26bc3f2d5e5627f927eb1b406f86bcc75fbb4a2be3c36116cbadaec2237f4e10

Analysis

max time kernel
130s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 15.1MB
Sample260629-eaam9scv3v
SHA256 26bc3f2d5e5627f927eb1b406f86bcc75fbb4a2be3c36116cbadaec2237f4e10
MD5 b3d73d92fd30f10d0b92d54ddb673f55
SHA1 1f84a2809ed03395f26876e2a6109604a186add0
SHA512 1832c8177d458e62c2879d483c8694d14b333f51ac291de99d3ba47679f90eed200d9603663659918a8c38d9a7b4da63c529dceeefdcdb3c14d0836a3427b142
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+Xj:ij
TLSH
T138F65A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\ResolveEnter.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{6BD7B79D-9006-4B69-BE25-7CC7A21E0331}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{9396D73A-5E6B-40EF-B43F-D208E956A55C}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	264	explorer.exe
Token: SeCreatePagefilePrivilege	264	explorer.exe
Token: SeShutdownPrivilege	264	explorer.exe
Token: SeCreatePagefilePrivilege	264	explorer.exe
Token: SeShutdownPrivilege	264	explorer.exe
Token: SeCreatePagefilePrivilege	264	explorer.exe
Token: SeShutdownPrivilege	264	explorer.exe
Token: SeCreatePagefilePrivilege	264	explorer.exe
Token: SeShutdownPrivilege	264	explorer.exe
Token: SeCreatePagefilePrivilege	264	explorer.exe
Token: SeShutdownPrivilege	264	explorer.exe
Token: SeCreatePagefilePrivilege	264	explorer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1212	sihost.exe
264	explorer.exe
264	explorer.exe
264	explorer.exe
264	explorer.exe
264	explorer.exe
264	explorer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
264	explorer.exe
264	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5308	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
5920	2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 264	1212	sihost.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5308

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-27_b3d73d92fd30f10d0b92d54ddb673f55_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5920

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:264

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2372

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 15.4MB
SHA256 8913cd6f6e902a5f79e6d7deb655fb878e09c866431c43d964212d149dcd41ba
MD5 1f9717096405b0c00b16ceec3a444461
SHA1 a86bb4211e0b8375d45114325c873000482ce269
SHA512 2ff76a4e2f84f119e902d73ef3d6faf20a3789a1b1fbaee0f05bce2488851bd9af16c2dbfe15c63c36ac68d8f99329c9b5028c49c00d6fefbed58885ebe1ee3e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+Xz:iz
TLSH
T10CF65A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 30.3MB
SHA256 4efb8e75d2de413f10033979902209685292c7ba96f9163ea7acda84f23edaf4
MD5 5948f9c039895fbb9eb8ac4fe8165a8c
SHA1 e310f55d4a214837263489ec1aa0148a7e707209
SHA512 cf3214f0c6b2fa4a15e209fdf2fcbdc64548a877e58a9c184ea8c8278dbf72ace60000dc3ea0d67c65c12ba90cb333f4840014c926fdb020311151d86369778f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwC:i+m
TLSH
T1AD675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 34.3MB
SHA256 33e8402a969a0a64d9661442df3d26368ed19b03149e3403730310fc88184361
MD5 8e8cd9c1baaa350f1e82fc438e2249d7
SHA1 e61784aa0ffa95af366e660fe38c38edd2458907
SHA512 8f4eb65c1d1fe5a280a7ac3d06b50460104d4b411e6d946d5abd35b3623d82677a444497140220cd196f05a9fcda2eb72e5428c297046fc5554641ee4aabccce
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwL:i+yvyEYKbi
TLSH
T125775A51F6A081B1D17A8470C6A6A77AFA3378411B708BC79385DB3D2F372C19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 30.6MB
SHA256 e545d7c1e5774dc12c8344265271f5c18dcd388b6152bd9851bb95bed25cafd3
MD5 2a6ddaa1e70122220271ca2a09bb44f8
SHA1 9cd9500b97dc3f12bfb083bf6afdcd36af81942c
SHA512 16ba5f2b946ae99ac58a2415c07155165798da913243cb2812ee701c6ef503f25d71eb3290f8b73f50253419797645a5f63a1616ff8ed8efd090a2222498b9c8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw2:i+i
TLSH
T158675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 53.7MB
SHA256 8ac4665acde63385bbc4ee5084169a66c69ef57d68a979168f492d8467ee7794
MD5 06076abc1a1693b723045e6f97ecd516
SHA1 719398048619a5327f15418e1019ce1ffd045370
SHA512 92d556776581acc37d0651743f8e0d32b7863d0e816f9f718c597bd0420e3d862d8a11156ea0ac9f98688a055bc3b37ce831f068728c728d0d0dd0bc0dbf5159
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwm:i+7UEtQevvqc2W1cpV2XI32i
TLSH
T1B9C77C91F6E483B2D27A8434C5B29676FA727C091B3187AB42B5F62D1F372D05E35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 17.2MB
SHA256 4628dc85af0f61cb41a55cd9fb2af2dee5e8d1e7093ec584f72c30ec43210144
MD5 17b2c31d24cf4057833e5d905bd22eda
SHA1 4a89fdd17a61ee56f9ce0ec77448fbda6c90ce10
SHA512 18bd3cd2f2ab2474bd132d3e8aade1c342d767aa98d5c1124017db6aff03d97386249c462d21976ee1e6693c3165d889984d4961d5d70fea53d625879555a223
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X/Gn:i/G
TLSH
T186075B51F5A48171D1BA8470C696A77AFA3378410B708BCB9386DB3C2F336D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectEdit.htm

