bd513616f692743651e493083c94f8e9ae93d2e4dccd5ab0186456d4b285e1ee

Analysis

max time kernel
130s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 7.1MB
Sample260629-c6hmmsbv7x
SHA256 bd513616f692743651e493083c94f8e9ae93d2e4dccd5ab0186456d4b285e1ee
MD5 d0211053265e0af82bd06522fc4f6081
SHA1 a8e5b8c554083f198bd5c5c78ab3f21cada3ccb8
SHA512 5341b0d1c8beda4c72f259b96cb6b23489297b98a354886a11d3cd5fce03bb350e8ae3a638decfeab7c460c585bd659a1cb50f4f6bfba04fbc63ec279b33a317
SSDEEP 98304:Su5x6M1c/h1+nu5x6M1c/h1+Tu5x6M1c/h1+nu5x6M1c/h1+h:Jw/h1+Qw/h1+cw/h1+Qw/h1+h
TLSH
T10B765A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{C9B85133-9835-44AB-9339-EAE897C5E9D5}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{F3561E93-08FB-4C5B-9D7F-BB725DC0B32B}	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe
Token: SeShutdownPrivilege	2696	explorer.exe
Token: SeCreatePagefilePrivilege	2696	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5188	sihost.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe
2696	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
4684	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5700	2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2984	StartMenuExperienceHost.exe
4616	SearchHost.exe
2696	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5188 wrote to memory of 2696	5188	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4684

C:\Users\Admin\AppData\Local\Temp\2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-27_d0211053265e0af82bd06522fc4f6081_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5700

