96821f24eef70b6d93bffd4d12e81a06f7e4dbbc069b3ae5e7c832e282615d8c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 12.0MB
Sample260804-m1tststyav
SHA256 96821f24eef70b6d93bffd4d12e81a06f7e4dbbc069b3ae5e7c832e282615d8c
MD5 8b0dad066c67411e3c7107e28678f58b
SHA1 de8869af3417fda435fea449965951bb60e24d35
SHA512 87957a60be2d20636696d0116802bd484d741b2da7ce7530b1fe8422b488706343420231245376f361905b943034b66b0be6374ebc5248dc80f61ae3992814e4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0py+:oWqQjp3
TLSH
T104D68D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\CheckpointExit.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Mail\wab.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3852	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5712	2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3852

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-08-03_8b0dad066c67411e3c7107e28678f58b_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 12.0MB
SHA256 96821f24eef70b6d93bffd4d12e81a06f7e4dbbc069b3ae5e7c832e282615d8c
MD5 8b0dad066c67411e3c7107e28678f58b
SHA1 de8869af3417fda435fea449965951bb60e24d35
SHA512 87957a60be2d20636696d0116802bd484d741b2da7ce7530b1fe8422b488706343420231245376f361905b943034b66b0be6374ebc5248dc80f61ae3992814e4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0py+:oWqQjp3
TLSH
T104D68D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 25.0MB
SHA256 8829016e691acb68ea319853edd10b1f9fd0529da7af825d2f9dfdc2a82fc6f5
MD5 df945e04a5c57c1cf4e7b81ed19e08c0
SHA1 cdb6ae86720619db2ea2fb1877938742be5e8031
SHA512 34ccec990732e6007669c146ca08a91db3e5531f6d97b7949172ebcee5ced4b6790419efa31324e36eafa66d670e4821748f6d1c167b989d8b2ddedc04416861
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIU:oWqQjpYWqQjp
TLSH
T162477C52F6A481B5D07AD174C6A6A736EA327C415B3086CB4385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 24.8MB
SHA256 48ae3e866293cac75a9a3f0a959fdce03d979071b972c23ea7c8725b6c93c5a4
MD5 08582860ffab6f7d9799c8fce8b33230
SHA1 be48bee64e9ee76b1516b04f07ad7dcad05071ba
SHA512 3464527cb27683c7eec12103fc2b092aa67c27daa3c63db126d202f19f9f9203fcad286a3e3ae714d46079f07c668f7b65e47d1eee6feff0cb6ce59187a43b04
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI+:oWqQjpYWqQjp
TLSH
T184477D52F6A481B5D07AC174C6A6A736EA327C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 24.1MB
SHA256 23bfa9264094321976fa5d101285f6108e180b2408793f060804a80884b8f6f3
MD5 ca280d8dae7b0ee7be33e2026c32c380
SHA1 e3cd55e5af93881d42d0d80d1f406d1efab558cb
SHA512 000c175263dc3046f3edc88af1a71b97d434d8da9de1d770a329db7eb5a8d6037c532f019c9aece833f829471075526ef87ddafbd71ff26f5d6024a3dfa42c5a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIZ:oWqQjpYWqQjp
TLSH
T1E9478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 24.4MB
SHA256 dc641c9913776d0a98da873d2c6aa9bfc8079368f458f61bfb65dec554ba9a7e
MD5 33c4e5a6d167db050e3be7e617e99122
SHA1 cc35119eff85006ec997c8bd42c8414f9b557075
SHA512 b8aaaf283fa320277a8a7d962d29036572f22597b3c90cd614cd97559391144cef18505f18daf55d3d4d7c4b5c7147fd275c247f736409055e2029bac565b072
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIY:oWqQjpYWqQjpH
TLSH
