dc23d5d9cdf93668f35b6b70cad2c77859f568ac1066555a2ff1c77d23c3d1b2

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 15.3MB
Sample260730-ffc61stscy
SHA256 dc23d5d9cdf93668f35b6b70cad2c77859f568ac1066555a2ff1c77d23c3d1b2
MD5 e4a1a46306e9fbac00ea9307b4123e8d
SHA1 a2c2be800f3446ebd33536e3498ee76e6048c3a6
SHA512 a75e22da55a1a0d60dae5ae02fa02b8e8a9bea505bb43c4578c5454cc86404a4133aef8a0f069bcce2a1c2bb63d8cb4c38f667c87237a647658eb29522962279
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1:o
TLSH
T1DEF65B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2404	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1740	2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2404

C:\Users\Admin\AppData\Local\Temp\2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-30_e4a1a46306e9fbac00ea9307b4123e8d_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 15.9MB
SHA256 c667ac19c41105b2055e66ce03395c48b176d38481b2571dff2da38cb6247295
MD5 01bad5aa53b2ddb0bfe42fd243dc90f9
SHA1 24afa7139976c862705f4201bb0b971722d8b375
SHA512 4f7434a66c5dcaeb65c24e83ccffeae85f3777810d727142489b11bc8eb7f9ae3e75eec2fc7c6f088cb0fec3c2c844f7c2b1458b016f736268ed3b058b47dc9a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1L/h1+:o
TLSH
T1F1F65B51F5A48272D0BA8075C6D6A77AFA3378411B308AC75386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 16.9MB
SHA256 360180e8ddebaf6d9d50444c58994d45d8c01dccb09dcdfe1f1cb51fa261be72
MD5 bd149937c934e6a3b4ec09b65b570f6f
SHA1 99f18911d3a51dac24bb9b8c87a79e97d81d07b0
SHA512 161be66ab1e3608683bbd94e6182f33be8c98c1fa7dbb10619724022fb3f1711008ca15a4585a403a26c08271e82f9410c08fef466fd90ee1912c1d61be727ef
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1yfPf:o5f
TLSH
T1B6075B51F5A48172D07A8075C696A77AFA337C411B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 17.1MB
SHA256 8cc720f23caea85e394651f39d5191559ab126ec0b52f6f08b638b6e4afec78d
MD5 f127a2d6811317f5847bd7ded937dd5c
SHA1 8680e7dfd09a9634a9f80f4e8f35f43a6606a789
SHA512 e57931e9764c9b7999462b84d086062587ff7d2029f900afb24e6d613f08f64e312a503969625802c984b7ed18284b66836d5af3ee077be433cf1a0a4f5c38c7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1/dKC16:oPC16
TLSH
T19B075B51F5A48172D07A8471C696A77AFA337C411B308ACB5386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 18.3MB
SHA256 650e3d46deeb5a58f26a5eb9316a8700ffb7aa4440b1f1d74b9cbc74912ea1a7
MD5 5ac39b7646406b42c1423b74626bec8b
SHA1 8e70bdfc1e84085418778630b6797444f672b649
SHA512 fcd5a4c2b20d94c6818f34034466cc5340418ba1872246973c635588c9fd69c66f074f858b247f4de5f61acbb5c2983dbdb53d257ba3573c6b2d37efcadb5000
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1SjnDO:ohO
TLSH
T15C175B52F5A481B2D07A8075C696A776FA337C410B308ACB5385FB2C2F376D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 64KB
SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
MD5 071d69befc4545d16c8415ee31c5afdc
SHA1 98106920c20562db4df0d21c498f51369d927ad9
SHA512 994fdea351d7be4c5434f4840958dad54941761c7132fb3cdc5aa3821de5c697829bc462ca8428d6341e9076d304a231f945e48f12c618c86ab01045a26eda17
SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0UeG9ODBZHlsP:2sXDsmJDZzgyQsRDptkar4Vyg/B
TLSH
T14D530EF819C0F18AF8D1D571A0C9B33926EACDE5BB5047DB7C172B429EAE4800397D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 30.5MB