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2696

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4616

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 7.6MB
SHA256 138499289583f5bb1cead24b6671dab38efa1f6ff52498a11fa08ad042edc10e
MD5 8bad01dcdf7703689d70d83039023bc3
SHA1 30aac8ea723192b80c257dafe7d5675020428505
SHA512 e91dcddf1785c6f36a567769139d52898eb85d75f53a2d03b38455a2eed92bbb6c6595583dfad8b4c29b8d61cb595f6c3b79a749d39328ef8d2b45678c5a1a45
SSDEEP 98304:Su5x6M1c/h1+nu5x6M1c/h1+Tu5x6M1c/h1+nu5x6M1c/h1+Hjo:Jw/h1+Qw/h1+cw/h1+Qw/h1+Do
TLSH
T116865A51F5A08272D07A8475C6D6A77AFA3378411B308AC79386DB3C2F276D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 15.1MB
SHA256 df27726193fb259ca1fd7721b6b441a42fd549302d9f54978d9d30240fb85843
MD5 06944a24fa979a8a5179a90a6e3fe5e8
SHA1 8898f44b42cc245f9bf6efb613de7e5e09e2954a
SHA512 89cc31fe0d794c8764599d7a45c1ddf71b5d6645bf71c0c033665295ea5b8dec65a5b1d295a5f9b63ab40a9d5bb229ef867fea24edaa20b3838458f2160afdb5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+3:
TLSH
T11BF65B51F5A48272D07A8471C6D6A77AFA3378411B308AC79386DB3C2F272D19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 14.8MB
SHA256 b4af95bff5aa4db0e4929d66cced202c43b740ff2ddee51d34333a3799fa0238
MD5 38ee72d57dcd06a53d52ef3295bdcf5c
SHA1 9b12faf279cbf9bc21a0425d927f53e6f1e5026f
SHA512 968e8194f342883cae9fa591d4b734bf63a8d84e85b18969188b611a4605c8dee940d741b96d8c6575617287cc8b15a24b579d78cca28c7fb9cbcfba1822faca
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+0/h1+:
TLSH
T144F64A61F5A08172D07A8471C6D6A77AFA3378415B318AC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14.2MB
SHA256 6f6f344f92ffab2668485b657414038e0963842122ed16192163c6fd06a1f89f
MD5 b1ec66229e0d4876584720d0aa59ccb1
SHA1 2ed405bd49696584112ec3a33cfdd88bbe071e25
SHA512 c9c100c983c0cf2ec8e5f1017aa3c523f7d58f3b9f2bb05c08ad47c0ea6024b1354f56b8213eb7e1dbff7145a8f1fd3b0ed2c3d8682238f386be72044081c670
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+:
TLSH
T11FE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 14.4MB
SHA256 0576d31f226091ab01e965c87cadf5b2499bc6eb28a13f9833734d9dea993e3b
MD5 76a211e0476758de2315175bb3120046
SHA1 f1f90819104a23840e0633b27959e62f54648512
SHA512 929f1022499e433f5f5a8d0a565f2d8c13f54c171c63aac32a113a262071a45bd5f044d581a701ed2f33acca5f8a24aa9077ce6e9c1249880475296536b662da
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+V:/
TLSH
T18BE65A61F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 14.5MB
SHA256 511117c8d0566266978063037a5aa9a8490596bc1128255098b8d9411caf39fc
MD5 f6319252d7666925c19d23ab27676203
SHA1 2a323847f8026a1f87031c873b4c80f95dcde2db
SHA512 bf4e6e0002336a33a936bbef081bc1ab8bd8b39ea187ac5a71807e0dca922a54f9b3df4e177486d48f687a78d60519a654d8f16c54642ca1cc00285e1b56edad
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+A:m
TLSH
T119E65A61F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 37.6MB
SHA256 5e2df7a5c8b315cd2843a8908e285948284ea99dab6feb69dc5c90afcc397e4e
MD5 bf57000d9c097ee5d1c2bc8c8d1847dd
SHA1 e3d3ab1f294f387028ca70de9b57778e0dbaac53
SHA512 a5ab89c5c9a3a7bed45985b6cb759e7bd04b573a7d25ad3e96f4647b63e32c83f4bc9a8166c10b9d524cbcc16cddddb20e63d220ce45d2bd1079fbf8beb1ab71
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+NUEtQeTbvf2zlO12:fUEtQevvqc2W1cpV2XI32i
TLSH
T1B5875A91F6E483E2D3669434C5B182B6FB727C0E1B3197BB4279F62E1E372905D25322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 14.3MB
SHA256 179ac01b9dbce932ab24367fd406988df92a32226cf49bbc4b38ae1155acb33d
MD5 7f2e2993255852fde924efe20d0abbde
SHA1 0459893201d1a7b3fe20c30b09aa4c83c9ef88a5
SHA512 993f87751ff91476129ff86410f04acddac59e2e2ee8211410ff0064dd2272bf6b60c7a3de34714a00a5f54aab688950603127f2ba93aa242dc8f25e2590f55f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+W:A
TLSH
T1E8E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 20.2MB
SHA256 58b9b8f72336e8cec04c036ddec78e7f046dbfebe34480613b7e243c497e5ab4