T150477D52F6A481B5D07AC174C6A6A736EA327C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 24.1MB
SHA256 466cd2e5c20f154f9c1b7a0db81a856ede82b2bf25bea258e9732bce9619ac53
MD5 eff07e93704a427b7f78e0ea2c253010
SHA1 40ef6f9721919aed959dc25360a7a09a8f12b7af
SHA512 33c99adeb4bf15ba004cde238cba8a15efe198eb71d8b7fe6457299e3d3e7bd3fb135a93c12569cb033915bf37e9301e54af783745943af89af26f9289984c74
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIh:oWqQjpYWqQjpK
TLSH
T11C478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 28.2MB
SHA256 fb7c34729565d02ccabe08d4fbc692d0d06f633285ee1b090c0d01e798b8dd83
MD5 d0dd2ec965678965b65e8717baa51eb4
SHA1 112d256b1d9153adef9b2f0564fd4da81710385d
SHA512 6d2052c0b0f8e5bd4cfe0e47234fe048d271493aa28f64ebaee92990a9d8da15aba14e34afa073439963eeda184da38756cde877eb5991a1c20fee315086c123
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIw:oWqQjpYWqQjp2vyEYKbi
TLSH
T168577D52F6E481B5E06AD174C6A69736FA727C415B3096CB0381F72D2F336D09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 47.6MB
SHA256 1baf391cdcde156a20418f1ed26c653a0bb0840ffefaf47ab5f0f45675b3970d
MD5 b8238a07535c07ffe91966c111ca1663
SHA1 a3587c9d192b7028c9401a9529d2b299c7d4e7e7
SHA512 4f2ab440cd36765e95f644d823b27c152b94acd90a9097ba4765be379e15e478cb25640aa236e022a0acb1d4c3e8b32841bfb82457e6ec8d2066c3ea3327e471
SSDEEP 393216:oWqQjpYWqQjpHUEtQevvqc2W1cpV2XI32i:vfjpffjp0E8c23pV2X+T
TLSH
T1A8B77C52F6E483E2E26A9534C5B18272EA727C0E1B3196FB0275F62D1F376D05E35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 24.2MB
SHA256 2870412ba80bc58fa0830a0e53521e2154e891c843ab98a6c5db7ab66f3ff8b8
MD5 7eb34164446dfe66726edef7975fb1e2
SHA1 e25e52a416402eba4a35eedf0c4e02db0d18424e
SHA512 ade16629cbc68f533ee4751be913fe30757066c22586a4416932fb7d897cce5d3422327cc423eb153637e01731b6218b976fc5c2d9fdf4bc04b0c612b6ef3356
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIT:oWqQjpYWqQjpo
TLSH
T157478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 30.2MB
SHA256 8d98c9a653ea06a61be4df1be66568e473140b17fa269578776864c9a1332283
MD5 da0ca35cc5bcca69e72fe4821ebd1e49
SHA1 f1357c44bdb454dbeb366ea572b6f42e26b45037
SHA512 88954e87d7b9a81c056875e949b7f0b90d71160ecd71303ddf1e55e0506103dd3d16355ad743511eba376c67d83da48cd4dae5941540f369f00e4b551c29f72a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIH:oWqQjpYWqQjpSQsas+PS
TLSH
T1D9678D53F2A441B5E06AD574C6A69732EA327C425B3086CF1384F7681F77AD0AB39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 25.8MB
SHA256 09f170825b9d57da6925c9e3f724c1b08806981b0663c0727ead250e6eaa9394
MD5 4952e758390249ffd0dd4a516bd1cc70
SHA1 a4dcafd6b0f15a63bfacf01847862638329d6d54
SHA512 faf103ab81d2ef05488a90d40c17399aafad6df366f25b12b972443adcd5487ac958298a9024cd2b182fcb22257b38f16dad12d73eb0ba9d4df3f41d06f783b2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIR:oWqQjpYWqQjpq/
TLSH
T1B2577C12F2E481B5D06AD174C7A6A736EA727C415B3086CB4385F72C2F776D09B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 26.4MB
SHA256 4e2c02e65140ec592cb8711e93a418ae3bdf7c31dcac071ac6777f444751f37a
MD5 cd0979f47ec4fcdca08e9e4a7c4c1a2a
SHA1 410e5e8ec97f3727c9b6ec95e0c3857a1f6e00fd