SHA256 88c0c2194b67fdaf4640292dba5858afe58a0fe23179a3347e22557e6eb67c92
MD5 8717018a486e28431fa22680e9e6e6c7
SHA1 fed88d283aacad4c95346c31ebde2bf11aa3e1c8
SHA512 2f54c11edf379f1a69a842f9c0d06a4dbb7cb810e4ea8bffc8cc77da32daf61816074f00b4cda989d498501f7b88f7c4fda8fa7f31d34613e5fae5b1e1a70f33
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hi:oUR
TLSH
T174675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 30.6MB
SHA256 7140939b0005335b6c17d963346d3e8a2461dc7c8730089f676e1b2413575ac6
MD5 81b9bc60881bc249c86544d16e3a5ac9
SHA1 1525716cdd53d880d4b730f0730ba9124584b623
SHA512 6e2d2ed7588be557ce3915293aa78154c213a11897361d9fe0fc563d5108df9f7807a15334d367b94ad04f504df6a363ae4e0387d9ba6d83a44bee336b432206
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hf:oUk
TLSH
T127675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 30.5MB
SHA256 f9011e3650a01e59ace35ae802ac953c9474d50bcd90e1e400ba8cea6fb45956
MD5 09364d8bee395928382fe13d60bdd52f
SHA1 542f6b786b933268df590d04df8d448c1c34c716
SHA512 3bfb8079085554ed835f1d351920702f97d803db61d0a8451d39fd6a6408f502abe915e40ae24abe06fa3986ee49392e1fa56a2dd5a17d644c55732926c96c48
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/ha:oUB
TLSH
T11F675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 30.5MB
SHA256 7bf68e7348b7eb5cf8bfc11917fee3cc5a25150494c55e04ee76f7c40286eefe
MD5 0a6186a04675c4e79ffd16d5fc201553
SHA1 d7d4b292ffcbabd39c3b5c010040c57ee74fa16c
SHA512 88e7913c9c970627247dc3c518f779c4a980a6000f210e6db2bfcbea1ba7f90d07d238dd70dbed67ad68ffb1d0b899df3132f8ffe3dbbd3bd3317de013e3321f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h1:oUO
TLSH
T1FD675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 30.5MB
SHA256 843f2aa4dac980eedd4f24470892afe805f8cca6d14d558799d9b0e1a59e24e3
MD5 30a0a5dd8b62a71829f7a6e431174f31
SHA1 2c2c52819cf786bf0e005bb8fe504b1dcb452035
SHA512 7718dfb42be7333270c8700fb94f401d7a3f0b8e43ae449630ef06c221a357ec758a249c5acfdc227d99a1132be638ed8bfd6e0290ba604c41f2731d110e892e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hC:oUJ
TLSH
T12E675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 30.8MB
SHA256 bb946606af62cc6cad30ae045291e7793ca9c72655e4296b57e904d5de971932
MD5 566f941f6ba2f34aeef7cf1eb86b2590
SHA1 35e076acad56a34e5bb63fd58be1a7bb74628214
SHA512 cc5608e21715bd230a623c6f04447a6f38fad79b6a91106685ed1ae828a769800a0557e05f68d104b3cf111a619c9198af16d982ffed99f18957c01b41bb4d32
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hQ:oUsm
TLSH
T15A675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 30.5MB
SHA256 8d9ad4e382322262786e0e3273f5327759ff33c3afed7598f47e4d3a52cab97f
MD5 9230fda731933e4370408aab2e110c01
SHA1 45569e06fcec71e2f33845976f9be4d946772fdc
SHA512 276206be24d00f9a9406b88bcc0200cd9aab8736c92b6702d8b6d75e4c53cfffd0d00a0d149c96798a084eeb3a3944bfff2a5694d3c6dd4939dad3612f9bcda7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hr:oUw
TLSH
T19E675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 30.5MB
SHA256 b7a0968d2134b76eff56b7c9605d8eb09dc315ea7b326accc641c3735428db33
MD5 a9c4143eed6bb01b0c9b084ad372307f
SHA1 c22cf9f1fff89483db925e09f41a2fc607f19962
SHA512 ae75332836cd2c9d03a73cc18134973364357edc2aab05c29ad2ac862afc46770af386fa2456d718864b667775e22b5e60a96a085d00e63f6e9dd34137e3fbff
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hv:oUo
TLSH
