e5d59c4f6dddebe55097fa315a252d42c72e0fe61e698f99649e709507ae4f50

Analysis

max time kernel
60s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 23.4MB
Sample260731-3vn86abj21
SHA256 e5d59c4f6dddebe55097fa315a252d42c72e0fe61e698f99649e709507ae4f50
MD5 5e6c5e3f6d4fb49aeb3b6f5e3d59838f
SHA1 0785f2d4f3854e0cc864fa75790cd5b9b91f28d7
SHA512 64696d438c9490dd86bc30ef4f557b329f46929ac8ab7e66b0f19c5a0e5be6243732271a261a6e4d0ea9e64039332b09f5328c2e604075cbcba65dc06e98adac
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+m:hGqGJK
TLSH
T15D477C55F5A481B1D0B6C174C6969776FA727C414B308BCB8386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4920	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4236	2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Users\Admin\AppData\Local\Temp\2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-31_5e6c5e3f6d4fb49aeb3b6f5e3d59838f_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 23.7MB
SHA256 88edacb310268479e58cf586200a771f555519bb3d1c68de99f4c6abbac9f8d9
MD5 d4b27c66e13a038159319f8232b9a4e5
SHA1 faf95098f5039a25ec3413fb9dd2a8fdfdd30b05
SHA512 b2a1632b2caf7fa564a60946214ef363afaf77194a99c2219f84af36bfbd7a31f2dd4771446e220315830629ad1fff977d45fbd713d0e02564ef2fb9a40c87be
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+J:hGqGJKS
TLSH
T100477C55F5A481B1D0BAC174C6969776FA727C414B308BCB8386EB2D2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 27.5MB
SHA256 57a586c5ea966ac7eb9912431d5eea95d40025a0f9cdfb8e21d4fd683487c267
MD5 a2b12d58033ea9471d3b5a19a78096ae
SHA1 2cc50a4c7a1909a4e1e36ebc512aa26ca79db09a
SHA512 fc21e02129e567560ace6cf5e8c62f51dd1f46c248cd85fc38c192227313ca733529aef50b17af810e493bca9b957eea52b83b2356e518f1ee5718b4c68bdfc5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+p:hGqGJKxvyEYKbi
TLSH
T1CB576D55F6A481B1D0B6C174C6A69776FA727C414B308BCB4285EB2D2F336D09E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 23.8MB
SHA256 c57014f27c6461f89449eeb93bc1624035f89bcf898cc75d8de75a02ea2339ba
MD5 b6e075f48791a01a119f8aeaf9caf660
SHA1 58366a9df18cc3192c947233198782d21a44c769
SHA512 4c4ec1598a54b9ce09c97ecb08947e9a068a8794aa90e14958923bad6bd698761a8ac2cd4926526367c8fc3a4f4f6f882a148a3120fc38b202c8caba635f65a7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+c:hGqGJK7
TLSH
T169477C55F5A481B1D0BAC170C6969776FA727C414B308BCB9386EB2D2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 25.6MB
SHA256 c1fda93e538c399039c1f7be624a37db5311645a9f187ebf917300b22c35fd3a
MD5 c782d5a504befcf9fc3c35fe342ec0e9
SHA1 e72118c2c88dfdc36a78c58f5081f14ee1481a34
SHA512 a7f2a0ad8f253903546c4f3fdf40a58ed4b7aab989890ac0a559d0bbfc187b5431904c69cb720e15516ca87b64a0a66bbd75c3b1315944bc507703a96560cab8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+k:hGqGJKyG
TLSH
T10F477D55F6A481B1D0B6C174C6969776FA727C414B308BCB4386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 47.0MB
SHA256 261af84a3fc027abc653033938d88428c167b06471bad03164d77abb830313d1
