6f4508485f58cb12c549291e59e82f135280669ef108e9b0cf846ed4673cfab2

Analysis

max time kernel
150s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Size 1.2MB
Sample260417-q2rlmsaw4x
SHA256 6f4508485f58cb12c549291e59e82f135280669ef108e9b0cf846ed4673cfab2
MD5 19b6f7575afcf7904d809cd8b9e4893f
SHA1 aa53000eaa46df9f9c9579ee84adb6253fcf6f75
SHA512 86932825128751d57b7486e5fddb26c9464997005d159b70a8395083a36074092c86424fec908a240aca8adb90d345c032985cadd9de776adaad4226b1c2214a
SSDEEP 24576:KK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC2:P2od+YBMF/XS/ezSC6vUzPvMC2
TLSH
T148554C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4288	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
3916	YZH.exe
3596	YZH.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened (read-only)	\??\B:	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened (read-only)	\??\A:	YZH.sys
File opened (read-only)	\??\B:	YZH.sys

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-0-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/files/0x000a0000000242a5-6.dat	upx
behavioral1/files/0x0008000000024470-13.dat	upx
behavioral1/memory/3916-19-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/4288-18-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3596-28-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/4288-9-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/files/0x000200000001f2b0-53.dat	upx
behavioral1/memory/2344-58-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/files/0x0001000000023434-60.dat	upx
behavioral1/files/0x0001000000023430-59.dat	upx
behavioral1/files/0x000200000001ffad-51.dat	upx
behavioral1/files/0x000100000002264e-50.dat	upx
behavioral1/files/0x0001000000021601-49.dat	upx
behavioral1/files/0x00010000000215ff-48.dat	upx
behavioral1/files/0x00010000000215cb-47.dat	upx
behavioral1/files/0x00020000000229e2-46.dat	upx
behavioral1/files/0x00020000000229e1-45.dat	upx
behavioral1/files/0x00020000000229e0-44.dat	upx
behavioral1/files/0x00020000000229d9-43.dat	upx
behavioral1/files/0x000100000001ff80-55.dat	upx
behavioral1/files/0x000100000001fcfe-54.dat	upx
behavioral1/memory/3596-40-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/files/0x0001000000023428-100.dat	upx
behavioral1/files/0x0001000000023432-102.dat	upx
behavioral1/files/0x00020000000202c3-116.dat	upx
behavioral1/files/0x0001000000021269-132.dat	upx
behavioral1/files/0x0001000000021268-131.dat	upx
behavioral1/files/0x0001000000021267-130.dat	upx
behavioral1/files/0x0001000000021266-129.dat	upx
behavioral1/files/0x0001000000021265-128.dat	upx
behavioral1/files/0x0001000000021264-127.dat	upx
behavioral1/files/0x0001000000021263-126.dat	upx
behavioral1/files/0x00030000000203e8-125.dat	upx
behavioral1/files/0x000200000002030c-124.dat	upx
behavioral1/files/0x000200000002030a-123.dat	upx
behavioral1/files/0x0002000000020308-122.dat	upx
behavioral1/files/0x0002000000020306-121.dat	upx
behavioral1/files/0x0002000000020304-120.dat	upx
behavioral1/files/0x0002000000020302-119.dat	upx
behavioral1/files/0x00020000000202ca-118.dat	upx
behavioral1/files/0x00020000000202c5-117.dat	upx
behavioral1/files/0x00020000000202c1-115.dat	upx
behavioral1/files/0x00020000000202bf-114.dat	upx
behavioral1/files/0x00020000000202bd-113.dat	upx
behavioral1/files/0x00020000000202bb-112.dat	upx
behavioral1/files/0x00020000000202b9-111.dat	upx
behavioral1/files/0x00020000000202b5-110.dat	upx
behavioral1/files/0x00020000000202b1-109.dat	upx
behavioral1/files/0x00020000000202af-108.dat	upx
behavioral1/files/0x00020000000202ac-107.dat	upx
behavioral1/files/0x00020000000202aa-106.dat	upx
behavioral1/files/0x00020000000202a8-105.dat	upx
behavioral1/files/0x00020000000202a6-104.dat	upx
behavioral1/files/0x00020000000202a4-103.dat	upx
behavioral1/files/0x0001000000023426-99.dat	upx
behavioral1/files/0x0001000000023422-98.dat	upx