T1F3675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 30.7MB
SHA256 9bc7d7f98398aedbcd7ddb5f321b87a06a6aaf6f8b695530a628bef81508dc4a
MD5 83a4140b04e3f40684a4d01465d046bd
SHA1 7f7dd47ca518690df959d9650e7dce5f112d4eb1
SHA512 a80ee864b47c2202001bddff56df9bee357a8b32a0bfbbc1ad607169ace63933132b0ee6fd117c2185fd44921565cd303ee1d16ff00408c100472146911f77e3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hX:oUM
TLSH
T16B675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 30.5MB
SHA256 5eb0c85d8c2e3c5ae4b2d11cbbfa6824bd6052dcc05be7f9b5a26c3d301ed458
MD5 009b5d30a089bba51a23f974c083a9b3
SHA1 120e42eab56ad581ef73f1f63c4377f48ff8da09
SHA512 f12bab11873c360856ff57659040babffc182a0e25db43b6dea5928e2ae52290970f6da48c12f5bd95195258cef975ecaee658d4564a699e8d6b40205fde2ac0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hm:oUV
TLSH
T15E675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 30.5MB
SHA256 7c48a5333af437110539ea5a2f0ed0fa08e596359802fb7bfe7fd0dfd6d4a8ef
MD5 c01ff1f71876759417d77c23c2835140
SHA1 0953f40e8c74aa1968008e627e2a7e8bee3e1be9
SHA512 8e726d264b7e7346a49202a84dee9b545316c7820e1be4c40b190235100ea5d2eb38f57027ee0413f47b2a18b6c4e749ff3fcd6d2257a126a42bee47a88df0b1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hw:oUX
TLSH
T17F675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 30.7MB
SHA256 89a774603a61092850d8537bddc44c29c096547ba1798a39ff9ff222a4a9c1f5
MD5 232e4c47577ddf5dfdf67ec8b29fd715
SHA1 a76a43046e8bdc9e649e6937031e6d13c4faf343
SHA512 e351b3e6e9ae08683a1a3e219fc6b4fcd16b1b19e6a77a69a52e53269c11d349fedcda58e92ea154d4dee348e4f8b7a6b3786a3a61292eb2b0da3475f012db64
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hH:oU8
TLSH
T118675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 30.8MB
SHA256 8a3f80f0be7481265ba8e18eb8d3d7ab7bf1c7c5db8673687c734bd5c5e31b76
MD5 70cbd64dd72cf3f0f9d1cb2140d1b463
SHA1 0c9961c501d0113cdedd84a2ddbb1b8d3491b619
SHA512 85f14fa08aac3378bcd028bab9b8c994622b21fb8bb3b647aebf87d90af0a8be5fe8bc2e24e95f2183b01a4ec92590b5db43bfd6fc0ca640309b8366cdd7cbdd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h3:oU+7
TLSH
T1CA675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 31.0MB
SHA256 3f0845c73661d9c3523415ae24cc342df9f804ed1cc885b1740e24daaabb8c12
MD5 d1b5a076512e3023f2ab40232da1757c
SHA1 30e0b46dbe96e26caee964ad49cb724fbe574abc
SHA512 a59f1b8ca5a5b1fa1b73412fd73bd7300f4fac32b087f649874c1c7ce7f36f720f2520fceaa50d7fe331725d5c20c28dc6dff7869e5d86843ac54c6f575f7081
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h0:oUZd
TLSH
T151675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 30.5MB
SHA256 7d9116dabdcea78adbedcdcc3a1b467df616d0dc3acacaa9b41f702abf83b11e
MD5 ba36e9c0db7ca6d69f050d64a01162f8
SHA1 09925dfadae1f7d8ebab502f75799a8f681baebb
SHA512 cf91a3acd09ff452e9ed003ab4903452826ee2ecba41d3975bad0b88161b73bf7f6ae24c43ca2bdc121866661aabcd9cf2c76f8cd0358a5bcbffc5265f3fb71a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hF:oU2
TLSH
T1F5675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 30.5MB
SHA256 3a5b9cf3eb29bc65fa7e861fe8cefa569dacc3d69496a76c59cd981d1d150df4
MD5 a9602e7e7adea64dc60ca659652a328c
SHA1 d8e560dc19de813b3360e5f01756e30043e73c8b
SHA512 4edb2791fe019881b0a1217f71d5e9186163b02039f0ed543ce805d4533e18a71034ec9d703ebe1ce776b78aa79bd12e66411b873274e3b3c1bd33642b7334f9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hA:oUb