MD5 d3491a04910c2527c7105f020e17510c
SHA1 dd044866181a9e4ea12a170aa04bd76d0e87aa8f
SHA512 e4a16352b412ea71c0b3b4592b7de616cc10686910391ed457bdb436bcde5d2afb40a74f95c1d0db2e9bce65b16238cc656d7a947eb6eb92b4f4678b79cc00e1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+P:hGqGJKEGqGJKt
TLSH
T1BDB77C55F5A481B1D0B6C174C6969776FA727C414B308BCB8386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 53.0MB
SHA256 2e7138d77f3d9b12a4b41b4f5d01345a566af14a1d912fcd3b1767f858bf9f8c
MD5 0c87116bb12e60987fc40e084cb8cc0b
SHA1 2fc869d6fadfea7f10fa8612695a389488a8d541
SHA512 902299966f342a268eb91fbc636cb4501a320c05af39b854e5508aa1840a09722aba17ba6be510777e3eb3aeca9c1ce7b8be050c586bd123962a118aa6b3e2db
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+r:hGqGJKEGqGJKPQsas+PS
TLSH
T151C78D52F2A481B5D0BAC570C6A69736FA727C414B3087CB5385E76D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 48.6MB
SHA256 10e5336be8f6e225b9a5a03af3f5f44b7cb68730d1165df7bdc146e04043c2ee
MD5 b7dbbf73f91519fce4a81d2ca8637520
SHA1 567474f867059e79357f3c7520da6aa631586b8b
SHA512 47a0cd3b7d0825ce7dd04ab7be3d512d34670531698e826efd82d9fd94569957c7791a6f51931b6005d3548a9af42fe35d60f4ab507d2d7747d370cb772f34e8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+1:hGqGJKEGqGJKr/
TLSH
T198B76C55F5A481B1D0BAC174C6969776FA727C414B308BCB8386E72D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 50.4MB
SHA256 d1ef3783c2d96311e2a8a12559f680a4425224ae9626d0f011eea47782e5bce9
MD5 b259008f40ddd317d241a8ce7f6909ec
SHA1 2b5b16cee7d712513ee2a5155b9eeb2db8a327b8
SHA512 1f25cc4a99d5b6be7e3f3568478d528b598176b29a231a4096722c10f49fd9950a374e93b1e1e84e9c848f7394083e1e0c0519c27699c34961c5a1ca81b8cb1d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+d:hGqGJKEGqGJKf+6
TLSH
T1F9C77D56F5A481B1D0BAC174C6969776FA727C414B308BCB4386E72D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 49.2MB
SHA256 7317cd345804bac3481078d84e152b08956b8306a4e6d8fe6204995cca419741
MD5 720dcc9453166a6c0e4c970d6074e417
SHA1 5c46790fe000a1e250f92cab3729a8bf97ac3b37
SHA512 e98cda9a05288b7d9e30a0f4f6db1b65df584df47c11131ec3b48647e2f61649dee8e14312c74322ad170fd5862eb2c048e763bc790b0e1764af86fa97847ce0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+1:hGqGJKEGqGJKHl0G
TLSH
T177B77C55F5A481B1D0BAC174C6969776FA727C414B308BCB4386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 48.5MB
SHA256 a5178d2cb3a8ce7807e67e80084b140c875241c49fceaa4b258f7f61bfada2b3
MD5 23a4186a1a4f01d3adc1eb10e509c0c5
SHA1 7d10cb4ca4171f702309db94f128fa658c838033
SHA512 9056d4383bda83e3773987bea280e8764761fbe7dc45523e8e7188763d0417cbe00acbae0af0a81b087e1187182580ce2c98bea69950319dcb60294d51bccec3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+W:hGqGJKEGqGJKwf
TLSH
T1E8B77C55F5A481B1D0BAC174C6969776FA727C414B308BCB4386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 25.3MB
SHA256 fb02c6fbd3d6edbe6b4e3da3b5305e6620bab6ef0410be6efae88cfcee6cb70e
MD5 49e4e34b625434e3e13c4ed12a029b2a
