6263ba3e582b1a161aa6d66582de77ff031bf39444fed189d15a0cdd4931ae73

Analysis

max time kernel
136s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 7.2MB
Sample260707-269tkafy3s
SHA256 6263ba3e582b1a161aa6d66582de77ff031bf39444fed189d15a0cdd4931ae73
MD5 64955516d60d76df23e1f13b7fcd86fe
SHA1 fa3afb33ea72660b33a9086d4c8fb23e69f5c0d7
SHA512 f85bad23f3368a23b4ce22da4d1b211b83d366b3088d2d5d618c69be8b1888e2ca7d93dc37b4d21004bff0f5dc957b22797947cb04fbe22074403b85ead35f88
SSDEEP 98304:Su5x6M1c/h1+nu5x6M1c/h1+Tu5x6M1c/h1+nu5x6M1c/h1+:Jw/h1+Qw/h1+cw/h1+Qw/h1+
TLSH
T11A764991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{38789E20-136B-4ACD-85F4-E7BD03553CB2}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{3FCCD25E-AC43-4729-9957-D04EC0180B23}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe
Token: SeShutdownPrivilege	4708	explorer.exe
Token: SeCreatePagefilePrivilege	4708	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2060	sihost.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe
4708	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3244	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1832	2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
2652	StartMenuExperienceHost.exe
3300	SearchHost.exe
4708	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4708	2060	sihost.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3244

C:\Users\Admin\AppData\Local\Temp\2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-07_64955516d60d76df23e1f13b7fcd86fe_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1832

