eeca91f3faf992dbed8d6c3079edbe05f07e8f8f9b9f01cce9218184aef41f94

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 14.0MB
Sample260730-hhx1basflg
SHA256 eeca91f3faf992dbed8d6c3079edbe05f07e8f8f9b9f01cce9218184aef41f94
MD5 d0711e28f4b8b24df92448873d400c6c
SHA1 7bbd504a93d3a410292c539e6c62f6d069448dfb
SHA512 5a24f1978d387740ccb488c28877cc9cdf90b27142e90c192fcc486f780dbed040c7ee62b32cefea05a1ee91c3296a18a632444afd06238a19f7b989ce35de9e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+b:Cc
TLSH
T1B2E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Mail\wab.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2764	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2972	2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2764

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-30_d0711e28f4b8b24df92448873d400c6c_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 14.9MB
SHA256 434e6934316ebe3d968b0adeb88660ef43407f738da72ef5e83bd007bea6918b
MD5 dbb4b8e02c404c491436769a641c0929
SHA1 7a4415099d59ad14c4bc0a68ab24676ae69632b2
SHA512 1f29742205d26058ce914b00d1bf696ce054e75e7f2555bcce241dc9553cd02b3c372d721a6013f1953fd18647e3c4c118c96686542b62600ab4a5e956a53674
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+1:C
TLSH
T165F65B51F5A48272D07A8075C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 14.7MB
SHA256 b6c54b68f0e08385a1bfb9556037f99cea16426cbc1859371e352adc27c34324
MD5 48f379a2c38dced980f72337e6f80000
SHA1 d7f6bec8da3741b0fe3c4ba0c8afe7fe2dbeb831
SHA512 343a6645d503460110c2495c75800ae26ea9d99fc674cd4c7561139bf97aa720475a54381bd145e2806b4e64203e28118ae0955d8e1023f2151eed9a7742bc69
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+6/h1+:C
TLSH
T127F64A51F5A08272D07A8471C6D6A77AFA3378415B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 28.0MB
SHA256 7ea38b470e3fb64faedf4d9be8253618fdb9f2de78632333ce5006c12ffd6731
MD5 06e990443ba16d7e30c3ea01c4be8121
SHA1 98133a669a455d98f4717419ee77668221c1e017
SHA512 61ced6e031ef4cd9316a428dfb1e01ae36f3d3926f572f8f68a4f1afe4445d6e4f766b2cc6e469b361c996fee738af4c4cff5ad46ecc9bda20b4eb6967dbbe57
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cw2:CP
TLSH
T16F575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 28.3MB
SHA256 1a8c16f610f0feecbf21c8db83123ed8365ce22b19d4c44b82c4c65242e00c2c
MD5 c5fcf51d9de1e5d8762276ccbd61b092
SHA1 33e331b9ce187d35c7d60b90a53f4202fc58f0e6
SHA512 148baa15f60daad41b9370fffaa1052dc6995ed548bfdd10f4dc12c1096ca736c79692710ce22613f4c5345acba95518eeb1640285c1ac8b442e9b51b3cfb895
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwU:CPQ
TLSH
T10D575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 28.0MB
SHA256 3baf50b271d90d2585795f1b92c4d7cb640257a35eb8d7a785b3692fcd2ae9c0
MD5 4ba4483ec97ffe2051e91c6caaf5ccdf
SHA1 94eb01150567f01db2c0aab4c88646ae45931a9a
SHA512 ba602147f14f9b87c9c69b018fbb13ea71a68de7385396ff37c5960aa6abedee2ef9fccfe7f23915ba3f224e927c23752c009817177d64c1fcc27de628cffb35
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwd:CPp
TLSH
T131575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 32.1MB
SHA256 e15d12a89d896e83740f726fcc288afa3161faeec2019bda03f9342d2bde06ea
MD5 fa82adf4aa94252381cd5aeedd1d9251
SHA1 601dfe1ebb73c315f5dbc58c3de866fb10c0200d
SHA512 ba1019df284c5c33e7d412a14740a66cb069b88f3620b8633531524a63f92d2c13459ff3d40e2bb096af28ce7fa452f3ff6f826dbcdfcb015012cb806e95b925