Path C:\Program Files\ConnectEdit.htm
Size 30.8MB
SHA256 948bbe164ef28a0546678625aa048831787c80cd6412ce60bddb62e9dd610620
MD5 aca640788ce4f076b37ea07c419f9d71
SHA1 adcaca68b6f008532fa593924770aef373e703fb
SHA512 8b70917bc496631a6ea9a9de9d7910d2ac940499e0336932cf21abf8b60b75d0618e2501d86b00b10ceb2300d28bb98b9e6079162f0087917575ac1203451a8a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwY:i+8
TLSH
T1CF675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 36.3MB
SHA256 7b1bbe4a29b5436add86b2f2883a066a87a3e82b83cef5cf6def601b97fb9ea4
MD5 efd87023c03212e9ec6704a45667674b
SHA1 c61490c03fef46035868c37fbeaf2aac0e35e7ef
SHA512 5e5e75d915159445b0074a5ef3475667c855d1f15029c0d3a55074e8ae92a6a01b1b70fa40c48d027a2f06e0dcee26ecb13adb305b60743b3317187cb4ebcae8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwk:i+uQsas+PS
TLSH
T159875B52F6A08175D07A8470C6A6A776FA337C414B7086CB53C5EB7C2F366C0AA76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 31.9MB
SHA256 465f4b0b7d59e2b949785fd16f9e58f4360d8b4b15d0c528c27e1017c0784dc1
MD5 51b03fbb11c4d29c4ae7a142cf452b5a
SHA1 3f4b222f58fbc7c70d3c43abe1193a65ad5b4d77
SHA512 198e10242adbc7733d0cc3d4a605bc31b0d48bca62d7eb98990446137295b3b15a5f910d17e2a38c3cc25d8d6e409e64df3cc67a2a9a34083f887242c455de2e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwW:i+e/
TLSH
T1B7776A61F5A08171D07A8471C796A77AFA337C414B608BC79386EB3C2F362C19A76727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 32.5MB
SHA256 4938876f8eb896f37d5d1e03d65569e94c94a895214714bf753e99e76735256a
MD5 dd74cc09a38aa84b7df224cf012c33c2
SHA1 5d0120094f980752a66795b857cb48dd57c499bc
SHA512 3c4356964c3a972b5580d73fea833944153d6859ca68cb080cb7ee36ca24e6cc6d848e2c26591ca1d331c63c5b873db7c62bff34ff9fd73c3382196b226d5fd3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwa:i+Ol0G
TLSH
T138775A62F5A08171D07A8471C696A77AFA337C411B708AC793C5EB3C2F362D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 31.8MB
SHA256 aa9ca7ed2945d1abff1430b79bc85036e94d09f6cbdd2ede80ad916ec7f0ec1c
MD5 97d96bb67f7e4854f3070bad24f270ea
SHA1 27f1a402b949f44d5e04eee3f96570c104494343
SHA512 f4d8f18f4f200d0237abcd97a0e15fdcd4e8914a6899c8fe35dd08fe3d1a94fe097c4453657cd31b408822d2edc0d61059c86ce2d2e790d1081dc46701e340f7
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwJ:i+Bf
TLSH
T122775A61F5A08172D07A8471C696A77AFA337C411B608AC793C5EB3C2F362D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 32.1MB
SHA256 1ee3208205b5500949ec8afb8347d27ec2529e48647cc12c458e1e41c07b2d56
MD5 29b942c3736e3c4252765f9c665a409a
SHA1 2cfe01f12f337fda7c73de3d7ff0ecc7b451812a
SHA512 d4324f60b5dd4999c048a3f376457cfd1c873666f1ec609fc83e8fde48a93b44cb7ac89e600bebd18faa17bfd2f67af7fd49b930f3f28ed866201125423217d5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwZ:i+HC16
TLSH
T144775A61F5A08171D07A8471C6A6A77AFA337C411B708AC79385EB3C2F362D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 33.3MB
SHA256 d1f93bc1d9bbde720f1eed0f7cc2c23d27f28fea63cb18cd90040969117f9ea9
MD5 9f31b73b8b661eb9f1da370d3a7bf816
SHA1 9707597415a14d4ede2e1aee65654782c8364ad0
SHA512 fec0c3551aed80ea5271755a922d1cb619a5182192c2d36c84b2dc935c66d6843eb5c0f83904c24e91bf195f90c2d801968395c901aeed47dbf205afe46fa2af
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwU:i+pO
TLSH
T1D4775A52F5A081B1D07A8471C696A77AFA337C410B608AC793C5EB3C2F376D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 31.6MB
SHA256 8c4521157c5fecdadcc96393f11799b36e3c4a59b6de9ab6a16aa2a99ef1cb4e
MD5 3219f9498b15d508898bf5388a9f724e