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4708

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2652

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 15.0MB
SHA256 459dc3ccda0c36d92b481f92598f0881193e978b50acd4e7ab6e3d6c778f7ae6
MD5 191c82071f83c49752c9bb76c2bb6f1b
SHA1 8493796aa8c47de26233c507a0166218b46f7ec1
SHA512 5893eac25c0c12a7c25241fb90570c6fbd94e5ae6c173de26670131a0861bef82fa9b9fdd01bd386ef48d5ad4d7f3cbe0634c225cb5f20cf99739562ca2a6fd6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+po:+
TLSH
T161F64951F5A08272D07A8471C696A77AFA3378411B708AC793C6DB3C2F272D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 15.4MB
SHA256 3eb1b938f9b88bea410f0c263a343ee13499abe3510e5092d4083a78da33fd11
MD5 c7a0107210c21ee10783182c0805f80c
SHA1 1d0b0bce80dc8183ff5b23ae859da3d4b3a18dc8
SHA512 5702d87029460c48e3a8e25ec9b1d7c6773c188810f95a6e1e93fae738463cac87af99b52990ba07a7a4f8bb7b8e9f4943be54a188c3dfe0178b054043808543
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+l:
TLSH
T1F9F65A51F5A08272D07A8071C6D6A77AFA3378411B708AC79386DB3C2F272D19A76737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 15.1MB
SHA256 35d2584e5a68dbf64a0a877cfde334834261c5dc03a5e45c595e95f599cf2d34
MD5 08f32261f631ce42b87ebcb670b92876
SHA1 b9aaaae08d5cfa3462d6cbd4679ad09010bb3b64
SHA512 5028064ba380395568ac1bbbe4d9e46bb7b1a7c8f5becaeb840598993e03517df45c7dd3f1d3b28ba518c2c40f1e7a84e78484f2fd7a9bd574c6a79bf3e7d8c0
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+q/h1+:
TLSH
T109F64A51F5A08272D07A8471C6D6A77AFA3378411B708AC79386DB3C2F272D19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14.5MB
SHA256 6a5e0f8fdca39455793eefb0ccc2970b1bc4a71af0ac05712ef295154cc093af
MD5 cc8c0a1c7a3f7f4a0eba370ba8ad6dd7
SHA1 175ddb47484aec0b2fcca9aa28427301d878086c
SHA512 402e39428799d9a27f4f3ca8e100d75affb88a7ddd426fa50ae1e486b183eb6c23484adafc88a93936b7e36c92d2cabb0109e7c8d3f4a6a31ac439332b9f7be2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+:
TLSH
T1BFE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 14.7MB
SHA256 8c78937b3223fda57aa50febd2ac609b239219a74a5dbb2cb283f490d4dd3f1d
MD5 b2769b7bb7f4cc60ad112d9f7524fdb1
SHA1 1e456d8bdb323b8df5d981b821f522f436c07768
SHA512 3053d1d777d4d1b4f0d5837ed38517458cf8ef13d2440e0e2327cfa0cb8d0dc5a66f7ff95b5583f6473c66a202efeb264a9355d9a4ca8039eaad69c75d337e8e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+7:T
TLSH
T118F65A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 14.5MB
SHA256 a930ad78b1fa5288cddeeadd68d09d477178b4164b7e8bb31a26ad13959f83f0
MD5 4209d89c8d1e4f7ec7641ff0b5ba41c5
SHA1 c8d64c2fd4c4cc15a394086c3f9dcb5145de1135
SHA512 8d1dc977750c2f889e51f7caa1e2f2002432f149b98d98f07e3e82cdf2567dc31d1d424dabe18a00cf603ad421052968f89035c80798582e588fddeb4062d753
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+Mb:G
TLSH
T142E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 18.5MB
SHA256 23ef574eb60ad42f8308c37104002d06e222ae62348515b7f98fc23fe64c35e1
MD5 9805facd889715614006a2d2c298f43e
SHA1 3e19d8bb853d79d38486dd07fc7145360e7ec011
SHA512 c563efabcb491fac706deed599a0ee1314a2bb7c1e7307cf10e46db224c1566da05e110a310938e3a062820ca43cad67c78127b22a14d98d93d9ba6dac33166c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+avyEYc/b3w8O:SvyEYKbi
TLSH
T1C9175A51F6A481B1D07A8074C6A6A676FA3378421B708BCB4285DB3D2F372D09E76737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 14.8MB
SHA256 26cae6679058ecc4d749b60ee2c1e992316cdc31979c7c309b0a546395a05338
MD5 584e7d634d83a85bc491e790a5fa7334
SHA1 41194c34b1ffca7b976d1366ddd668fcd59ecd23
SHA512 c4d523f3d701217bb852642a920455bd1920c78159dacc9bf7697420749d2ceef2f4baa70025f4241869f8bf5f2fb96784200d996257534652a900c9a1f2fcb4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+K:C
TLSH
T19FF65A61F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 37.9MB
SHA256 b3ecbfa70402346d5a384da8b0cba516e769a4ab6836228b2d38978934539774
MD5 a49811c10ea46c22cb31375342278e79
SHA1 7f9b746c74aec612c0a0557ce1742ac08f6bc304