behavioral1/memory/4288-182-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3916-183-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3916-185-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3596-187-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3916-189-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3916-193-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/3916-197-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	YZH.sys
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	YZH.sys
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	YZH.sys
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	YZH.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	YZH.sys
File opened for modification	C:\Program Files\dotnet\dotnet.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	YZH.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	YZH.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\YZH.tmp	YZH.sys
File opened for modification	C:\Windows\YZH.tmp	YZH.sys
File created	C:\Windows\YZH.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
File created	C:\Windows\YZH.sys	YZH.exe
File opened for modification	C:\Windows\YZH.sys	YZH.exe
File created	C:\Windows\YZH.exe	YZH.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.sys

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2344	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
2344	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe
3916	YZH.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3916	YZH.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 4288	2344	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe	86
PID 2344 wrote to memory of 3916	2344	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe	87
PID 3916 wrote to memory of 3596	3916	YZH.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
  C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys /zhj
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4288
- C:\Windows\YZH.exe
  C:\Windows\YZH.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\YZH.sys
    C:\Windows\YZH.sys /zhj
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 aa653a0e5f3b99a39c3b95064c1d99c6b9b6f135abdd44a63e7282cd987c5873
MD5 a6ee2ffb5e7a413b3fcb43c99daa3427
SHA1 9667b0b8275eed55e7643e4a7573a2240fca42f6
SHA512 9a0b83f0176cd73875d0605c5dd26e9806406c785c02e3a0f731a6cff5697b4e7bcc25cc8a319976a388544275f585b23a5b164d2fdf325e2268d79dca8f2dc5
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCCPji0Aj2:d2oNBMhXWezSC6v2XMCIjoK
TLSH
T183854C66F6788372D072D0BAC5D2A75AE9723482573089CB4386C76C2F277E6C53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 161bb9c883ad289b8ebe3afe05dae8d2c528357422c023d9124ce57bdc785b73
MD5 6106fb6299e427716eeadb15722e14fa
SHA1 580df06f2487ab92bd9debd8e146253a9ee648da
SHA512 e6dcf3b796a4ce6ba210266c975a8aae3577ca97c5d0c17526a861d6003ea85af8f602805614ce698bfa9f81e4411fce790f231029f7e0cbfe8b0e4c8ffaa8aa
SSDEEP 49152:B2od+YBMF/XS/ezSC6vUzPvMCF/ezSC6vUzPvMHjyq:B2oNBMhXWezSC6v2XMCNezSC6v2XMHz
TLSH
T18AB51966F5788333D0B2D0BAC5D2AA5AFA723482573089CB4347876C2E277E6C536735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.9MB
SHA256 01b80632c53dda2333a3cf3019b3de91682a566d17b7869d4f1061a0500cd769
MD5 06226aa7bd70715302f9743c4b4ba107
SHA1 d8f302ea398bb439425765966e2c305730892e7b
SHA512 c01be8d6c59f5ecf6225afc4d26e3b704926b681922de32655d7145b9473eb38b13c9c005bf0afc718f32f0e188cbb16682b9476c4c738a8b0f7fdee5c529115
SSDEEP 49152:B2od+YBMF/XS/ezSC6vUzPvMCCVO88hXl+M:B2oNBMhXWezSC6v2XMCl/h1+M
TLSH
T1E6954C6AF5748232D072D0BAC5D2AB5AEA723442573089CB4347C76C2F277E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 2a11af7b67a6e41062db263de493f3a4472b4365f597931cd4483bd34bff496b
MD5 02960e78ab13f5b0d40c09311d751255
SHA1 abcd6eeb6e972cb4cf7b8961d0ed5ad9d04b8b83
SHA512 e0fdd99233a6f4f9c2ef6ea0baca25f734fb5de5e216adcc5469ac0f8c27516d9bd14540fc721f0381676a10244bddbda756f0c896f6e51182fa22faf4bbb49c