SHA512 7874c5b4230ef3e466b8f284d335936c45069332ce77bddb11970ec3c488a589dfb98df7440793f4109515b6ef8e436b7844fef863c7edae7288a1c4344c4c4e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIx:oWqQjpYWqQjpCl0G
TLSH
T192578D53F2E481B5D06AD174C6A6A736EA327C415B3096CB0385F72C2F776D09B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 25.7MB
SHA256 a55d1785d6ed0dc146c9705c27fa6d878e4a3b6adf266bac1fc6f6e02ce1a9ae
MD5 7ae33377fda8d727c34b0130e4f53fbf
SHA1 ac16c50f4e642ac72747ef80d9dc4428c2781505
SHA512 f512cf4abc40e7cca9e9630340dcda6bfb6b9399d20fc3c5f6ccda2063683833e5eac41128695d7aa65e6f62f49b7e80443915293cad89e53947e8c8c07cc075
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIy:oWqQjpYWqQjp9f
TLSH
T15B478E53F2A481B5D06AD174C6A6A736EA327C415B3086CB4385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 25.9MB
SHA256 80c28343eb0e2b612a2e3f8fdb2591666c3e93fbc9c113208babaa5718d3a3b8
MD5 c8cc0af7c02e0d02f4f21120f87fe32f
SHA1 b29a852e3749600a798d96afb402a80d71ef27ca
SHA512 939f71eb95c858e8cc3abda2cde6faf72760efb062716516e9a66a10e5456dfc8c5eab7bce9b4d162c7055f16bc724d92f616ee624b411774a45fcee66664dd5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIG:oWqQjpYWqQjpbC16
TLSH
T15F577D52F2E481B5D06AD174C6A6A736EA727C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 27.2MB
SHA256 1e3d71674244449802bcf7f13119c4bdfb0359ba899daabefc45765db9d0b275
MD5 8f43f3431cee70c13535e35c6e98f7b5
SHA1 41d1e37250f69bc594caf3abfe1e91122ab80359
SHA512 b3aa8a81fe02d5b8df2d362d22e55577265511a563ee0a65eec37c42b2e736151f428528a660a067478778827e873071a419ac3b10d69a450ef46f212bb7711e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIv:oWqQjpYWqQjpdO
TLSH
T152578D53F2A481B5D06AD174C6A69736EA327C415B3096CB0385FB2C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 25.5MB
SHA256 f7f417f1f7b5c091355fc35d8823f67fdbc3264bb550231a9bb00e46d0fcb514
MD5 f9bbea474193dd362d377aa768bab7e5
SHA1 c4315764d6842ceb6dd7d3a397bb93e21292c9f2
SHA512 451673a74099782c1afe0f381ec0ab05fe3a3d9128e5234c08a547eaf1001beb098bb778620d1adac6fe0148935323d0a4714059700d5606bef4468e5b7330cc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIp:oWqQjpYWqQjpR0
TLSH
T1DE478D52F6A481B5D06AD174C6A6A736EA337C415B3086CB4385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 24.1MB
SHA256 36eaa50fce5d21b564ee971b06a977d7fd12088dc0379faa15ec9afedf564968
MD5 7306fd45c6cf9ca9d4bd1e3e9d037a2a
SHA1 6c8dda5930cfc9fddcf02029f11eef63dfda0e35
SHA512 709da715ed949eb6514fcec4358b202fb0bea2fe2d2c48004dc0a0b58a568af40193968c2f1d66fee4874cce44937831d985706eb73efe0a82b20d390c12db4e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIN:oWqQjpYWqQjpG
TLSH
T165478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 24.1MB
SHA256 4bec9ee7b2bcc42e6f4f41cbe03efc8aa18e1d1f01da50b1a71461c1da7bbcab
MD5 7c81b78d45c62dde1d79b2e9fb6af751
SHA1 ede2e2d75e3665533579d464e410c7ec5e1ca2bc
SHA512 19d60744b2855c56d85e0394fa83de17c47f29c5943c506a76dd9b4b430143b7d114adcd61002ee3058590bc5fc2462a6d056960a70cf825ba8306f6d5498008
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIZ:oWqQjpYWqQjpi
TLSH
T124478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 24.1MB
SHA256 72b3e5e31a73883f86aa71ea9c6e40271811e879270d80ebbd0031ac10de6cb3
MD5 3dac05223a3f9bbf0b2870329865e277
SHA1 c87bcbb14591a9fa25722317609e21ae2a18c683