TLSH
T1FC675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 30.5MB
SHA256 96948787d10622d7e049cd5542e30fbc3cd73805903d320b89f9863a1328c57f
MD5 8e80a565fa00d997ae8c9087207e1b8f
SHA1 f6aa2c9a1fce173a11e57f95cb47e06fad04675a
SHA512 cb5885fe14fd2bc9e4ff5ec6e041b1b0974b7709c844680267ebd386929252af446430e25209d2288d3cbf4287df508a8dfef3eb3e2127fd1543a34a1cfc0de5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hW:oUZ
TLSH
T16F675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 30.5MB
SHA256 b6079ad2bd0b3faa78bcb6d27c7e8838ed061c905bb36652e17045093c12d75e
MD5 b90fbaee5500311ffc8bf805c122a2ec
SHA1 91a7d4c0032c9a46d9a0e57f490c00b8489ec9b6
SHA512 683ee270c3fc871a8732c2603c7966a0382f38c94d283046e5c5a5c3a0184cd316abf5baf76df019f7450a38dbba96ec81490da0f92e4ad9883471cbb5279c48
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hZ:oUC
TLSH
T154675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 30.5MB
SHA256 e8acc2c799a50dfefca0f5b9141bf1f896279ca0cdbf62c266594734dcc25f5f
MD5 9b26c70357bbd5028d4e03031bfc2f73
SHA1 aa6e1da514a34ef4a9a8dff68a75a702ad800100
SHA512 bc4f80e261a04fea64bcc9a1ce15a6dd56a5be88c6c5ed279f76eb677622d6e611fe34a98a70b432fceac66dae2586cfac2592e7ce4005860cb7ae30168edd9a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hL:oUo
TLSH
T1CA675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 30.5MB
SHA256 f29bff81f3c1925d42abe32dd5d7e308da7e06ee27385351a352a8eefe2569b2
MD5 908226bc8c50c31b4522f06d8096ea39
SHA1 4d005390d42c4dec4468e63f4fb2736fbd063670
SHA512 0cc4531a81e6a36e7d24a642d86ef4e263a1fdc68965be9b83c0d4be2b4c654499ff08688df06083be6d4fb8aaabf0c338870e8b1f808dc03d4967b3f18133bd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hn:oU8
TLSH
T148675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 30.5MB
SHA256 dc973e873efd7988c8f2253e198c7e00773eb6585221ba5ae15c0685f0c702e6
MD5 d8d77b9480dd8edb2baa1531abff0079
SHA1 0adea51952abdd250cddf2f26b09316d4788457c
SHA512 a226f4353d54a4fafb8a329be22e83e4ec6e5fa8d3dcdb928e15256d096b9fb32c871775659b6b479e38d390484795c1c23bbf0d5cefa6cd4ff97854deafa814
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hC:oUx
TLSH
T1D6675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 15.3MB
SHA256 87e2ba90ae4ca33d7383a64bdb0ded56e1812ec6b1d10663047ce4b4bcc238de
MD5 13ea542e734ad5fa78af1fa06251efa3
SHA1 8d03f859a19c6e801a44a6392309727dd03a6cd6
SHA512 fe49b4e7ae16f05340b67e93f808974685ca2f14a8a9b95b3ad2068a07a33f8c1361a6188b4375fec9810a5db03f4ce229977a82b9dc7be40ac302c5dc639903
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1W:ol
TLSH
T16AF65B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 30.5MB
SHA256 7aa0a2285c1b5d17ba5d188efdb980fe56fe565aba067e778b33c0a6fd8fcf01
MD5 e3b74b09ccfe87e6799b224c172914ce
SHA1 4e46f7d0a5b24ee8fc266182705ef4b86c37f894
SHA512 05ed1535f2b6e6c689a62a510074165475f335eb7641f0796945318ae4e38108bcedfe18fa94b181878578a74e2f7bb31d7cef210a389caeaab8f856844b64cd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h9:oUa
TLSH
T1D9675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 30.5MB
SHA256 1ce7e73fcff4b333f96769a80959390dfacbd8c4eae0194f626d44c57331c778
MD5 312ddaa59eede66238b185969eb4663a
SHA1 eaff9097609d11759d3407209051de88a1f6c24c