SHA1 014d18b87b09699e55223ab464cb574b00cc9ebb
SHA512 a11f637f183b40e9677f3167e2a6ca859a2a0d38c8675f799ca70382eb16efa3958e44ebd19a85c73c3c58fa0676fcfd0aab8c7c3bd33231bab249ffd35fea5d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw+:i+90
TLSH
T197775A61F5A08172D07A8471C696A77AFA337C411B608AC793C5EB3C2F362D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 30.2MB
SHA256 1357109d274e36404eb52df209424266bc6b5c5c742b7cc2c4eb72e6fe871443
MD5 148999d486c12fa39083788f197ee7f7
SHA1 7bdc1f03078de222da32d44e3cca7a905ad82b40
SHA512 c6837974eda2d938a6a63d88c27c87cfcae458b155cd404bd90cdc0b6e2620f3f953f22792cb54a3ac9ca83b863d841bf1465c915db92f98383f77839cefebba
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwO:i+i
TLSH
T1BD675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 30.2MB
SHA256 9abedc05238527496a0b5bf4eaf08114e886a32f481cdc11d742440539947676
MD5 138b5685fd51bc63a2f7771166bb3410
SHA1 8261dfb36eff530e1e66ba5f0d382e50a9fb2169
SHA512 5b117bf9c18b2c4c0842f5427ccc7ddf5cac7e64c5046fab7f64f1eb501df82c77c17864aa8166a8900e245f3b083683de60801cf7cc3092cb1b2c4adb60ab9e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwK:i++
TLSH
T143675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 30.2MB
SHA256 723c49ef9aea651f0d92ae538b6d9f8965b0a4f3b5b611dc7eef5f3172f4fd57
MD5 2ddc332af56fb00ab1486cb858cbb739
SHA1 813ab89af3e790330b5d790776bd3cbfee4c1ba7
SHA512 85f626719a9d9c277f6d9c82324deaf8d64fdd2ab17e619727f9adeaca9a6edabfb3d33d3d2b599bcd68fd03e5a0f3e7169382595487449ac44f14e71b218973
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwF:i+Z
TLSH
T132675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 30.2MB
SHA256 94a189a8ebf425438bb9523395742a5a1a134e8a2175d57a2e9112b8854e2771
MD5 9968869e3ecb1d32888e6c9643ccd95a
SHA1 955e906ff3e8a9e6f1eeda39c1ff1cb24b34fe63
SHA512 b30f66c8890a790689453650fc30aab464b66a0a5e6cb6fb313cb86c8b0f12669c3b8ae960dee3dd394764225d3b20f837ca5316d519ae8bc3268cbca8c24961
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwN:i+J
TLSH
T114675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 30.2MB
SHA256 2f64f1a2c51ed85c4e3b7a54ec64802073a653ff9356c84796c2e9f4a0eb486a
MD5 9c25daceb1743c509f4a59143acdf434
SHA1 bebd4d46081a13ae1eec1b757b388a7c21e94665
SHA512 b4ce6c2523668fb2ee5ac65facbebb663e0f482af140b37a5b8f5814028133b816f8c3f893d987fc322c0f1d3a290834c7b55fe27c7dbda67d746fba757f0944
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwq:i+W
TLSH
T1A6675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 30.2MB
SHA256 b4cb50d145c3c42cafaf6553ddffc7247baf8c6cb1d0efbba0e7c1f96101c7a5
MD5 c4118df3947eb4e95e1565d10bc2568e
SHA1 9dc0f4f83ef42a360b396a6e4e496558df542cb7
SHA512 de51902cd9df0f089fd612a4d3cce3e54cbbd788cfb157412892cf0196c66cc5627a355348aeb7bea03cb17baadb2d1cf3643a43702b69922068461ccdebb0ae
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwF:i+B
TLSH
T192675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 15.4MB
SHA256 0cab9ceee4ac9d48f2591d3f2e39892503c531f812c44b1e6857befca8ea68b9
MD5 9c04e629b4431a35a4be4bc392fc99ad
SHA1 f5a3b0c315d6c7c0100afe84860a7cdf686742be
SHA512 8135baf04cd455882b5cc9d897e4a7ad81ea9b7178ccff3b0a504e075e6dc7a20d78ab0ed35f640aebf5671ec376368f24edddcc4179a5657bfb8451def2f176
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+Xkfu:ikm
TLSH
T171F65A61F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 30.2MB
SHA256 6d4923fd62008de3d86d8f01e49ace12e1f510a6abacb5f8fd0fed9b5ce26ffc
MD5 628c07fad20d3c5ea1328fcb636f4d22
SHA1 a78a8ab97e5280cc9565a66172212f0576689eb7