SHA512 0b293d70f7cae4291753f2ab250dfde353eece78dd69bbf81dbe8f7eaf9b417b17c4d18c86ea6eb1b4b8436c6761dc7c97fa4e8c297a2c436c22f94abf185cd3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIC:oWqQjpYWqQjpN
TLSH
T177478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 960KB
SHA256 b6bfa9acdd9417d53631eeb3e32ec0937b3287ab4963d3a18fcb0b1ffe79f4a3
MD5 ad4ef2f7f6b86fc306b38d7103462205
SHA1 ad2979c17b1a211a9a8acde89bbd2ff72d9ec3bb
SHA512 1e2760f39446e0d7489f0e4dfd1bdb391d7d0dc1eff90cec1b0c8e3fab7d538d47013f2ddf8f01ef4996674698f5e66d5a352944be39fd7b21316baf1227ecd0
SSDEEP 12288:8ESvdPZD/JGMj4IwHfRlz6YIfrgueRug09fkVJjBq33vb5D:tEBDRGo4x5x6YXuquvkVbqPbV
TLSH
T130259DD1B5C180F6D6A5583084DDB33AEA76EE8227108BC7D357DF182E361809E3767A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 24.1MB
SHA256 d9142178f0df56b791add9f41c0bec88f446ff070bb8783879d2afa49bd7b93c
MD5 09f54d863eec758a83cd2404901ade23
SHA1 c4c4e1ad1ebfb1f8a662c942ee7681247608d8a2
SHA512 2131f8b41d47705a8c7721740005079d6f553a1722f0e97e7b1c1fc09251dc06084c14fa6cfcc898a3c628ba2bbdd96169710029b38e0ab91051d3efbb1d76dd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI6:oWqQjpYWqQjpV
TLSH
T14A478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 24.1MB
SHA256 0933134cf3ecbd4fb356dafc61ac200880bfcd319d2a8df5ed7e79015613f8eb
MD5 82c3ad46f86be8071993c1c563980b82
SHA1 846efa579671f55cdb14eedaf1061004c63919ec
SHA512 5d5e7a6e437853e94249e45e94cbb49e8b44948e12ccf65a1ce26b36222bdbeb9b84aa6ca745dbc74593822c51c6f87bba683270070fd1386733ebd8ca734e68
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIV:oWqQjpYWqQjpy
TLSH
T13B478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 24.1MB
SHA256 c999e9fb1725699168dea339ef8a70dbf4fcef6fd8bb1296d200debf44d94ea3
MD5 d76145ec67ed882e1dca93eff976c4ef
SHA1 2aeb51aa049f13780357b1a89b5363f58a0aeaaf
SHA512 54260b3fe5e81b1f8520af106f7dbab4cafe8726e6af06c524b31c6e822fad22af625cbfe5b64725cf5a943aa082fee49cbf914ff85fc2faa1358763c8766169
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIi:oWqQjpYWqQjpd
TLSH
T120478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 24.1MB
SHA256 d2763de362bc1973c8aadeeb46b79ee39d75b662f189637f02edbc94515ae517
MD5 036932acabcc37f21f1c1d2374dab3c3
SHA1 a37e6844cef53953ca5818d3e5ed99a475607063
SHA512 f4406fe151d4f02911731e88c8caf744f27e18cc4d59626515400b3ed6b8f1de06afbec01bc737dac692d94879d34b7f0f4140539afe955e5eaa46d6b76272ed
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIL:oWqQjpYWqQjp8
TLSH
T18C478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 24.1MB
SHA256 807518f6a41813544afe47dd4c5c3e7264365d7cdec12920d2827745559800a5
MD5 e90c30575a56ee4e26a7388fc4c68cd4
SHA1 c065daa35128a43a473207889af7b004c2b75188
SHA512 f1a0ba62960328e1168d9bc3eae21428885445d6d7d2a1a5f62afe88a79a286969ea41bd9a72137d13024c1e9f8b22288bd9c322163c0f7bb0b47adf7d3ea6b6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIP:oWqQjpYWqQjp8
TLSH
T1AF478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 24.3MB
SHA256 995cbaf23ab08d005d859529055155c724c5fef16c7cb6115b2de8739941ae25
MD5 54083c99e7d188ff19d2aba58a6137db
SHA1 52287711b58faf9b839bb4bd646a911b77456dfd
SHA512 fcb8f7b3f948b89aaeeba6dc5f0939bc96d3b5c728bb066c14cd8cbbebf0cfd8de1b5bced26f998062f45b84a0001fba9d9f8511c80876c8358e6850b9911599