SHA512 533f5fb5119bb8129c3c688fc646818cd08e73f6d9bcc52b2684604f40e60f9f91d9a59d34469e14267e077c25381d346ed988a1da063c6b114193b6c2745d4e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hM:oU7
TLSH
T142675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 30.5MB
SHA256 39ca02f0620bf9f2e2e21fdbcaed982e43339578e4216e36cf5d52822b911d4a
MD5 a36bd74b78abfb3512d79aeba268c2bb
SHA1 04df45eae115c758953fd161235f01bca322bc9f
SHA512 844e06412906006e64add39e333fb0ce241435ae758ac7d2be43d42a9db4740973ee17a0c4af1b4a60bd255f3ce88e0daf4e8b6f9a40a1aad0d5bf82ef1138ea
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hM:oUD
TLSH
T15A675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 30.5MB
SHA256 76b23f31d913700392562212094e3288ee44ddff1b551d57341608d80df49794
MD5 99c947fa3ebe33008134f5072d05753f
SHA1 bcc0fa9d899a135d103801c41a1ff0f666d5f397
SHA512 b766f5c79d232d682e724a22382828661fff747708daae010182ee68d3103c837e1951567c883f94534dd7379a4cda3e5e99f239fccc2b6506c47db8325e277a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h8:oUz
TLSH
T17F675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 30.5MB
SHA256 edd6ea4d2d09beeb64e683bb540ab835ad7e083f95887d33ca7772876495377b
MD5 202852c691d4a847037027c2050fa024
SHA1 0e6591faee87246d132bb70f74509d725c7d6682
SHA512 d90f8ca5132b1e12876ed1e85f357183c8355ceeae651ff03e9ce6c280ab9abd74d653e3e0eece4c2e738e7c56e6c795b8edad19986ca07f6b4d8afa73bc088f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hF:oUe
TLSH
T1A0675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 30.5MB
SHA256 7a96ebc99e2963b60754bc59c4665bf696ccde9a2f63d56d75c7ef44814e2c5b
MD5 08d87dee8c296c93a9cb3670161e2615
SHA1 c907b5ec3ae47b4f1e5c7ee914af6240c56c7d54
SHA512 255028cd7011b594061b57541b032c962edbdd56fe6e3587feebba80cbbc13442744875ed96952452c543001dc0d76f9012bb9930547e73cf63a8dd3ff550ebc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h4:oUD
TLSH
T1A7675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 30.5MB
SHA256 718c7b3281e41b7968bffd9d204bb318aaeb5cc3afe199e612bfbd81a8f963ad
MD5 14c5d383882ecb88de61c390acf34f80
SHA1 8059c143c71904559c3ca1414d75032a85f319c0
SHA512 3429a727575ec057c3c8409963aa88d717071bb986def6010d5143e651f2eab4443af8798c68c1e6c3b6a00725516161465b57154d7e17403751fd69a2a9dd24
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hd:oUm
TLSH
T14E675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 30.5MB
SHA256 aa2a1911e8d6a7d33e603a967618af9f6981493aa841f8c2fd960d9fd58925cc
MD5 672a4e47761082a6a46d8f843154f5e1
SHA1 1af2d6841bb0f7719b7448ab2ea0c6f3c03a68c8
SHA512 82ecb79af94b9b64b8d81b22e9f5a3d3bb0174f1f0f0eca1bc54d17ce48d86e6dbd71f9a9e2150a69b4e825c213d3348a58707b823d8da4e411142c60a1a2206
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hf:oUo
TLSH
T1F5675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 30.5MB
SHA256 5eb83b00c8eb6fd07a3bb03c92a28546f7f821b1fa17c869aa7223c8d6e3bdd6
MD5 bfc20e20e3de9bda99618e14eadd5ab6
SHA1 3682343061f62cba731efad3aaa426263e1dca93
SHA512 658b7c3fa9a0539aa13de7f64be475ae516e2858335e11406f474cfb72b99740e86927130612e211da324d02c6d6c4cf1d547209dc6b091e4fdd95ead6fffcb5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hZ:oUK
TLSH
T139675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 30.5MB
SHA256 6e2204357b923b8f5e595d4558fe169d5dcbdcdbb62a65233caa4c19a3c50375
MD5 2d78cbddd434d2992ed6387d1cb25a4b