SHA512 59a8af236813f250f78f72f054c9bb5264b51ee4d718fb3072e27811349073a3409bd3062ea177b69e81cdd1b232564dbb2acc41c25179b16c48bdda4cd9871b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+DUEtQeTbvf2zlO12:bUEtQevvqc2W1cpV2XI32i
TLSH
T1BB975A91F6E483E2D36A9434C5B182B6FA727C0E1B3197BB4179F62E1F372905D25322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 16.6MB
SHA256 f1b663b4f41080160e18f8512bc8cad00841072eae33564c1d0530eac00a9256
MD5 c71d429b68fa35d7729eb1ff76535b4e
SHA1 6d3826c4e0c26ac516e53d68c3c66bf201515718
SHA512 47684d0bc952b804ddacd52790e7fa47f0eeab7f8ca43bf7060a70c86ba1b5174391c07c8adaeb26fc0d0da9f47be931082276decd6e5ed3acc834f38520720b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+XGn:fG
TLSH
T1BD075A51F5A48171D0BA8470C696A77AFA3378410B708BCB9386DB3C2F376D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 14.5MB
SHA256 3ec6e7e7dede41a4bd260970ed01d2910ae2f8b92b7fca831f0f8f7b9221bce0
MD5 58735346e468e33950418ca8384ec308
SHA1 3e87e05c9bada31974ae603c219d5d8d4d30b1ab
SHA512 6ff1aa8ba25d8197d6c89a0e5629d1ee7441d58fddc215aa6d5038f452e32ec1ffc2ae4e681254b5e762b9faf322c6de12ea98668541301ae7fb98f67ce39251
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+s:k
TLSH
T179E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 20.5MB
SHA256 63b806ec64bd59d48e12f022a6d19f73f037e885f621f453dea35903868f9a66
MD5 e11293f846bff7ae4fe0ae09ccbe87cf
SHA1 afc63045ae894a7e970d312264843aeaccc42359
SHA512 09d58bc106b69ea6706c537e74e979f9bd85a7f2b4903b91ec2b829b93839880aad84c4861c887d509bda1d377b328d32205d33d7046780e4fa4bda1d2d922c2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+WQyiKaUX+PNo:OQsas+PS
TLSH
T120275C52F2A481B5D06AC470C6A6A736FA337C46477087CB52C5E77C2F366D0AA36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 16.2MB
SHA256 5f352df38af32693e35004e0fda3822e86cc2325acf7a0fda041249cdeac29cb
MD5 d51de0cfc30e568f0ac3b590c1483e66
SHA1 0c00f9dcac111196318c8a51460d2eb36a9c9a0d
SHA512 a5a8771f7b4205dc6ca6587a3281873599573b596b05b317abef64d46e92e5daa4d5dba2a51e031a0ac41c8b8b3200f29b6e501ff66a7bfb75a2f307581b858d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+2thHf:+/
TLSH
T1E8074A62F5A08171D06A8071C796A776FA737C414B608BC79386FB3C2F366C09A76727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 17.9MB
SHA256 88a16c4493a76cceff56245c7427f41ebe387f7147e207e5195c78af0e3feb02
MD5 194210e0f0c3d7094095d21fbd3e7b4f
SHA1 9e0a955e57fe4135f22ebb12d9c9d8231b1be07f
SHA512 48f714804d29d5cb81a2ae197e2775e07137ebc7cf988fa19eeff3cd5f40761733bd9963ee0ca858304960d27b3fb63676e60ef2113fb37da7724e702ff630e1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+ULIHuWhs:c+6
TLSH
T13C175B52F5A481B5D06AC075C696A736FA337C420B608ACB4385EB3C2F376D19B76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 16.7MB
SHA256 3990fad4f3b3816a6970c770ad10b92b729c5bf0e8949dae8ef0287a65abdf20
MD5 656d0c3d4ff0e3f0bb1c3cb8de03a3e2
SHA1 62fdb36b063ae8225f4e13025146d8587ae46a19
SHA512 8489db6a40a67c7af9aaa31a25e761da6b7e88261b82abeb91bb98921dbb90ad36e4e1270f359b6573533792ce7c286b0f037f3357066bf7f484436c84650bea
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+W6Jm0G:ul0G
TLSH
T139075A52F5A081B1D07A8471C696A77AFA337C411B608ACB5385FB3C2F376D09A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 16.1MB
SHA256 c2312b7dc5038be25c6bdc02dc7577ef19ccd45a0324cd8a762814ef51287598
MD5 d7f87afefae122a0393af4b9768c71bb
SHA1 ba0e5e6af63d9e978c4aba21d1f3f343f3be5c8e
SHA512 9f7461c6b18b414023721acc8e3b8bbd1b78f8342d567f742d23f18cee852f93831200f1757ba0eec54b4914cfb3e558d10945faf3bc0aaf703584d8d124c000
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+hfPf:hf
TLSH
T1A4075A52F5A081B1D07A8471C696A77AFA337C411B608ACB5385FB3C2F376D09A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 16.3MB
SHA256 db58fa2beabc3c505eabd40f85085a8b890bf868a577f997fb4f7d47057cbfab
MD5 7cc4974362102f406476dc5bef1f9c5e
SHA1 6f4ff626af55b5c605f3c240a04e901d3321ea4b
SHA512 842e7776132a6e13b9e22aec98629868997762ab1d6038ab197fba31963138b12fb876cf202d4a017bc89e2d8a132c75ff8e94553456e832ca57746e813c3560
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+odKC16:nC16
TLSH
T1EA074A52F5A081B1D07A8471C696A77AFA337C411B708ACB5385FA3C2F376D09A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 17.5MB