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI3:oWqQjpYWqQjpg
TLSH
T107478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 24.1MB
SHA256 3267391d9a0332117ab916f5a4ff0f16d8fc91cf282940ee17a26222971dfc87
MD5 8433809359844e7e10d3bce211da6d11
SHA1 ee80e63700f1c46c47f7a265dad3fdbab89bc38f
SHA512 8d672afbdb3dc8ea02e553d8687f563c445df5bcd7508ef186222e7a1b68a6d21797793e9d114f63dad30c99e46f86e034b0b93059d4e86a6349678f8acf77bb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIG:oWqQjpYWqQjpx
TLSH
T132478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 24.1MB
SHA256 873c4d30a3bdb6e9b8e3daa08820817d868238a2859032081e39060723b85345
MD5 3226622e5535ca335585c1e419e337b5
SHA1 3b7e8104947163144e11e21b2045328d07f2ca42
SHA512 f1ca12f5b95dbb05ae92e3660536182309c634fb36599b5192a78e35a527ba29208b9192a6186a0d7cb593777eb590e852239e4afa44104d884f8ee63bbc3802
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIQ:oWqQjpYWqQjpj
TLSH
T1EC478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 24.3MB
SHA256 3dd32be61eeee396725ea1af7e136a2e1e7eb48a6fac15f1936a27bd48bd3032
MD5 ad3f1489b24bfa6506b47b97eb638b93
SHA1 eb7d001b98c2bbc438c973527deb12a032548641
SHA512 3459ded0e0144d83c704695115de702d8a51a8bc812e5c253922c543670182ddc2d0068aa21a2716de2d3b2bd9bfee9a6cd300b4e56b7b3ee3cfdf5413c75261
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIn:oWqQjpYWqQjp4
TLSH
T11D478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 64KB
SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
MD5 071d69befc4545d16c8415ee31c5afdc
SHA1 98106920c20562db4df0d21c498f51369d927ad9
SHA512 994fdea351d7be4c5434f4840958dad54941761c7132fb3cdc5aa3821de5c697829bc462ca8428d6341e9076d304a231f945e48f12c618c86ab01045a26eda17
SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0UeG9ODBZHlsP:2sXDsmJDZzgyQsRDptkar4Vyg/B
TLSH
T14D530EF819C0F18AF8D1D571A0C9B33926EACDE5BB5047DB7C172B429EAE4800397D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 24.1MB
SHA256 364437d8ed3d4cf6e6796c06315673ae4d5301043280fe626d2db40e924d1e4a
MD5 e16268ef8d0ef111793d4acb4ac9d8e7
SHA1 36ad03ae3a86f591a380f99df061d5f9d3fd3fff
SHA512 79380c8b63f265280b9ea112c741ed46ec20345f8c06ca2d1e96a3efc7fddb7e2bfaecb40d8f3c51e8068566b36a198e132351c43259f7eae0b41774e8761bd3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIl:oWqQjpYWqQjpC
TLSH
T176478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 24.1MB
SHA256 17c88656cfb03aeec4df641ee887187ce820534cbd0e2c1fb29de49984f863a6
MD5 6d8ea745ac7b8f216adaef76cb22285f
SHA1 3c4ddc0cc01fae5d534162db33efc73738a74685
SHA512 44f41bbb26f60c30670c8bc84bc7e20b623cda5d8dd9655b97d9fcc18173b32e2bd8412eb5195f99b2ce022a9a7c95131f2c603e35f4319666d5f2938dcf2b90
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI2:oWqQjpYWqQjpl
TLSH
T1FD478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 24.1MB
SHA256 ffdcf8c73432a16fe75b0d2ae945b6daa459d052a2d6c50df5e42328eea9d570
MD5 34c42b5ffaf9452169f62482934e9fc7
SHA1 ad66165538a08ef1c2c04c5c5585d557a9ca96d5
SHA512 3f1e817d45eefee17d0e60c0aeaaed4cbaebd06e4cfcd22575c51da8833d0723e752b4b8dac15aaec82454d3d18490aa7de9b7102f1ae227f37cf23a7c42424a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI5:oWqQjpYWqQjpe