SHA1 ed943c603e252bf05df13565bc5b4b5517fa23d2
SHA512 4f93ce7cda8e204849d40ceaf0a92b10f3699bb76e207eac6e1ca6a20f114207422bc2ec33665cd37516c4440a6c74812fc0cde607deda24f398057966315eae
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h3:oUo
TLSH
T157675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 30.5MB
SHA256 9af0c09c7bfc741537982ce677818ce6e560a782f79a0535cf362d4a67461bbc
MD5 a133e022f64bc9c3a30f9b36230e968b
SHA1 d8505b2159c87baed15327780803e9693c2eebd6
SHA512 24a3faec506afecbaee49fce3d178896a4695f7d230872fc5d385d05f20ea72aab6a79cc6bb3a8bc16b2e5de710b262e61d8080390f81359986dcbc71493efe8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hh:oUm
TLSH
T142675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 30.5MB
SHA256 12d360651cb84b22c13a26085d0d14512a3e034581f807124defa5ce0f8a348b
MD5 50541770bd9c364a2dbfac3d6c4cdb43
SHA1 9f1033f8f37d800754ab759031446b30defdfe83
SHA512 fe915d258804921505758ddfe7ca61f6cb9f26c4b4785db4ef3b525e476bd04eff61265eb3aafa76946189aa4248e136a000b3aeb819bd3fab1a39dc8dcab371
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hG:oU1
TLSH
T1DE675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 30.5MB
SHA256 8d7cb93aa20c0c50fee0a65c2583f2ee91a35fd7502e19d3e8b77bd4b0f506da
MD5 01f63d91aca28bbd6fa8fdac62f1dd36
SHA1 6c3f4b71e4f4cf09512072778f07f038f3c48e03
SHA512 eb5a51f22ed4104afd6bc62dbdbf638e1043ca5c420d80318268d3ce3c7d76b418e4b3b0ac3753fb7debd6e9112e61cc057d3a15658a24ca31748690595bb979
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hX:oUg
TLSH
T190675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 30.5MB
SHA256 c94fb28dfb44f389691841343f3c3ffda7c0849ef30671c81cb1a74aa8726063
MD5 7f3728ec4de4ede5b66162439105bdac
SHA1 516c2aacd6aae4e2bf29634b8d3e712dce8f21c2
SHA512 4e00464a9a30b037d806e5b157e55a19789af1b17640df3d91a3ba9ac96a2490fb5d87fa80300dbb036fc544b74b5f04ca5da44ef22ff8053ef718dd2ce49f14
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hZ:oU6
TLSH
T103675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 30.5MB
SHA256 f7c6eb2fd3cb94eaf085bab4c48b2bf686e8c14f732495d72ebe7cd91f62ec21
MD5 7ff4328807f93689fc73c50049332faa
SHA1 773a53cc467150d40c86d5f5f31dc5dd0c8e77d1
SHA512 f629fb4f875b52b158868c5a1b96d02efb5d34ebde3bd5d094cc6ef3604a3739ab584d35df0a832ca055e88beae590a2c43bce6a5635a2cf505c3d69648ce2da
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/ht:oUO
TLSH
T155675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 30.5MB
SHA256 59e77b0174ea5a68dd0ba87107a5707cb5b5588767ca48eb9d5495b6a32788d0
MD5 323e558b2b3d8b47b23b857f99bb3ec7
SHA1 607ef73a59f4702e9f7de0b371039eba6d8d8d5c
SHA512 82913967686bc4e1a936f5150e0bb481602c1d3546ffc3f284de46af72016feca329da322258ebdc1a7c28f9cb5a01704e0d972453ac2030567694fbd035e48d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hk:oUH
TLSH
T13F675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 30.5MB
SHA256 582069a4e45093c5548b15c8ebc376cb7aabd1154800342a47c34140149a0e20
MD5 a03dc76a450356ae9612f59b4d9e3a6d
SHA1 650b34e714abc371f0cad62d5cdb621235ce1b18
SHA512 30d6974f2dd6b0629ebc22aa4612184973345e3b6aff68605bae1f8ee80bc4b2c4e5a46901b581fa8013192fe4e27a73a86593f8776a007ee9e50d15231e459f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hW:oUB
TLSH
T1E4675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 30.5MB
SHA256 e8b97a1a2ee1102a780b3cbab0bc54a23b18c34260694106ff9741ed4223ac2d
