2443b8da23c3cbb33923cedfc86462d13db980c6a2567a1390566f5d370446d7

Analysis

max time kernel
77s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 22.5MB
Sample260730-dxfblacj8x
SHA256 2443b8da23c3cbb33923cedfc86462d13db980c6a2567a1390566f5d370446d7
MD5 692e06b0ee6ddf6e145feb4e44bad36e
SHA1 62d73a46b13514631d71753c8cbc1481e16f65e8
SHA512 dfcb0b36a6b755026451ad3d833dd9d1e0708aaca532f3f85c8daf6aa439d27e4232aafbe6e94b8e7c0f807460b5c575de3ca7c845d008650576c7d595797526
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+V:hGqG9
TLSH
T140377C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\HideMount.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5080	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3840	2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5080

C:\Users\Admin\AppData\Local\Temp\2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-30_692e06b0ee6ddf6e145feb4e44bad36e_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 23.2MB
SHA256 61b2c2acd25285516fb59d26414f12116b005e5a000cbb725866e77af5901607
MD5 e01baca92443205d4d740c215661bba7
SHA1 9253851e7cddd17fcd2d09ee15372b43825f4f02
SHA512 f1066a51b8fd820436ea3da53489659a8133f45d6d2926b2a7cf810e050acc1925e3849d5f4af4f876fc121c0ad7f2b43f5603283b2cf74b15847e3afae46b3d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+t:hGqG
TLSH
T166377C55F6A481B1D0B6C174C6D6A77AFA327C415B308BCB5386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 22.6MB
SHA256 5d11db42f1262b7b2e689791909a8b106442512470cdb2ca50c75d44191a20e2
MD5 48c517d72ec6791c0f5cea732e77e729
SHA1 6213fc14006e0493880ccaf97761095e5dfaa739
SHA512 e14577d4288153a09d228f7597e4dab232ba11c7732570d1925cc057303274a4b3d51f4224e38ea52fb2e94c5224892380383f81b8e7f429b2c56adcfd9e717f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+a:hGqGi
TLSH
T19A377C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 51.0MB
SHA256 3abeb5efe445bb99458dc851f5b3f3b6160f5de298ae54e318e39f3faf151359
MD5 c423519c4832b411e2d6d2b086ea9b6c
SHA1 f852881a9d3d0c7e42d31d2375d5161745d07169
SHA512 77ee60d9f9e7bbb87eb4508ef9dfb51f0d8b9684fe38bf167b4b1d1177b523e96be06625bf999cb660284b2571a478df995260f6cb7427e37718c43ad2aa8497
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+D:hGqGTGqGIQsas+PS
TLSH
T17CC78D52F2A481B1D0B6C574C6A69776FA327C414B308BCB5385DB6D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 46.7MB
SHA256 01e4e4eab59d7e39a840b8f24fde7a68d5f28e20421575c488c96d0644f38373
MD5 b6210c323b6b30c6a74f8713bb67fea2
SHA1 a263c80da611d0493aaafc750fe6223b0ae2def4
SHA512 3203b0cba96f6b0b8b93174789a244c940054f2f4be1238541373ea0c336231460aabe13bef66ec158912f419352c59b913b939de11c848171c45e503030d11b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+N:hGqGTGqGM/
TLSH
T17CB77C51F6A481B1D0B6C174C6969776FA727C414B308BCB9386DB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 48.4MB
SHA256 47de14e4012ca8dc609800140630173f599c5a492cb661a608a23098de0afb24
MD5 bd153c0caba43d712586fbc68173f159
SHA1 afd1d92ac97191cd26f6751933d3a70fa53e1ba6
SHA512 e724b9e90d2505b57015cb4eaff2e68c07d34959b2eae69a6c98739aa5a3e503750db273bf672d30d275cdf48257abfb1ebcd066de012ce32303752ddb6f337f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+1:hGqGTGqGC+6
TLSH
T143B77C52F6A481B1D0B6C174C6969776FA327C414B308BCB5386DB2D2F336D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 47.2MB