TLSH
T14A478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 24.1MB
SHA256 b601b151a597051c67c3472d66115546b92166aef92cbf221b3782233589cdc3
MD5 9196f88774b9116598d5dfb4f0db5114
SHA1 9aed71c1a36dea14857ceda7640f8ea2eb004eec
SHA512 6f4a2fbe3784d6673558b3815e0f784b313c1267171e167d42dd8f769cc479447774140c2431bfad1627a3dbee6a01fe2852a34e241af6d0d873f4962bc2462b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIr:oWqQjpYWqQjpc
TLSH
T103478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 24.1MB
SHA256 2a3101faca92585b7432e90e9ef74439395d5a38f5936f581a0687c0cc58c8b1
MD5 d79fe138b51e27025fb401b277e0d333
SHA1 9c0d9a771cc0f8d00a4312873821a59f7818819a
SHA512 90133cf7ab3916f9f03186220657e831c186fc20bb9bad1780fb1ecfbd294b56c52403cd315f23d5ad8c2a3305f1f9ef97a52667da645d255481bbf9a48fe49c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIi:oWqQjpYWqQjpF
TLSH
T1E2478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 24.1MB
SHA256 aa0a3720f3ecb79a0bb1a18a8d1a3492de06432b478f82980ff7e3691455dbcc
MD5 3317e4b275af28d7c74ee753099486d0
SHA1 ccdbf036e97fb006d0e49e15549cc0d8a6accd66
SHA512 cbaeaa3eed5038a229f2670381cf05a2b7765e71e08ce9046e03d8f522ef13d49b906b4f831fe81dc7e162c17f36ce357992ee7dec991d1944400b6b60a553c2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIS:oWqQjpYWqQjp5
TLSH
T1A4478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 24.1MB
SHA256 d226015b9b81c32b90dc253e9eecd5b02d374233c1f580256fdeebff6957c3ca
MD5 c7895e114d4b137d74265eb280505af5
SHA1 0d58b11ffb8279b3dcd2ba6da28cd2ca817fe6a7
SHA512 e1a29d6ffe25a92e02ff67bf3ce25231eb6c963e063f4d1849f44c850530e53c0e7b845e4243872ef9ab6e5a43e1dd7b481d97993079388fcd4178ebe0845ebb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQId:oWqQjpYWqQjp+
TLSH
T18B478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 24.1MB
SHA256 7ae5118dbf48640ad290916e82d671385756a2b097e67a0201c735eb0a3f165e
MD5 eb55a27ba809e72f4427afc35ea719b1
SHA1 585d11bf826e79586ffe5bff2c067fd6d465962d
SHA512 ca14667015df1f8b20fe03ecc64d430f49e27f2804f0f206cd3e116c2856af9b6ded985646eaf31358de7c4b1beb331edf0b56d22467fe2d53ac087c67788c75
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIs:oWqQjpYWqQjp/
TLSH
T1E5478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 24.1MB
SHA256 6bf23572a91c8c8f3c83f673912d90ccc540e10ce8c56fa366f601e58362e343
MD5 30161cbdae7d655999bfc3179fb8ffe8
SHA1 727ded0ab6df3103d33e15d55d7c913bedc78806
SHA512 ff6fe583c8ab865998cbfec352e805d9878219c98f4b78e0e480f35efe2872a9f5cc97b94ab0b12826255dc107a2ed2be286cacf1d7c682d8046e22301b39745
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIs:oWqQjpYWqQjp3
TLSH
T17A478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 24.1MB
SHA256 10dc0cc8bdc9918ae68947c9f9cc668d53c9b032a86d9974edc7805aa297c850
MD5 f1534962972110ea0864c92cd9698abd
SHA1 a7054d1201baaa27d11357fd7639f64b565df501
SHA512 353440b622c69302020067f2417ccc40731b59572681d047bb0cdba327832c9ab89ded11d288f6e758fab4cc6c14d3a380904a5f84c35b42a21c967185ee42c9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIc:oWqQjpYWqQjp3
TLSH
T182478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 24.1MB