MD5 f0db9a5db95b47bfcad8b5e1814ceca0
SHA1 9eb772d5035b7e23a9c504faedea83c34995ab55
SHA512 bfc37b3b605c9574a2f0dbce18f9c025653318fe4dd3e4fed3eb42ffaf657d2739c5da0f615a585d309155e26a6c3978233d278fe1bef07bdc6889a4222901db
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+8QyiKaUX+PNo:qQsas+PS
TLSH
T17C276D52F2A481B5D07AC470C6A6A736EA327C46477087CB5285E77C2F376D0AB36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 15.9MB
SHA256 867940dc5dc1fc407a6396f19384a13bb904346e5c7f1b3fab67e95c104af295
MD5 c225be3da9030b4c3889cf3cb8f2fae5
SHA1 659387ac64df9e5110ed0ccbfd1350c33a200f79
SHA512 ea8348832e3ed452922a8c2768087d6b227ccdb5ba800636f3f3190571690e4e229ea036b3bf9cf203e980cdc1131e870ef6fe235baf024a41c43543189c18f1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+8thHf:C/
TLSH
T17CF65A62F5A08171D07A8471C696A776FA737C414B608BC79386FB2C2F376C09A36727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 17.6MB
SHA256 eb8ee09fdc5e0eabc27c235a03fd13fbbd16bc6b4966bbbf991bb09fd800b95e
MD5 5c3995c60f099aff6933c5990b07d40d
SHA1 4c3d2f67762e3f7f02a56478b9df1ff299b6068e
SHA512 83b33f534b1a693b1b2647db7c9c07dfc11e83ac806ce845d11ae86ecd1083b2270a73d8b618296aa6d2e352616c192c72df467ad1cf30ae46b2e6ece5acc390
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+OLIHuWhs:Q+6
TLSH
T143175C52F5A481B5D07AC475C696A736FA337C420B308ACB5385EB2C2F376D19B36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 16.4MB
SHA256 2d301ec8674274cc33a4363f0e8d227616d6d60da2e1a06a1c202416262511fd
MD5 1625f8bc1451315e583becbb1691df08
SHA1 c6b6e38d5b178f48880378161f15186c97786ac2
SHA512 30ef107cd328f6e9544371d301f6c84b76863f64eb007c4b14ca9bebd0191c2548a6eed7174e064f6e2f6f7818bfbc37b9d317e2aeb45528f0a2bce7b2eaf3aa
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+Q6Jm0G:al0G
TLSH
T157075B52F5A481B1D07A8471C696A77AFA337C411B308ACB5385FB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 15.8MB
SHA256 fb46001fb3261bc7277ec168e78561212e0e54c4af034f2a797bb6f7f0758595
MD5 74c0fa0d5b83bdb563ccc93b6ad9ce81
SHA1 a28e911ecd9c39846f4fc23b41907cc49d996c8c
SHA512 3a983acabc0ce941aaaaade509b8edb2b2aaf7633f58f7f84f4fa9c24c597a17030e9bbeaaa4b85d070a84dde3608867f4f6b237af4d8b890c32e678cc430fb0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+vfPf:lf
TLSH
T1C0F65B52F5A081B1D07A8471C696A77AFA337C411B208ACB5385FB7C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 16.0MB
SHA256 8bba2656d09b81246c4867bc012ec4d27964be885f7a4ada6a3cd77584601b7a
MD5 ea2f0f4b4f816da7cab70f6469d57bbd
SHA1 cf873ef36430897234b2382d22460c599b476a06
SHA512 f0f0e6de45a97233845b73bf8455dc0fb02ae0a76de2f3e8cbfdb9259fddfe9f116d7b997ce194a550135c4633768957f73f29d0e5e4f92fe7bbbe546aed8209
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+CdKC16:TC16
TLSH
T1BC075A52F5A481B1D07A8471C696A77AFA337C411B308ACB5385FB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 17.2MB
SHA256 5a937f57d28a836baaeeca742c66f28b2ecff4dfa90b165fad36fb8b739c6db1
MD5 032919ccfc55253d70ba1c96ef70a89a
SHA1 fba44e9566abeb210aa8600e70e6156a026b0202
SHA512 218792aa3a3b02c133761b6f5e8d389247aa6d82b6bdfecf105d2e2211c1fb82b2973424078cb308ee469e4593d0cce75a71df3d950b25d1957a9ea90a162d83
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+TjnDO:FO
TLSH
T1E9075B52F5A481B1D07A8471C696A77AFA337C414B308ACB5385FB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 15.6MB
SHA256 5d45d6dd288e5dca79af8cee05d1ffa1aa47d15d6e2d44188dd3b975895dc9b4
MD5 6502bb6a19afd21f40c501eff5b03de7
SHA1 cce74afc1b7294ac06d68768140bffb843be99f5
SHA512 69076177f937b63eadcdf079431e34ca22133ad58f07cfd4028430b85603920f24e78d97a9908648c7b4c1ffcddcbf49699483973586577750818b2f43770ae7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+t2iw3:50
TLSH
T196F64A52F5A081B1D07A8471C696A77AFA337C411B608AC75386FB3C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 14.2MB
SHA256 9920d098ce5e525ba50163154a55108856d2e17051cfcdaba049c598a2a3df68