SHA256 8913a0a862b927c9a794d84d8ab8994f5e75ac6d856237b83d5c750ff8e32766
MD5 7d4c2dd710f13926f76e9367fea1e52f
SHA1 a02b56693600f73e3783d9a540d88f7c0b125d99
SHA512 75fa90988d2ff0081d7b4dbd8db63df936b9ec64e127a27b12cdaafd45a164cab7ec463370cce87bf49c3dc4d83e2cc480f083e51dd76539f919252cb7823d84
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+9jnDO:JO
TLSH
T1B1075A52F5A481B1D07A8071C696A776FA337C410B608ACB5385FB3C2F376D19A7A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 15.9MB
SHA256 fac98d2a332c8491cf1b943fffac48cc57b2c4e1d85557b8bbab270d2dccc557
MD5 53dde57f8af73a6270dbb96c9c8df417
SHA1 da3c5f554d7fc63b00c1ce7f4bb86e66fedd327a
SHA512 7ee110bf9b1a01738248c126254c66c639557cb9a8376f5e0023a84360e619718587e8c538b38604a7ece3bd40066851e02d9c615e6baf3d2becf198e9335dab
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+z2iw3:d0
TLSH
T1DBF65A52F5A081B1D07A8471C696A77AFA337C411B608AC75386FB3C2F372D19A76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 14.5MB
SHA256 a571bdc4534696a316b41a6e4698fe8e1e166d2e998049ed604dc523618487ac
MD5 d2c7e5bb5e536b8ddf10c99584167c5c
SHA1 0f8a9eb1becd153e1e271e07f76f0e3c00a8f7a4
SHA512 a1f97fddd72c6c32cfc1fb7f469a47364b347fe1036f1e6fd2bd6d7bfb8425f4397fa135cda33c23a9ca7a3e2072ee9d23c14360f0083bcf9d7b366bfe2a7345
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+q:C
TLSH
T198E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 14.5MB
SHA256 465de7f9366f18e5955ce840377e81476a7b2b7cd1da8748adfc6804023f20fd
MD5 5d6bbc709a57968ca3c07b5ed38320f2
SHA1 9790e6b66dc26a1bff91436c1b08d05986c2d22c
SHA512 533c017e82669934ad6cf013436a7d8c4de888a25f21e814626930e4f7a72e2ca9454a71ee8b3fadc87ebcc8375a6615ccdc7081e3f32df0113ad42e3d9c759f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+G:e
TLSH
T1B9E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 14.5MB
SHA256 65cb1dc78e9e4478085129b52af31daac1b8f89fa6dda23425ac8f0828c8f65d
MD5 c02e2db84d916b4f5b751142ded562df
SHA1 773251af9d6c06245b3cecc1aa941b27c5894dca
SHA512 26674496f125102f6245b5ec12d9189dcdbf31525f5946ae9c9c0cec0087c1f10475299bb46134a68760631fd09ce67a89baed8166c36a9dc3c88ef94d454c43
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+x:5
TLSH
T1A4E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 14.5MB
SHA256 c0b24de0eb5b02fa94e220b846d83c352920b9d9ce073c5805f256ba785f4b0e
MD5 6e8c0c7e46398688fd06d60850211287
SHA1 2f426e4a4b7ff3b1aecbed11c96fe02c4470abc0
SHA512 40873c05bf012366c45bcef949c3b4692a8a3490b63be9d40e44c6cd7bf2cec0d545b0bff044486682393f5d9b0be8de734f538f56b94ec1d7d56fac3f7e28b6
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+E:M
TLSH
T111E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F362C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 14.5MB
SHA256 74cffe2dd1119683307f864a3fd3dc941a39f9ba5c356cc68b776b95f043327d
MD5 0d390427e122dc9beaba7cf0ca57071b
SHA1 d42145668c3f747e0139bdc7fe0d82b0ad17dbcd
SHA512 87934e842676916e0ff6b4ec1a34b01f3d49feeb1f4dc409de5b26c72c3bd93552eec09a633eb5d2d50ed3739bb8836337502a9d807c0b4f92875b7d1908d69c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+h:p
TLSH
T152E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 14.5MB
SHA256 6a91572771e86fe0c8d60c3e8c733a1c29cbefd0d57043d0c2148a49b3661314
MD5 4bd9c1a0f373b414a3dfd40d8b52fe1b
SHA1 c0d6d15f439e92453982a3163787cace942e22c5
SHA512 c67ed96c6572fc2376e39a53b6c2d54f10bb44fd52d6f3ea904268e4aefd23bbafd3a679261a546fa5bcb8e2ac87b6d9d8e1a0682dd229313e6de873e47423b5
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+u:2
TLSH
T1E6E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 14.5MB
SHA256 2743fe7b1999f4775d76a35e86045dbc96ffd492dbcb13b7cd2a1102367f4728
MD5 aabb85a33dff1ccac70c0433c11f66f4
SHA1 678e6c56804b3140d16f6bf18c866f0652a2f2d6
SHA512 cdfea5a68d5690c05b5870b17862d200ebf7e537dc829eab1b26fef945ab8c3c60ac68d999087db0bbeee27097a262b692a7a7c8a2d250423ab4a85a65d9a69c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+p:h
TLSH
T10BE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 14.7MB
SHA256 f3f6de5109a88d07d1acac996b9bcbe3915a9a52a6c3523df87c4f0ec38eb481