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwE:CP3vyEYKbi
TLSH
T117774A51F6A481B1D07A8071C6A6A77AFA3378411B308BC75386DB3D2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 28.4MB
SHA256 0d2664787b3dc71182f7c48307cbfc775c6db72aefc3e713fe598b61f0a60b68
MD5 92e5cf55551751f9d5266545361b2f71
SHA1 ea7311b19ce5851552ff6728387955e770f3ce31
SHA512 ee82bd6e28adde2a40547e576402f38ed9322f9bb2d0dcbdab8bcc19ae71cc6b3afa148521f56d7c3d2b0ae959060960c9645d86eea959c2f9d1217b04b56977
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwZ:CPt
TLSH
T1A2575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 30.1MB
SHA256 76da5013fbf3b461644d692b15404a22ad5e57e28511d9ae061418fa6f88027d
MD5 173a7f6cd4949c2312c3f94b14923bb8
SHA1 34fac5db30bcf3f35d954ec5f8e84a9425b4ed03
SHA512 ae13c93eacc5543ee8daa3eefa9074ba4e8c254cb36eaa20e70cad121786cb2b9d805c4eabfe8039cb1eb1b589d1725e61cfd9f41a617dc2b45fce402d452b30
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwz:CPwG
TLSH
T176674951F5A08171D1BA8471C696A77AFA3378411B308ACB9386DB3C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 28.1MB
SHA256 84bd36c4975575c7118d75b0832b228b292c5f2c7e92fcd548e899c800b174fd
MD5 c2d6ce8a0e76def2a5c11e9f731b8baf
SHA1 75c805ceadf0a9e32517de4e7be4a4a449678495
SHA512 97237aa3d7d70d78297e53df7bcaa2b91d64ea6d1a6feefb29e9e055d3321cb93c7e01ad527415200ee6262fad1a70290a1246e8f0401f800f2d8cbd9ecb92ed
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwP:CPL
TLSH
T151575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 34.1MB
SHA256 8b2f554ea5adccff36127c94ed0889a74902576e4ab3e3158131cb1dbc509f37
MD5 8897753c0a9b7cc6353b06229710afe6
SHA1 cef942d9ee98b0cd7bf4c836f90c90a3f2b5a770
SHA512 ff4bca736de78a715cf9d59dc8b440628ca6b3ab22713d1b3afab2747b051d66d428bbcd9977768954eb1a06fb1bda24da402bd71773bf9696d48f9d06473701
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwr:CPpQsas+PS
TLSH
T1E8775C52F2A08175D07A8470C6A6A776FA337C415B7087CB5385EB7C2F366C1AA36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 20.1MB
SHA256 1c8d9bef256cea64efb5f8d0094e97cc7972c89ecc24ad924ea7939c536a99d4
MD5 71cdd85f4a7e36c7a68688e2a34a2870
SHA1 f636ac97cfe993ec910f4b2bb9e476c04c8513d5
SHA512 7240d9061a4ce3d597f948410a7bda162078069663c28fc14a8c5fa7cbcbe2a6c9eb1af5e629b5ba43d5f91be5ff2ad1c42e8276081911db48520f1259d9002b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+GQyiKaUX+PNo:CpQsas+PS
TLSH
T1DB276D52F2A481B5D07AC470C6A6A736EA327C46477087CB5285E77C2F376D0AB36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 29.7MB
SHA256 4afb72af70bf2021fc2b91984c1bc6a692356305dc32bdf894477a8e62ff575a
MD5 0d5cb6a03d39ef53caa8665564f5f9f1
SHA1 46dd8e27874b1cc15cdb8e3489ebbd5cdc87cfd1
SHA512 70d3852dfb745474d28c6c4a393bc384fb51aef81818fe5292a160c5858f6d443aff93cf9a252c333081dfe3f33012c8cb00267d8c23c85bc2ac557620a04c75
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cw1:CPp/
TLSH
T1B9675A61F5A08171D07A8071C696A77AFA737C415B708BC79386EB3C2F362C19A36727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 31.5MB
SHA256 da8f1c9de6e94e88c8c27d378eb994d15e2b1d7befe8f4b9bffd7601e2e8aa9f
MD5 e18bc638345039735410d040f361f8d4
SHA1 e3651276e07566df3e6319350f7146d895469080
SHA512 78b3210d47382fcc82ef3fbe8b8fe37479db8e7da4097940c884872b6d957b8e61bbbc85f64be64ed4f0234ad82c04a5e911ed75b19399394f65186996842341
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwd:CPV+6