SSDEEP 24576:fK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCMan:i2od+YBMF/XS/ezSC6vUzPvMCv
TLSH
T102555C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 88fc183450428ae3d9617a592051105d93d62734f28f4c5db41ff4cb92de9476
MD5 725c6d8e5b81b94517b2127ece6d6ddb
SHA1 7ae5668fca203894c930a9cdfc5197272a6d0f0c
SHA512 1a686274e7596f85ea7ffe62fe784ce78ad973c92f5516bbfe3f3a68b83f21e243784178267c8ad78c89fb303ac4d95f3f106a95b29883decb7ac579e83afc05
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCtJIUm:d2od+YBMF/XS/ezSC6vUzPvMCtJIUm
TLSH
T1EA756C2AFA7881B2D076D0BAC6D2E716E7723492573086CF8352835C5F176E58D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 1.3MB
SHA256 14596e74ba814430b7780f1d1e43eb78a2897671e749f72dee6df503cc0df42b
MD5 38a1d3bcc1caf61931b222a79e41545f
SHA1 3ccfb58117c015967954496ede594108b02a4404
SHA512 a66f957252e9111bd456e5accab3cdaade33057b3e93d3865a2d79c82ccb30a170bf3b26c0d393c4305187eddcfc8402f4851ba419c543256c28d0f25a31e94c
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCn/:d2od+YBMF/XS/ezSC6vUzPvMCn/
TLSH
T18A554C6AF6B88232D072D07AC6D2E71AE5723482533085CF434787692F177E6D53AB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b1299f7c660598cabd41d8720a8102dfbc5e75b0a2da2e232266dc742b92bcd0
MD5 735b538c9497a6fd7f097b50c468ee22
SHA1 2e88fd662f262940a486b12b92b02691aa0fc9e5
SHA512 a45a32daf8905832c522b7011026274daff498fb799b1bae3342734d07215f18f036b152c2c75675f71515d0e894128737042002629f52f96ef902d975586218
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCfaewsAja:d2od+YBMF/XS/ezSC6vUzPvMCilja
TLSH
T143757D25F678C132D076D0BAC6D2E71AE5723442573089CB93968B6C1F277E2D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8b31a08341faee8bdd53aea7a0648bba9cf1da7856ef268c4c9f5e0f13c109bd
MD5 92e7e72a3b0ae45014b650dea42cf0ba
SHA1 f25e356bb4cefac56690e59022bb1e22af013916
SHA512 85c0bcc3c1b63a1b96cac990addf563f75e3692db49db883d96d158fe7fe0d56227bbbf24091427c3bec91340d3e083596aad0c139455ba91df94b5ba7cf1680
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCIZu3:d2od+YBMF/XS/ezSC6vUzPvMCJ
TLSH
T198654D6AF6B88272D072D07AC5D2EB1AE6723482533085CF434787692F177E6D93A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 7.3MB
SHA256 b935220ca0a0fa787c6fc7562eb7f5bca92234633d2c237758c4fcc7bcb7b483
MD5 80ef45f8cb2a3a01388427183efd2524
SHA1 88fcc35b872029a26962ec6c06bb36ec72910234
SHA512 00443f66e6cef89007fae8e8cbd5c69b02d3beb1861d6059aac4df6049819c8c2f617ee776fdbdf4cb60384ad01380fef4906a77e2873c9c5b45d418a0439fc8
SSDEEP 98304:42oNBMhXWezSC6v2XMCEQRQyi36YOcP+Lvw2gAf+PN3g:42ZDLQyiKaUX+PNQ
TLSH
T1F0767C13F3B501B8E06ED974CF7956229A317C4B87B092DF268436E51E72AD47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.5MB
SHA256 2fad0a49e4c13d8790ad8f281eab22f55cbcb5a495a0896344218712989fc8f4
MD5 4120b05a4ac4b5b277f9e6d8acd6802a
SHA1 2f4760d0b88cf5d7ad85b8fd93d7b4290493b130
SHA512 da4f96893ccfd3c0712dff9d87250ba50a83b6797c8345ea8590bd9689ac2b56b2cf8cc0e8f6b9de329f847eaae536a9f5a2f553a7dc6119ee4be55462c89644
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMC6B+taZ3usBWOBr4tEGW0bqx0z+n217aau1glL:d2oNBMhXWezSC6v2XMCou6Jm0xd2dL
TLSH
T106068D13F1A941F5D06AD079C786A623E972BC460B30A6DF0781B3592F37AE49B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.9MB
SHA256 6662e2835e7a2c61f51092be4e6115a7206304ac8edbb62c3b91f8a1d330d768
MD5 bfd2b3d932401a125ffdd42cabb01217
SHA1 1cd485dd80f768de1e8c967b787087cf83c4f52a
SHA512 de2aba05c88e8a7d78353ed68d8f6b129411a17f45c67f39b3941086914a18d661f9fb6c66fe79631ce3aae39f030e207f57fc8913cfd631c455c080155632a8
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCU1hpsNoJpF1A6GU44CwH7R4xa:d2oNBMhXWezSC6v2XMCUmifP5Rf
TLSH
T1B9E57C27F2A841F5D06AD079C792A626EA727C42073096CF0781B7591F37BE49B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.1MB
SHA256 09c7207ffe682f662ab0cb2a054b3891d4674dd05634a4c8ff944525d7801826
MD5 99f2a3100e4e3b2ad1f5d7ffae878178
SHA1 b927189a447d54d27213cb1f5b85da75b28f50fa