SHA512 46241a2263161796becdd9b1ef07cea10c06e4be7d3bed698f1e390f1862c40cff7681d01c5044dfeab43f0b7fab6451311c2d6250c21ee8466d44b52defb450
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwU:i+Y
TLSH
T194675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 30.2MB
SHA256 70cfa93156b28315012a16e0403072e103b1f231de83e8fb2210b7f29eb54b38
MD5 f7ab4988b20f0fa307c5a76a64cd8a26
SHA1 fc1fdef4575f8f942a6cc78fee3c4198a7ea37de
SHA512 47b60719dc4e2b00dc86e686dd8d7c24dd1c4eef9ff024f25fa08ec72ae0f9a4237b2a1bbf1501a7cdc0d3e5e1b3c6cdb5534bed61bdddf58c8670fe34c2179c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw0:i+Q
TLSH
T13B675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 30.4MB
SHA256 c39f1075d09e875f70b31ebbc9f38be3d0dcc8ad572a808ff6f56bb4c1c3af81
MD5 36f8cbb195872d0425433883218f0e52
SHA1 1c4fccfd46ec470aa47461ab3d2d4a4965297090
SHA512 1b29035047976217d83a061982dde7717f4e64a91eddfe6e16f35817492b5f7fc9c7a480e44d33ffd6c3717b37d6d5f37b6af1d0b215048e4fa18cfc22b80275
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwo:i+k
TLSH
T1B7675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 30.2MB
SHA256 1cb2a200984cce0ad767c5b93b7c5f2cc8979d047864057d63f132f8292b053f
MD5 e0b3f0ddae8acffc7171f0f0a71b34f5
SHA1 125a0ed4606980c9b505985ff1831a2a627034ea
SHA512 09e6de378edec31cf16c3272ce9b1503d575eb3490f78c25eeea0dffb4c4cb87f572db20aba11890a797f27979f88719e53df69b8f24659cda0d5446878d092c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwJ:i+d
TLSH
T190675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 30.2MB
SHA256 726fa3fc31c1af52ad2aab5efbb967496bed6e57df7b7d66571e63c020409df4
MD5 3f28fc885a20d2f395686ad5f6851706
SHA1 06ce8035734ca7b994053ea7a0573a1b03b690e8
SHA512 de952e6491b06736561ee0bf26fdfd2328e32ed331e7983ac1146b513834cac21f2fa08ac3880566f81aa752cd04859d37b9d65987f02c5ed8adaabca24f1c40
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwr:i+v
TLSH
T1CE675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 30.4MB
SHA256 cc139f96f4f7f03f195e0ba305fd1524000e99ee48340db981a311d25302118e
MD5 11941ee0d992a53bb77ef59bcafc6505
SHA1 169c1db8a5588632376ca34ea9333c8d099c4fd8
SHA512 7e83a480a0102fe61d30017f9c16661ba5f57db78d7e169843b5921d1e679840e3a57066f9f39cc152ed84fecc54a8213a98edbc78510b790626f4f6906119fa
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwA:i+0
TLSH
T117675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 30.5MB
SHA256 eb77fd224fc1356f1dea1289efd34c4832bb977bf792ca1cf8458df2a7bac911
MD5 0984389705ad2f4060b2061e6c7cde9c
SHA1 6ae48003247f84da52ad4a18bd9e2d34c060e544
SHA512 660edbf957c71049b90a45440a36979e0207ed828eca76b1f4a3081a0c6f35c2b33d88268e74c7e3c653272e7190ca008594efdf3b4c05ab5c10184bbe8e2382
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwU:i+G7
TLSH
T127675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 30.7MB
SHA256 b10e36008aa05ba16f6f2d9eeb1698dca5544311174102e4706756ea2cbb5a02
MD5 160e5828d69d1b3bc03d49ab4311697d
SHA1 355c65117d3cb3837ae871e0a6877ab6aa9b19b1
SHA512 7c59ad7c232c1f1a6b0d94d9f1ba0c500ed8180f24e669279c8e074a1fe09b2aa9bf66e6f5bd86b486de6282286e43b72003c52a202168a34038079fd1a7b330
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwT:i+Rd
TLSH
T153675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 30.2MB
SHA256 a516a23eb8245aecdde62b5f27d613558e643013022c9677f62521c6ec7f50e2
MD5 a36daa3b69a683866d3953c0968b8599
SHA1 9b1f545ab0eb535eb6054d387fa54cc5be353813
SHA512 5194f095afad2df7201f6af46b322c0cca6ef603eb70374ed24a3c97fff3dfe02f3bd033064b0e3b503878ce5a8a8bf7742deeade20284a8d1959a91448f9ebe
