891720aa3cc460354a477a3cb14260ae9538ca9bbb803f20605927924e90474b

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Size 8.1MB
Sample260707-bt91pact3p
SHA256 891720aa3cc460354a477a3cb14260ae9538ca9bbb803f20605927924e90474b
MD5 b4728442d7a07b53b2cb169d4f1ff3a1
SHA1 5bf04f9297185a48b8402aced30f38825fb72da4
SHA512 fafc2db2b7f615a2556d98a0c6c8c18bbf9810c62f42d8f22ee9840aa67ce16866486808d103d5d31cfef775bad570e6c53b683d966960c3761989dc3d7923a2
SSDEEP 98304:Su5x6M1c/h1+nu5x6M1c/h1+wxwYgRqu5x6M1c/h1+nu5x6M1c/h1+wxwYgRz:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwJ
TLSH
T1F5869D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{48650B41-A6C3-4FAE-8426-3AA179B6A59E}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{CC8DC233-D1B4-420D-93D2-63292951C598}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe
Token: SeShutdownPrivilege	3036	explorer.exe
Token: SeCreatePagefilePrivilege	3036	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2216	sihost.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3324	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3204	2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
3096	StartMenuExperienceHost.exe
3036	explorer.exe
1848	SearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3036	2216	sihost.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Users\Admin\AppData\Local\Temp\2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-06_b4728442d7a07b53b2cb169d4f1ff3a1_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3204

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3036

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3096

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 9.0MB
SHA256 70687eb5cc0b8df1fd85d80b74b7cca7d0339540b32e24e2d72c4b8ddb79a944
MD5 9c5e2103561f76ab4d479f3c7a7f8667
SHA1 3dfd7f5784461a2c176b3a7c1cbcd32b45f950a3
SHA512 506c1709235acb3f4fb693f8dbcf13a66ccfd675414c0d13c341be2913b62f18afeac7f6470138075e669eea44e7f1f7ef98ff126fb17e02bc53b694e53743ce
SSDEEP 98304:Su5x6M1c/h1+nu5x6M1c/h1+wxwYgRqu5x6M1c/h1+nu5x6M1c/h1+wxwYgRuezY:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwP
TLSH
T112968D51F5A48272D0B6C075C5D6A77AFA3378421B308BCB5386DB2C2E372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 8.8MB
SHA256 ebeb777abdf61245697abb790fcb1cc67cfa1a6c50a4181e1914bd8441f5b6a1
MD5 a220f1b9eb28ee8d5b539529e9768dba
SHA1 b3ba43856f188b5dab4f90b110847ef21b9de1e9
SHA512 7f23f9962ac1f132c8e98d1eee9d05d39c4b774c55c356a44385019edf9492132bbc6d6955a69ca728c9853a8d701de8aca11bbf88e782e0f57e4e56819cb9bd
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwc/h1+:hw3w
TLSH
T1AA968DA1F5A08272D076C075C5D6A77AEA3378425B308BC75386DB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 16.2MB
SHA256 9931207875a874832b22282e822a01765bf66cc4fcb99ad8df3f131a68b136be
MD5 9931191f5218b78dca5b5812921e499f
SHA1 c43527e5ea5c7ab493c4241c16f057300247f825
SHA512 02eb4a5e096ccad8bb576240d9dbb141e451bdd4703478031368b80f3eb572b56a611b11f6c18d67e65e7287da208c913e4a37b7a5bbb8adc25ace192b015d68
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw:hw3wnw3w
TLSH
T116079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 16.4MB
SHA256 39f46dac7e995068974a0fbad7a305439287d3b5ef24707f5111f29ab306c7d7
MD5 e5c206fa230a513134e01ffa63437223
SHA1 27ba843f1fe1e9581c4d3f577f2dca552f4f2761
SHA512 99ed91c3f99994b7674a54ff1ac795a80097329340a20dcc097c2cc3c7cf0a652762113f5a88ed088451e7400adae749dd2c09a6e9097b8b9afd0eb3a196bda1
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwd:hw3wnw3wd
TLSH
T1DA079DA1F5A08172D1B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 16.2MB
SHA256 764b42d462953385edcf5d9e15a5c7aedde3ed62105a663b03c49367de595d43