SHA1 69020b87f34603f108a2a22a27d4062de1b1c795
SHA512 b15618d573517b1c21290f44e76212b5fe1f4ec5bf9f63f3523bd43a259cb174e6cc868f36e6ceab21e4ebaff41be3884264c63d819743b784afea673244cd2e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+v:hGqGJK6C16
TLSH
T122476C55F6A481B1D0BAC174C6969776FA727C414B308BCB4386F72D2F336D09A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 26.5MB
SHA256 f6b4a66d4e57088da3d01aecb6a6bb98e24fbf4adeb384e8fb93c4f58dc469b3
MD5 5465cfe35795fb3cbe17220ee688c1f2
SHA1 33af998aaea7df1eccdc6abe494a87d0d1a61bf6
SHA512 a640f1de6ce36f0edc7d08272809ce3321c3a5435784230626ecad34a88512617e96915995ed07a4f7c019f3c399ffafb06a27c8dc3430aa8ffa3b9d30430583
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+e:hGqGJKeO
TLSH
T11A577D52F5A481B5D0BAC174C6969776FA727C414B308BCB4385FB2D2F336D09A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 24.9MB
SHA256 429cbea894b4aff94fe13e674671cc7fdb465261c1e4fe94c33e7e205f4deb3f
MD5 4aa56c2e2cab50519672a33e1d412577
SHA1 e7bcf86706e6ad879a307ae6d597f873b1bf5b5a
SHA512 10caa71a737e5baf01dd8f298681c284083904a9229af1d47fd88090146344842d68abe507d86ddce9559665f14f9809ac7c53073fb9bd0e42bc02daddeabc35
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+U:hGqGJKQ0
TLSH
T167476C55F5A481B1D0BAC174C6969776FA727C414B308BCB4386FB2D2F336D09A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 46.9MB
SHA256 af11f022bc641c185398ea166bdde81a0f7a7fefb48cdd5ec4ae17d865b4a343
MD5 e3e685ed6850418f764f075c16177e9d
SHA1 d335647afc881bba64b1f693a84a393e18ca2b2e
SHA512 fcb0785729608312036cddb4aa191cf53728879ecbcc9444c2969c53f4d1efad26c15101048dbe806c281b29cc3a5819e48fba9a260f60813327f08a5a829346
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+5:hGqGJKEGqGJKf
TLSH
T136B77C55F5A481B1D0B6C170C6969776FA727C415B308BCB8386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 46.6MB
SHA256 1cd1c6b693dc24cf19192c258132e711d25fd1f35e4673fd36acbbb4be384936
MD5 530a4edb9fac33b674a397fe7454d9a1
SHA1 98f3fdb29772c2eb177dbc80e352635d65f8b8bc
SHA512 78059ac07854d4f68e08f15abea15c93ce05f5d4ff83b2a635109972d35c3a7c7b88a165ef2d9cce1ab30bb4dc509c5be37188189c47b48896ea56e6bb53e545
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+x:hGqGJKEGqGJK
TLSH
T1A3B77C55F6A481B1D0B6C174C6969776FA727C415B308BCB4386EB2C2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 46.9MB
SHA256 55031411a6d613dd49fbcc434aa702f9c7d9e4c17ddb02e7c4a1062598d9e44b
MD5 6e616b35103ceb7af7207db5e741635e
SHA1 14ad07b5cbeb3380bb2dbbcde24cb890a500f576
SHA512 c04e165f2065f6993748a947e5b414b2935c8feb7d3ca41ffb2455c95a7482ba1cd4558232018749b64d2637b28156c01a92631b61d1585bc4fad35b9bb2244e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+O:hGqGJKEGqGJKc
TLSH
T1DAB77C55F5A481B1D0B6C170C6969776FA727C415B308BCB8386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 46.1MB
SHA256 5df55e80e52bebe0f5273059acfac8e9e3328cb61ee682eb7a2315803044db5b
MD5 61d475ffc6ee0f05ac4127925c7aff74
SHA1 683abc18b63dff1742f75a3dd4a9f19ce4228f08