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwK:i+O
TLSH
T1B7675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 30.2MB
SHA256 cbdce47210fed4fd1cf70f62980bfcb0a240358f5eb06f6d255a03700667791a
MD5 be4951d22a6db7527109e26dafe0665d
SHA1 e7f7bde2fb60a12952d0b9e1b98aeffd05c7997e
SHA512 bd88fef87bd6a41ec4ee6941f3795d06cf3bd4d4da29f92064c13da5b1b18d3d55d2e252a5eedafe2d5bc22822310fd967b44a14067cae099f77921aee60090d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwn:i+j
TLSH
T1B3675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 30.2MB
SHA256 88e1f9d97902c5840ff5e706921fae82838e3f726697ec85f6b43430c4ab2a2b
MD5 45ace47e922d40f75c212efce726a3f5
SHA1 fd6fe3ae6b282111c436a5aeae0e17662d435f25
SHA512 d515ddc08cc19784f6e968564998f5187b56324ba1fe0537a25d48f1dd1a0c35e514724d4ef0a54e9986dfb931dd9c63be297337f1c4da6c05ee7a36e96bd213
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw9:i+h
TLSH
T1F0675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 30.2MB
SHA256 e889a09dd12e37e565454291ee1ebccb0268b89f76f3f552c79b750368ea9320
MD5 1eee98d0dd08bbf68e66fbba08df6bc8
SHA1 c7e6f7a43fe21056ded63a1080194f03bf02ffa8
SHA512 f632de6a5dc9d3e8bd28b2e3511071eea9e0a487c8670acf77ace36c13e2473efbf468855869a29ea3d50ed7505eeb3c05e0523ed7ac0a809c322a6ff4a1f048
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwG:i+6
TLSH
T11E675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 30.2MB
SHA256 fb8c10d5ffc2a39f6daf8b631e6a490ba702e767819c367f4110ceeb405639e9
MD5 5ec6dc556c496a7cac3864766b258d7b
SHA1 e7e892dd3fdfb4007da7337c3f0e203f648a516e
SHA512 9a29c8d001bd887c0e1a554ac86d3708fe6106e62f944cba47067ac5221737d95ca1c2e2470ec169e5a0909ad8322d48affa4cb44b96555c1cc5b0c3931a3d1d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwk:i+A
TLSH
T1FB675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 30.2MB
SHA256 94e740fb20f8c93c43a896a3638396f56921724ed24d6929ae7a280e56c74506
MD5 7acfc0ecf4f3441893b2281d9301e7c1
SHA1 933c2af4c17ff773537b15484d269fc64c715d2a
SHA512 88ebb839dca0639fe6ba26d9e57aed78ea863a6676df26ee4e677046e7482fd36323f14c90c1f391ae58fd17bdac026db52a188ae288e6bcae9781a4780bef3a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwQ:i+U
TLSH
T1A0675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 30.2MB
SHA256 17058eeb529ea8f0ce25dfbd5d1cdaf469ef45f21db567b3be7513fe846f9ffb
MD5 fdf5aa79d9949e7af199e673fa62d997
SHA1 8c5f546725c27fd8ebb7facfe5061f2a52d3d2e3
SHA512 6178b18184b568f22f0d0f3b9c7b7e64f8b901a58a5a019adf8cb4091193bd536aeab6379e89df30776147b735dfda6a1fac3159085731f3650d76a7cb34b52b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwt:i+p
TLSH
T195675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 30.2MB
SHA256 9eb6f4085d573750e41b6ca009acfd80770c8676257c96dd9ffa9c00837589ec
MD5 6cb0429b08ff53dcbd0896a94dcdab17
SHA1 d03b1b0aae7bca2bb40f2ae1ea0a22e261940278
SHA512 71c437527735a410228e62b6b3cd163380ac4909bcb5ab6d1791ae64a26a6529bfea704132f8a274840549574d5788bab30ed0dfe488768e122c89ae9d0b10c6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwh:i+d
TLSH
T1FF675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 30.2MB
SHA256 f56a14e88967a07c7b5a737fb2576205f8d57d1d64312405aec80f99668e0bd8
MD5 b78afb6c53d9e89869fe67b298891962
SHA1 bcee98bc51e582b1edbdc082b99ba455bf1258fb
SHA512 49ae30bf305a0792f04b1399f989be83f698aaa572be4e66b3a0944edefb98af7e6efce981519d43272d95ff423592d235ed5ebdba26f47baa648ce7908841f4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwW:i+i
TLSH
T123675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 30.2MB