SHA256 ae05565a892383bca8797a756e516db2f479a53b58af842fb6d489f261219531
MD5 ea73bbefaaad35618c5a46bc4a259aa1
SHA1 269667da726f671c84d7a66be878fb0195fd7502
SHA512 2e4579d5ce9c5fadbba2d1a9ffe401b8b0255dc5c1d5d93233adc7fb3f804237e8702174ba8dcb629a51c4b741f3ecd9a9a772df65b89c838b5df2e516835e7b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIY:oWqQjpYWqQjpX
TLSH
T1DD478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 24.1MB
SHA256 702227133f56f487a8354e6dc9e5868a3e842e98fbd93d23036a4d5ce895d587
MD5 c43e8c5dd8008b7b2d6597e7c6806b50
SHA1 3bac350b4506390cc8d7c2d2c4639f092d2296a7
SHA512 f71f94b5c2029f9e70769692d0ce384925f6b56d1b2402aa14680991039ce0a0e1e7fa444fbf2d2b48ef6749bab5ed9170aac6d390a1c7cc3df76a540d9a4a5d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI9:oWqQjpYWqQjpq
TLSH
T14C478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 24.1MB
SHA256 0346db21b95b9dd3ff6ce7e1fbe943df43f7975fcfd9ea7ae955631bd0af65ee
MD5 bc1cee55d9e4f47e6319cd6d09c9c7fd
SHA1 8bf04741d5be1e63eb4be4e76e63e51df881e7ec
SHA512 79e29e663cdf6e72a1c96f1d376a193df10ad538267f46aa06bdd29abca3e4eb2b97784d75f578d29280f7162cdb66cee37a54a835580e4573f2c3bd1294ddeb
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI/:oWqQjpYWqQjp0
TLSH
T1EF478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 24.1MB
SHA256 6ae515af75fa628595eadc175823f1d5da19c9c4e12c529905696d4bdbf158a4
MD5 472d5622ce4741df15c2f329f5bcf42f
SHA1 3a024f2d30a29284d5791a6685a29131935a113c
SHA512 cf95fc01ec856f2f5c801a8a76c0adb9a35cd9fdb52639e12f6a14aa42356f1747ab5c3d3c6f3739c37cc698e1d83139cff0ba01870df6dc5ec63a040e44f1e9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI5:oWqQjpYWqQjpu
TLSH
T1BC478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 24.1MB
SHA256 57e232bf1a48211d69dc93f85a085b897b8de16016bc000d1009e56bb3c27180
MD5 4a86e2a2c9f415b589e184d8319b08c9
SHA1 b7b5d7dcf90945f67ebc7029a5b2cff1ac39c59b
SHA512 10835518dc671c62864e2679f28aa7ffad7c842f6854aafd2be4dffded0e04bf2c209b1f062e8ea2c38bcecdd5680d5569c888abe0189403440983671b131726
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIX:oWqQjpYWqQjp0
TLSH
T189478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 24.1MB
SHA256 30cf1624b65c275555d4caf1f3ff5053df61a1d583e4aa62664240ef401d4600
MD5 aeedf7b560b74f010014dafb2e77a899
SHA1 1d21c84264550043bd5ca9a73fa54230e21c4c75
SHA512 c5cd12860716a2035b9d22564bc72f6882bd096bb342e4f285f9ba860a47eb15ebc1590acf0dc856a85f505174fc2e3a3e223fe63cb754c68a0ba5b385a68f1a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIY:oWqQjpYWqQjpf
TLSH
T175478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 24.1MB
SHA256 34276a33a9b75813239677dd8d15e6486d1e9361973de821b2e748c008f0fc81
MD5 facb566095b9c399846a6014249703bc
SHA1 7bf53715fef5446737af33abfd3f9ec36da9e941
SHA512 3021f32ce9227e7d952e527f8988d86139e3eee5dd98fb60be3c2405f25b899bb1d3b81425acac9b49d7310dfe2c4ff7a71f5f0df1a4711d344fdc870a7033d6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIB:oWqQjpYWqQjpy
TLSH
T171478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 24.1MB
SHA256 e4b668a41384121dff2b8cf677f79db78088e00960851d66908730fdc457152e
MD5 c4fb2fc90a464b9f2289a632123d490b
SHA1 0c83deb5d13381a6c478b22d6f6c6060691910c8