SHA512 35c9b8162bb4b57d3c2d5712646c7219d3d657f18143834ec50f02621eeeed61e5c6e1d3303db099f692b9bf94d7abbd0b6eae555f59d190de62775b10e4a8e5
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCZSuZQIY0Be2K8RVtOnks6NMHq2:d2oNBMhXWezSC6v2XMC35dKCi612
TLSH
T1A4E57C17F2E841B5E0BAD179C6A2A626EA727C42473096CF034177591F37BE09B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 4.3MB
SHA256 f1315d70222140e69eb558b326e5fc48972dff468a5c3ff73b45e24b9cf2ab32
MD5 38eed92bd01f3c20109c5a08a74928a5
SHA1 6d1a90bc5f7787906391dcb1ae492e80e807a619
SHA512 0137037169a9b3ae66aec1ed327a7dafab26a0456af72b5ec52dd06e5088d41148281acb98a0929e8f0519b291d916639ead99e377c28fbe855babf65d26b5eb
SSDEEP 49152:F2od+YBMF/XS/ezSC6vUzPvMCWyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0Xe:F2oNBMhXWezSC6v2XMCFm7vj1BDlZC
TLSH
T1BC268C13F2A841E5D069D079C3869632EA727C464730A6DF0781BB652F77BE09B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.7MB
SHA256 9472c6f063c0f082450b2c53e8b5548be3924ad798607b52d8700ba410ce83f3
MD5 94047ca3eb502817ee600e3e9d549658
SHA1 027133b5e2037b4fe583b63fd6e3b5160bac2cf4
SHA512 670c13a48bce4faa5ca03391a30910578cc0c4660454040aa213591ead7541e7255c7f5af5e9cb4e1fd073847dc94417e26fa78cf73102080361f6cf7bffbce0
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCXhtSn8EApI0fig1giDn0AP5wy:d2oNBMhXWezSC6v2XMCGX2iwphr
TLSH
T117D58C27F2A841B5D07AD079C7829626E9727C4207309ADF0742B7691F37BE49B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 9463020415dbdaeec109ca6d7bf91ab713c0d92a7a0d2cddc9679bf4cb9cd72e
MD5 e3c703714a13145fd04f7f3370843aff
SHA1 c1c5eb8d9712d8a9afd6bb017f95824ca1738c16
SHA512 7eed07f7c6989d13c3b3b497b719715451a6a4ad67b174d84107d3a71d3ba335d4ada29d2de091b206f7104346c536ec3baab3a8ad68fc632fea1f2fb75c895d
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCHf:d2od+YBMF/XS/ezSC6vUzPvMC/
TLSH
T1B5554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 904f79ad3f695d2f3394d7b444601c331ba32adbc5fcda86196723820b2296a0
MD5 43844df7cb3a22fd611d9fe53ccd578f
SHA1 3ecbf942eacdf6c628808cfc7eb497fc1108e6b6
SHA512 e9a22b8e83ea59863327d06c55ccda04e0f87206ba89a873f1ddafdbff133e6949c072e3a95c1d4b7cd0275714201cbf42cd6147b219ed3f5457e3e8cbb82cd9
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCVR:d2od+YBMF/XS/ezSC6vUzPvMC3
TLSH
T1F7554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 d89f892cbd60206dac3bf5a4cbe6afabb4ae5b6e4b9855a9b5f2f36e5f5ec417
MD5 17b25c43cda1685b159970d0bb509c3e
SHA1 4916f9b70b4aa073726d3fd42ca6582924de4458
SHA512 2e65a7e6f8d15f2c4274b576bb285611a3687729a16fc038c7b2591b5f96e92843e7054677b29c8ccbb714e8d84beee8b39c8f620ddcfdbef3abe45ca085d3d2
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC/k:d2od+YBMF/XS/ezSC6vUzPvMCM
TLSH
T1AB554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a3eaefd72d33965bdc3f7837d2246ae90a63d06537492ac85e42e6eea684f5e0
MD5 f6c0149f85cebe267c46b9e1bb5bbd1b
SHA1 a7a20725c27225446415d3508079ffffff67d1fd
SHA512 30dd31342e13a8e3a0c10395506e08f3b780dbbc065c57ffcd0a4c9d49777266dc235cb92230c9ac863944ffb32bd2b73b3a0ccde1169ea0a449c2c9636be539
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC9:d2od+YBMF/XS/ezSC6vUzPvMC9
TLSH
T15B555C6AF6B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 5a074a8af823cec03a709f8ee3190b26407e4eb1695462f2ea09c024f1e0ee97
MD5 2fce795fe86f999f250a2e092618120c
SHA1 bb0cdd6fbf8ba9f7ee4ba1c7fc65eba0ec794d43
SHA512 71f18555d2f023a646b5779e57480c8fd56b4e3c3112e673ef7c17482bd4ed99cdf2a9e08fcfc3ef45ea25c74ea1d8b6dae04d6d8ab1ab337dc562715abc56f3
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCGJ:d2od+YBMF/XS/ezSC6vUzPvMCo
TLSH
T1E3554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 a60864475045a8d6802bf21f4fb749e320c24719ca0b1118c6aafb8cfc89a69b
MD5 4eab6ecc1a3ced945558ad47c2ce2333
SHA1 dfdfb95574c6c344e1131b9ceee19b591ce65b33
SHA512 d629723df07194aa1d6f70ea7d3a1514e7fb2cef92d33d37e0eedde4d29bb6affcfdb741508993c90b50c17c9733ea77f77a405c9b8cda769cebfd70c407a00f