MD5 8c51e380378bcc203b66671224f6094d
SHA1 81887d2f03f2a4d962f3f382133bd30f1ca7cb77
SHA512 1b218f237102e286bb7766a383d981a09c39e497ddf19a0f82b4f11df5e32b3f21887f3daf89e9c871e5484b0ceb48d8e383f765532ce0ba499cd702daf4841a
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwab:hw3wnw3wk
TLSH
T103079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 20.3MB
SHA256 d9cfdace99d98042e8a161bcfeb28a846da266030290b2722c035f87c5623611
MD5 27d79f01ff63daff5249543d1bd6b4ab
SHA1 02ca6f34c04609abbe3a01d8352bedbdd264752e
SHA512 6ad1d5e882be088972ef7d3497af3abd1f31dbffec5eabd9898cefcb7f9c2f8a813ff8c64e391431b9c7ff72176c631bc1f851da592340d0a0d7eb01b789203c
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwMvyEYc/m:hw3wnw3wMvyEYKbi
TLSH
T1F1278D51F6A481B1D076C074C5A6A77AFA7278421B308BCB4386DB2D2F376D09E36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 31.6MB
SHA256 42a67c1d42e4d44dc2137d13e3dfbbbed1e17d99b7d5320a86ae6dd5ddd116a1
MD5 84e3df6a126e23923638b7d4232507d2
SHA1 7fdd55875148717b14e3a13e01ca4fb1cf14badd
SHA512 1fa2c87cdad7bae2694554b216c510de28eb9ee3409aa5f033d56376c6dd1ad388a5c22322c02611944f469670f47007255dc13f434735f93e36ae498383845e
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwVUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlV:hw3wVUEtQevvqc2W1cpV2XI32i
TLSH
T1E5776B91BAE483E2E3A6953484B282B6FB717C0E1F31977B4179F21E1F376905D25322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 18.3MB
SHA256 7eb8244cc968739fa196a3c3a80d06ce9315c68bdd48bd57df2f455f01ece741
MD5 ae6e60c0af6f1e56b0d0dda9c95f69e1
SHA1 125012f86d63f98deca7c95531c17b989857ca01
SHA512 708c81efd35336af65ad519c78ca5712b94911cdb64f0c1660299930a569ca7af3cd381847411f3c9c429501c38485e1ddcfd79c39b11b91cf4a378178e6a3e8
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw5Gn:hw3wnw3w5G
TLSH
T199179D55F6A481B1D0B6C074C5D6A77AFA327C415B308BCB9386CB2C2E376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 16.3MB
SHA256 a98921828655a403ea7610fc748aa73bb9b1a4d7b8765cd06aab8cf02c4fb111
MD5 04ea4bb7c200b9ec4d3eb1d51019cc59
SHA1 ed01152fc16651133bd8bc32e207c3100b57e3a9
SHA512 92075ca26e00cca7b88d4e5f4523326853f58276f1b606b8b8cfaf7a8f27010b999e0fb41a5736b00b2947e02edd86f727175008eae2d5b606b1649bca585525
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwe:hw3wnw3we
TLSH
T1F8079D91F5A08172D0B68471C5D6A77AEA337C425B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 22.2MB
SHA256 ea20f1b8c9cbed0843809e4313082fbfb061ed4b906ca51f711c5f5ff80156d6
MD5 f6b7493e5d26ec5a0e9bbaa64ec57d71
SHA1 92eb991c08d68ee00f3f15cd0aff28f89104574f
SHA512 b96641620d7f9bf02a184ce163a2930867b530ac8f2720a5ef59c8fc110a86b97aa23b1a0970047d7b0b3d76425ca63b74405adf562825e76cad500607001bb2
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwEQyiKaUD:hw3wnw3wEQsas+PS
TLSH
T1E9379F52F2A481B5D07AC474C6A6A736EA327C46477087CB5385E76C2F376C0AB36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 17.9MB
SHA256 ed238ca520c0aa6e1c3a1622cb0f8bcdf51fbb4c4bbb40218630c6207bb6d16f
MD5 bdf064d43f7c98199a176339855f9b41
SHA1 7cb5e99097fc6214f7ed102dd62ad32ed4ca1e64
SHA512 61d22d3c96f04db0b4e89891ad99b6bed4148e4bdd76676aa43b46c7eadd38e390b0be9707e0111914a26b5122a2f9009d1ccf3026d90141859834d7079b7aa5
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwEthHf:hw3wnw3wQ/
TLSH
T17E178D62F5A08171D0768071C6D6A77AEA727C415B308BC79386FB2C2F376D09A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 19.6MB
SHA256 11d14251e92495eb9783e0accfaeb66da51b61f76642a90acaaf3827b950facf
MD5 78ac22b1cce720d6a0f2d62ccc9ed714
SHA1 bf067b648bce9a3852cca757064f55f00156ec74
SHA512 bccf2cc12a21dd004e96346cb6882c4198d8f48bcc536762d8b01f562f038c49bd14be112c6d7e63f9c7330bb709296676e3667fcf7f4860b7601c23c7e260c8