TLSH
T17C775B52F5A481B1D07A8471C696A77AFA337C411B308ACB5385EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 30.3MB
SHA256 bb46f3ad93a4b3836be1e0053d65a887a9c680a8e4be303c7a7f548fe2cc2413
MD5 dc0cf51d541dc020d264141754fc7eed
SHA1 4383e5030246f98220ef9870f7c6b3869ba4f0df
SHA512 79bcc82043de4720db87f41e9c3628b716ae1f6914f20658fb3f46eda0d9b290be432fcc5193f1d35986988274680ebcc77507ccde384f72071c03feea2701b8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cw1:CP9l0G
TLSH
T1C2674A52F5A081B1D07A8471C696A77AFA337C411B708AC75386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 29.6MB
SHA256 454fd45883aaf92c703ce3b64c1527c93cbdd31b71250f42c4c97a025b6bd6fc
MD5 6856fd7968f53e76d38254f20299bb74
SHA1 326545ab72ae468f4cb0b1ae49d19be78c0ea372
SHA512 bee7338026c4c2965a1d48645197cea0c3ddc3ca31d0cdfc33bb53dab78a67f090dda597c79413ba53ecd8d64a66e480c8c390cfc144707a0c6e308c651c14d0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwW:CPaf
TLSH
T1E1674951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 29.9MB
SHA256 78682bec45aec08ce66e3f6678a87760ea388979104a95558a10a5975a8c59da
MD5 3074804b5cd223aecdb91377a2b9e2d9
SHA1 abc1590952827eda58b850c65d4d07e1a2ecd0cd
SHA512 b2137708ec8e13773926b703e9c23bbe9ab0d5cd1f16e4e05cf5ae542c00761034f291e3599e705a084e47c834352463560fad43e0e2ba3f0c672193b0102e07
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cw6:CPgC16
TLSH
T106674951F5A08171D07A8471C696A77AFA337C411B708ACB9386EB3C2F366D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 31.1MB
SHA256 8e2d5d1af854d0750cf056a73cf8afbb8a31dfa5df2d543c4a4c5e253f414aea
MD5 4d401ba3d9c337a438d9ee60e1c12ce5
SHA1 e1423e5f4077fc50ce2c81181db56c40fed28dc0
SHA512 4016c901fe51632d4bbada67d3ca4c90ff784c09a4ad2242287c51905bcdd13f5d7e1f9e7e9d49d48036d3929a313dabc2f79e93b72f4e4a8a2b6f36deda3657
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwD:CP0O
TLSH
T1F7675A52F5A081B1D07A8471C696A77AFA337C415B308AC75386EB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 29.4MB
SHA256 22d90ad3b6cca09a6f3656e89dcd3e5b73808785ef3e1d70af8c8917b9aa145d
MD5 6a23f891c5998c213255851b01be47a7
SHA1 ff841d25bd0cb595dea0d4749bfdeef406c2c48a
SHA512 f9e968118c25e5ec068875e9b9ebba89f95cb35708961ff1303609ad7032920a591167c529e43ee2d6643ca4fc371db913f9d1ddfe093c5f61fffaec4ffb5d5b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwV:CPC0
TLSH
T149674951F5A08172D07A8471C696A77AFA337C411B608AC79386EB3C2F376D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 28.0MB
SHA256 bc054c55b988fba5cefe9f16453d721dc644ec0dd3c54cf245e1a477165f9417
MD5 1fdaa84db2a51098d578475670992ce4
SHA1 f05af0e904950ea21c5e204b4951f54a9c89ee62
SHA512 2aa2134fdf887c2854980a8247961ff4691576d178b3d11da7113cd8c7070eafdcae4206a0b4876e33c940e191dd4ffeb623daca1c238baa279487adf76ab378
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cw5:CPl
TLSH
T1AA575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 28.0MB
SHA256 eb9005a2f4209f053fa5494a195ff5ae0dc9e06c5fc69411950a513845968e56
MD5 ada88326ae5c06eeaa9826d1be6c9649
SHA1 1bc9f4fc331d1c434f44aec75f19138ec0f29b4f
SHA512 c5b1ad472785e9a211e078911cea99fe8acb2ff6a3c32de822498f01a52980602e87eb62e9baed0f1e1e9e2487b7e07a6e2a97f7143b957e0040753edf464507
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwe:CPq
TLSH
T130575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 64KB
SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