SHA512 46cfa6093e32b031040dc36e4e309c899e5684a68c75c0142c86a4fa2756304dab4de4cedfabc6bdb94d94fd764ddc716fa29dbb709b2df7248730becac59c06
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+e:hGqGJKEGqGJKE
TLSH
T1A5B77C55F6A481B1D0B6C170C6969776FA727C415B308BCB9386DB2C2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 45.6MB
SHA256 1de18b83834262e0a5c8efe76bc2112f3df1f95c204ea66bcd2a3b450152fc54
MD5 b5655e8293a057191e5a2d061c85d1df
SHA1 4e26af48f5c7422fcb3d1dcae98cfcd856919fc0
SHA512 ba140b33ba3873f7ec2a41ecab8228112537664ffa87f0cf25be62cfb303ba33f075ae566507bb3b81f8b8222181f3a2a8f6471c47e292c7fdc31f56f264a830
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+P:hGqGJKEGqGS
TLSH
T188A77C55F6A481B1D0B6C174C696A776FA327C415B308BCB9386DB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 44.6MB
SHA256 65de3e70671bf792e5f534663b99913c9ed823a5362f96ef9332adcacf9a0527
MD5 e66e256464fb6585345530a46513c647
SHA1 6c728abab50a5e5ea1adac81af0fbb27b04ae2cb
SHA512 3f398d11af1f35d3bd28f990a43405d550e5f900ac38fd0dc620c5d62e3deaf4f2e6b4d41b4a85b9164a6c6e69dd232fd739b02b2539ef2f820ffc90f168f799
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+y:hGqGJKEGqQ
TLSH
T154A77C55F5A081B1D0B6C074C696A77AFA727C415B308BCB9386DB2D2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 42.8MB
SHA256 e8819a3f82f120d52b1f9c86911bc48009e159a5bd2c5191542264b38140c0c9
MD5 b66941d9e6b891881a14887092be3f91
SHA1 98093e32450a65892b0bd493ade760b2767d2be5
SHA512 c28072e991786c1511ec676bf288091610717cd9c05b1a5a05248df7376fb6963a5bf0ecf9c4c3300970729e4286d30709fbc218b00070560a532ceca750c4b5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+w:hGqGJKEGr
TLSH
T11BA76C55F5A481B1D0B68070C6D6A77AFA727C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 42.5MB
SHA256 a3b654ec8ddd834c08c5625c8716735c4a6b4e5660da11cc16ee456cb42578d7
MD5 9e7a7c40cccce05fc06d384134050f17
SHA1 30562dc27dba8e104f3dd17e2678c62d7c577e65
SHA512 c92749f4a5b2f0f46626f44e8eee256268249c25e24863727e4b62b1aa94616e78a78b629ad7c8601c1679ec105e48ac164a2b6755a5117a927d0c4c5b93dc4a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+B:hGqGJKEGW
TLSH
T189A76C55F5A481B1D0B68070C6D6A77AFA727C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 42.4MB
SHA256 4c4eb7ab0fc90eb78a8f3fbec9f69b1601cc70ec717416db08dd366b50b88c5d
MD5 35f7e59a8b19a0a34fb2e4073e50329a
SHA1 641d33a5f464fa96e964691bc8d0fecbb67f1fd8
SHA512 901ef755c43bf299d1f2ff49289bcadeb43f15532bb04ee32632f75375e0533df80c62538b56ee693ecc96bce278845a43b4b6bcf5414e782f112f38a79bc8e5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Q:hGqGJKEGz
TLSH
T123A76C51F5A081B1D1B68470C696A776FA737C415B308BCB9386EB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 42.2MB
SHA256 1eaf3758354f820e418add94a8571fbcc62b1abe80bf2a07143ed71e054fbd7e
MD5 5c41db3d28684c04f0813e9dd8da9804
SHA1 0f914b7c4b850953244cd1c892afde82d5004287
SHA512 942e16d464c8df81563f2e7a8fe9caff0e69fecec824412fd82468969ec179f30bc79ba854cf853924aabd5ae7b60b3a9db0a93933e66b975ef68cae817d75fe