MD5 d8e8a4617aa792a70a12bae72fb2fbd8
SHA1 f7288030ef55ae6589d79f936cb5841be74da893
SHA512 f024befb97f6bf669560df0b8ba30e1384ea2801d564d989eb0aa18b1b112618a32d60758cd458cf3565d97b82765c778bacb8f13678aedb9cc9bb73a7c7b6a4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+Mfu:Em
TLSH
T11FF64991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 14.5MB
SHA256 5fbf0701bd20a3881e48f5e72e6ed4966c5bb16cf37ca5fff9b7fb61a90b0519
MD5 68c91a3b95b9c540ed8bbb91f70520c0
SHA1 4bda36030274eb8bb4d787b342409dce37b65540
SHA512 b631da2b001bc493fd73901c1a23fd3eb9a566515ab4d03de53e09f54aea021c69de7cc413442bc10ee8058e11bc6935978828abcffd00156810a4081a75751e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+Q:4
TLSH
T1EEE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 14.5MB
SHA256 a9ea1bb1dd1ca50c182f47c53812a79923fb9f3e14c29d7f76bd67cf5e38688e
MD5 5c019f50215dff344034f47ce28cedac
SHA1 9fe3cb2f30606dda86a92a30702770d11cb0865c
SHA512 25f0469dad395aa49933610cc78af3dde8b22c133b50f6753a61b94ce63c92f245ef59ac17af3dcb55f0168c626f08e7b9651f18730fdba07186946c20a63845
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+I:w
TLSH
T13AE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 14.6MB
SHA256 bb5e7326fc9ab91e28ee4ae189e4db3f61933c654d8b83a6da0ac9ceaa1de08e
MD5 8da71b9ec11baee033206f26867192d3
SHA1 4a00b6beb9f154a84128f94791de838df1a50ebc
SHA512 7f5f1ba4bc1975c024c22378276b72af3a545555808303d846e441a592981ae5902fc911a6542050aa46d16ead4a40ccead247714597dd516c10307d474850af
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+ns:E
TLSH
T11AF64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 14.5MB
SHA256 86d4d415e5f55989118cfd9ef8f0e2636d0252fd6758861f4953c28aad29aec9
MD5 f35aff8439fe52e3b2a2c7e097555e14
SHA1 ae898cde2a3f783d5096a7af96a54bad71b12580
SHA512 6b01773d5b14c0927667ebf85927138281db47550e446b817bdedb933bfbc438a97721b4f279d12b7051331f5b4fc9402efc137666b19edd130f653dbcf9978c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+1:9
TLSH
T1A3E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 14.5MB
SHA256 5d686fbbbd63a4b3a02a4659126c32d78e066110224008e8dd684548aad0ab34
MD5 0cbf1662b6089a286e91a2f85dd5e2ee
SHA1 914c7a53bcb156cd530238a060f0fcdfc3ac8fc9
SHA512 c79250c99bfad7009011a43f2503225cbcda269b2e46e45a036d49a1537c2c17be2b77555d12dbfbb9b42112d292f6a8b2a736d371b7db8f07cfe01e64cb1f25
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+3:P
TLSH
T1F6E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 14.6MB
SHA256 c87a39a86b6239d86201cd868cd76e69292f92cd58ccc7e76ad74504ac01aa56
MD5 0d1c652bf541daee1725070cf67b4f47
SHA1 29084e3b60fddc98c7dfe8f74832433bf7a07802
SHA512 3b21adc8a0f714bfa8ce5ea0e896d42b16c7d52cdbfc3022e21adb53a5e23c8c96869668a1cbb0142efe65f74f369a042f2973d35cebc7ca6891762339bd18a4
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+aT:U
TLSH
T154F64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 14.7MB
SHA256 307e84a6285eb8d35ae1c6923403687ae271e14fd471581aec00625516fd57bd
MD5 f464dbd1d0caf563586e1ca5dd88239a
SHA1 3544f3b948019aaebe586338e675a90281fd4ae8
SHA512 b7e61a46b10405491f491ad19843bb7afafc3b4fb9971bbe1029caf53e15eeb7253cbfe2cf3d1f541660487c74083d58fd7243b1114937d61d25296e26c67b2f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+etB:m7
TLSH
T11EF64991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 14.9MB
SHA256 6ec229c952c567772dc3f9a651aeadfaedb00ece415e6c178a98c1e20b61ff0f
MD5 d247dcaa87e246b43563bb274b81cd88
SHA1 cb190f9b85c575a410418b22f43c041c45fe4d91
SHA512 e76a464445fb6391ac857cd65356f89a06b697078f1fd279b3433495926c1454f0d3ef35f39b98fee8bfe55e0180fcb1d2a2f8217a0f7a9d3f0eabc323679571
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+5q6:xd
TLSH
T1D9F64A91F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 14.5MB
SHA256 16d2010f5fe9b9cdd793c69751870802d615472ad8da6ba9eab0cdfd5d3875a1
MD5 33c14298283563c44e8a3ea7af808233
SHA1 c279accec7baedbca73b71bb136c4fcf4693e793
SHA512 66d1c5a252f017685b1a30abdb69592f0b7b1f27b709d8606f3c07d1666d9adc8b865f9c1fda70eda66f0e9bfecfa7fef8a9c7297e38fcbb020480422c3dd17e
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+W:u