SHA256 aaa693825fd64b95e39b9fd3cfb57effacc61ae33346f5467778fd72e0696890
MD5 fd002108d343db0a6658ea8a45d06226
SHA1 9f5ec7d3cab46f3499e63ac9d1428133e364db82
SHA512 1b2aa18588826e3f37fea347be5e74a6a479851784c33ce0bf471c7da5732d1316b2f5fbedcaf77459ea7c5e292463343df31ba415778409f1274c14663ddf33
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+N:hGqGTGqG8l0G
TLSH
T157B77C51F6A481B1D0B6C174C696A776FA327C415B308BCB5386DB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 46.6MB
SHA256 4612196d63a7e2098c37c87028a0f09d7f62923eca1b06e099dc484fbcd1f13a
MD5 de47fcb1374c77faba23eea5dbf085e9
SHA1 f15e33aaea468f382c6ef930ce8680ba9b1bfb52
SHA512 14fb914b0a467d71e7f056d108ac1905a38054f0cf83372822607625e946a108c03ecf216f902e8cd1d927d4f973d005aee8e61680c4f62f1f4a1bdc39d91b10
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+e:hGqGTGqGzf
TLSH
T1C0B77C51F6A481B1D0B6C174C696A77AFA327C411B308BCB5386DB2D2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 46.8MB
SHA256 ca5a5fab9e387606cfd78d640373d10c4803a156e0ccfa74e1f91e603930155f
MD5 050478ebac2b440cb8e823e9f710ddca
SHA1 307710477a2dd406537ba22674939b3de189f200
SHA512 b059cb1cf9dc9dae3f10e15bc5dff0d98381abfe2455f4634475a4fffdc46709ca74cd1693d08b86500f11d5c218ea7016d84f53762fe6e8d2ff5d596b936d5b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+S:hGqGTGqGdC16
TLSH
T1BCB77C51F6A481B1D0B6C174C6D6A77AFA327C415B308BCB5386DB2D2E336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 48.0MB
SHA256 6b396ec5ec7cb8dfbe80e15175dda8147438e1eed2203cfc9770cc3c9f56e1b8
MD5 35c98e53a0214ab65a09bdfe879e9c6f
SHA1 554b86e606f20ee6fa42f0a7f588bc50eb6f1e8c
SHA512 73482804c1c19a5cead37343e72c6d217fd82f0c2d01e0754a8b289fb01f17d98dc759e8a2c266255747144f771ee83a0a5f1f8705dc732f8d6f2b19584f3466
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+r:hGqGTGqGfO
TLSH
T1E9B77C51F6A481B1D0B6C174C696A776FA327C414B308BCB5386DB2D2F336D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 46.4MB
SHA256 23bd3f8602c1470e2764df9087dd65946f9d56e8f8bd031e8a6ad878d7855afb
MD5 00f22b66a120fa165d045f1568d672c7
SHA1 2060a04326bfac2eaa34d663860159fac7270e79
SHA512 e6f7c21a9c3025d0ffec1edd2af5e8c875c427edf851c89c751c4ea2d12691e49e1507cf23db647479a1ca9f1fe0718535b3a30849dc70c4cdef53180d0202c3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+N:hGqGTGqGP0
TLSH
T196B77C51F6A481B1D0B6C174C6D6A77AFA327C415B308BCB5386DB2D2E336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideMount.exe

Path C:\Program Files\HideMount.exe
Size 45.2MB
SHA256 a75164cb6c24d773f22935ee9f9db3ce281005797658c6e7e65ee49c4cab07fd
MD5 db67beaaa6339f0c1d674ae956a52853
SHA1 9939be3015a14ae82d69e3e4e0e9c5366ad081b7
SHA512 6ece48acf4b91e6d01ee89f74e5c807aecd1f5d3efcdbabaae72854844ab9ca82d3b476db7d6f7496a57777f0813cd1281355501aa05762b4cd0c8c05bf0444c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+J:hGqGTGqGe
TLSH
T146A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 45.0MB
SHA256 c75e1a53e2d775a12790fa033dc50e4eab3942f038b7cbe42674cd01b28d7771
MD5 ca4ad41d632a973535f5c5f01c689e67
SHA1 83043a76a300d33bc86123a363cf663fc62cc0eb
SHA512 ca07c0dbe208282506c0cff1cd0e0aa9f1cda0fc207f56f3a9d62f9d422334ebc269d0837196f22f919c5fd8daffbca832cc71b37e49adc882451c9ba11e38a0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+x:hGqGTGqGY
TLSH