MD5 d1220d08df8b0296fa5acc3f85114267
SHA1 5d185dc741252efd0f0884309528d9eb790a41c5
SHA512 93740610222ce16d88dc650c8425f4488363bc5aff419eb546eb5409f6a8735bb0f1df1546a689e68de3f77aee46fcd59a6c7a00542c38e73dcf607965686e14
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+M:e
TLSH
T192E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 14.2MB
SHA256 15844ed01e0aa0d454a57ee7d5cbf2e00f0a65c0fda2a9141f89afd10bb90e92
MD5 f57a8b5658130f31ada1b88ef20d6401
SHA1 43e064a7bf3455f2740146f85ee2a40a100c3974
SHA512 7fce37500b300b940ec2d1f42de0f2e2387497b8bb4f8b4bf32e297566b097ad1ee7eca96a162c7862ab8d8870cf50bd6835728efd005fe1d466b8ee01dbc351
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+U:6
TLSH
T145E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 14.2MB
SHA256 0f8bf95a6c62122580f6984f0abc7e12c5ae521b6272782b854260668a139e95
MD5 971a14e6bd74ad18adb2d2d6f7c6fd06
SHA1 9f4d36476b6613bb35f097df9703dd47284a6800
SHA512 f4655224234564fab73cf0b3bf5f8fc08326a17a5ee4e9d51ea837d16e668cd3426ae224bc64a229a15b58da03a22369b406513f11524b5ab41139712c82ffd9
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+X:V
TLSH
T193E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 14.2MB
SHA256 d7cd69b51599351237b2c0d112c3ba87234ca70cdbe7202daca31a90f0b106cd
MD5 9e81e22957743faec6e256bc852bc0d5
SHA1 e7e263a1b6125b026a60510168e2de4d26d77c52
SHA512 21e4359311e95b0344d96c8568767a2484553e2618ef3f46b7aea354211f375823ba0837fa7c56ce5be12675ebed39368d583f28c3555981d067c7db2058b9c4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+G:Q
TLSH
T1A2E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 14.2MB
SHA256 6b57c0f3a42c5174a7c758ae13772e1fe332d73b15614470cce5271a6f4a5d75
MD5 4c5683298d03d52b3edc198e71598b3c
SHA1 fb95fb6343705ab6231dfdd077c4a6031f9869e1
SHA512 990daa7d36844a48dc76f9e246e25c6a1575f2816b2743b3252a9b014b192d0c47d26e930b704be7fed53ec75295e3a38fa7a6eeefecef7229194969c7d09878
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+D:9
TLSH
T1A6E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 14.2MB
SHA256 ce0cb003b8515b6bd235c250cb58616fcf6a036b4256db4ab6994f3b07ea5f3e
MD5 d5213166559bf8e0fd20364407f012c9
SHA1 75c0648b8d53a876708ff67480dc717fa1b57984
SHA512 b68db22063f2f0b572718e4e550acf98b0ca51255bc0549569ae967f58bb9632f1a9fd8a1855f391cb212cfc7c318af4772e13cec10d17267925a8399d6c9a3a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+s:a
TLSH
T1DDE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 14.2MB
SHA256 795c16be1ef11492e9332bd688b5c18b63b757d7d485584accd414f86af9f961
MD5 6a4f26c4aec983fd13863316e8232571
SHA1 5d7de639351e1346b8c5bb75981c66e518cd9874
SHA512 6940f857aebf65cad1f9eb72110edd12f4c0ca682c193d32864a693f3e8a0eab66bb6aec3bda9184486d1aa060b62a71781608b2ae8b0d9d0d7a2a15851dbe26
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+3:V
TLSH
T170E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 14.4MB
SHA256 fe8bfbe79d2d9726423d9c205ec594f90ed2cbc2f5f899271054cc1e23f8c9b1
MD5 1565187360382899af5000bfb22e66ab
SHA1 b28a76b571886b4456fddce52e3ce278b22f4119
SHA512 219fb6bab308d9ab91791d5d06aa5ae2768c2e7179a2b77f1de4e0cdbee46ebb0171f7083195b2326f2fa11f7cf63e16367f85031638dfdff3113afab4b1a1b6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+mfu:Ym
TLSH
T1FBE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 14.2MB
SHA256 a1292129e478ba30f7a2d7e7318b642b717486580a40b9d9bbaac08ca6e03014
MD5 6aa7419e744fdbd28114cf85f9cac8f9
SHA1 dddb49f544d5ec97acadc6bd83fafc187d5687be
SHA512 faece54d96f0e5003749db962666a06beeb938d1a3d2afbc1643b8fcd3f9dc27fd15f3feddbb68bad0ee296e59c35a13a40ba91c1836aaee4e1b6a38ab695931
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+K:k
TLSH
T113E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 14.2MB
SHA256 d328d180908b92159e85766547137073bedd6bc6ca205cc9a46ac5e8b20936c9
MD5 0b8d44235cc72cf96b2c4b06ca598458
SHA1 034395c6922c60f6ac79d9eb9db4b60337ffd6e2