SHA256 e37b6e497cdb7321355cfa964e04fd27272572991876fdf0aeafe0f8f3586594
MD5 9a7f92279b3f9a17a782a1f09866f94b
SHA1 4e29b985db5844d563a786d69068a649eb82514e
SHA512 b1b8402c423bba2ff52cb1547db1faf5cf9321fd3e4273a3e64d8dbdba50c15005252cca13030606737f37894fe7ea5cf53c131bfd3ee031bf7eaa2314624024
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwn:i+T
TLSH
T10E675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 30.2MB
SHA256 fa66aa7a0c7b0033ce1e6b72f826caa28a65b5fef27bb0328ec1522a81c93f58
MD5 637386ade8f5b4ba33c80cf22fcc55c4
SHA1 0f57a804bd167ce7a345236fde7da69d7d111ee0
SHA512 f04674a5de4cb48eedfdb9c2f072fa9705e4ad20683af4024d029fed724f7ebf546b40add8f462132746909bb7c5976d80679922af06ccc04149bb0f39fbd1a0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwP:i+L
TLSH
T1A7675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 30.2MB
SHA256 30fdb43173518bcbc941f29b3cd9af609fe06c2a338bc01260d59e347ca75937
MD5 6131f9d323ce2a04dac30cfc18fcfd5e
SHA1 3ada8443279561cd42d24211d78d44b822c8b1d7
SHA512 e7178bda0b0df6109668e03f3f2e776bba2f950982733a582498eef0f2a5dfb02623dcff55d6abf579e4d278bd21ab4b7f68ee336fef15f5646b4742cc248771
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwv:i+7
TLSH
T117675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 30.2MB
SHA256 845ed52297bc5ec1830eeca81b4d321fb9a1ddfbceed4c72f665b3e6a4a067ea
MD5 29362590435085abac038440366c0a88
SHA1 34491b9bbb12bb5ba2b94105b3e46f382004f8a6
SHA512 f2a8ef1204cbd78032a805c8f0b851b6c918188b30e0c50a5f9b231556a9c839e6431cc5f70606d5e04219bc38b4a9c3ffe22a82379b9e8d39f3a7bff5983a0e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw6:i+2
TLSH
T1C3675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 30.2MB
SHA256 ba2087c8d5de4e3a68fa91368d745375b8461c44f043a0956a810057ecfa4e44
MD5 af3262ea06b0d37cb38f97375bb4715c
SHA1 8884a1dcdb2e7006353d864d3c96759c646ea81a
SHA512 fa1c136282f82b7689486fb578f54d069ab9fa4dfda48b96bd7c270e7372c927d19cce83358e748177a5b05714f16e245ea4b6c89b61a689b1b4efbd7f0d18c3
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwP:i+L
TLSH
T13A675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 30.2MB
SHA256 33a3146d47644041becdcf634e3ed531ae63162ab3f2a1588e352b6f53c633f3
MD5 a89e135d40cb62f9f61f263fb354b81e
SHA1 9c3b1228d96de2abb7779c107c92ff288737cee4
SHA512 49d255b8ad8c2646e47a2bc1bde1e481d8b0f3cf1e120f89a1b58fe916ff7d21127cd1fd94a3e6c2e6c6fa67010f626d415e1be0704855ecc549223579c2bd8b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwS:i++
TLSH
T113675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 15.1MB
SHA256 a3471afa9e4af4cff558558fab4290dc5d049df7ef472d51cc5269b98ff8f6f1
MD5 e146f2602a396f93f5af35183d35a324
SHA1 43ff5b5500a363b83f07d50a09b344a857a9191b
SHA512 407340a07350a9b57e1ed85276618c5c64655aba2b8c2745f65f9b2a6b39badee559ab6feba728eea8e7b9efde9ad99b4d48f0e06eb77e1a7a9a2fc80801793a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+XS:iS
TLSH
T1BAF65A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 30.2MB
SHA256 71c57acb95a03855127d81f10c40cae34960483afaf20609fdb279cbe41b4d64
MD5 0d18f1dbe6a9f2f9793a178deb8c5b8f
SHA1 2e39eea536099c849fb356f4da09fa7aea45562b
SHA512 b6220b7d96e2ca4bab0deff654d804231c57ef237529679edfcaabf7c4780b8ae09b38859baa11d1453471a2b303ca3c97b1ef0cc0a2e3004cbafb5bf34dd5d4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw8:i+g
TLSH
T195675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 30.2MB
SHA256 ae9f20ea94f0a40415f692053210bde3acac52ecaeafc364062f32c93efadf5b
MD5 39c9c0730b74a8a877af1a6ed2b2b60c
SHA1 0fac75805377a2df96b1c5c6fa7ce832f48ce5c4