T192A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 45.0MB
SHA256 fbf7bd9e259199b261f9b8135daa8c76cc3f2c2cb67e9596a84d8dc32b60a84b
MD5 83b4ce1d9c28ef1c02172c9f1555cb3b
SHA1 6bc14b5498bbd7ae2b8d8f56bd34cdb8f6f70a36
SHA512 109cc7e9e5bde1c2d31496350ae9569abf7c4ce81f8460dda816ed8b22535bf23c31dd2f31377c3b1f7bc109ca12698c226ecda0ddca58d81ef390c483402f9a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+t:hGqGTGqGw
TLSH
T145A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 45.0MB
SHA256 22e8c1c7b89ef85e8d8520e8e64f5e1c4128c2ec979b8207f3d4cd32609d489c
MD5 4c2318ac3e7d1fa977edbd9ad9af2551
SHA1 07b45c01f164476e1c29a5784ac6c582eb74a055
SHA512 5db5cbe61dd6281228d151ed926429c6ea78f5e26ac2ebfa1ed51784b384de91d28ed2bd8561e4eb374a689d4a84dc372442e5e07352760661e19e905e5061f7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+G:hGqGTGqGD
TLSH
T193A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 45.0MB
SHA256 64eb537c9539c6f8cc3936084e4fd4de6a502ea68ecaf0027c0d4bcc55d7d7e4
MD5 ddcda207fbd8190c7ec4e517af339de7
SHA1 4cfada41e64e6ad08f3abc5d4f72a56e42cb9869
SHA512 c72760b4056c62bd9c2fb4d2e9ff8aae845973e824b1a84586c09babf43bc13099c6732f76db56d5453e3ed94e71ef0cbf9befc4bcb547b11ba69a2dba34ea0d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+b:hGqGTGqG6
TLSH
T1A2A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 45.0MB
SHA256 3e409d23e10913c5f66130e13187606f6881803a133470c13cea4af90e0cc61f
MD5 3c3c33dddd8b0a85c2de4eef630fbe26
SHA1 a22c8dba6ca0fc243f4c641346ae0e7006b0847f
SHA512 29deb877499a0eb5d6e7fdab6bd16dabbe2bfd639f8825cd8ac26c99db182a5724f07cd3068a0af4ba61eee36c572857ae1d6f327fc1d3438f700f4bbe920e78
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+2:hGqGTGqGX
TLSH
T1A6A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 45.0MB
SHA256 a39987cdcd28ec957aed9f0825c7765111f0c0ad503c55172d6ab7bedff43844
MD5 15043c49f72bd669d0847263e3720d85
SHA1 22d47ea8e756182e5196f0b8d814ee1ebaac1619
SHA512 db1b94a441ee50b447c6fe066384701f795cf8dd8a77503c0871428afc8d361c06c34d2c1c1d538052fc3f51ac623fb24b407cc07007270ac6d060c622490b8a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+R:hGqGTGqGQ
TLSH
T1DDA77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 45.0MB
SHA256 9b303e15a8a628829cf8f7d86d5e5d5a522ce2488c5e742a3b2f5d389c3c7364
MD5 62c79fada19e19652fbeadab49d2a962
SHA1 ac56debd418a5c166a6c2921544f670968f2b9c5
SHA512 569a2f2380c218b54af4f78d02560231955a2b0bf75fa0ee0888e1f237df85295f6a08d72ef5390bce9af6ead41cdc72223d09007a2f2e63c95cc320042940b1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+u:hGqGTGqGr
TLSH
T170A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 45.2MB
SHA256 9fa390ee9b9332b4bc235f298b0a42091c6cdc59cf8b9dfc805f8d788cf59762
MD5 d4465ea516701624417d5e08f9c1f175
SHA1 2a10664da87e728471e76ff9441561ee58dc67da
SHA512 eae8d43e1f9210148364e620596fd146e2c50724a1b34312d47e5172993d81c05fef8755a49b499bf6a7f66041bfc28054abc947b37d5a1fafc983c2d8a92686
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+E:hGqGTGqGam
TLSH
T1FBA77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 45.0MB
SHA256 70555bf1d8326fedaf4bb2ab54ba55e6a8cedd0840537eb594a6e6c175926c40
MD5 11f2d0eba637a7c93780b4176444d9eb
SHA1 73511494bca8fb73931f7ef3cf6d66c4e9e97ab5