SHA512 fecbaeba9eee8746bf50760981b2bea8833423ae0aa224e8594ba7573c8323105498521383af2cb3e018e6fa1357ae365d99b27204858057215ab8c0c9eb5498
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+m:k
TLSH
T1BBE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 14.3MB
SHA256 91412bfb23adf0d6fc8ae4f149a022a13babf38c164bdea6555e0abff1228588
MD5 0518da223869557c7d9e51b8f45d524f
SHA1 e0ed4a7363331fc29900b2e954d2ac13fa56c05e
SHA512 f62a706fd7185a35bcf8d7747356801744164e52088567ef81120fcd903bb13e63f256f3049af8dd2afd2096d664420a846f2b93223fd6737cef6d9921e2de0b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+Bs:4
TLSH
T126E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 14.2MB
SHA256 0c50f56227e8af6c84fa708c6dd3029e69c46e831c0016d34a44521e62088fd4
MD5 3363fda9fec15fc07fbb568b9c9f19f9
SHA1 b8cc4140c4ba0a9bc03f31921724ec4ec5b19ef1
SHA512 8bd4f77849dae73c088c56013f9e6d60659aabc1049189831c9a8924e1ba7a595500022602255aecd44be4a20088b219332fe913916abcc41e504862a994c592
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+H:5
TLSH
T18BE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 14.2MB
SHA256 3211344d6f32ee6b84f6002924696150a1e93a8a77c469fd6794b7576c647916
MD5 e3d32c84a9620629e2c44ca180cb8744
SHA1 f1702f5c14b1ff73906bc8ebadc20db88c5eded1
SHA512 0904ee0ffb767d8cdf669ccdf884c0e445e3982a0c3d9b2d02c18408bf28b36deca8d8ef9a5ba70fb18ff3081f9352b5af0c35c0dd87105d7b548ad27b69fc5c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+p:7
TLSH
T1A2E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 14.3MB
SHA256 a46718e090590767d6286c575a22ac437aa0a1dece3664193642bea301e92dad
MD5 700714fba838a5a40368e28951ad6dda
SHA1 f863fdeb4a546617b515df462fd0eea12279cfd5
SHA512 4f684972871fe52e19e2a466810578133486e1807692b88f9d971df8434bcf62f1b066ca3d5b10dd633f2994cf033f046cb0b2e8d51998b19319cb2b24037c42
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+QT:w
TLSH
T197E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 14.4MB
SHA256 89c437aa2e3c06e809b99586a486dd895dfa05c6ebde3eecad2a9e4484964112
MD5 79b85525a7b73f12f9c720c30d662547
SHA1 b5f7c74d220d151179362328f1566916a0d4a5ee
SHA512 fdda2e137270f873def196537f378bd151ca895d82f32796ac64b1e9e9af4b45473008eeaad4aed3252bff6a2247770befc9c53771eba42a36fc409810b092ec
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+ctB:K7
TLSH
T1C0E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 14.6MB
SHA256 d019eebb5e86ef77a3b8428aaba717eaa17003d4519ff0a768c8e51960e0d636
MD5 07532e2d6ebafc18bb36440c3ee162e7
SHA1 44b71e6a2d8709c7c3b76c920576ac7228e3b653
SHA512 edb39d235731e65f579bf349e6c99e1dbdba0908aa9cdef4a8327a95efedcb3b8f91194923f5f5f93590d3177ca33297451ec7584b9daf92e998bd328215bb2c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+fq6:dd
TLSH
T174F65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272D19A36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 14.2MB
SHA256 0c5d1a2a5e61f53818662ad0dfa6d01a40fcd32f901d97f4344db81b23ff8d2f
MD5 d6e38c53755a9c20c92f913a6201621f
SHA1 5421b4ffa9e4630fc6be1944fd34df66cf34136a
SHA512 f28795130129b0b12ffe685a34291563b89e405c7284967c54ddd630d9d7b50176b4b64a727cc1cba3ad67a77b59edd2831ebab9441208c5706a61ced47600b4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+E:6
TLSH
T18EE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 14.2MB
SHA256 2ecd96cd4cb5106a77da90a8a641dc1022412063dba1935108956f453bf31b6a
MD5 455f32927723f44ce86cc14f8da35234
SHA1 65ad3189f6ec5cad3967b8441c38b896ad3ef112
SHA512 faf321a6da0476825948d17016252407f31001eb10b0032bc09e639d7962a2ab4fcce3ea457984d636752f56ed408c82d0c451cb3c1d812c5a7387703428071b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+t:X
TLSH
T19AE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 14.2MB
SHA256 27498c5201f6fecac1a8c96fee7275af896acc1924c80e7bcacbf6798c7b5ce3
MD5 355b4fa7cce2aae6995c1e3446aaa021
SHA1 2cba01fe93545db03b40836b08b388d740336fd4