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwmLIHuWhs:hw3wnw3wm+6
TLSH
T15C278D52F5A481B5D076C075C696A736EA327C425B308BCB4385FB2C2E376D19B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 18.4MB
SHA256 3011a3e002a5a74691420db52f642d748611e41df3616501c7653244848704fb
MD5 70910a254982a4c340fd4a46faa71eec
SHA1 54f401a99c058ebd1db5c1b619e4443ac05544e3
SHA512 ecc0074d4b309d72f8970525c4c283d86d36cc71d1c29e6c2f337e1100c058df4d370fb5d7b171c01c25cabf280a3944a87e9d611ca5beb61bb6932b6f08c0ff
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw46Jm0G:hw3wnw3w4l0G
TLSH
T19E178C52F5A081B1D076C475C5D6A77AEA327C411B308BCB5386FB2C2E376D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 18.0MB
SHA256 cbefff9aaf656def2db2a36b3fc590f7a54094c7e68d865147a2b4af034a7022
MD5 e7298588ff96dec5f0630a470762db7f
SHA1 86515af05346c3e39227e0bbde8748a0e362827a
SHA512 47ec47bef526b194e9e3a6ce3cc3cfa6619e16ac1800cf351615b71b2a92db57102ce9402d1aa6ff8a6c23cceceb8e54614f52101c8c49c11c39d3152e77527a
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwadKC16:hw3wnw3wJC16
TLSH
T11B178D52F5A481B1D0B6C475C5D6A77AEA327C411B308BCB5386FB2C2E376D09A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 19.2MB
SHA256 528b3cd523f641e10f241f9ed7e79ae01640935f69ffd46bedd5239693de51e1
MD5 a3fc669f7085876ad2c8504e46fa17f7
SHA1 40270e3093e25c02175e7c522b7255d244a7d586
SHA512 fde7ded59be345c7d997cb142a6b7e44b58ead3a40ca64dbc74bfacb671148f8715b2a4c01d45733e762c58b21ad6e8265900d1bd010908bef0e726b5052086b
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwbjnDO:hw3wnw3wbO
TLSH
T198178D52F5A481B1D076C075C5D6A77AEA327C415B308BCB5386FB2C2E376D09A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 17.6MB
SHA256 f76fd7d441958e5493bfcf887a55292b833a0dbbfdd5cb2bd8b215d61fc9d348
MD5 283bf43ba181676d00f090678cc8b908
SHA1 3a126144bb0572cb88aeca09db86bbd4148d648b
SHA512 ae912625fe3a8a468762845a86c9908d693cc1584e101479b1dc09d8819bcd1a44a77d34a39b4e8183cda23f5d27b85bf3ef834095e8eaa3fe81034ca4756257
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwl2iw3:hw3wnw3wb0
TLSH
T1FA078D92F5A081B1D076C475C5D6A77AEA327C411B308BCB5386FB2C2E376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 16.2MB
SHA256 bde623abf1105d782321146fe155402eb2e3945829fe7a16b58d37afce92e43c
MD5 4c30fa9e3069e5376c9cd9e7752799b0
SHA1 d9bb963df4c1f4da0cbde2922e01c1a7f59be52a
SHA512 bffd5a4e65b6ea66638319d3536d4da930da2725726596554294aab56227886edc1b4e7568c13b16f2b08bf6f9bf661e6c6a8748e41d810dd977608375e403d9
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwc:hw3wnw3wc
TLSH
T12B079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 16.2MB
SHA256 517a6f726972fbef3b0450b3aa15199323b0290888ea950662e2b8f8f1cca53e
MD5 2f1b250766d9f3b7d1bfa56cda75c418
SHA1 5a96e151167d9418b12ba2a41106a0cb04a2fafd
SHA512 1219801f954e6bdd144e7aae6c87a9e10e29945f08f59d7ab72d448f5b27d5f360c363305856ff963c5a3f8b7eee9f348af242dd1bf1e8740a43e7995d18767f
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwP:hw3wnw3wP
TLSH
T142079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 16.2MB
SHA256 6093265dae7dcd0addb4ec64c8ead809b38a068c79b934c82bea4a3fd4c85f0c
MD5 ac2be239a302c195bf7b359d6b0edf63
SHA1 188b1924cb20b8fcf5b0efe10a3f1efb0d73526b
SHA512 46febf21f7e578fa6e1c84157c3c163c401a5d939e6b4a0f9be08c69b6fa5fea1c37cf00623663dec35f62bca6d581a9ec8fa7f147056ebe9d9b8486afd82d4f
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw+:hw3wnw3w+
TLSH
T1A8079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 16.2MB
SHA256 c5cd64fc8fd3e0459501bfbe1a79c432116e7754929d76a76902b0ab24f6e6ae
MD5 883accf9f13c633ee469df5f6042ef8b