SHA512 3f632a055c10411df13790b9b19893f3d7caded27a3672d9e40e0abfb1d9347746c3d9f8c0e66c2674591d3d760f48f7e361642ca7e35a0e2a49663683fbb5c0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+v:hGqGTGqGW
TLSH
T113A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 45.0MB
SHA256 5ea41b5c64b5f12484e240a83c7c09946a1be268c0e10ae4bea60c565a0933c9
MD5 ed82e0094cb6b97b8fcb49f8730413a9
SHA1 20de5a60fa705ff60ad3eeab75327e4ad0df8783
SHA512 f801688bc0ff547d65ccc5ae3d6addeabf0654b4a79a4ad2e0ebe721c9580cc09fa30b22324a9a5917e945af8fcf1f792317322925546bfd25c1158307bf5299
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+r:hGqGTGqGq
TLSH
T1BBA77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 45.1MB
SHA256 2a0c5191e1370af8fef8d836b1b6c1c434ba074345288236a1961bcee0c4849b
MD5 e2d3425aaf42e0d9f54ea4290318e7dd
SHA1 6080cb63784dba48d65c31efad42e48d503930e0
SHA512 5450fa8b7fb115c175be78021b310068c9457eb2365b93ca043de65ef8595d2558c9049ed8d15ffc0524de79f94b978e8c670c4ab365abbdedd0518eb3c99adc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+z:hGqGTGqGG
TLSH
T126A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 45.0MB
SHA256 f82960f87bfae32101d9b07c8cb7df8c5bc3eb5454db274482150e5f3f5a5ade
MD5 c7f3899dbfb49acc6da7f38060c2fa6c
SHA1 b01c4185f5403c2b6ef07f1b58325e07974dee18
SHA512 2eb6a685d2eedab12325c93b2e9fe939a7fb425922569cd9176dfc9d7d7e08502f493d853cd3a73a13b160f18f64285133243a41f81663580e3a76bc38f0441f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+6:hGqGTGqGz
TLSH
T18BA77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 45.0MB
SHA256 40a3ec336d77d025be73b4a4487d8440665a2efdc58b670de58c347d9b32fd91
MD5 618f23ef1bdd9e73f2251f2a6dd464c3
SHA1 bce1266abc311f2392253db7e27dc72f5d2ca6b9
SHA512 6e377d0d26666856b8bcdf1de1bc4cd8991720d155e1dc75e60833c4f3e058a64fa6047d871d6163035c7df58280349135fd76dbbea94247378bfd2c77433a55
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+U:hGqGTGqGl
TLSH
T1A2A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 45.1MB
SHA256 14fedd974bec55daf1655aa3271352410d4f9bda6ccb4a910b8d970147099c23
MD5 3868dc7b82d7736fed108b1b166be9ab
SHA1 536b2b3b808bdd76233a9fc847d2a9fc3575eea4
SHA512 130da0e30445e567c4306d5b7256da3d5e955d9b20caa0d0657f7f29a11c080c9da91786dd55cb3518f7386504b81ddfee9c13286f3a4fe1ed89026deab8ae6b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+r:hGqGTGqGW
TLSH
T197A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 38.2MB
SHA256 8d0729b1e47e9d57116f59bc593a47fe2e799ca454dc6d3d31a57b5ddbe13261
MD5 3c0aa14f6959b3971b2dc12a4d5652b5
SHA1 fe18db5a69c702b48c2164f9e6c6b425d0b3fbd1
SHA512 9fc6a0dfeb185a08682c9896fb4c4b0f2f0478402fa5f37b314509fc59aaed06d1c768953472501d0339659845052eddb2a2d6beb30b3ed9eb685388dd89f671
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+w:hGqGTGf
TLSH
T158977C51F5A481B1D1B68174C6D6A77AFA327C415B308BCB9386CB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 38.6MB
SHA256 9f07c9402542c64a6c3ee92fcd16f6f4c7529a8a616b5b4227f234312e5d4081
MD5 3f7c4bc699151047f7540278ac87761f
SHA1 37316931fcc19998c46a7abde8459b72837deca8
SHA512 98cba74562180e3b16aeb9d5b2e06888b5883c73d56c9a191c588fc51c1402c6e2fc8337a2553d6d79cd9eaf1b50333439a924aadfa2b5894494d4e951171023
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+L:hGqGTGE
TLSH
T17C977C51F5A481B1D1B68170C6D6A77AFA327C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 37.3MB