SHA512 16ba1868b4a9efdd8dccfe231a7bbda71e7bd79d82421acc75f94a26c0a146c92e907e3f63f649ff1f928e19986db79791918965d1e411aef42b68611f2cffb8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+z:N
TLSH
T101E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 14.2MB
SHA256 8038b2ee8a29ff6611395819f9016c055dc3e0640e5ddb0f4a29a8af675bb2f7
MD5 1ce6b017284c1eebd21655bfc6efe251
SHA1 9b47679c47063014cfdae38991902946222a3a5c
SHA512 52a0ce217c233a9fd2ccf808d9cccb24599182cdd19e96d07b0c14dc55bdfcba35682d2f01316bee509b5bc88f3208bfee21549c1a4807a85297e0fb801a4ca5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+I:2
TLSH
T14FE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 14.2MB
SHA256 c202ff4cb3bc4ff3bde70a95fdcdaa19315636797593d661af85750010f6eeef
MD5 b332210185d330596b56514086a22e9f
SHA1 43a33af1e40c3cd5611079bb2675bdc9d0124d63
SHA512 c62c9ecd78b24327e8a39e24b248d658764dd38c597f7dbf17d714c7086a9d6c6de756a68c757d2575cb3419f263c5565ebf55f9be2f1ed3b44e2eee20aca675
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+e:U
TLSH
T1FEE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 14.2MB
SHA256 80b92c1627adc77b6b97b318a686ccc85c53e681589821979bb5008fa3077251
MD5 ecfc591446ca549933b19c5e098a8d49
SHA1 bd11a63d0fecb38c058574a066b4493739c6a962
SHA512 7c39f2f548c0ef1a1b91958f0d061706b248475f568918d2419f1d00354a2237d02f72c9e364359fee9318da9790d5675110a01308c4e9ae4ec3cc138efe0be6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+6:A
TLSH
T13AE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 14.2MB
SHA256 27fb9be676a23d54286f63f0fa75541b8aa720196d2d1289e33f3ad063272c25
MD5 b8e8c4d35bbe211ac7ee480ed19c0325
SHA1 5bb70af4371269cbdce4678b0ba5f86339728030
SHA512 86d19a9780e7faa441508f38cb7300fae080eaf86271236145fb03ce77e5951762a90e56ca76d7d3a75f2e53fc167605728d81b23af45bf0e3b4a90206923657
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+P:d
TLSH
T1DDE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 14.2MB
SHA256 b89d5ce70f56517dc15e80975f60fe3ff67096aaa70b82e0f012af49e0677b81
MD5 3953152ac5ebdfea1154d58e82de1e91
SHA1 d111d8de52b5c825ef33c7f6347228858a62c1ae
SHA512 873599afe021103687b735d922fe59c715d29c9d2b02a53b6ae2ee2c96c461f6efc18e3b1fcd6b80f1efb5546945336ef4ab5645deb2e09911b7f4530c9253b6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+r:R
TLSH
T1A5E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 14.2MB
SHA256 8a16dab88b9e87e001aaa76cbbd89bd4d809a9de5c76c5b0ba959ffefd853c6e
MD5 615591bf890785179b6615f5fcdfb6e3
SHA1 913a0e7aa306a5e74748ffe2c4b61d39ba22b166
SHA512 42f149bf5c727d647cf0f99db4f997c1dbbf67c9ad948caf26b2814b6a486d2ff0f3f9f1107d6c10929a9c0a18043e2b6b127856eb995d8adc0334fecba47503
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+s:G
TLSH
T1C1E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 14.2MB
SHA256 065dbfddc2b7157b84202d93aa405e8fb7be2c04d655a4a1c9f96755df58bbbe
MD5 b1663d86280275141aac7b5d84c0f21b
SHA1 c611b48d0dbf29d67eb430872acf0eb8b1e9c16f
SHA512 49214fb5a7e1e452e6a01762bdb4e0ac71021853f2a7dc2dde97dd8672119e8d1a3a133b24834658e26c2f613014a04cd59fadeccdd9293ce630a3110fd7eb73
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+F:X
TLSH
T1BEE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 14.2MB
SHA256 51afe3af08dd8a79153ba8ed526eb53c164c1ad6184001d37d5f65d227c124e3
MD5 13b589dbbdda73eb3fe411d97606084c
SHA1 d969aec42b8226eb1a71b896d9865878b2259544
SHA512 9b3ffc8521139364cdd7f3bb7e1427101a4ed35c381a2226b61f0f4e0fda409548639a9d2af42bfa9796234052a2b1fc6067bb2b606c2c334494500c98b86237
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+F:/
TLSH
T1A9E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 14.2MB
SHA256 e77fb6dfa27e85e77ac1b5f5cf26df8f22751d7f0743ea7a46421c3bb6fc8e3a
MD5 aa4468db7e97a99970badad5b6864207
SHA1 eabd4e7be319b90db367a5510cb5295e94639030
SHA512 d93c10141ee7da0dc35a8aff89a0d16cde09a211735b71acc400c99dc34c90a6b260e64b25ec65649dfa3079ad604b201340efaa11c5c1ff4736fe5f7a2c5d8c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+9:f