SHA512 076315dbb9f2293144fef977a5fba0ab1adc57daca902e1bb274346fbbafdebac3f64f22a5030f97589bee897b9d38ae2996db9344157f4edd8b107554f8848a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwH:i+D
TLSH
T151675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 30.2MB
SHA256 c94dad1f06bcc5562e623042a011736fab1bdc6bc84b5ae6e1ae76c30fa8d054
MD5 ce0d552c18758677b2841583845e78d1
SHA1 323c198203661ed3f8415ec65da272e74852dff1
SHA512 a8733635888fbf8f8ffa3a6f0429b5bb870017b686de263a87348b16cf8a5c7ff587f53627d9a2b5d5e1cb0d5b0688ae77a52dfb5c48a2b349be91804a18ae41
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwq:i+O
TLSH
T195675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 30.2MB
SHA256 6971a7a534876529adc49580cbb804bbcf98b7bcbcc067f0b0f2007f0e2b7975
MD5 d3084c4a96c45057b569cf395f2e3a01
SHA1 bdbc14bbd36572f8372c3e0fbdd62178352a22eb
SHA512 4b9a5ed4e610bc4bf299d6f31a69eebe1fc3c013bf39d4a60746bc2358a626a20d88732955cc550885ef9d4cf5c3c75e291cabdeda771b7af8cc4dde7869d976
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwp:i+t
TLSH
T172675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 30.2MB
SHA256 8a15c0d5ecdb49c7c585f3931a8b2df6194a25d7df325f12ad6e2f0aa895f61a
MD5 d19c060abdaafbca917ca3e715ee2534
SHA1 2b4a787f433084d54f93c2b6509f6f9e4e11d9d5
SHA512 dcc7ae4e43b6b4c4d1772eee0593d2e3343896c453bad040eb28699282fbd7e32fa18fc0c0a0340807de0a3ea174292e43aed38da24614f1fb67ac8211166c06
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw0:i+I
TLSH
T15F675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 30.2MB
SHA256 da30c93cddfe914c9af246cf80f43c0bfe134bb7a9280111ed146d18a6187689
MD5 25aad5d3e87a8142176e6cd3838b4248
SHA1 c5d2aa4f51b1283566cf4174e02df76cab3a3c35
SHA512 a852742dd6df8c884e270a1b54f8623de784a64259e4d77425ff16b519654171b8dedc62f03ff4b661f439e8a997b772c22e51c3d2b94240beb478418cb5461e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwW:i+C
TLSH
T117675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 30.2MB
SHA256 1ba068b87a23263a8cd51c159b4c4d3ce1c0f1c628e016bf2b045aa6a09636e5
MD5 cfd913d958d8431b54f9177d16269830
SHA1 44d83a59afe9a51df1f28a88e1077e0857b171a3
SHA512 2cbb341d7251647de0c324b035c6da862206182238a70259e6c4b04c2f39b616cb9e00168ee3d316b1908ec6ed919bc66863a63e5a1956710d68c06498844309
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw6:i+G
TLSH
T102675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 30.2MB
SHA256 89014761bbc48cfa0c0d9ceebe7b8f764d1270206e03942fd498bc7e0c53d707
MD5 5e6d38e8f3e3d321db167708983c591a
SHA1 8daeda2f5bcf185faf6d44bcc6d21cf2442376ae
SHA512 13081e64772ba574d81d4d65886fddc2de2d5456b2e9f7fc5152e74c9aacc5b6c33729d87940243ef18a7e235478fa087ce5259b0007ea8bf2452895bc9e3228
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cw7:i+P
TLSH
T112675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 30.2MB
SHA256 66858d4882dda4b8fa219e175bb7b8f204c4737fec0d577482e26a8159b1d992
MD5 894eb74aba63f4957b4672c62403ee93
SHA1 0ae5a4dfec1f7e3bd97e6974d90e4f3a1a98fa31
SHA512 e21326f60dca7cd095a58f7616ff1f9744a299bd28cc2380b46eb364426a221d66d3a0720c31eaf4fabe389e88af6e1d1948d0ca736e3aa0dbf93f1e804d3d07
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwF:i+5
TLSH
T117675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 30.2MB
SHA256 283eb6d90b8576eca77809508e9473062f1f033c00836176b20bbdc5027e2dc4
MD5 4f3ca6b091c6654aa79d59c32487e1d2
SHA1 0d9fba3615e84bcb94bf51560fbfc90caa03aada
SHA512 fa421ea913df3462fb42262208d6c96a2e605d7b0632eb170074cc303d012bf70b1d9b8bba1518f2a8e2522d6c1b898db5c280bd487b560b27cf0f6af6b30b50