SHA512 4a14837a685922562e25040960ada66ce5fdafe4c12072ef12cca3327006829933c40daa21117608e336cf1f830ee5f783dced7034651345a960fa95e8f0951f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIm:oWqQjpYWqQjpB
TLSH
T11C478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 24.1MB
SHA256 3cd88a0bbe2cdddceb0396f35588e40a3e98abedf0f7bb99f192c7cdeb9f3945
MD5 728a0a068f26c889d5ec71dc1466f009
SHA1 3872d6abf004da809583a511acced0574784cba0
SHA512 4260f9bae29ec36e5a50a4fa8d1d64f6094879bd34832da7a412f8d3d2e78143b5f271c6709a5be4968f089665f111df6975dd1e4ff3086f8d7a0eb0c8c83e9d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI3:oWqQjpYWqQjpc
TLSH
T1A5478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 24.1MB
SHA256 854d57dc9dd07daaf1c6a12de56ec5808238a03e9293314e74f970b2b2c2c4c8
MD5 79a7cc6b4361563ccc15979dfbed87f7
SHA1 88e33b459b96f80f6914b0245793d502297641a6
SHA512 bf6fcd57bb60e1c623723442c87a64103398365b362f593d566358283ee6be6aa300cb89c3bcd32d61f6dc68c94864fc2c75bf5b856712be37b4c9caabcef243
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI5:oWqQjpYWqQjp+
TLSH
T139478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 24.2MB
SHA256 fad7a62058864b1fc8e8550a219f19c7ffdce8960181dfa40ff9feebe407b737
MD5 e090e057481309d9d65c6e9e2bc50def
SHA1 3ad5f9dd193c70b6d8af1fedbb1e4cefbe9a49b4
SHA512 5a295d4a277301efa132b082adfdcccac77037d98d48c70e114ba71b633a9d67f41eecccac7c55ed6afc17efdfc5fc9d2cee1c0b52f2ad0b8827ea01ba337887
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI5:oWqQjpYWqQjp6
TLSH
T1DF477C52F2A481B5D06AD174C6A6A736FA337C415B3086CB5385FB2C2F376D09B36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 24.2MB
SHA256 00a91b989c79a1f02674feb97c1c47a57b0da70f7f6499d193dc1be7e2497019
MD5 dd3ab082934517fcbfad4d421085172e
SHA1 d5f6a8cb4e32f1e075f8d9797d211485c79204b1
SHA512 3982022c914cda1140721e843ee83bcf544627e0c3489d086a126b74fc0d6e6ac280d4c20b1acf66fe5eceb6b8aff2ffacf0655479414127539f8c5b28d6283d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIF:oWqQjpYWqQjp6
TLSH
T1D9478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 24.2MB
SHA256 bd39c821c36681fefb34459a1b29958f6c0f3b295e29e6c40a48a6ab913e0753
MD5 23a95c0d8051c9d9dea37102fa76be0c
SHA1 79b36a70948cfb249298ae5e1597d0b8abce5c9b
SHA512 74fb05890b0afa1311ae8868d60d62acaedda0fc8e290703149289a8c3a4450b10db72bbb3cd49820e3fd16de34d1c86afae4e0c62cb996cb1ea633be8bf9a38
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQIz:oWqQjpYWqQjpyj
TLSH
T163478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 24.2MB
SHA256 da1d0b90296c7c503bceb5203012f74133670b39188d9b63a03ad6d31668ea02
MD5 b2ab8617d6c3b9fec42859c6fde968cf
SHA1 29896bb820defdf776df73d22de6100a21137163
SHA512 7bce3355190941c03aed6e37eccd5d3160d064dcb3874ba916e207f3446cc58120ca3fd503285ef84a50106df3dbfe44e4171cd7560769ad1f452ad5d8485769
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI0pyuw/h1+Qw/h1+cw/h1+Qw/h1+vXWqQI1:oWqQjpYWqQjpwD
TLSH
T152478D52F2A481B5D06AD174C6A6A736EA337C415B3086CB5385FB2C2F376D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3852-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3852-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5712-2-0x0000000000400000-0x00000000004E4000-memory.dmp

Download