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+l:hGqGJKEGm
TLSH
T1C9A76C55F5A481B1D0B68070C6D6A77AFA727C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 42.2MB
SHA256 eaf5defe0f764e3ca8c9509a17e0e27e5409251d53f2297dab690b594a2b308b
MD5 64739e15cee29c45beb486233b09203c
SHA1 2a86512828f6e6fd63838c4207994c2a9a71e24b
SHA512 03400261ea7ccb79387654c4eb5d2920dcfee242e92e85a33ff12a9b80d1a5afd59bf100a6da4aba4699edc21f0e44785c69a4cb166b7427b39b903df3669ba1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+d:hGqGJKEG+
TLSH
T1F2A76C55F5A481B1D0B68070C6D6A77AFA727C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 42.1MB
SHA256 a4fb4f71ee98c7c0b395ddda11e23db8ead0ba4c2580b9309b3914a1b41e91ac
MD5 9e266aced2c25fef8506d86aa1cfb571
SHA1 7319fdcfa5f92392a1b3735637a3eab9f1f98fd2
SHA512 a23ae089e383f1616f52967a976876ccdbf4cd694b82131fbceeb776b59ad90f8e64134c1e0c6e97e3c8909131a9c3a736944e1b4d35232171772673165a067c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+w:hGqGJKEGb
TLSH
T1FCA76C55F5A481B1D0B68070C6D6A776FA727C415B308BCB9386EB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 42.0MB
SHA256 72163595be570a24c1cccc1d07248c12e3fb6a24cb126b308d3e6036b4cbeb97
MD5 66523e83454d76059b5915caca9fbbce
SHA1 f721c52607282c2b863c830c4193ced826839ba2
SHA512 5ff0a34b2f2b98d583a091dedead6e427bdb10baa7abcc5de621e11d16c75baaac505c6b514d05ced6acc0c4369641d33bdb1bbe1178899ce928bc9c4fbd1af4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+I:hGqGJKEG3
TLSH
T1E3A76C55F5A481B1D0B68070C6D6A776FA727C415B308BCB9386EB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 23.5MB
SHA256 c7be23407785c8deaf2fecb6738223b8e200b66b0a52c97c25d22545acadb324
MD5 974adddeb1152314a6833257788397db
SHA1 8936a8a020ef31a3a543d267b19c764e6ff04529
SHA512 5976e98fdc041c011efbf69e650aded16c6c4a8d317b6bd387f041a949796a1650e03841dfb5f3b59369f7a4b06bc753464239ea4db379bc4aff986876fa5b19
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1++:hGqGJKN
TLSH
T15C477C55F5A481B1D0B6C170C6969776FA727C415B308BCB8386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 40.8MB
SHA256 d248cd9c6069a6a773e06d57775c9bd49c5a024e42e29f224668d08ba32abe53
MD5 bbeb9a87c986961e252db4b69a14add7
SHA1 6d97e88e81d8fe0be0e7a7a91829b29fc55b49ea
SHA512 e8056db8c80321dc8e6d18624bc6ccb29ef15118332495775b73c9ffe70947b1dfa8c79e7e645e9ea8015bbfde1a1ed0f32d9cd44399c95b11d43b518e11fae4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+s:hGqGJKEGb
TLSH
T170976C55F5A481B1D0B68070C6D6A77AFA727C415B308BCB9386DB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 40.1MB
SHA256 a14c3c1900e87aea71c9119d7d64cda75b67d29819a41e1706967b9606c9c54c
MD5 e8cd6bc4d7bf8c99bae2b0b3ddc44db0
SHA1 76131e675ad1a2291b05be21cd76de739a17598d
SHA512 36627cb6b31968b94d2fe39411647e017afb8efeba882ab9665b32d6a06eb623d981d14e33fad455c4fec338bb520742caa43597ee3e5b2d0ca7658ff6bb893b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+L:hGqGJKEG0
TLSH