TLSH
T1EBE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 14.5MB
SHA256 196b4b969f320073954f6e829850077825beb85cea0f3e787f7d1c5b70a572e2
MD5 8de5751827bc438f924b97533d4d9bbc
SHA1 384c77167855c11cbf08659662c5a8626748079e
SHA512 968037862111f223ce4d3e28c0d6e4fd48ee38c9edc9d8d94f076f62bce7811889a2d6bd90ecf6589bd240440551cde281ed12699ca9a2aeec261f6b9736702c
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+7:D
TLSH
T17DE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 14.5MB
SHA256 38502f90b5b26e3a093e52c28a26d4e09f8452c48e02f56e92e9d0bc8a3705fc
MD5 7022db0de68b9a2b08414e21bc510f05
SHA1 164e91e3681ba869394dafefebfde2430eaf5a07
SHA512 2207864cd0bda517677a89128b6cbf82dc3025ccc241c7dca6e2b5f5b5bb8495396c59f592901a25c3971415745d3accc7ec415d2f287d31c67e1c99af54135f
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+5:B
TLSH
T18EE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 14.5MB
SHA256 6ee7793d958903aa824267b11709bf58aae344e3e610f298a80ab7410385940c
MD5 f0d2190e00f384ca9138cff93f850756
SHA1 0c906862946dcaddd872e91f33b3c78305aa8ad0
SHA512 934a3b606cace757aecaf1113b5c0aa23e130090d1bcb03fa97664ad5ad399a8d2e03d8b4871127e038b6bd2385054f65cf1568d708c194eca565c312734a07a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+i:a
TLSH
T18EE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 14.5MB
SHA256 250d2421bdf8472ade2ed131e224d52e82c0f7152e82eff5dd7f6bb632bdc2ad
MD5 83c89542060e884796e0e505ad0acb34
SHA1 8114a0a8c5f45ef7499974961081cc165f3ed72f
SHA512 79e8d178a32c47ef1c790e4f4db59db241da39136972953c13c03d714a07734575c909189f8c2f7ee5ab82105a6f1e646f691d3cfdef6aea30e47619ade93149
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+I:g
TLSH
T1C8E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 14.5MB
SHA256 ca17801d1055ede5831a700d09190b2c36188e0a13cfb2083a1ea521ba7cbda4
MD5 45893014b177c81d60dffc308883f146
SHA1 48c598b86d591fdac6838a89e0ac75b0b2d0f193
SHA512 2afee0d9d7c2843175e4aba524dcee15e85a9ad282b63542d9ad04a25c38389438ea18050828c11768dfcf1eed4234ffc3fc1ed2a1ac2778cd8ed12ef83f6060
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+c:0
TLSH
T1C0E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 14.5MB
SHA256 d0b334686565e09beeb5681cc02b4255075b44637e8b4c5254032238a94395ea
MD5 b3891ca8a268e573e93a40c6947fb8fd
SHA1 63cdb6391cf96781e3c6707fa6c5fbe645db10ca
SHA512 920e62c59ae84000f974e001f0cd34f14de19b6c5dfcae339445333f36aa4bd2392c936eabf9a29072c41294611e4ffb95f28bcfc434b7ed8210b1dec87b18e8
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+R:J
TLSH
T1ECE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 14.5MB
SHA256 e3176827e5d608662621f6af9834ae3f6522588b288e0a864add9db399159c9f
MD5 3b86f2c210005dc3599265150849cac4
SHA1 adede05110de78b7c2e81969278a7839789ba744
SHA512 bb3ed163a5f917a820727d3e5b2f6724eaf9190c8da830d8022437fe796e144bd3c674ff1121f8bdd2b4c687e37dcba6eb40e87e92d215e1d0b846e448a41bbd
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+F:9
TLSH
T1CCE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 14.5MB
SHA256 8450f9584b27cb905cf899fceb8cd23a507f87b8a08689a8d3a0260a1a41fd5d
MD5 f2cd28ae867cc930fd890a80ef67ec2a
SHA1 4ab6308f946553c44eb17860827de2e03a16bbae
SHA512 ccd68bf5ca6a4461e0209b9dd993479e871b66d8ea91f7d7917e738a1034adbfba020be5de0739b4fe9fad21474c0be4d50754555b9b1e1483078019f7c9dc48
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+6:C
TLSH
T165E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 14.5MB
SHA256 c21e2e93e8623ec911620cc8ee96fbbb236e5b364a964f6fb7ba24f4f55a176f
MD5 fae50c4530440a0a134403fa20375ef1
SHA1 d0dca2e0c2e3ae7334504e28d93a5ecf45bd879c
SHA512 73ff492b0e447454156e494de5653fefcff31c23c0e0353108a24355fca537db44fee72ba0396adfef9c5a324d724bbd989c435c5efc4f634470f7bd3138ce0a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+b:z
TLSH
T17FE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 14.5MB
SHA256 654dc742c0b634db73a250969274864861054dfb014ab178bf21e1b35bdc287f
MD5 6c98276e798264ce0d58ba8bda4c3f25
SHA1 027bdeeef8a7b4302d5d39b7c3f43e4ffe4d9a87
SHA512 bd53bc47f5a809dbc2bbeb078698e0dd584c6682abd8ab34637777316f87bf07ae6aa46e0ca964ea44f7057e6dead7f212398ba6e90776639ec51213b6f90afe