SHA256 7b3697a60ec3e600fa9943a35803f2595dd4f2094a9420648df39f1a46b0bb3a
MD5 5a9b292eb8b716942139b6aa01a02ce4
SHA1 8d11818d5fbf6b92544dee93226c728342f75487
SHA512 3e058144e0fefa62c2de9804e0912408b4c81e2a11fde74fe71bafdf776a1d2ee16facf122930039264d80ed2e0f6623d8bc5c5b8d5dd9cfccd02a0c6bdb943d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+B:hGqGTG2
TLSH
T13D877C51F5A481B1D1B68170C6D6A77AFA327C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 38.0MB
SHA256 c792d444fc718457d1628049891551e7c980b80ef3bf0ab8a5820358a26ba735
MD5 d60547e9d30234d19122b78ee0f8273f
SHA1 add2b8a60bcf8bb2c9d89b60dee93ec4a23f9fe8
SHA512 4c0953b750ef24d5d300e71bc0896ab49fd511a714e6877d036419b91172f2fe9b488ee663b0d14bfc8fa911ee8be3e108b186ebe8bc3f3fd1a9bdede2561301
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+i:hGqGTGR
TLSH
T1DF977C51F5A481B1D1B68570C6D6A77AFA327C415B308BCB9386CB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 37.9MB
SHA256 9fa4e904875944269053ecf521ee32d42b6b613d7c31c74bc6c77e0c0bed925c
MD5 03090e23d56340700cbd27726cc08f9d
SHA1 165d1c87f900fbe390a161d8654cc05fb82b66df
SHA512 dc603caff38e21368f636ba39c2bc6aaac9df1d8421cbde51e537b5df8da43c7ab6d0d4f8f43158adbe9ae5295711a271c589fa139f4b74efdb098e5d1160855
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+0:hGqGTGv
TLSH
T1EF977C51F5A481B1D1B68570C6D6A77AFA327C411B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 38.9MB
SHA256 19b283ff836612aaef9775ce797dec623613a434ffb873b6cd6d58ddaa30c608
MD5 962e26907125eb4f15b6fb86b2be078e
SHA1 b9f86b594d3880033cbbca53341c33c5ce067af8
SHA512 7e75e9ccec2e8165ad41a410fb6b24aedfa6cd94d07277b9fb0c018ddfc1ac4cf24ffd36d282ee4a22a2e82720dd4857c042e1fa7e041e565d219e7cac93f77c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+z:hGqGTG0
TLSH
T14A977C51F5A481B1D1B68170C6D6A77AFA327C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 38.4MB
SHA256 d0adf13cde723c6456138d1714f529e9796c9302dc6c188099cc4e667b5c484c
MD5 19438c573e13c470cca215e609039b2d
SHA1 b6b4517f3673940857d72b29018e0c77ece01524
SHA512 c1083b6fbdbd19b366f41500cdc761390c3b325a12e36ac80552d3c8d97f33c45a41544ce0d052d4d80312b9b34ef253174b1e625aebb80fa627a93a01eac855
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Q:hGqGTGb
TLSH
T147977C51F5A481B1D1B68174C6D6A77AFA327C415B308BCB9386CB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 37.1MB
SHA256 0cdc037fc9d61f1a5bb7ebd6022dc6ca5580c038d02f7083326e8a3f547e9fc1
MD5 513623eb5dd2864def7ea42746db3da5
SHA1 cdf82e35e35b5894f48db1e42163c74c8071a75b
SHA512 3a780bfff5d7fad0e5504db9515a706f608927f8e706daf473dbf190517f50b913b351ffec670184d77c24c36ce139b19f5ea858454ddeddcfcfe121534fc25d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+p:hGqGTG+
TLSH
T1DA877C51F5A481B1D1B68170C6D6A77AFA327C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 37.0MB
SHA256 02ec559cd53b7dc5178dab0b8befc214fed0e16cd0f3041381dccaeb688ef901
MD5 e600562cff866274d58cbdb65a3fbb2d
SHA1 eea031989beec0533bc35c8f8da79dfd40f94ebd
SHA512 b8f918eb0b54362a3b93647fc9972dd65c011c44c726168bf40585dd19c84cc8154c10062b7d90839e96119523b201405339b8b06455e6be424fd6e62ce0fd3b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+2:hGqGTG
TLSH
T169877C51F5A481B1D1B68170C6D6A77AFA327C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 37.6MB
SHA256 51a160970d15cc806abf99fff9695abdd9a40093bac7752192f3569f94d74b99