T1C2976C51F5A481B1D0B68170C6D6A776FA727C415B308BCB9386EB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 39.5MB
SHA256 9d8bb1d8bb6feef4d33c765974078487dd970b4fb8eb4d99b595e8e8b128c4b9
MD5 b9a7820a6b7a0925672d660a6063b904
SHA1 20a4a8caf7ed56c02d46768dca72f45adf74193b
SHA512 d271cdace8a66edc19891102de716eef3ae17eeba0b5a7c75eb8506fda0471f86032a724ccd6a37c58308f77337e58b21ccf7e159415347985221c6a90623254
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+V:hGqGJKEGm
TLSH
T1AD976C55F5A481B1D0B68070C6D6A776FA727C415B308BCB9386EB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 39.4MB
SHA256 817c328f849ccb61f6ba57264591569da204c4d31e9d36f295792d1919868837
MD5 82b607f388d65f7ed4534c6f404d680e
SHA1 1023fd5225c0ef9e7fa0d683964e74d9927642f3
SHA512 23708615a23b99af4c8bdf6e00746dce2055ee92e4f15980875edc184b30474f86597e9a94e01c8bd0dd5398e4e937d926b1c9d37d36fc1d221be50b31bc9209
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+d:hGqGJKEGK
TLSH
T167976C55F5A481B1D0B68070C6D6A776FA727C415B308BCB9386EB2C2F336D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 39.2MB
SHA256 1e4c9043858a6ea03e4de421abcffad33e21fc0b8e4def9ab78c029047490c6f
MD5 5aaebe9f3acdf9041d349d3ad01579ed
SHA1 29b330f28b97783f0a63f8790aa643170066fdd1
SHA512 d855fa831462f2b32981683a632550a10b8bad9492aa66da9a9fd515547adea5d6ddb6ac1980cab8d01b57b3e93a0286e2ae67f7cb9de300e5ad8e092f2033b9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+g:hGqGJKEGT
TLSH
T134976C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 39.1MB
SHA256 6c6d54db142b27547bc5578349606156e542ef5302995a66f4b636b56134ece7
MD5 1c186ec68c202528a0f4e3b5d1c854f8
SHA1 423db55e066c81d8d7dce7d98cf192d025522b4a
SHA512 ddc1c284d38669603f6595c8518c531a57916d1409be7d4c1395aac5886ca45b075333f9237c84b610ce4c4e890b425b83ce60e4e2eb32c9a35ab06a49fa7e7c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+m:hGqGJKEG1
TLSH
T169977C55F5A481B1D0B68170C6D6A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 38.9MB
SHA256 48cef91cc8cfc8499dfcaf461ff6d47b09b62934765ad25e4d0568ebf35d04d0
MD5 67b3c1fd2af7b3cfc0edbb99a5cd4621
SHA1 6cfc058b1cea245765fb40d7901b707a4b6c4db9
SHA512 e67bf6f79fe4d7ab957c35df24c7a4005c8436353d95290134a8baf7c0b7f47d4f74f8f199a0a079aa791ca9410fe0ae305752a28d6cef30c225cdd30fecc68a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+e:hGqGJKEGt
TLSH
T16A977C55F5A481B1D0B68170C6D6A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 38.1MB
SHA256 8db87733d00198b8b471e3dd585a830df88328da0f282ea22a4ead2e9eb5601c
MD5 ca9e33bd9d39131f1487a8ef2508d1d4
SHA1 e2f6cf36543a7e31cac84b9733552506f889b51e
SHA512 8adfcc03dd7a1d81855c1aa1e8933eff8bc80adfa2f99c477ac44d3fb8e512f9753d8b0491b744ffaa1a535a8da23826bcf933a5195944e5e4ea5bfe48ddbc95
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+c:hGqGJKEGr
TLSH
T171976C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 38.0MB
SHA256 f06d4debf76f2d44d670b16d27431aca5afdb66f3d06fc806913d1e2f02937ec
MD5 9d28fb75d968a5b27aff71290b800bbc