TLSH
T1D1E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 14.2MB
SHA256 080ee27f91e97b24344336984269396ae31b11fe7e99e503b2a314a44c18f92a
MD5 b615b5d2ff1d389b9b30151e309f72ba
SHA1 8afb14a6f38e5c010b554a4daa00c441077267b4
SHA512 ea92e157a2719e26f67786805ea7f865573ddda96fc306cd400c22990a3167b4f481755d39e90ee61ee3e150678f01cbbbdf77c166fe9c57ab7018643a598e07
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+U:q
TLSH
T198E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 14.2MB
SHA256 2b299b67d6a459e2839e9d3912acbe0e3445ecfb85b8fae1a1357e9732c29d20
MD5 dca76762456fc86ebcb5377e4a741c8e
SHA1 d03ff55234bae1bc972c70da0d4773abcefdd487
SHA512 ea79d8c621db72778a7a593b5a600129cb2ef978c2969c6eeb14d08d7151e51ddbd57adf347668366f93cc2a35a4e67e4fe876be1a553a5bef92eb287e492142
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+d:f
TLSH
T139E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 14.2MB
SHA256 865975ca7e20974223e97aa97485536dc5ac41715d27686df63c0462a6bd9e11
MD5 3e8d57466716eb4712f5a88b140ef289
SHA1 9b2e548bccfad3a44e266639de1b4cc2a0195987
SHA512 456bc91e66d0e9dc50d6a23d9c657a6b1b9c74e5e6ad1b8e243e380d380091c2887991f8fc27eeac36169cc3d34a2846c9ba32e01b90c2be9985d2219b3d90ba
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+s:C
TLSH
T163E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 14.2MB
SHA256 88a03268890720bc623ff8b80e0ede80617fa673c6d7d892f7691f63d3c1ffac
MD5 4dc71566075d686f7af2a16e2282149c
SHA1 8a8ddb69762327039fabe6e6ff3d0b6d3bbac74a
SHA512 28ac09ce692dad62717668687fb420324dfaeac88062fef7c89e16a02069c4041e88c79feb34bc3a9a688bde5c02d5e7a028125560039feb8f00930cb7c750b4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1++:M
TLSH
T10AE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 14.2MB
SHA256 1360dedbe41e0b0bdbd308415ddab2458b1d90aea31af5c46b0ce8995ad00052
MD5 aad6825ed09dddeb81445cdbc098a24b
SHA1 bb7b4433930290076d34a2f72daf5598b80854ad
SHA512 524262a1ea42659d2f9d40a5b49ffc79053d083f19af9370b11f39547d3b89ddec836666d1449cb2328194a76524b19ed5bdfbd32ffd296540c55c504d86f54a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+I:2
TLSH
T19EE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 14.2MB
SHA256 d047e0877c27b51953bbc48c6b168c96c84502ca02874d7b4b071cf64ec125cf
MD5 33a338a02c7149d83fd35f6d8d3b8a75
SHA1 59fc469a3ece48f2699551407089503b020d1d86
SHA512 8f0cf25452804c18451c1d1f6b55d3902998ac79dd437fec6950893b103ba69877f1ebfeac544dc2d9d0b92e014467c528b034fba30b38022259c0dfa53a534b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+e:s
TLSH
T1B0E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 14.2MB
SHA256 13420a24c6e933f71c0d2c18d22a8678fced76a9692f3bcb5b2931f9787f9827
MD5 f7b189174945e6137a225b1f1e4bb15d
SHA1 a7f58b5b0522dc3808c7a6ce8a91e8c7703586ea
SHA512 bda7af4667e82cad27b963f6a54eeebd9291cc77effd6e5693d4fa33b69f5f3b2c7a5fd497d19031c9ab9c83da46b8fa423ca5acca712c30113d9257bd617037
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+V:3
TLSH
T14CE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 14.2MB
SHA256 b93099546d3af52529e983d26aafd0bfa370a0f6606798caca2dfa35c4045526
MD5 4fb347dca35d6adf112a5ddd892b5476
SHA1 2d47648ea014e96a87541d5dd9944fa4a8b4bf3b
SHA512 c6e8c24915789f574508ae277f1a104eb255b60fc4192cea330837c0deb36f71e10e14ae0d8f07ba569f6f6bce4b93e068300682ee8e82477accbf708844f91d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+U:6
TLSH
T140E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 14.2MB
SHA256 2d4c75e241fe0dbce1892fc8eb11baed53516b4acbeb6b60ebaf021092b9efb7
MD5 38e6c274d063238068d60ebd39ce880a
SHA1 6788860a976a6522b66f8221228796f4ff208186
SHA512 ad04086bf096f0f78cb87ef9f8c226ccef25af00d9080c390cbe70e7653d7fc32fbaa79580ed11ba95f583a9cca032b50c528ed9d50233ac0ce322751a146f99
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+f:Z
TLSH
T1D1E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 14.2MB
SHA256 bc0a4995a779836630abec0aea5c3691c31ee0f5c9e542afa3c3e2f0e3a9f52c