MD5 071d69befc4545d16c8415ee31c5afdc
SHA1 98106920c20562db4df0d21c498f51369d927ad9
SHA512 994fdea351d7be4c5434f4840958dad54941761c7132fb3cdc5aa3821de5c697829bc462ca8428d6341e9076d304a231f945e48f12c618c86ab01045a26eda17
SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0UeG9ODBZHlsP:2sXDsmJDZzgyQsRDptkar4Vyg/B
TLSH
T14D530EF819C0F18AF8D1D571A0C9B33926EACDE5BB5047DB7C172B429EAE4800397D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 28.0MB
SHA256 63243c103e20e50a330269bf3fe22428bd4109264b5adba9848b396f20f75873
MD5 bcd8eca8b4f9a6f7a6d0cc8b5328a5d3
SHA1 a9bca137895e768160fb170e635a2a8590315d5e
SHA512 8a2079d2427e9934b6c49cef116577c62998ccdb4b3a87976e09cb61bba4cf9377e5a77a93d1b4ed3f41bf074c43ac4e18f14e1059d30d45973dd7ea61ca8ba6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwJ:CP9
TLSH
T1CB575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 28.3MB
SHA256 d664334163fe903448f4e122e87ca8237a14f48b5579b6308bc1e3ea809aa365
MD5 64cb865980484b0f492dd239358cccbc
SHA1 72d9e337e01d16c876f3d38d64af75e21a0f2f3b
SHA512 2a265772d9267126150fa67fefd61343fbe7357dffd8423cd8cbee97d7b5b85d26b56b0f11d43d8e0b14ee0dffe19efc934069e4d1b21b001f323e7de5539d5e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwc:CPVm
TLSH
T1D6575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 28.0MB
SHA256 fa09dd6099256a87904d0726d7d32fbe79449722c4a662cc76d80d8118087776
MD5 3e86acfa8a8998250d634017c6692f82
SHA1 f86bcf7afd27ab41f2aac1fbaa251ffa4aa78c48
SHA512 0467a58ad8b257eb6cccce477c719928f9953f73ab03ada4df7e7ea8936d83fb8d402f58c1af3041137575e61c67b1d447b4e54a6f94f79781cd6d73947111b8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwn:CPz
TLSH
T1E9575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 28.0MB
SHA256 9b28bd741a853e56c2f7ad9150d7a56414ae4a3652e9863d1392a00bd250a75a
MD5 511e9e6b59af19e8169cafe79a1d21b9
SHA1 53a568fc253aa5ca88c81bfc1f6c5e020c88b9c9
SHA512 7f768c6ec3b6c727ee072a5a5031f201b188d92e0751c09e88d2aaed204f09fdf8983f603649df6017e246bbca3e89c2a3bb20cb062c92984faab0de5a0bf0a1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwD:CPX
TLSH
T136575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 28.2MB
SHA256 2e88262bfb99b204ac9e1e3229552b319e65a34f9b464e0529a253779ca56455
MD5 917c4dbb9e6fac61dc8d89c648af2580
SHA1 b53e70cdb4035c1fae540b9cf01dcc9af3cc3fb1
SHA512 c0a70dcb7b9a330bea70327453558cfa5871bcee5f33e6a452763753dd6e97d55cdb6d35b16987b28ac409110eb3b192230b6874a0e3b9e4f2af10abcc82240b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwb:CPv
TLSH
T16C575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 28.0MB
SHA256 f9385225fc8d1df6b62747a9a8edda1dfe82ae438a48f05c04a88c45381dcfff
MD5 473bd8dc451cab08d3867dc114ffa2ab
SHA1 50a3c672648361aef38bceaad47592bc0763f28d
SHA512 56fc03d37f2608e5e024e7f90f79d1833cb02a55bd9246ff691df81d005165b0a98168a2578fa036a26440c43b076351bac5ca8ec9ffa03be0798a99a0a533d4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwy:CPO
TLSH
T18F575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 28.0MB
SHA256 a5e3fac6900dcbe9aec121433a8651ef3740ae3e2a4b47422684081f37c429ee
MD5 84ed47222800a05eaaf2d3e8836f273f
SHA1 97b5b96fc35c26a22f19bde649aa2c8d6699dbaa
SHA512 5c6743f15b41a965a66f584aa4c34f57ec8140816174698c0473dd8729f02f1c3c419870b8883ae6bc76ab506d1b6bf839a065ab1ce64cfa832134a79415a23e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwc:CPo