SHA1 ae4f8a44a664317651e08914a00b43183851a9c9
SHA512 34512d848e8eed7ed968d018a4eca92d35b34e208b5209e935b47483e3f4245c91e72f9d894bd46992b9cf111c2fb923d345949534831c0bfd82a7afc067f897
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+S:hGqGJKEG9
TLSH
T197976C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 37.8MB
SHA256 1086ada2709287f7844c75829bb7f72481ff90565df491e2c8e4e7829ebb47c7
MD5 149dec338aff05fb8b2970dc5e8f0071
SHA1 9da8bde7ec3539f14f32ade4e1de4c6043f1f99d
SHA512 0b0af3ae97345238c2bd46fa8e73d214e6fdb9b3839c612ecf478f4b74db91f7a376a3e4b4e2a04ee6ad2ec392490ec1315fb112dae6b0eac48004f0933f0d0c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+M:hGqGJKEGz
TLSH
T1EB976C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 37.8MB
SHA256 7dc08e7a8c84190a1044cc73587fd6689aba1b4b99a8ebfd87a134d0ec77ecdd
MD5 8d8ce13e0fe2e2d1bd382bf34554b003
SHA1 7e7b4a0a519d3c8fbae57de305288e653b0f5420
SHA512 45941deb83a2a0a75052eab173fdbc07eaf81ddb08f83b73a659d8164592eb11b9e535c9638067b5e228deb1652922536462f73504d1b1cc9b1fdb89c68cc2b5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+E:hGqGJKEG3
TLSH
T1D5976C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 37.6MB
SHA256 4ff88d4cee90d090051d2c9f0c3a255a2bd33b601f29ab891ff7a0fdea28dbf3
MD5 269df2eb916cf21c139e47463dbbfe00
SHA1 b58445ba5368fbe809e20fbc7ceb63370dddfc1f
SHA512 7abd1d745f1a07b3ce65945b152e061bf1fba12be55ab96f28eb69fe82b348afc1683f654c2a37f90b0ce967a2af65d7c2898150e8ccae1413705491a7a6f539
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+P:hGqGJKEGA
TLSH
T185876C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 37.5MB
SHA256 003ad2735caf3e90087f2d8f1b863620315b5f3f883a2c71a002714228177d7d
MD5 76c1b02939bd676507e9669cad7c68ea
SHA1 fe19e32a695a4f0bc0de957374ea201dd4b39b67
SHA512 61d8968d44c20dff3a1ed243c193c5522e7fb8f7eb88787d97a478d7ec887ba3062fa4e79163afe22d3e54b7c0dcb7cbf0fc713951627aaf20dcd364ce52b301
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+U:hGqGJKEGT
TLSH
T150876C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 37.4MB
SHA256 094b4e660096edd530a6987918c61fbe8709dd06807aab992f6945348a343527
MD5 3ab5ad7f649af6f552b2485ade9edd2c
SHA1 7af351d8fed6577b1cb99ef436906dc0138a6894
SHA512 0e82abc90e04c6404673e2c299cb8c7c9664f3c3b5a8f61150be9562d756bc057b49f9b1ebb14123951c3734484d98253a790c577e102135c96e568939d2f4d3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Y:hGqGJKEGD
TLSH
T10D876C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 37.4MB
SHA256 ebdbdb7a83c8894b62df371bbbb205ef2f005f41b03fad6d4224ddd96e4f74ec
MD5 c49ee2d0efe0454b475c762cdc36db2c
SHA1 4125468229f2ea2a607a740d89b2174b58fc33db
SHA512 349e46ffda51aa9e43b009bc3437207ec7b7dde4339ae7447aa48b4e5887f2b0caae3d4750dc55cb96e8031e45b6b5b732b83172c1843d47593dd03f4d2f9cb4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+I:hGqGJKEGb
TLSH
T126876C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 37.2MB
SHA256 f47da1c2d27765d66fbd9d28497513894217600d637e922b4cfd31b7040bd32c