SHA1 ddfb1b9a4d8cfa0c3695410eef043989046d46e2
SHA512 accdf19233557657a51836f0bad0895b2f09ef0d8e2417eababf64a9c5aacd358906cde1d782324b6a3a488301d2f7fb9a263e61a21f9f56c5e03de9518f9639
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwb:hw3wnw3wb
TLSH
T1CC079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 16.2MB
SHA256 bd4d604dbb7ab05ea2d1239766820e3936796f54819cc2887a66c7d7bbb0c219
MD5 b6e9ea2fa40f3faef90c968f875b69a9
SHA1 7954d0589b635a9be5d539aaf96c635c921adfa5
SHA512 ee5f30330e2679c72b2320bd184acbafe1bff5f3d18c38b4952b2758bd09f86435f2a0cbcd8b458edecc8587b98b2d1f908a18d78542aedbe9d90b68b824b7b7
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwE:hw3wnw3wE
TLSH
T12C079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 16.2MB
SHA256 cb2e3324175c29e5459012d8de18aa87e04ebc42e20621f9f2dbb0996ca49e64
MD5 f3561e29b1c800f5bc25616cd5b59f0c
SHA1 a02f9670e9d2ca48b42760e7784543a1cdd7e8e5
SHA512 a31f8ac4fbb4a7b86f863c67b63c79dab360b3c49af9f8f3f4d13a46ba08be4241f464bfd03c7f3800faaca8ab1df5c7094479ef4ec5c983ed30c6b6bdfebc8e
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwf:hw3wnw3wf
TLSH
T1A6079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 16.4MB
SHA256 7f8f3a8184d72002073a07bdca274a27b110b45d8b7fb407bb362b15a4b93cc3
MD5 f6ea6b9f8597cd9ac2f6ed37e6f0c336
SHA1 875007637ea76943114b794c9f4aa17fcc7bb676
SHA512 959fb81250c750c388029e18db7a7127548ed7f0c057ca775a70e9831c68a1f4e33c20b9b98461a5608cbb7493d4e2cf42dcc0b402eafa806b5637f15bb28fc5
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwufu:hw3wnw3wum
TLSH
T199079D91F5A08172D0B68471C5D6A77AEA337C425B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 16.2MB
SHA256 5b14db30b9487ee4b7e221310bcceeba81d25349fd6f286f56e121a7f49f40a8
MD5 5ad1cedf09822aa587ec05fe83ff1d6b
SHA1 83e7fb0c02b187d98094b1f98cd591a157085bbe
SHA512 f27a80c12fd0ec5acfc8a9a88c9920b2e0254b4a28cbf4e7c3b49bfac7bf401536db9b5006bbdd4fa384484008dec0b7e5a09ffa7db09f10c6070fe0b3ba6087
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwC:hw3wnw3wC
TLSH
T1BF079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 16.2MB
SHA256 76c4ec0040a5cd6a28c23c00ec85340fad3a090739f9bb5a612c69d417ac5252
MD5 9414113a63a20c8a47e7fd9669523a68
SHA1 c333028c6874accd5ba6b88a6e866d4b05ebcd92
SHA512 225b2b51b8234d1ea8b9ee5df7ed9e890ae60c5373b606a2a993f333804d63edda0c2da53d5a4055223fffa0e79b450fe1e6b92cb1b6022d21618095a49cd9c6
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw+:hw3wnw3w+
TLSH
T192079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 16.3MB
SHA256 9111840eb4fcbf3efd898dbedb505f30a4b5baeaeebc6d143b1839bd249fb5af
MD5 617d30ceb6ee84cf70659c2a6c21a1c1
SHA1 105a89a200077806a2aff1cb6442b1cef28d5b6b
SHA512 4e96e97699fb8f2a2979886332e67d82ce72dbaea08d503acf1cca808a0e3239c5d1e24ecde89fc74ca8608603626d4d4872d6f504dd40c8c189c1a7ee0f84ad
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwps:hw3wnw3wq
TLSH
T177079D91F5A08172D0B68471C5D6A77AEA337C425B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 16.2MB
SHA256 f509a3fcd78956bef17ead81e5f68199dc57f02af4313d8e1c142c7c185cccdb
MD5 adf61cce8da6bd26e55634b107a9a864
SHA1 d536bee1cc64d8babb1562910b8dfadc5b96bfb1
SHA512 d4be6b9b137b37be68156a6f64957cc47df79c720a61e9f59f1e20ae4efddb27fb0645552f18943c0361d8b4e10ee09863b95227695903e36445c05f3feb81e8
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwf:hw3wnw3wf
TLSH
T191079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 16.2MB
SHA256 5d033a18353533050ce4a6dc7bea92f147da662d9172c8b06a1a870d967be71e
MD5 e506dfc528c3ec823ad671d5efcddb18
SHA1 8ad4f0ae9650ce787bbc30f789c33402d5888b03
