB
SHA256 49a30f897bcb306a3f2402eceb5cf33ee445580db0a0b38bdf421d96ce1953b4
MD5 7408526990957f9907473c164fbbd6e7
SHA1 21a39878a21acc10a2fec9b45af13f7e101e8e77
SHA512 1b652fd3d7bc55dc9344a5f8e65bd5e88c3b91a5241a9deba3704e00e64b098fba532d862069d2edbeae6aa296e506668a272c7c84bf06e2d422efbfb8275da6
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCT:2cD2cDFcD2cDu
TLSH
T19717AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
Size 18.6MB
SHA256 4818b6b4454f7421d41a5bbde89c382ff1d4bd6dc61ecdbf8fae3c0e4f8613fa
MD5 3b2208ac5a14e0d516a8f2fa6981ae49
SHA1 1302ac0ba346e0d588b0a37752baec4f8b654683
SHA512 ba1ddaf0ab0e2ab4e3e4b46342272dd7a454f8e30a81cc689512cc426e1ac969f564f7279dcb7cfe2e13217bfd0c11fcfcd279125b3841bf0b0c054ead4bb495
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCj:2cD2cDFcD2cDS
TLSH
T1DD17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
Size 18.6MB
SHA256 239c8bf15c9bcd563a03d0d5a31ac4a597294438b5a98ecbe770cf5abb77639e
MD5 7dc6c7cbbee9142b9aabbc6ec71b8d33
SHA1 0c540ca1d18a8b751be7f4799f7291d540d3319c
SHA512 90231f0e0337ef934f33663fbaceeb546f31e35bb0739e73278a2a73ace915e388a04ebe98acb658c48c3a13281cf62d50cfdabd269da80b99740cb0ab5ede9e
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbC9:2cD2cDFcD2cD0
TLSH
T13C17AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
Size 18.6MB
SHA256 cec035481ec7226db420364472d7b4885799a5adf3fb8c374d8a8b09479ff9c1
MD5 2864d9dd6032abc0d553ac083ad9d5c4
SHA1 77c1a54f2841d5c94360a7f0188c1b3b7a8b28b6
SHA512 559ed9b614704fd31de36141cd570cc62204f820bc127a20c3f8fcdec8210538c7fba0b4ad0e19c55121283acc0275857989becef2c354ad4f4c5203129094d7
SSDEEP 196608:l8Vb618U68Vbb8Vb618U68VbCv8Vb618U68Vbb8Vb618U68VbCz/:2cD2cDFcD2cD4/
TLSH
T1C517AE13F6A444F5D17A99304AA59332EB72BC110B3197CB93A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spo0lve.exe

Path C:\windows\SysWOW64\drivers\spo0lve.exe
Size 9.3MB
SHA256 0f2aeeaa547c3f23f9ac1512e2b4a5aa888959a10a0be7f0082184d0c6759ec7
MD5 0148465aabe42f33f9598bdfb50578f9
SHA1 b2998026d0c75e9a6ef7d6b38adc57e3f1a2f5ee
SHA512 e1ff8586deae0c226f72f4bb3191e6016bc16c6909e3f7cd11ea2778fbf5a4cf000585a7ae5de1b8d40be2a2a48070632b296f4f736c471361e643f00e724f77
SSDEEP 98304:te5x6c1QVb6nUm8Ule5x6c1QVb4e5x6c1QVb6nUm8Ule5x6c1QVbC:i8Vb618U68Vbb8Vb618U68VbC
TLSH
T14FA6AE17F6A444F5D17A99304AA59332EB72BC110B3197CB83A4F61D1F336D0AE3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download