MD5 4c24acad3fcbba1fa9ae60b3e2e63c54
SHA1 8e49e6fd9699ff588c5999c56ce3c101d006ee9e
SHA512 62a3423d435885150a62192348ff61be541cc3e70a0a91b879d97324e4f7bffef14f957b38e52d711b58a5160d0573d73d1d2df809466d9ae1c09193c449a803
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+K:hGqGTGV
TLSH
T1B1877C51F5A481B1D1B68170C6D6A77AFA327C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 36.6MB
SHA256 424223d5e1b25acc1176bc98ab1d5549f4d3144e095a915c125d559e31decc98
MD5 574252504ac5d0348da8bc2e5f1f8234
SHA1 8e65fcaf80d52f0e11f4550d66e0ca3aec288779
SHA512 adc2bdb2f7e56eacfa5a51a6619ab6fc5fc318c2dca2c39bd8e0840ec8dd70228af9a39d6b23d455335ddb693d6d776f773eedf92264ebaf07cfee0eec822119
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+l:hGqGTGe
TLSH
T10B877C51F6A481B1D1B6C174C5D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 37.5MB
SHA256 d7f2d65bd4cf85af11fb4d3ca535705cb9e4ed2fde5eaca147b06b4533237df3
MD5 87a0b5fe5fdebb4bf6be37fa1e2e35f1
SHA1 af35622011028dc552d9a045b27ff30f82167c84
SHA512 295928043a177ac399a2e55a016d865644c2f146a83671922b7f9eea6197566aa87418c144dcdb794526902e4b988918fcd2ed86e3650461ffa0bf8c7e15af61
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+m:hGqGTG9
TLSH
T1A4877C51F5A481B1D1B68170C6D6A77AFA327C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 32.9MB
SHA256 c6f54d238eb1175f11937d39f51b4eec034c37b2106d08f0086135bebd231937
MD5 d7f2ef5527fa6725c431e42a1d1fdd6e
SHA1 98df92a8283008c7e009f247caff9de9c1103d7b
SHA512 21b9b889349800e3687a748c2633b28d561edfe06ef18ff82efc58d09f1fd89f0aa5a638f9eaec7169afc1fc1c60f85500b20f166770584eef4dd36b52796ab9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+M:hGqGTA
TLSH
T1FA776B51F5A481B1D1B6C174C6D6A77AFA327C411B308BCB9386CB2D2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 33.9MB
SHA256 d6d08b96189a42aed10002ddf173868fdcac326cb2ab5e679d5d9ea3f9eff599
MD5 338b2bae6dafb79700854136f547326e
SHA1 8c6ff86f42c06b54cf4fc727538290c806ee6ee7
SHA512 e57437a2ab1c75f2fe27f9f887f9202cd5fe3682ee48f9077ef151930d6e3367020dacab450680e40df76401b1a899b6797e2482171232923071f0e15c158ec6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+v:hGqGTG0
TLSH
T138777C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 32.8MB
SHA256 ef58ceca0bc87f12de4aa81610e9a568a32b1612fa716a25b4a006686c5ff0d7
MD5 ff6b8d707190cd297d99ce0ef2edc735
SHA1 9a18a02ca4beb5e954a31c204cea3a7e7b86e074
SHA512 eb60311dc2866994b209203ca711641392e525240ee609a8b49c5cf890c37ac73398a4f3e31d9f0fd8d0051e0eb9440e5e3b922664d0d9629a286d6e96f7683f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+A:hGqGTk
TLSH
T19C776B51F5A481B1D1B6C074C6D6A77AFA327C411B308BCB9386CB2D2E376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 33.7MB
SHA256 084a691b406ad1d24d3073e825debbcaa8aa22cde617bece7be6ce223e7fe191
MD5 d4498582829590b3703579f8e698a069
SHA1 645f1ebee73488be7038d64124fe237a71a80695
SHA512 7ecc4d94fc2b866604ca5e711b5d5fb42806f692ec0a5de42580d7b6fbc1d805ecea3d197ce3ccd973340ff4553bdda989b56972a0f2a72b175dfd8979ba8ff0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+A:hGqGTGz
TLSH
T1DD777C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 31.6MB
SHA256 5b5e8275eb43248baa35d45ea6a796d3d304ed745f5a1e43ea372bd6fc80ba76
MD5 f62c3238b2056b2ccec9d0841d199bb9
SHA1 21e6e96ec4a7b3a74031305ea04b980e5e56a08c