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCxl:d2od+YBMF/XS/ezSC6vUzPvMCb
TLSH
T1E0554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 cdcf765af334325a125fadac85045e99699177c9c66674620ee998e5bffab2be
MD5 0ebf7e2a35ea12d7fa26704cfc16454b
SHA1 65096f63fa695c03328d347ba9ceba130e42f593
SHA512 dd7726134fe45d3be90fa08948cf00809c73abb4d62cfb7e748efdfbda333d56e683017dccd30cc50a0e7cda045732492fe749de347b36965724797469f42164
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCl2:d2od+YBMF/XS/ezSC6vUzPvMCk
TLSH
T1D6554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 2cdd4e681dc127079692bc4b5759d9551e7edd497dcf7c7713e55d652db667ca
MD5 f40c1bfbd6be8a227ba8a093da865da3
SHA1 b228a49bf309f0177450d687439d3d376aa96363
SHA512 a0ed81c2b7451cc2bbe39b5f1d7b86de4792d8b5be36ab60528549be6d004c50045e6eb6db6ceb3a08111eaf44df531d147f44494f5413d118fb41efef7d54a9
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC7N:d2od+YBMF/XS/ezSC6vUzPvMCx
TLSH
T101554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 1d90455cf2905ad659ce88963324931658e00919bee91f67b1c19b2ed6cb7d9f
MD5 0c200b7d04a01dcdb0f46ac759d76a1b
SHA1 4074220e36399b18119000c198535193a4194e07
SHA512 a5bfc375158f9f69e302127cd70c6726d2a759b0ab49b899d1bbd527a48fee18b923dd7db7fc4bf7d4016e3df29fe1b464bfb500f92ca44ee40a9ed1bc909044
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCZj:d2od+YBMF/XS/ezSC6vUzPvMCx
TLSH
T1EC554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787692F177E6D53AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9dfc80f651e276174cab0733cf1e0cdf21bb7bb529156c62c340ed2050bfd44b
MD5 8ae2b9e0de4f50b396b7d3fd6a6822b5
SHA1 5365eac73eaedf4ea196e4ddd7e3aecc8f6aa759
SHA512 5e1e40cfb2d38513a012cf992722e06d2d390bee2c10a8de80e4f7de3258c15869befd93f4119a49b72b292bef2fa0bf6c75838b6595e1c59875d488c40217c4
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCkzyf:d2od+YBMF/XS/ezSC6vUzPvMCkk
TLSH
T194656D6AF6B84172D072D07AC5D2AB1AE6723483533089CF434787692F177E6D93AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 ca1eb4b887daca81c7e4fc8194c1e6c6aead6d49f9fd376bdb0c083edaa92a30
MD5 0398be6d9c0a250ccb63b5cffb85d030
SHA1 7dc3ee7a0766afe53dcae6c98496615430eae075
SHA512 513cbbe5795362c5d7a73eb220b388a79f865d94072c6b78a4b76740b9551a592de4b31923ef769de2f7aaed01bc424bf105eebb6737a80af7dd34eb3a1d1f8e
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCbQ:d2od+YBMF/XS/ezSC6vUzPvMCs
TLSH
T17E554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 37125e92950fcf4c716d01c5f4af07f802adee503bccc55b652f2f4a3f30c8dd
MD5 3cfc07c27c2995f0e5b522279e0e6ad5
SHA1 191ca94f21e738e7c6d474f3601c66b8f4a354fc
SHA512 37330bab976bff7e3a822aca5cb9cdf092a0bb04667b9ab7d15fcf8afb7db1b1818bd51dfdf59257f11ff8da2bd13ed95ed2e8199666e30e5df295ef38e9b096
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCPa:d2od+YBMF/XS/ezSC6vUzPvMCS
TLSH
T1CA554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 33727ba48884d621b1c29abfea0b352abf42bb9bcd519a72e26f8442a05c12d6
MD5 a123125713ddf2abb50a0e51e96e1b64
SHA1 41f679808e6aea6a5d011e42ae8daf9cd790676f
SHA512 4296c9b620f6bb1d65c10a98e4218d4dfc0571b4d09f131702299e24b9144d7fcc416a2f2cb21f9cfedca9d05d03bef6b4e087f7cbd7bd7a7d38ed80525ddd6d
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCVzy0:d2od+YBMF/XS/ezSC6vUzPvMCVn
TLSH
T18E656D6AF6B84272D072D07AC5D2AB1AE6723483533089CF434787692F177E5D93AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9b53ea72e31a11d9ed4b1db0cf71e991293b8d599b8381f7fc88819793983734
MD5 a35f160405332e45b3c8724799388a96
SHA1 e52902b4831f3063fdb2595041651ca361c1a54d
SHA512 75fd2fba9b4df03fd960ece00717f3326e08d334bc0a4f1f61f4c9a4505426c8ce08891f58aa61213a8d81227ea1e0d0004512fa29f0d759356152c527c4f4af
SSDEEP 24576:uK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCTTWaLl3z0zDw:z2od+YBMF/XS/ezSC6vUzPvMCTT1Lljh
TLSH
T115757D6AF6B44172D472D07AC5D2EA1AE57234825330C5CF038787692F277E6D93AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ace858d27fa04ed8fc6a79036ffbd11b1657311fcc5572b633eec628bc1c56d5