TLSH
T133575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 28.2MB
SHA256 b3c0a7436eace5e65299e54098021693f938fd54d84e27e38d50438b82e78d9a
MD5 f3cc2c7743e088211fbd9d0b601a5cf9
SHA1 e737b124413fea749e35f9d4b56e288d5c16c668
SHA512 b455f4574aead97dba1377babb0d84459c7b9427f2e21ab735ec6d08106e131f5ddc4fb7490f7c92da429fc4b9f6006ed8d196053fe985943521cb20e29deac8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwT:CPf
TLSH
T155575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 28.3MB
SHA256 0ec2b5d3b49cf3d84d8b8d9852a6848e78114658a18edd1da8dd3225a3b52910
MD5 8a81b8290ff100fcd1e2c95eb2ea64f4
SHA1 a26bbcc5558146de3b430eefa43364d201501596
SHA512 586497a52ace2eae02d08833d20c3fa306428e31f837f75e001529e0bd5a7b49338248e76fa013dca0ca2d94709c3505ba5a5712e0962cd923f4a4734dcb50d2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cw7:CPL7
TLSH
T11A575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 28.5MB
SHA256 cc033d05b0cb0513771f007c96235b733dd1d2449ceb62ddf1c3478ba528f359
MD5 0a84031e78fce1d17dcb78bdf809f6b5
SHA1 4681541116b412280b54082bcac907b81bfaa850
SHA512 84e9b2a3e91f3e64b3cb88beffb50e34f3a97916dcede5ab06e2acd10ddbb84f76a4c57c1f59f3f4e40b8a10c44990a95c1e79df0aa43d9a6468bc8bb1b7f6ef
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cww:CPsd
TLSH
T199675A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 28.0MB
SHA256 300f2ffd1973cbd857aace5ebbea99561cce11443222737769cda8caf2890ae6
MD5 04e9fcca0048eff749f103db069eaf1c
SHA1 ae3c018454908d041aa7c43b92cd0fbdd13bfb46
SHA512 055d9c23ffab89cbdbfb0d68c450183bc492c18d5ea950c2fe072071fb9683d746e48b1d3ba321d9a8c297481e6a9397d413d0a87e4e0527417a5811afa88ca0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwB:CP9
TLSH
T14F575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 28.0MB
SHA256 355657937244362b070fc9989c5c7acbdc7e1b936226453c486b729478718f0e
MD5 952235fdb4ac93a4c7354f5e630959d9
SHA1 7fcf45eec5137301d879b07a9edae948795818ab
SHA512 ca15fc996e4644bd73d934c4cc86600634b4138bea3ec282221fbb6004a24d0aa823a3a73e292589197e488e947e82a66ce864dddac18356dede2cefda8e02b8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwU:CPo
TLSH
T134575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 28.0MB
SHA256 6792a44f6c42aee5080d3494ea25b433234f5f628851ff322b584bc7e9162246
MD5 ae6971ccaf1028764f4940b94df13375
SHA1 5a9ace148d4b5268a303daa6a5756f4052283644
SHA512 66b4b20e72bb3dea29fdfbdcfb148ae9eee52b7189d6680a75574104d0f0e01777a6ae2d9c6c85add2bd7bf31da784230180a76fa67a5837174f422950da644c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwC:CP+
TLSH
T11E575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 28.0MB
SHA256 d71bc5c89e9f5b7b97f5d47e93c2586e6ac0fa55b4e74ad9cda4e0aa18e762cd
MD5 9815662de7cf762021b832679561858a
SHA1 363e3b32005bf12caf6d9571c44874d9d0fa65b4
SHA512 a2e1e09022d1385b5ba6dd93549abd4c653a7136b9c04e9755fd537b380f4bbed99055c6db7e544106264bea3f8bc1e1d45b185f8059e2cf9989e124c85d3e31
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwl:CPx
TLSH
T10F575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 28.0MB
SHA256 6dcda49c79801d34bcfeb0b7038bba5cda47cfd436be46c5a5818e60ae0f869b
MD5 6d4e95dfe4827ee4fd5ffb06ee767fe7
SHA1 189a79e732b23edd40b37ba9a9364c277c0012ed
SHA512 6dc1597359e56bb6f4a8c1bafae02d0613b2dd73b009032e7dcd29f298b7e4c9466507649edc605153a42a6b077bc4aa4d0eb03d2f22b4ae313947351bf7f688