SHA512 1715d67fa9c95124b15be1d8fe26a5a8f52a8feff6627db84b2eddc7fa253cd9951cf4881e97f1d808b30ec7e9345ae8b50fd2cb8b7d2247c85157c13b37152d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+k:hGqGc
TLSH
T174776B51F5A081B1D1B68470C6D6A77AFA327C415B308BCB9386DB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 30.7MB
SHA256 abd3d97931e2814a72b4bee67d429431582bcd3edb075625359ddab4ff73da88
MD5 402fcdc67de0ea7b20dc9baae033e2a4
SHA1 21b5730d049a3828a05cce29902c1b0189c69e0b
SHA512 a650eb857e6da2d4de5d8031df427447eaac242dbad60905d0e013d77dd23e5ac84bcbc9b20fe0486ceb8dfeff622327dc0f4dc493974364947caec0c93a052e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+v:hGqG3
TLSH
T1BC676B51F5A481B1D1B68470C6D6A77AFA327C411B308BCB9386DB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 31.7MB
SHA256 5c368cb8198005b6aa27458a406aae536e3759ec38b7fb30bc6fde3c55953ba4
MD5 9392e1c5633031a58ec03f4953404da4
SHA1 4d4ad1d68dca025577187b88cf0923e9de51244f
SHA512 a958492d8ba6c4a8321ef543a4a1f93812d9b2ee6639d20f88618040901d21a75318dec20c6a1b423d6656b0d4cc9afc68fba97b80fea56ae3369d45b86cdd3f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+K:hGqGTm
TLSH
T1AF776B51F5A081B1D1B68470C6D6A77AFA327C415B308BCB9386DB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 45.1MB
SHA256 badce9ec5055518ab3a4c029055cb769e0c5d5d4543d64fd8c103435649a8482
MD5 a37156693dc017b6246f3094fee66101
SHA1 8c5a2e45123b878236f50fd4f6d136eb0bd1ef87
SHA512 6e279e412e888a8054a85ff4127357fab44512ec1a799b25080c89202ef31a92d629f844c5a2460bb4478f9022ef5225ab167d0d1e7494bfe7d6c550c439f15c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+9:hGqGTGqGE
TLSH
T176A77C51F5A481B1D1B68174C696A77AFA337C415B308BCB9386CB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 45.0MB
SHA256 5579886698f3e5dbf930cf586bedd6897f94193c80ab0711ee1c54dfa349ca22
MD5 db4bebe9fdb5a042a65ea436d4fbf012
SHA1 815b4e22b4758e3c247a7ac9b5ab5ed761b39d56
SHA512 1246fd84cc5b25345d36facaa907495d4dea107a2822dd6ded827594714d9b1d867212dd7db351399ba6042696ab988c6c0827b315aa348ec4dbc070af6c633c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+R:hGqGTGqGU
TLSH
T1FCA77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 45.0MB
SHA256 dee09928a1dc1d08b67ff497f476621c3cad8f7c76b33bf43520cd89c0ac111b
MD5 fa917a650e3ec76b32d794fe943e37ca
SHA1 85d9b2c2628a52123e0569201d4697c40448ccee
SHA512 82394e5b436d3719f9c506c714da229b78ae66ccb6864bc745d6e14fafecbf2fa6f143a8405b03694f7674baf79c89bedcf01ac8c29d8b16219ac3bfd2f0bd82
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+/:hGqGTGqGwj
TLSH
T151A77C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spo0lve.exe

Path C:\windows\SysWOW64\drivers\spo0lve.exe
Size 22.5MB
SHA256 2443b8da23c3cbb33923cedfc86462d13db980c6a2567a1390566f5d370446d7
MD5 692e06b0ee6ddf6e145feb4e44bad36e
SHA1 62d73a46b13514631d71753c8cbc1481e16f65e8
SHA512 dfcb0b36a6b755026451ad3d833dd9d1e0708aaca532f3f85c8daf6aa439d27e4232aafbe6e94b8e7c0f807460b5c575de3ca7c845d008650576c7d595797526
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+V:hGqG9
TLSH
T140377C51F5A481B1D1B6C174C6D6A77AFA327C415B308BCB9386CB2C2E336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3840-5-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5080-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5080-4-0x0000000000400000-0x00000000004E4000-memory.dmp

Download