MD5 f399ff5201cd334cf600ce4ff99ed1a6
SHA1 13fde73d00ec3df6b0e05d54acc010dd69d8352d
SHA512 9d8dbdc9fd424af9676418914b9f106fff77ca8d8ce67d4a39947918257cd96f3ea2c3f2cd42a3a0571c3678c170cd4321570a60c12783092d1b52c1ff331879
SSDEEP 49152:z2od+YBMF/XS/ezSC6vUzPvMC/Td9CHKya2:z2oNBMhXWezSC6v2XMCbCq2
TLSH
T183857D65F6B84172E073D17AC5D2A616EA7238825730C9CF038687691F277E5C93AF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 35ff6d4654037dc96027a286bc908915eba8cf2266a367166a95ffe3cff9a9d5
MD5 64f72c713769f0a18c8f95d67cb3f52e
SHA1 1c30c30ec465d8eabfe74825d893b1ba2d15ea7b
SHA512 cfcfc5473b446cdc94ef5a96b3d14573c0ea7e2f678d12e933fea243f7a15b4cfddd71128a6f02e83d0caa2626459234e8669140f28fd362e790ff94f1c3cb64
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCd9:d2od+YBMF/XS/ezSC6vUzPvMCL
TLSH
T104554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 ea983c318db44784d4b1ea8424dd664852529fde78b33649039073f7f5fbd9ee
MD5 43cdc1f84145534eaa73d2f648142ad3
SHA1 b7f95370f77061629eb01b57031d5c9d0905d1c1
SHA512 3cb4261b900ed6cac0c431023fd1b60977a67edb75265536731539f5a23626fd310753e086bce366f230410b3089ce7c30fd1fa8ba0e3042aeae04288261e404
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC5U:d2od+YBMF/XS/ezSC6vUzPvMCC
TLSH
T1AC555C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 ce035086ec21b612f022a86ca77341ee044faa4ba4e7df72e2c31e05f60c5972
MD5 30340bae5d15ef4652edb0bd9f4a42d0
SHA1 9a32502219e12ab730ab33c60ae3c3303e1e5786
SHA512 73e0eea34ee7f7644783ede4c48ab585e239fd279fef3ac6c895f0840fc1b0fc134e39cfa76b7c8fd56c7cbf70f16c0310bc3c587822405f461942ddb40ff881
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCyZ:d2od+YBMF/XS/ezSC6vUzPvMCc
TLSH
T128554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 c81aefee8084410385e59829672eb01d8c5ddf0e667896f3147c0c181a21840f
MD5 93aae8209def6555a601e4c2cddb0637
SHA1 918dcb2e466099d017aa74c1dbe0832328416207
SHA512 058bfda41cc948ca12ee83ba5cbb4044bffeddd26d68b6c1320715619fcd840ef23b342082a7ef0c7b4be22e4e38f75c1c541dcca9c3d034b1f3b98f681c5728
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCFN:d2od+YBMF/XS/ezSC6vUzPvMC3
TLSH
T131554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 b6cd206dbcc2e4939af33ff1073c1d4f15e8175c4182e42216aebf3669967005
MD5 7902e7b2acb3d1e6c242b39496c0b411
SHA1 3129191d8351fe7660dca6bf2b060c39ae92aed9
SHA512 9312b7d8a67bc0e403102f8bae5a388282738ac05c24bd5204d76a9038691b7d478a00b214de3031f29c2b317c4551d14c7624d18eddea7fe136904984e3e263
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCX1:d2od+YBMF/XS/ezSC6vUzPvMCl
TLSH
T10B554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 5cbe65dc94cb66357ebb0665f10854d85a0e72859843520fc3278a257854c353
MD5 58e4c45a797a98e6822e36ad643c2434
SHA1 edd9678e29ba4c80cc54ed700a3fcb5688f7c04a
SHA512 1269e5da3d30c2da2f57d854630793f2f1709787ea53184bf6f742e958f6afeb6fec162f5621c46920f0b80482cf2319e47cfa6c791e5bd7691b381b9a04d1b5
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCoO:d2od+YBMF/XS/ezSC6vUzPvMCJ
TLSH
T18F554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 6c5fa398835628328682836447de239e1afb09f6eacec9e7ad63a4c8ce938fb3
MD5 1708a920bd14af9aa7f9a623154378e4
SHA1 d07f1600a7b193a5d4ff6e6926b90382ece6d514
SHA512 4987a849dacdf908414f09d060d9547b90b4986b80570f98ecfcfb998509b1d09798daa7110b818409aea7f6daeb8aa6e1d0a346302c716fa90219b28bde30e1
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC7o:d2od+YBMF/XS/ezSC6vUzPvMCM
TLSH
T10C554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 1ae6fe2af3ff117145cf21856e2e83bedd2b9cd93bd5b6285cb59799bfdb2017
MD5 0cd105ee47daabbac170d98e8146ec90
SHA1 5b587631ae3895b26ce1db9dad7fc925ae7c6d8f
SHA512 3eeb06710dfdcf2c03a2216d751348787130cb7f8e202205503cd671c6678deafe41c39dfcd78087d4744d48463408558deef50f8e27340329a7bc9160f2744d
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCCn:d2od+YBMF/XS/ezSC6vUzPvMCk