MD5 806739a0dcaaf317a44f04a37e763185
SHA1 f7b3333dbcfc32dadf8ade0cdd41c2f1ad2bae9f
SHA512 4c7e5becd9463b6fe9fd82f9757dcc1e2f35163ffad3778cf674099e5d405f6d8daaf58ce20304ecd969ed5897319cc359fb6cbabf9db3cea24a5c8a16316f64
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hD:oUE
TLSH
T1FB675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 30.5MB
SHA256 c0e10c9874b8532563e9d0198727b1be10f708e043104a3702c709c7a5171448
MD5 5fa5e5d7ad045a8accbdcdc276bd3885
SHA1 0deccccc1cfda8ed17cade2f6f0d6b92d450cb81
SHA512 4ded8298d79480d7d05e285905e88906170288a66dd717d78dbf7d009fa44a0e866193934465e3d811be6c6de1849753d30d0fbaf515527b2d74a2ce7aea2d7e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hX:oUM
TLSH
T194675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 30.5MB
SHA256 80b1dfeca0d0a0839b786552dc966fccc73fd56de4cce21abf5b2908fe5fcf02
MD5 953f13619384d251c951fb28ef56a87e
SHA1 ccb04dbccb2b5c879558ea6fd1aff69111ff6187
SHA512 c72ed73466a9217c026fb29195f01c0b01d07383155f0d5b3667f2aec90e791a1febe7f2d91c7a972e8c632f15b4657a2270c9a27f480bde691c11c56ea0a62a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hL:oUM
TLSH
T133675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 30.7MB
SHA256 4164011b68f61129bd918a8c6d9b67fa3565f3ab47b17c77448eaf251edeab86
MD5 33ac342f05d77d7fa685e028d16ebe7b
SHA1 346c8a2539c9f64b0364cd4c1b6b1c926f12eb61
SHA512 f332349e3aa4622b0a1737a345a3b22389fa1ac8fa76eb9a0933bc97a768fa8e0aa5b0fb2e04b05aaa8c5bdeaf41fd3b6c4321f869023b6ab6972f03cef6e9bf
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hB:oUe
TLSH
T1DA675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 30.5MB
SHA256 66680e37e5b9b28c4bba7d88a11aa1ac5acd11c991c845f42645ea382f127e13
MD5 cedbff7749bf1536c5dfc2e617eeb364
SHA1 f66afa599dfb274175a94d4dcdfd65704186040b
SHA512 062bfbf21c5bba83ead9352b305d103a92ba3928bad7e796c2b257784de99f862919b17d54f8abd76996ecb6b8d04b9bbc83cab917a384e63ee9c65ad7cbb8b4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hF:oU2
TLSH
T109675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 30.5MB
SHA256 a25e4856fb38d7ddca1ebcacde32e630dd504d22c6fbdc6bfb555d0b83e5a4f7
MD5 bfcaca591d049e040811819760ce759d
SHA1 dc0bea87d88975e9be6f034b8d306b4eca4e6c9c
SHA512 8acb79783f003e691b227142bda7bd1029dd06d8134a3de4b48cfd2c37422a13e9672e2d22eb9a634f13222f138982210fb7de6d90a79afbd5e1c9c0ab77ae9b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h8:oUz
TLSH
T12A675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 30.5MB
SHA256 131d39e7deb7c214dfd4f7280c4b894bba3ff4c3be2e52c739283ee3fac3d1ac
MD5 f4f6b0964fcac06374902ed54dd285db
SHA1 c9615b2ba66e8d0df3adf2a1356e3475312f11cd
SHA512 236dee499b79ea24b172e63a71ae9907f843b678f7c4f8ad739546ebf8fbb041ae92593960576d9d946e78418d4d642def144c6d37faf104dadc6b42da0c79f4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/h2:oUt
TLSH
T1E4675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
Size 30.6MB
SHA256 7d525549787d4ab271aac1d7e7249b94b9782d3d83311fb32542752ac43d7425
MD5 c8d2c5aae6f5d622100cfefb7c599c08
SHA1 393cce2f926d55dd61abf5bca234da4eb49f8317
SHA512 4d5136a5ac04bd0ffa6624fde8534773c87010967887dbac63a2e58e019e676d2de8ea9377a21d8af69e84b9f89e850ef2f628f17f689eda49b2ab709975eadb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hT:oUs
TLSH