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwv:CPD
TLSH
T136575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 28.0MB
SHA256 4f2336e82f257b2857a6773e1e2ab9a012e12e7378dc5fc89fc63a76cd0773c9
MD5 4726ea2a2ce1bec3c64935f5d8ae41e1
SHA1 c9de0a12b7b9048256fce0eec6affe3c45deb0fe
SHA512 3257e49fbff2eaff45b06ecaab90a93eabefa9f728b465dab1f6e53ea23d253d5e67e6f8b81e75a153e0d599ff24e53c653d8b168f2310861573541ca590caf8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwj:CP/
TLSH
T131575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 28.0MB
SHA256 59e5a24dcdb945465016d6403bd8d3adbbcd6382372352968932e8488779de71
MD5 01d454e39bb27761b1f529b32ed360d4
SHA1 c04a8b211a591af9f8a254620ee527d5d8d2c904
SHA512 66f4b619ac20e1cbd0471bd26d39b9650e5caac0a4140ece8bcc43cd0c3c3ed98681842edc7bfbd25cfbadacfa0ba2f7ae881771fe1cad1fa3be3b8466abde88
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwm:CPa
TLSH
T14A575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 28.0MB
SHA256 f60f21c283e80f0b054dbdd1ea919140a329c48ee1f43b70be52a9b85eefb675
MD5 03a06086a8c4c503a5395327cbc8497a
SHA1 7cf29ae0e730de881f12256b23f5f6aab1a58129
SHA512 c273180052a5ecdcf8fdb37ff83540445eff6f1cb9146d027117997bc408975c589b8d78dd3f30e5e2c117f9d0453c97a2e53c3c9093e2b33ba44d33746f704c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwB:CPF
TLSH
T100575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 28.0MB
SHA256 44fada9f498c218e0776d590f961836b8632258fe3940fceef4feadd7af3c823
MD5 e8b1c17bfe93a2396f7b469c719c2717
SHA1 e92609edc4a879d38606953f434f834877869e78
SHA512 42df02ad5bf2f77574a19f6cd9c1f99b3dfb5b43836a8c1e4f2947a580e6ae52b954e879864052cc60582a0b58d72a35ddb5b0b7c0d869d46d8396d94a29f0d9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwg:CPk
TLSH
T13F575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 28.0MB
SHA256 47c6493310b543373aacfc81f8f90e39bb033e7d2b8d7bc856c738f06229b3d4
MD5 6b6627f72b2f31ffdfcd51888361f4bf
SHA1 6d9004800d21079a88920adfded9656bfb063a91
SHA512 1bb984864138895d8655193cfe143171ba4590e37b6ebe451136bd4a3941d0c5dfb71027e9e87ff2be917e959f6b79e640e92fdb7bea2a849650a1a100ce7ceb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwQ:CP0
TLSH
T1A5575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 28.0MB
SHA256 80a10442ceab104c58eba814bfb3ff7d57b5058e2dd44800773de02ddfcf9f1b
MD5 16581401613424aec2aaa7856b2bc93c
SHA1 b9b2d65cb419042c57b5dad789e828fae1cbf31c
SHA512 31d6de00038d5409ddbfe6302744d8de20b2d41244857cf2b718c0a195e81f07707c460475c854629b6f607004b996cb9e61169e6f870f7cb7c555ceb1bc1ad0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cww:CPk
TLSH
T192575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 28.0MB
SHA256 8f4bdade5075ea7805e9cb52aec937ae7755bd4f88e59ac80468b95cdd9ef5d4
MD5 3c39d3abd8a81049217df3d00b9fefed
SHA1 66a993ef20220b0cea848c3a8221015577f85492
SHA512 839f78e962ac5200bab5d945e9fd1cc69bfe9102dc95f1083a64ebd25dd2378d0b8bbce24c5e21e1017c8107f4dc2e017c10f8e7a4351a44c501f52c6feec23c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwZ:CP9
TLSH
T16D575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 28.0MB
SHA256 50f681a9c650fab14dc5b06051a0e93d2049429af52ca8c7db502b0e5878c2bb
MD5 6e5ea7fbb77be9e49e6a561cc776d2d2
SHA1 e25bf60e7bc7c114c90983d2ceb2f58eb1b76c34
SHA512 a73a78206335e49f3673e3c25a34c90772e0d4c4f85b7584968b3175b48a77090344bbd4db4aabdf97aea45854ff3a98b716374a84ea044c6783c297c753816c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cws:CPA