TLSH
T132554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 50abb00deab215be1442e25e27231306f9aad55c4133f8ef3d924def0d843656
MD5 e9b021e4099a94fbf6c79d02d45ba439
SHA1 88675128bddc13ce2483612f097a51ef4301da77
SHA512 cc823af9b325cfabc173ee185f2811066c295aa6140edb116245497fada4808a51b6ac29acab6adb7bdda8a3eff04d6b1f613af97f105d0829222f3e314a0a9b
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCSa:d2od+YBMF/XS/ezSC6vUzPvMCv
TLSH
T182554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 1.3MB
SHA256 d51b650421ca9220856bd9a11da8625427b106b7e4ba3ca1a5b0b99742fd491a
MD5 e0fbed296546bc4097e929cb0dcc36ec
SHA1 8ba2512d4c0ad9e6e84ddcdf826f070fd58a46c9
SHA512 90f86f4466c34d2c944f28227bc55c518cac6da478569db84aa18574057f6011ea3c6b8f54e7dd5e0d24eb138a51a2c64ff71795f9ea75c19f88f0e18cf8a6b6
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCM/:d2od+YBMF/XS/ezSC6vUzPvMCu
TLSH
T178554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 1.3MB
SHA256 64710a6ecbcee75314577a7d24277b321d961005157488d4b77bfc0a3a13366d
MD5 043281453b004d97525d055833878007
SHA1 ab87008049dcb2204d0452c34347f90667f8040e
SHA512 b6c88eaa570e45df2786e267cf9044cd63a45bf979d2c8086f85e6770175d79e3529d1482713106d529a2b0fddc185270b504135d87f01d2bca8204cda93fcfd
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCyj:d2od+YBMF/XS/ezSC6vUzPvMCO
TLSH
T1CD554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 1.3MB
SHA256 8da9c0e1d7fcd56511c977573f611db597720387f8410006b2393661036fb0fb
MD5 34d67f0ca7bd3576cccaced24b218047
SHA1 bb922fe4aad1085f803cbf78e449aea0c20a6144
SHA512 26b150fd4e01b3131fa13ced9fb7098cd725b402c688601fa1e03105fe8447ab867a54e2d1a202d8c44cd0b4cc25679f411426e256e4c271e0a9546a41f456b8
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCfG:d2od+YBMF/XS/ezSC6vUzPvMCu
TLSH
T137554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 1.3MB
SHA256 696dd0084e7c0c073a11113df09e886871dd0696bfd796886c36a8f4e7367177
MD5 ddeb34d21cd2c33428855a524182dfac
SHA1 e187706ca87d575b61ebe44d6057020736d3805b
SHA512 6e930d0bb8756805695d9f22b83b990845ef7163316ddd26fa75c9c7d5aa207aad964a7d183735e45a706f3ce7689edb60696f82938f493f487e53f6501e64b4
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC4s:d2od+YBMF/XS/ezSC6vUzPvMCL
TLSH
T1B4554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 1.3MB
SHA256 03e20eeee93cbd92f8225b8592cf3bef952c02c50ec92bd7486cd925186ac052
MD5 30feb2b928f5247dea5015a59bf0fea6
SHA1 bbae51f718707b27e15919acc809f6206c17f6c6
SHA512 e70053d8ef8ff2c3fa451081f3ff619c4f35bbba6569b62b3ebd1f766c5b15f260ce8b7d523b7b2a34a3f610945ab50c548a00ffd60df4482e67f772c8015fed
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC58:d2od+YBMF/XS/ezSC6vUzPvMCS
TLSH
T1B8554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 1.3MB
SHA256 e9d38244c9fc026c3ca3cd91545745923a909c7464a0e68c79d09053d9720401
MD5 3915b691b864c374ee6cef9fba6d5867
SHA1 2552c81af42cabf485630d2719539dd1d72c991b
SHA512 a51a41c590713c37ee6e6814e5d9427c1f051379ccb34d29cddc784cadc5f387c07353d68541f7591a1af161ee38c90a7eef73287fdcf3385dd862603421786b
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCsY:d2od+YBMF/XS/ezSC6vUzPvMCz
TLSH
T1B2554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9c9ecf783e884abaadb4543b5ffe169bb744029f51bf56e983ebe5d501f30d16
MD5 523732e8747246bd6a8f52e7fa3cdd3a
SHA1 2677289e94c2529e000c3a955578893b6f26651f
SHA512 b7039b128e0b8095cca41177ec9658fb2d3277cea792bfa654f8591273db3ad76c6de23f770b5a20881619a18bed944d8317d301247cbf36b7649a5a64c28c42
SSDEEP 24576:8K2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCrX:12od+YBMF/XS/ezSC6vUzPvMCD
TLSH
T1F365186AE5684272D07ED07AC792A616F673348253B085CB03C2C77C1F276E599BA733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 1.3MB
SHA256 b8e74f97cf83f5b177bd1d537dc467a21e708fab1ebc1b22a8d431fe3abd389d
MD5 f5b99ccc9f571dc0b0063f2fe7ab00c2
SHA1 8e6d189caa90718a3c50cca97251522b814eed15