MD5 eb0f7b903665a62dfa274a2803e44f63
SHA1 676f462b5360b227456918f288ca9f65b6f9e59a
SHA512 e22fe86e49f4774d62e753877144cf924d5a5eb823c8e938933d9b125197000656e660baad4604f15cfe8d15ba8881c2a29d029c24375c6cf5e25a5f5175f575
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+S:k
TLSH
T12CE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 14.2MB
SHA256 8debcd81b344fa7d753d0812a5b4dee0359e0ab5a0c490802fefdc48b2132f8e
MD5 8a92095e7bd84d9b684326bbb4e441a7
SHA1 e3e03ba481157d3fbc850c71c443eb5f51ff32ad
SHA512 cdc63c3cbfb7d1837ec23f211ee68eb1abf4a154494aa3ddf4a07207b5dd1209cd0766e8a0fb036394602c1e780aaa214b63618cd3bb928359217a00dc9d06d2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+M:m
TLSH
T143E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 14.2MB
SHA256 f47c03b0b2e4f84699b07248dffd379c3852000a4a659381756f3db6d65b10d6
MD5 558deaa86070be5211285823fe64188e
SHA1 c8f052a00af4f2952f94d58704a345b56d9df25b
SHA512 c666dd71018af2853a96f46da4ed8857390389c711f3282e5b17df7c7f116a744f40e44aefbc17573a12bab5650f30e82393c954c21fb50438d6e820584c64b3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+E:K
TLSH
T146E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 14.3MB
SHA256 df17f92bf63c55a43bab79d9c9382c210eef51bc73927948ce901a4df15d82c0
MD5 6430c4419eaca5584f591a46707cb3dd
SHA1 38db1e994216536b38ef525a0eac283cfedee8be
SHA512 45177dfe1c60790f7569b6613e0c97214d506a5fedd61cd6eb646f9a0007056264841e9831f60a149c546b3c09f7499a5a029ee97ff23264a2ea3066b8b711e4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+4:i
TLSH
T176E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 14.2MB
SHA256 83a7c20113d5507583aac4ec92cda4f4a008675904bb85d120e3acdf1ac81e5a
MD5 18b9278449afe1886f95dda84b38439b
SHA1 47b01ac7013a59ba462e18b26e70ee5169544800
SHA512 bd7c66cd984420ef0865d0286cd95bb7af188310d1083cd8b2cc1444c47d8df4f891bb46f1be803b4a2f5e0f3cd4e7237977251c31232a81c1b381daa8484b5d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+w:S
TLSH
T1FCE65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 14.2MB
SHA256 6f753f4184da39867bb7e414f9ea3b2f729ec253544d1f72ff57265aa2d50726
MD5 fc12896f8520591ea2713e1da392ef13
SHA1 26cdbe99482d5f754add4c91c6b35bc814c66383
SHA512 bd6c09fec90329a0be11ebe1dc9612606ee3cbcb794d503890a4e4059a1cd5f97222ec9c167859f36a6a1731ba5e248acece76103415883f596faee6b874374f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+0j:Kj
TLSH
T151E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 14.2MB
SHA256 2040f6629419159be7f84dddf493ac0a62abfd01bd3f6ebfb966eeea28fcc8c7
MD5 14e0f7e41c0f11b6183a0d1ae1af4f32
SHA1 4d0135f2d9a025759cc1a7e4d6351143aa991520
SHA512 8ad028c8e36eec8acb0a1e78610cf5465f960ea8d4e91b50e371e42978ee76e9211cd51c152c8237536c5b5a9cbe77ae506f9af283caaf4d5a7b986da734e1f1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+vw/h1+Qw/h1+cw/h1+Qw/h1+mD:4D
TLSH
T1E0E65A91F5A08172D17A8471C696A77AFA3378411B708BC79386DB3C2F272C19A36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
MD5 2510ff22aab74c2ba735738716005a2f
SHA1 306d676ad05de19254b82e221f183ff918e4902b
SHA512 b06c9137817610963efc14c36895253ac8c2eb5af5c9c5e3bdfa59fef8050d9827e4d250b571051c52d7141b4d69702cb0e23a14a114c3e163b1b5bdb2911f1f
TLSH
T1BEF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4540AE6C3E3B3002F494BC
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4616-463-0x00000191001E0000-0x00000191002E0000-memory.dmp

Download

memory/4616-480-0x0000019103930000-0x0000019103950000-memory.dmp

Download

memory/4616-509-0x0000019114310000-0x0000019114330000-memory.dmp

Download

memory/4616-481-0x0000019113E20000-0x0000019113F20000-memory.dmp

Download

memory/4616-495-0x0000019103C70000-0x0000019103C90000-memory.dmp

Download

memory/4684-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4684-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5700-58-0x0000000000400000-0x00000000004E4000-memory.dmp

Download