T1D8675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
Size 30.5MB
SHA256 2726e9aebaf8a70ccbac6f50226f442382d02925323b894f723a607a525f99d8
MD5 77b3f55c2679457835e5fbd313134740
SHA1 43906bc715ad1c3f14e5495848f45760e779e0da
SHA512 e0e1645d30690946c4a31716a7e0dca0a9969b07a23eced70afbe7012fcc7f478d2276e0af08b8ac9a9c10f8b3b786319f85c49fb20dc27aa19acd50b48c2701
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hh:oUe
TLSH
T10E675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
Size 30.8MB
SHA256 169d25a8b9e017d6bd3270cf152e3daff3ea487828b0e0d2e46487deb1ef443e
MD5 9cd64a3d45dfa51c318f5c28d5003cff
SHA1 10a9f5c685eec4234a85f907b71ad4bf1ec8b50b
SHA512 26d8fc69620a054b1254c90176bb6b455a8a76688702527b39a3c4422ff5fed2aef44f2b5dd76370dcf13436d67b42546fb65c7203caebff03d372439f9a2e2e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hg:oU0i
TLSH
T156675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 30.6MB
SHA256 5984522b870793165815940a0430900fd61938699a1d24fb9aa6c5bd0740924f
MD5 341f6f5b524863c0a7d69769a8978493
SHA1 992608cd53fb919ea3b2e68dec51ae88bdd76c6d
SHA512 525713c5b27ae3942e6b11c1ec76feddb53663d0e32d30ed5d5faebbad0b51cfe4d39420a03ee27d0beb2755959f43cd89b39f25f3b367a011545e3f981e5509
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hu:oUx
TLSH
T17A675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 30.8MB
SHA256 e2d86c6e23f7fc552489b4d8390f23dea842c5ce1ca072542e70e5b87d5e8bb0
MD5 3a36e7bea1b9891fb524200c79b1b970
SHA1 da4a37edf8841a34beea4413b568489ec60aa65c
SHA512 70e69570b3141c68f7567cd9d852aad6ad038fcf9b7d78df7b291f53613199d9420c6b2f339d9b8e42496e31ef89b71c2044d2d7ec50401b946b67529d078ec5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI10w/h1+Qw/hW:oUQY
TLSH
T14A675B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 15.3MB
SHA256 5c92b84cc9c5ac1d5a6a7df21937a7e83dd450963265c99c50ddcd73d7117829
MD5 fefe37ac751a2854186d2a6fafcbc67f
SHA1 4a6600bad98592e785515771f2e01706fce5ecd8
SHA512 9fd042c939649ae9fa96da155be87b59669c812fed3b1a3eb14ef36f301749c26040916f4de5612b37177fd92c0b9d484a5dedf4c0118df0b2de00a447341493
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1jj:oGj
TLSH
T140F65B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 15.3MB
SHA256 08d9d18d1df20297437f0c4032bb4d3a9c44fda4f6c222e064e67bf280f80bb3
MD5 5422d9c4ed087a69d939b1a40d7bcbf3
SHA1 7ba05df352fab3b1f6b7bf0f3447d9720024f1ff
SHA512 07fd1ebecd26317bb43adce3f604f9d85e4754b6493eb9a4d6b95fe09ae196a21a816aa96dcee7464c71a5830c8f17a32ddc9d15a980afd094c0877916676dbc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1pD:o8D
TLSH
T13CF65B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spo0lve.exe

Path C:\windows\SysWOW64\drivers\spo0lve.exe
Size 15.3MB
SHA256 dc23d5d9cdf93668f35b6b70cad2c77859f568ac1066555a2ff1c77d23c3d1b2
MD5 e4a1a46306e9fbac00ea9307b4123e8d
SHA1 a2c2be800f3446ebd33536e3498ee76e6048c3a6
SHA512 a75e22da55a1a0d60dae5ae02fa02b8e8a9bea505bb43c4578c5454cc86404a4133aef8a0f069bcce2a1c2bb63d8cb4c38f667c87237a647658eb29522962279
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+5lw/h1+Qw/h1+cw/h1+Qw/h1+5sI1:o
TLSH
T1DEF65B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1740-5-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2404-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2404-4-0x0000000000400000-0x00000000004E4000-memory.dmp

Download