SHA512 4516c8d51c4f82d13dcdd6362bd6857b3b9022e5f5d0d46351b926a1f53f607943b3bb80310c3a5ec71d04cc2d8684dc48fed4cac61f7cb0e612f0ef0832eeb8
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwx:hw3wnw3wx
TLSH
T1B2079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 16.3MB
SHA256 53aceff53ad5c132dfdcd0bfdeffc567eab7fcec18a756a5bc56666249868c7d
MD5 6574b2c25f25ba19b6443bca5ee7f167
SHA1 93dff495e7870577eafc159e117d5ca6fd7e085c
SHA512 b0ab574cb777ebc2425e57fd6c65d59c82889cd6fee4c331b80c1b78d51d45705c6d8916efbea975cae1bd194899d02bdfab1c2205b454ff80adcec5a19e6fd6
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwYT:hw3wnw3wy
TLSH
T18B079D91F5A08172D0B68471C5D6A77AEA337C425B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 16.4MB
SHA256 1bc640a50e70b34c5c0b7da87fe846cbda00dc8fb441bcd11357a0b40ea7fd6b
MD5 b06b2db42ece1ed1f4755b3fb8d6c106
SHA1 1ec4c5b66676d2bc19e43d02580c9935f113301d
SHA512 dbb4f6235745f145d21b45f99ce1e6b10a3924cf1e7f7b7b5da94e522496cd6dca78ae26e14e01c7d5c36f515b47a064dfbd519e8e43b9f75d5ccdded1d2dc01
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw0tB:hw3wnw3w07
TLSH
T1B9079D91F5A08172D0B68471C5D6A77AEA337C425B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 16.6MB
SHA256 57e2dd4e0050463b95e8ab65c55d7d293f29c0a954b8d7f14e6f02cafef114c8
MD5 784427542ec557f47f5d60058c29ffaa
SHA1 2b60ecce304e7d15da8945189bd4db777e51091e
SHA512 7e57bf8819fef4bdfe9e98716f1507cda1f74320a7cf5e144e38e559779b14a363addf9b4f1f6be93ea7155a84d478d05c019656f4e37bd8d3ed7a5679c21b10
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwHq6:hw3wnw3wHd
TLSH
T146079D91F5A08172D0B68471C5D6A77AEA337C415B308BCB9386DB2C2F376D19A36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 16.2MB
SHA256 d34d910279dce04601a7c0c1d8a3869a8d65c7337015da9326c6e19e443bded7
MD5 7c49e2e3ad7025f861d3a185a81fe768
SHA1 bd4dff87b08fa36d3e10e7438badba793c146991
SHA512 f705d05baf4895df367bf89bcb20052fa303eb7d90d092a95cf6211c23a2f444415aff75a18c53379c7e926a0fc85e0665becca2baf63b537bffc9932443b1eb
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwM:hw3wnw3wM
TLSH
T1C5079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 16.2MB
SHA256 24e9fde30b598c1c45e35073190fb806c42c0cd8b71a7a89dfb652ee328ea32b
MD5 3ea1876142eb4308a3e61730258b9ecd
SHA1 366051c907a8ba8708e103c16349dca6813c7952
SHA512 7aa84509afabaf00db6eb20dda1828f747868e1389a5d17f7940e56c31fcf45a59a0321d81d51872eb5940b3a4472413bc7cc41a0d9eb805593c69ad0f7de92d
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwF:hw3wnw3wF
TLSH
T1FA079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 16.2MB
SHA256 88ef7cefbdcf304e7ca3a9397c8125cde3094651fb52642d2e698a847e00bf1d
MD5 0e949e9e5cd52d9145d24095cd040165
SHA1 813df04dd42aa2a759cca9d08aa53dbbf20aa6dc
SHA512 bd8b1a3396206845d8841d45998bbb2670038b01815f5e6bb60414363d001865fad6b3ebc6e9a58c87f20cf711b7b44dc8fbd0a27720d2251b439e31e76261b6
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwr:hw3wnw3wr
TLSH
T13E079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 16.2MB
SHA256 e4d4aea647b7f53a384a732a5a9b4b3173e0ec7d84d5a7ab77a8cdedd3dc040b
MD5 c7245de005329bd85652fb90336358da
SHA1 6dd8efc793d55ccdb1ff33e2475915119cb94f59
SHA512 4d42c43f35270b82048cd87e708bcf4e5533d06c545ab1ecf35c0bd7a390b300c412aff15027eb27d432a32a7c37fe02fbbbd21dd5a13ee0cce020ca6c3ad9b3
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwQ:hw3wnw3wQ
TLSH
T118079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 16.2MB
SHA256 f05a583676892678bda2d2132447681f4be43c184c8a2d45eadf6dffd1d19c0c
MD5 687c7f71f30f748497f2300ec8b6d070
SHA1 8721ab23e853ab3186dfa9dc1ff35f042b280411
SHA512 a04222051acd0d2cc2255b70373302ce880aa9c1a81ab1c57da68bea337a2cff6499e55a7b784dc04df3696909bc87ea169d8fe34b260096d379cb19d5030f2d