SHA512 291675297f5a9bcbe33439f6c0c5002048f2d50e1b626f2f418b8cfdd9232e7571b15f0fb12902bb3353bd1a41c435aec8882661e1d02cfd29c8622da77f3cf0
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC3:d2od+YBMF/XS/ezSC6vUzPvMC3
TLSH
T191554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787692F177E6D53AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 1.3MB
SHA256 79b967d9162572de7053f62bcddfa882fc751c7c4a554eaf939d53a194e5c79c
MD5 249baffc5cc4af7bb3ec9eb03d917ee3
SHA1 f5d5ebd555edd79dbffd33f4116d83f28a4736b3
SHA512 dd88f107abce491ee47cedd4ecace46f4674a9ea38334ede63f6d2df90b87a6fd14d4f5deb38d5046f279f98d3b6079d62acd0217340ed9293ddb8c53bb6eacc
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCx3:d2od+YBMF/XS/ezSC6vUzPvMCx3
TLSH
T178555C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 1.3MB
SHA256 fbf9b594b11122054717bd56ca78fa7b5e331c4d5dcbe81166642e099847b002
MD5 c04396e2afc83c6bb424da80d0c5a175
SHA1 e32288bfa3f4434b13d76e81681bfd5eaaa3e1c0
SHA512 ffb407ce0315f053989153d799e233806050bc4b913adabade1497ed06acd4e46d0128dd1a298a78c4187830a6adf041323fededcd034fa854098e75865e9d60
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCLjz:d2od+YBMF/XS/ezSC6vUzPvMCLX
TLSH
T1E4555C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787692F177E6D53AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys

Path C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
Size 2.5MB
SHA256 78539cf66441f06f58b293dfcaf67ac3a7198716b68953a3d3003958692faa38
MD5 05cfb2c1758c56abd1a8ce0407049652
SHA1 b7b49c67ba8a27d5d62aff9c6c02be6c63df1c3f
SHA512 a83172326eb153a98f574571a0b3ec0e51b9233361cf04c4fd11b1c8dc8abccff20c0e7c9646487ec2c660f66c1a6e32be0392f261b0dd39b42faffc551f2eb2
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCC2od+YBMF/XS/ezSC6vUzPvMCy:d2oNBMhXWezSC6v2XMCC2oNBMhXWezSN
TLSH
T180C54C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YZH.exe

Path C:\Windows\YZH.exe
Size 1.2MB
SHA256 6f4508485f58cb12c549291e59e82f135280669ef108e9b0cf846ed4673cfab2
MD5 19b6f7575afcf7904d809cd8b9e4893f
SHA1 aa53000eaa46df9f9c9579ee84adb6253fcf6f75
SHA512 86932825128751d57b7486e5fddb26c9464997005d159b70a8395083a36074092c86424fec908a240aca8adb90d345c032985cadd9de776adaad4226b1c2214a
SSDEEP 24576:KK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC2:P2od+YBMF/XS/ezSC6vUzPvMC2
TLSH
T148554C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2344-1-0x000000000043E000-0x000000000043F000-memory.dmp

Download

memory/2344-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2344-58-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3596-28-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3596-187-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3596-40-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-183-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-197-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-237-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-233-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-185-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-186-0x0000000002680000-0x0000000002753000-memory.dmp

Download

memory/3916-19-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-189-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-193-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-229-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-201-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-205-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-209-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-213-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-217-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-221-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3916-225-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4288-9-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4288-18-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4288-182-0x0000000000400000-0x000000000043F000-memory.dmp

Download