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+j:r
TLSH
T154E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 14.5MB
SHA256 077c2551ff35afd5701d6b4fb5d257f21a17805ad38d7685b52000e8e8318845
MD5 06e09e75220858ea25900b6f1f39a206
SHA1 70b40c6b89444bdc78781cd00b6f6b2e3da27289
SHA512 dc82e52ca45ddd288f919c51284b1bc3680aeab88aae9e2884aae13c7b159fd9251a2bf338ea885b5e56c69c01603dcb2c9cc9ca10ebd4bccd3438635632f851
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+T:b
TLSH
T16AE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 14.5MB
SHA256 25833e2a8692d0ce9680f4ca0cd331fef2370672bbedabde115fa88b92a880d0
MD5 40501140b7019f50a67501f6d637f88e
SHA1 776e58ed0f88910f5302071f669b43e9c01eb8a2
SHA512 5fd5c51f831bb3014c3728dc78f05457bd857f53b891134e178ebe1d63ec4c27cd2c19544aabbd0205ef61170d4b1d2a311b34a7e8784778f0fefd5004a46098
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1++:W
TLSH
T124E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 14.5MB
SHA256 a6d3a5ee4e817633f123869d2698ed779ef7a2279322cb546e926f82dade053c
MD5 cf9da895acc20da8683800334e866f7c
SHA1 de47e303b311296ae9418d1c5eacc9f7931b2f17
SHA512 7c71f03101e1475009fb0cc1beddf3cec189ad577e011640ad41d6f1cf082aad5194e1b0998f40ea80b28038dab40eb14e4bde27cd427467677071b924fbfb16
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+j:r
TLSH
T122E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 14.5MB
SHA256 ba4e85cff7f97e78de81701430f615493a0d8519ec28e21ec2d5ef3b5887d4f1
MD5 7abed28129397534559b5a0ff2fe5248
SHA1 b7f8835cb126f4a5ac3187eb73e18daaed94f65c
SHA512 1957e1335d21ca2746910f8e4796ea84dbea36698a9bf83dc410e2f139ab65bceca23b284bbc01277d4ba742e30911df7711c3223fcae703f34f3bbbbbdeafb1
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+G:e
TLSH
T191E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 14.5MB
SHA256 d05fa048a7dc7581834e0c34aead8ad5fd4ecd5db8117344d8f6ebebc9b54cd7
MD5 2f1f799757d74257cf714a3e65c9cc2d
SHA1 276ad4fa4d217f877182291ba5a734231f0844d1
SHA512 09095c60a5af28d0f8df97b0f92bdf6585a95d0f37148aed10daa1a0d4a5fd34bfad67145114a445c6e13afe259ef652209e7f82c72c880887f4b038ad8c0254
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+I:g
TLSH
T141E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 14.5MB
SHA256 9c566da490b1d49b756d95465e77650f8158ca3333bc31d0c6e959738dee4996
MD5 037e278663c78762cee55f1f6f548ce6
SHA1 2cf7a7d2ab7f3b6ad3b18c784bfce4132fca4ca1
SHA512 0bb9333f64ea9112032eb9ef9395db4897f67c4e5ebc32acd792e1fd3ce0cb0d4bc47c90c03642aaa866f271e5a5348bea0a41b5018241ae172f963187fd3615
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+q:y
TLSH
T193E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 14.5MB
SHA256 c26bc44b3c36d890fbeddf61546780ef621ef8277b3a31cd17e37858bc92109b
MD5 80ad907a17799acfc61c4305af696b47
SHA1 e74bbc49f2e16b6fe5d7f768be4923fa775cb35a
SHA512 146c3ee4f173db2152d4fd63cfd96e90f420bbc27ce7d899c412b11660c2d4389956ccbec530e4beb6d3ce57f58c77fd25f6487715eefa0e6c9e48af64a8a93d
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+I:A
TLSH
T111E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 14.5MB
SHA256 70f9a5f6be0b25e368d4813a9c468f3ed2419c35547ff787932d8182c7469bdf
MD5 60524c368ec7441bced4adb459676770
SHA1 909b26639c386edfa4dca2a0a74425e431cd30f0
SHA512 7f3cb67b564d9aab24424c42835ebfbabbf5f584e358414cbeb41c91f00fbe9200695a193fc3dca1ec69acd68c2e2092e0677196c93c53cf113afb2714cf18ef
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+L:j
TLSH
T180E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 14.5MB
SHA256 49b4ff0e159d9ab55898fec6a7c1e186a9596234c73ad8820cd0415f5f9e350e
MD5 d69dfbc4ac9f6896e3f92e8c0cd04600
SHA1 8ccc4e07d68d147791f664577de75ea39885ccab
SHA512 94f5dcbdc459e28612509556652339e9cb7557d6cf8327d236a67bd392e64d4aba7422c86f34e3b591b6cc529fcaf5abf7489f6427d08509e7c0e6baa5a7f20b
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+G:u
TLSH
T12CE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 14.5MB
SHA256 c942c7b2a4c7c96f9b86b27fe339392c70e0ef251580687452074ff0153ae91b
MD5 464f088fdcb8b5d24a00d65a4e20c8c8