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwG:hw3wnw3wG
TLSH
T152079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 16.2MB
SHA256 fffb024781ddf4565f3039d63c715a608657f6b6a4472d746f1b1bd7ed08e55f
MD5 dae93b31e1e1b154ea254e1badf46e1b
SHA1 3b3bf903599e531855004dd3fb47a1a163028739
SHA512 2499a1503eed1dda1510200f6675ef3880d34005ea7fbeec3d08fe470591136d46aca6f80605004a8cdee158904218a947619b0b819aa0f55628433e0d01417e
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwC:hw3wnw3wC
TLSH
T1CE079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 16.2MB
SHA256 ee68aa44c1ca04129129176ccb9a4a9a85215203cece8af4f959d873d906af99
MD5 2170d6ad91f53510c68fc4039ea570c8
SHA1 a7188aac8460a9c41926c60d6319b9072091d31d
SHA512 7960c9951c7fe105d24378be3d88dde084efaea632aaa1cc14a4504e022f81abc677aee26c68f5cec6a339a9887b0082abc20ce2713721a935d8afc4cf9d2c73
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwX:hw3wnw3wX
TLSH
T1A1079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 16.2MB
SHA256 81b1db23fe43195f7f7c843384f727d29e16e3009b463c2d862317b7eff6c773
MD5 c71aa0a74e4fa984b206f5bb698ebf78
SHA1 831b6555ab6d13ed091c3b5f5c02520532ca2329
SHA512 406020edde15728778828cd39058d474bbb875d1aaa484313fe578cf23f26fadf881f7a433241bcf870dab23f284f350a8aa6afe256bb63f5ed310ef344d5850
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwT:hw3wnw3wT
TLSH
T1FE079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 16.2MB
SHA256 fc55fe6e395ceb1986030ddc36e272aee7674adf892e3315a51df9629a330b62
MD5 c9d851607cdf6fc18883af0fb0012a6e
SHA1 682043e9b56f5d524980075e4aee1ac6b2ba77b0
SHA512 cd37c028a605e8fd178415dcae14bc1a00f61c04a42cf564bc6d32ba255e4cd0b5d0417e947496fb4bbb839f121e7d397743df71d63a859f8e8989b9bbc4fad4
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwE:hw3wnw3wE
TLSH
T18D079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 16.2MB
SHA256 a47fadda3abe3691bf80cd29be30843de2849b3a90aefb4ba6672debe0de5e91
MD5 8174cf3a07b4324fb9b4bcebbbadd1a2
SHA1 9e46deaffb7dac4bf6227535137a6e2e122119cc
SHA512 4c5b9faa3490699736b12576103c01ee57349bf29b039f5805764be7a533a4951158bb20980f9e022db7ac7f6a9d1d41148aee61a566a2d64226dca2c58a53bd
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwt:hw3wnw3wt
TLSH
T13C079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 16.2MB
SHA256 183ba0ac6fbe07afa49943258e9c50cd8882802eab90d0e8985e4ade4df69e81
MD5 d1bc9f2a9ff355b6964a3a142eca663e
SHA1 53a1beffbbafcd4c5b0cd27a85fe475f2adf62ad
SHA512 7fe699ef6d9ee32c1c3fc77d3eb759505200d47fc98b877c916126fbe95c00c37b53d9d8afc90ee01f28d0355007c12229503bfd0bd2ed5ac7505cc12ccf1cd2
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwd:hw3wnw3wd
TLSH
T165079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 16.2MB
SHA256 b730be48309bfccb90e5f7df0a55c4dc795784998b5c9fd40aa3e0158b94f6b8
MD5 0cadc7f75b537e8576880a64318fee7f
SHA1 b4ce403680e72670dfe0e3d1a6d41506c29b55db
SHA512 6adfbfb727b94fab664ef7171647bdfb420e32d3926893b410a4041e3cfd813b44c9c19a5a79a94f06b4756e11bd47a1271f06f4a850d720e0020323c3f97e4b
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwV:hw3wnw3wV
TLSH
T1BF079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 16.2MB
SHA256 fbeeb6735ab587ee70df9497f1ff82fd6990f9bc812b492e7940011d82d9dc6d
MD5 6b9a5379ad031acde78fb97cf3ed50cf
SHA1 277398b4eb71255e92a62004f95b064cc96f69d6
SHA512 0c6cacfb57ce757d5e2a10de321d2d92710d753bea5775114efc8160cbf4be197770928d353ccceb0a037b149c1f9f7dd87787cfffb353301039b7ce1e1608f5
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw8:hw3wnw3w8
TLSH
T1CA079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 16.2MB
SHA256 1c4fb0266adf7a0e9efe5b92a5547b7753957a870a27cf23cf1bfc8f6c35cf21