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwA:i+8
TLSH
T119675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 15.1MB
SHA256 4a60a2550da4d840447763363897168d6fcc54d0c32573b3b809c258bb702a56
MD5 16cc011664c5ffdab10497be3a45674e
SHA1 9b8fc17dd154c727114cc7ead689350daf05dbd1
SHA512 36e3dc1730793485e2f44bea7d190d4fcc40b56c20d4df488534090f5d612ad94d981913534872434b99db657eded0ad809931540d10624574460fc29ce5170a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+XU:iU
TLSH
T11CF65A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 30.2MB
SHA256 2dba7525e5069124f98088ae3f8ad196a56c65d368357e94d82f16f37d43f2d2
MD5 2ef98bb06797aa2b90ae1be3b2e9d909
SHA1 61d1c975905c30b91fc7ce83ee39d256a83dcbef
SHA512 ba25aeda859573217dae9eaec27f99d6068956d907764cbd76f939ed3dd8b8c5a63f3767b014c0d88edb4729d41151e82564a750e03a55887379c4356104a56b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwg:i+U
TLSH
T123675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 30.4MB
SHA256 bcad00f4ef1ded2a187854862df31197c77feb0633a2afd4d4b3b89be7cd26ce
MD5 1d6f30c31fdfc52cd7690aebe0215e0d
SHA1 11813feadd5854c84fb8e3881cb9813b9e42ba6c
SHA512 de9d76b599ce4ab17871096fc1511517a085569f38e3ae5170247ad72d0460e2066a1c4970882e31d30a62657407d9c9027bed46d55360dfeff55031125f456e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwa:i+2
TLSH
T176675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 15.2MB
SHA256 feec9421c264dab6a05c147a8ac16f543c4ce1dc60c9328f7f80d97533fb073b
MD5 cbf8801be4fb89d3d4eb16b61f696bce
SHA1 9fb791ba032fd64878dd946ecc5635ba3a26490e
SHA512 84df4a80ce2f9cdbd0803380f2cce3197da9758fd35fd6b2418dd7e6545b834c03a81f56e0d5b2c16821af8a33cca7d30a4636849f7b07d34921ca9b1912a8d8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+Xu:iu
TLSH
T148F65A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 30.3MB
SHA256 2b5f465df41fe20a6662db83d44928afbd146b0561cd297f5f70e7b6c6d4963f
MD5 fb6307282fded0a0f9e3b88e7bca6950
SHA1 0d0f5f4fa4c7533641033ffce381339d1c4755cd
SHA512 3de2246457d74a9e6f64b439a481a3edb302a6c5c108c8c214addcfe56f36ff81af847bfed7588f98c80cc9ae8a3be13d80ff94ae08bfbdc7a37c0b65baa2c90
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cws:i+ej
TLSH
T1EF675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 30.3MB
SHA256 4e5417939144861a70db769d3098d672c443c7db64370b225340420831a1d003
MD5 06fe7e48022bc107526aa69f752dc176
SHA1 b85622f50c2dd5ebd251ab90b66a1b0ca48b0348
SHA512 d1a9de8b9f69bec96d223399445ca3b28096633b180b3fb389645a0c5425a69fd8a5cc43dd8261660d82501d02e9ecf27d18c5320c52bac2e6d5679dcae4fa75
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+ww/h1+Qw/h1+cw/h1+Qw/h1+X9w/h1+Qw/h1+cwe:i+ED
TLSH
T162675A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-615-0x000000000F430000-0x000000000F5FA000-memory.dmp

Download

memory/2372-443-0x0000022A14000000-0x0000022A14100000-memory.dmp

Download

memory/2372-425-0x0000022A001E0000-0x0000022A002E0000-memory.dmp

Download

memory/2372-424-0x0000022A001E0000-0x0000022A002E0000-memory.dmp

Download

memory/2372-452-0x0000022A02B90000-0x0000022A02BB0000-memory.dmp

Download

memory/2372-442-0x0000022A02A50000-0x0000022A02A70000-memory.dmp

Download

memory/2372-469-0x0000022A14280000-0x0000022A142A0000-memory.dmp

Download

memory/4688-619-0x000001FAF0080000-0x000001FAF04B4000-memory.dmp

Download

memory/5308-17-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5308-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5920-35-0x0000000000400000-0x00000000004E4000-memory.dmp

Download