MD5 43142995309b75961eb0b01a05e65709
SHA1 16da5e216db79d53317937415235c2bf2e35038c
SHA512 b67fdc9d8c7efb766bc4a6a92bbd0e75a4a55066d679d5e3bd3300de757bed09ed927d307f2d4215a0ba6bf2fd5c0251db1e3e4ee2432e6dfb50066decf14088
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+G:hGqGJKEG5
TLSH
T18A877C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 37.1MB
SHA256 467d1204f48027f94a71fd28122db56d3b4a1ef1146c044d21fccd7e4ddfc7d7
MD5 6a5a518c6ac0fedc69589c9393321fff
SHA1 e7cd657b2d283c71630e0bdc208b850ec36e6008
SHA512 706c87b1da37330652a30737167bea726593843c70e0fcb97fbfe58ae92d8dd02db0fe7b25a47893ac8d5d4fa7f1244f0ae0219f3eaeeaa0ef4fd66e12994b8c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+2:hGqGJKEGt
TLSH
T18D877C55F5A481B1D0B6C170C696A776FA727C415B308BCB9386EB2C2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 47.0MB
SHA256 14e82baf677b06b5aa1672444202e418a27bdc2dbe70b55cc5c039a1dc279eab
MD5 4a62db5583ed8d7f38640dc55362f938
SHA1 51385bf2a596bd950f2e06547856bdfb35848c79
SHA512 41b3ef924ddad271890d3e5145ce6178a06250cce7e15a8b6dd5c2f912e876155620403e9c5edb73d4b9fb0d076eec20cd52062bac4735de3a265bc6bc4f173c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+V:hGqGJKEGqGJKz
TLSH
T100B77C55F5A481B1D0BAC174C6969776FA727C414B308BCB8386EB2D2F336D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 47.0MB
SHA256 696ffe944ea7327ae1ff393e18652ef2733d7577020a5066699faadfe0032c09
MD5 bf1cbef02993b3bf2e1f3101f8f4624f
SHA1 7dc63f0038fd2d09cff4c7961ab97bfedd330ee9
SHA512 aa9d8bea4473f330a54883a82311dab1a6f1ec62b562e10eea4763cf936417d5037bf5ac24f8914dd45cdf241a3cae19350520d9f5ff9d07635c557cc720bb11
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Z:hGqGJKEGqGJKv
TLSH
T10BB77C55F5A481B1D0B6C170C6969776FA727C415B308BCB8386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 47.0MB
SHA256 ccc4ab1b48f155b7f63820d283b1dae588a5aa4a2597531dc6ca252de68d0b62
MD5 6f4146b31c2139ccec0a50f395d928b3
SHA1 f8d0f20dc4b5cdac845af2ce4fd8148c533c8a7e
SHA512 94981999c6a4e070feaae755dfcd6d50c3d3b5099d9fb6fe15c414a967627482791d643db90dcd71635ffc01adfe5c96d1aa1fa12d88ce63c60bc37815069021
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+3:hGqGJKEGqGJKFj
TLSH
T112B77C55F5A481B1D0B6C174C6969776FA727C414B308BCB8386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 23.5MB
SHA256 b3ea1175920f566e4e3a4b3eeabb113b928352978633e5bff9ea522acd627b48
MD5 587d143e9ed52cb8928088fe4ed23d3a
SHA1 ca30733df4771ccb85138e127e563fd9269e741e
SHA512 552fe21c3cdd68f53ed470206be8754da8b3b012d00fefb2c6c50946c8401d0c027aa79db4e064a990cb69583eb19e1b0157ae6d6b21248a2ebdaeb7fbab448b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+wGnow/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+U:hGqGJKXD
TLSH
T14B477C55F5A481B1D0B6C174C6969776FA727C414B308BCB8386EB2D2F336D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4236-2-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4920-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download