MD5 964b0efa5238fac8d1646fc9dc617f44
SHA1 e77cf43906b0a7f59012ff666d8add4326414c41
SHA512 9581abf2bd62cd360e8f58d03cb0b79923d599f378ff27d9b134e33861a38b77217d0fa3af29cc33417e9e88878522180cae44dff43f37039d9cff86bc2cdf9c
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw1:hw3wnw3w1
TLSH
T1D2079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 16.2MB
SHA256 5110cce9bc56b4b01b6a5b5afcb2f14ca256377705b963af4c2754ed2faac5ef
MD5 e37cbdf9afe264d8232d0400e63a2c60
SHA1 6f71de6287f88f0fd62eb624ed174249aa93cee9
SHA512 d077cbee398d4f50fe93485c7a960c1bc11031dcbb9f7a9bd5b3da7640808fcdbd539df551a34b1c6b48b9b396bf1842e45d566634bfacc8d20d92a932da63fa
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw0:hw3wnw3w0
TLSH
T17B079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 16.2MB
SHA256 031b8a663d6fae4f81d70ad985990e3ef870a26c9d524e93aa192b0d35f085d5
MD5 3d413aaf0d59a53f3b0e54c986cdc4a9
SHA1 d43723f0aecfe85d1aa2a742560c6f1ef1091c4c
SHA512 36c89a4eec7980014cc9df3c5793bfbed059fef2898e72c2828cd95edd5c374349f63d979b7bf3b496857146301a42331db5aa656695e6f9e2ae338486b9dc0e
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwG:hw3wnw3wG
TLSH
T19B079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 16.2MB
SHA256 896abd9aa679c2da4d4dc79c2c110d4a58fb9b439c208d108df392d9b7276649
MD5 1bbd28978119deeb694961e54eaa4d39
SHA1 667429acd1dca8d1b0f0e63321999f7ac43c30ea
SHA512 e0d01a94a941dc9e6665192cc3b290f6aa721f38d32399b9f9b088339ef15529f10400c337dc4d2da5bf668f0ffa68c31777a5e6fefafc262f70f921bbc11647
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwg:hw3wnw3wg
TLSH
T14D079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 16.2MB
SHA256 96906c862b640525f86df7144b8c4a871175b9b078125b7d543854e43ab86482
MD5 209aba82f797e3a4ac8a89fef7d04219
SHA1 efae341a6acfd07706cab55a8283b6ade02646d3
SHA512 43dc4d56f87e8ddc040688820e8b8fe7dbda99ba287241136acbad5f03a3ff18ff047afc49ad7a53af90fd8182df1231727334981e699b400db65aebbc9de94f
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwm:hw3wnw3wm
TLSH
T1B5079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 16.2MB
SHA256 30fec87fafc778dfba9a113dbae17da6fbdb07c1e7b25cc322f0cf644697f709
MD5 ca7882cd282f2e264494887b6338b389
SHA1 a9a870b8f4160a59724837cbb2b8ceca7af69840
SHA512 f4a1a1d483068929c5970d222f1331b087cd848c3209d46e150e3880558e7cc63b2b99bb6ff5517358e9f71d4d8810b58f268c940b7429159ace3ec7cc9894df
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwd:hw3wnw3wd
TLSH
T10F079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 16.2MB
SHA256 d5ae624f403b974c24c0620e6bc9dca6dd423d2afbbf9d6777fb6791fe6f2290
MD5 305d2c1da82bdc83b2f10dde7204408e
SHA1 24242a793bacb14ca1c377430ef65b87a9ca40c4
SHA512 4bf10f4e7799046d7f1845bed89b83da50324268488584528d4a72908fbcedb0bfceaa1abb2d57431547be87cceab1f8aa9a3ee2e6dd31944f84cde5b2815e2b
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwM:hw3wnw3wM
TLSH
T121079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 16.2MB
SHA256 6ed2fca26bb34f2af32208e7fe685601ea9b8551d230a327b6fa1a5e26e61704
MD5 bba5988159851eb28a0054541b16cdcf
SHA1 c4e94c8b3ab1c07d51e4c34b38413d34fa804a39
SHA512 233bd98fb0a97ed2e825296ed85aa88b8f381519f5a08b87f035a1f063c7b6b94d8aa4a7e87eb1ab126e98f10942765bd94a942d3a3369af0d5e5d331af51a31
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwH:hw3wnw3wH
TLSH
T181079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 16.2MB
SHA256 2e96865b35ca977956629077cc8eaf48bb6af4203544876965ca884e6bc4cd3e
MD5 ff1a66b879cad64941db5326a9576835
SHA1 98a2b4d1662df5045ab952063cd3ec7c3c091cfe
SHA512 07954849728acfc9de5c66eb98f0b99caea8786a5e5cba395f93fce2dcb8c691240e552ad6e99218c1715d87300ad6a7d2bd09d2653095f1ba53ac7a6766c85e