TLSH
T153575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 28.0MB
SHA256 3c99d1df77e02bb1900123fbcc2efa53bb83e7ec8639fd6cc60d1efbb8fa526f
MD5 047b3484e951009aba94d9891d5d8f14
SHA1 2314813dc814ed10ff083ad79b78ca6782ee3b1f
SHA512 ba4d6f60382468b7ced1619a5b19e90f582d739c43dddacd645770cc118ee346ed9aa465aaab55b3c205ab4b1e0774a96cb37e56a245b6282a2a719522236374
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwR:CP1
TLSH
T137575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 28.0MB
SHA256 f93dc11cdf53b2d4a2cb7432617725aca7506db00e8b4da6db2ec12c5c2d3cd6
MD5 be97fb2a8bd42fddac9c6aa5ba3ca672
SHA1 3c44e33cf5122e5f8912108f6baf4235aa92a83e
SHA512 a777599e185066c672e9cdcc6084bf05faaab0a7bfac2d90e055f3df2a260945a79bb060c5100501367c731b32d41d5536fca8589cfd6254b1c8521cd853a931
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cw7:CP3
TLSH
T1AF575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 28.0MB
SHA256 eb5923ba74cafce5020b741998af0f291958e6641bb97bb98dafa7aca38264df
MD5 c58ca14b9a69ed0b9c532de69e02b881
SHA1 ced454a3686aa21b4555c2d5d766309eb53a8d36
SHA512 734a6668073d2e67a537c87098d4033cf77b72d51e14f02f11370380df9aec602ba16eb9cc481c594fd44c9456c1a9b8bbf1738881fcfce6835daf0b5ea492cd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwN:CPB
TLSH
T145575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 28.0MB
SHA256 57097210fa8d9d93491d1892b2e3c84d5d43ff67c951e46e65c823449c569c3e
MD5 51e369a802734acac0c1c6b1cb8a666d
SHA1 5921c4ff06056383da173c7f3ea52768f97cfc5b
SHA512 c4a319ab025e6bb50b5c95e1a425f2303ad7a35b02012f091ce013cfcad13f33416a9a92d3bd52ab1b9697b607bdbcce81318e16331e80bf9109851f59f8bee9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwz:CPv
TLSH
T11C575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 28.0MB
SHA256 a7d5ce172f6dc890ad6703d9020e74b198ca1160daab8ef8a8f0a9ee8c5c2510
MD5 e7f3b0a479155540ad0f5789855e003a
SHA1 b618db52ed0006c918f92c71231eb2e36d837df4
SHA512 f12eebd39d4576b03126dedeb025dcdef864e6c94b5017ff834584e409b1fb6cf2bde1b430ba01d0ebfa8e6cfed3dca26d6b9ded3339ff1755f2483334d5ec6b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwM:CPw
TLSH
T106575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 28.0MB
SHA256 6de4719d43622aa9dba51a88be1dc7f7d25c75aca06c933b5959ffdcaf28d2ee
MD5 d321a10fea43b092443f3539b0cdaba0
SHA1 355c4e81a1255eaf1e130afbd6cd7020bac843ed
SHA512 5cb6d2e3c66e9e6732ab015d0fef26e9b3bc82e1d31b97cb3ec5200d55150128539bf489aae0ea57938f1eb7d9ef7f325a4d2d74d8d64a8cb4d495bb2c698701
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwt:CPJ
TLSH
T14E575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 28.0MB
SHA256 79b0382fe96eb93fb2937b53d437bc99ec615bb653ea0f137ad1708c55db3960
MD5 aef0bbfc74885b7b84a3221341775fc4
SHA1 7314f02b9245f133accf6b2686e8300f21d4873b
SHA512 d2a32f354e3b5d1563d62dd5dda59e7d6a435854d9ec7be7155313a3a27274a597425f3d5155e07c995e2a728672d0a3a65468198301e7cd2098800fb6d39923
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwy:CPe
TLSH
T167575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 28.0MB
SHA256 fb1f79e96fac77246be4c664e218d365a88f07fb8b62ecdc52e28ffc23d31d47
MD5 afce180d84f26ac36c2a6b3fe28c4704
SHA1 d0ae74389bfdb9f553049cd5dfe797863f05e2f2
SHA512 7fcc45ee635c59f97c29c5a932e979acabaac2bcba9c2dba77f2e978678e12ed6009e76b634499d005a77617f12bc084905b1df12d769489f4078aca7522fe52