SHA1 7f5832091224f519f194b59709ddaa50c99b16f8
SHA512 1b5eac04b1a828d25bd0323cad52a54727c38a693d8818c23f12e77b66c78c6524cc19a063144070718d8aa31911d65600e7320561dac3dd9ae6668259e2ec30
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+V:N
TLSH
T13AE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 14.5MB
SHA256 e4a18dbca410905155afe036832c19d2882216a1a004e7caf7140faab1fc212f
MD5 25fcf82e56291baf4db8e5806a8fd805
SHA1 578e827b91c54499633a62819d1d14e95cc86271
SHA512 e6bbc491c71f2b4aa1e8bbe1f00ff5008304c532790df624ed844a4900691a5da87113ea0454d2a65d281900237bb4a8a4f6f7d051a5f3eba9252a528f4e31bc
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+A:o
TLSH
T1E3E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 14.5MB
SHA256 e476f87e37fa3654faabe8ade6ba999e7a92b84a2b3d0028504f2c46b8783c26
MD5 c3f28556b4dcee94585eb7b141b0b83f
SHA1 f60e556bc58097dcc07e32b774f0b32f38d0dd9c
SHA512 5574aa5d33479378ff9054be81a9f0101d76e7755cca27e61bf8b2ce2f33f6e1a93d9159d5c588fe90d8c0ced1081e31695487efeff58bcc3ee60eb6b634341a
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+a:i
TLSH
T189E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 14.5MB
SHA256 e6886b64e1360874ed626a5d883738762c5ec4cf6c20af36bee5e4eef9b5fa60
MD5 9aa7625c70d3f8c21ad89fde2b7e38df
SHA1 b72ce9b4f0c6fc37c8e9737fbbb53291e1342760
SHA512 e9256199b0e117da814b06600001f11b1beeae619b81c0b57a2df2f24423c2b34aeb847dc952378ed79a774c79546f6786796865f50f0677948ecbb87c1701ac
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+u:m
TLSH
T162E64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 14.6MB
SHA256 bbef2f0bb224d493e1b277bf2a53a80842fd6a4d44cab18bfa6cb86d9a3ab8eb
MD5 11fab81126da401d760b3571e7a6e4c2
SHA1 dd19628206a2d2dadbbe3e85d56f776afac40605
SHA512 4b6b49099fdf676a3f92a20636f81aa2d6afb26ec857107ade218379da8bd64b5b44188b6918880d78ea88e69ca3a4b24133d12c65282ccff2b6f627db8f8117
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+O:2
TLSH
T15BF64A51F5A08171D17A8471C696A77AFA3378411BA08BC793C6DB3C2F362C19AB6733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 14.5MB
SHA256 37c991da7775295e89efe04e4288bb69d193b9a6d8de2dfeb17f9669a88e7f30
MD5 eaeeab568b9be9a0ca79903cdd856686
SHA1 502b7cd4d0f0f47587980f811111ab565f7fa98f
SHA512 df61a6e74e4a054cff84e51246e07d06d5d434fd6a7681f3a88e5a5cd067c95c0e5307c0791fd743dae18ec33e4f801c4c9a6a15d77789c0cf06cd4c18c61ff2
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+W:O
TLSH
T1F7E64991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 14.5MB
SHA256 0ac5f6203f37934fb88701af02816a5158e260f7f0736745ba169ea757341313
MD5 8aac8d58c08f039db2d4a1367d05783a
SHA1 9cf52f7cf894a2a2ecadedb89d0716c0bb0a8d9e
SHA512 3f865ac5fea7103bd340816ea53a874a5871f86ae57b43869339f1d7e5611a341c3f4166f907dc3f0df16bae225ed49b11881ac3df37fe58e30e0ef53a4a0fff
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+mj:+j
TLSH
T1EAE64991F5A08172D17A8471C696A77AFA3378411B608BC793C6DB3C2F272C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 14.5MB
SHA256 ea0cdb17805b20eb95d8f033de6bd802d296f8e17f9c7b3d1d499fc95c8ac655
MD5 7ab468a483ed2647f72d4a483c3eb396
SHA1 eb6739f0dcbcb7f426312114cbdb82abf8c62a47
SHA512 5b1e4f971f4644a366df26b349468026044c956e5962f743ca7985ca9d4bdb91393c99e1f53c766fb61d7bdc1d97e6bf7a8de1d57d853020bffb7bca53bf8d63
SSDEEP 196608:Jw/h1+Qw/h1+cw/h1+Qw/h1+1w/h1+Qw/h1+cw/h1+Qw/h1+cD:kD
TLSH
T15FE64991F5A08172D17A8471C696A77AFA3378411B608AC793C6DB3C2F372C19A76733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1832-80-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2652-620-0x000001DDEACE0000-0x000001DDEAF9C000-memory.dmp

Download

memory/3244-51-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3244-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3300-341-0x000001C4001E0000-0x000001C4002E0000-memory.dmp

Download

memory/3300-392-0x000001C414450000-0x000001C414470000-memory.dmp

Download

memory/3300-378-0x000001C401D10000-0x000001C401D30000-memory.dmp

Download

memory/3300-359-0x000001C414000000-0x000001C414100000-memory.dmp

Download

memory/3300-357-0x000001C401A60000-0x000001C401A80000-memory.dmp

Download