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwj:CP/
TLSH
T127575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 28.0MB
SHA256 7c8a8279c0f5407e8d93df18efa3dad2b0b07318ff01775798e0c89957e32766
MD5 0c24362425bf68d4b7f1bedb12b68001
SHA1 edc012440155245f6e43441ed5d5dbe1bfd66312
SHA512 31c2c9e8c6c54043b86bef56814563feca7d7e030c590272c70f35a02ee143fe4a0aad5090acdc3c7eac0c61b22f1d45c83db4813857e0501bb072a3da30bb4a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwN:CPh
TLSH
T1D8575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 28.0MB
SHA256 d2f70f91f94231fcc242a9a5a4d2e7c250d037e582a0085ebb6620e036647175
MD5 060eb5989bd404523b7869fdc21bcf2a
SHA1 4c1349e476098c718607bcf44aec71a8f8afe5c4
SHA512 eaab3d4db17b88dae0138afa7534cb2c53350d2e7707f59e9e85a927a6a925721ae8f9b9d1c737dbc67a8c7e27ea3aa1eb25c6812623e569c152fd1e21afb479
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwR:CPl
TLSH
T1D4575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 28.0MB
SHA256 a6f859aaa38bad248f5cd50fbe7ede77bef42621a989b43075fd905d91fbf0af
MD5 5fe725b5d96e8aaa9451a2205d1cddb0
SHA1 fd71a4445b9cf440ae1e071c36b00b4438b64478
SHA512 ba17a6e159fb34b66bb6eb55775f692d446fadb61bc14f946c5703103f7f7b6e2cb0dd305d947f6eab240154b000a17afe5b80d523bbd97a381dd5e61ec8f3db
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwA:CPM
TLSH
T1D5575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 14.1MB
SHA256 5b302d295be9c063e5cbd5ff37f8cc306599c440cd7e5b52cc611e2b834b60cf
MD5 4da0fdc078a29e862d1b68e4d31d5098
SHA1 2a71c19cf55c47ed0dfeb3a82e502aba51c8513f
SHA512 b849df29c88de8f82e8824c56660ea2d73b98554d9f2178297893ce5042e5be05db22ee1c178dddf5d0fefc9089288ea4b355d607922c2a764a59feb19fb783f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+e:Ch
TLSH
T17DE64991F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 28.1MB
SHA256 51b70d4cccf9897c34d9907647cfcb2b8ff76516949ad436774390b7547eef39
MD5 66bb39a1833d446bc4859b451f9dbaa0
SHA1 b1210493c92ece742a3b620429cd5ef3c7517ef9
SHA512 d8efc055a9bb957239849d005c8114d594a65aef131bb985ce96109dd0526e6068ae41e2aae9e016f3279b5d351922a4423c09be044759a7bcd90251f1f7d023
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwZ:CPd
TLSH
T1BA575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 28.1MB
SHA256 2995f77a98d882f1ba39d21bd2826e5be186018563086dec7e7ae0e30762ae0d
MD5 cd943a6042ba2f2e134e59c8f31caf36
SHA1 32021e3088e2055eaf35b0bc2af71d0dcf58dc61
SHA512 59f4ec0e3e9b698f4bf3558c9f1eebed46dd5e1174645441e80e0bd8a76f6e876279a52a51e9b08891b149d21f4b94ba5de4ec4d11834bfe9d1bac05303c2340
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cw3:CPPj
TLSH
T1CE575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 28.1MB
SHA256 f7bb54f48422190bebc947240253080f649f6849020ead889f93fcf25a4d7c6b
MD5 a6773b6a01a624b8cb22d251c5ee15d1
SHA1 32db8567b8e2f3aba4b8bebc00b2d96f23e83c77
SHA512 f9b171ad2c0c999520bdc1f3319744cec120f251bcf67c5c4e1aacd724b27f89c717e65e6a27f75b7b2f35484d30d54ef9b9e755a6d4e8af8b892a4916d95a7f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+b9w/h1+Qw/h1+cw/h1+Qw/h1+lw/h1+Qw/h1+cwZ:CPtD
TLSH
T14A575A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2764-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2764-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2972-2-0x0000000000400000-0x00000000004E4000-memory.dmp

Download