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwK:hw3wnw3wK
TLSH
T1C1079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 16.2MB
SHA256 90849144eb46058db952ece08b14a509d33eb97724026db9894bd919d8174c05
MD5 795ad84adcb9afa93f8e7b1082c37a2c
SHA1 100000a1d9f2ab04df6f0473227e74ad570e981e
SHA512 e5d62dec59a2124d7e82e7894f21f30759b39a9d7e48263a1d99d9ded86cbe770ffb6868e2f02b3d90fe0a634c9cc638cd44c8021a386b32689a9ac24a72e714
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwE:hw3wnw3wE
TLSH
T1B7079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 16.2MB
SHA256 e66dc446a40f12a4ad28bccbb8701682beab109577b3ca31e468a1ce369a6734
MD5 98aaf115d78e0debea1675d7f97bba06
SHA1 44b2b3a27f697aa723170f7bed23b35bad9ddb82
SHA512 83aaf2332de19c7ce1bddd5a7bf17728856d7a777eefe38304ae2c19540bf387c7af8701286d99bc4f54810b1e291c032b4eed8c7c5e100788f1a7981170033b
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwM:hw3wnw3wM
TLSH
T177079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 16.2MB
SHA256 4f1571997cc184a777aa4335a61c393486015b220762acef6cf4778ddde5e3d0
MD5 eabd9173abd113c41852e9c773ef65ac
SHA1 795ca79b8c57c2af61924d010aa703de37930b13
SHA512 91b163de23a180a742ea3c74fd72bdcf27eda486e2be62a0ecf7d147830d5a9a426fbf0d5e7c51d8990158cd7057e3c13464b6e6f146b7e624791c055f2666ac
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwF:hw3wnw3wF
TLSH
T1E8079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 16.2MB
SHA256 0f64f63dd394545fb01c7e6767f1e41555685ce458fa81b868d0e3eb3745440d
MD5 27ebfe01fe783ca91f393e6a560d64ef
SHA1 38f884a6990cfc92db64eaf68ea50d0224bfb4c8
SHA512 a9efdfacdafde20e5beabf0bc478b2b9279b3d0e3c07f9e5dbcf11eaa0b8fbda024104d7c7b06a21a1b8d729fce6abf373e5cf384bad2d1e9ec7ae07bdf776bc
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwz:hw3wnw3wz
TLSH
T19F079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 16.3MB
SHA256 331ebc0850fcdf304122eb2e0b9ead20baa898d6928b55109a63de33e91ce5ec
MD5 e5aff8b52d85ee57352468c097a9ea51
SHA1 99255870b781f9e354fc70db5cf0c60d7d248d97
SHA512 ad100fdb061d6dffda87d3feddd56d09791ef7cb354e044fe8327de6664ad43287bfde2e785ceab29fa676bf46caf5bdaf2ba6f9e6c1e9dbc8af40b43f422f5a
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwQ:hw3wnw3wQ
TLSH
T193078C91F5A08272D07A8471C5D6A77AFA3378415B308BC79386DB3C2F272D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 16.2MB
SHA256 c19cff56585852f963df412782b29037d9339b6afa122de1da6ff4c0e9f392a7
MD5 1bf01438859fa83e2a9cec29dfbb5207
SHA1 e376d7506fdb5c22acc7ed646a944df514290a9f
SHA512 1fe0110b82135aa1fdec5f02a9e688ad494cfeed8f2b57bfc18206720c6cc98c223c89984981d9e487f815eb532a92b9dc9e3aea32aa7951912f2b1e217e8140
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw4:hw3wnw3w4
TLSH
T1A2079D91F5A08272D0B68471C5D6A77AEA337D415B308BC79386DB2C2F372C19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 16.2MB
SHA256 27fc916d4eb8f87ff8e31f8be9f63f8e33f31040b88fb744eeb4c5121e1bd767
MD5 0ffa659ff2045e353eaaeea3aca8644b
SHA1 9d55b54a9125e88f3891ec48230c62b546bdf8cb
SHA512 62ee4a22bad2959a8a18fea2de68268adcccc7e9daee03297d10ac34bd29c85298ee3cd04188feda0ca276916f6ea1b34d003bca79bca75c5b8c42f3a01622a2
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gwcj:hw3wnw3wcj
TLSH
T18C079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 16.2MB
SHA256 d9df832c2eb530ec4a93a4a0094e319c89853d36daf8fa937e17ca8774020185
MD5 b0f5e8c7e03be274400927508ed3fb17
SHA1 158bb68e03e512cbdad9e22fc7c721057378dbdb
SHA512 e45a56e091e2c3c048a2e88dc4b8670f994268b974a381d84d5a8b84c628b9e34e31d0871e08a3ad2bb4c2aeda7c0f3e26ef3a00648f31e8d14c49243259ea59
SSDEEP 196608:Jw/h1+Qw/h1+gwXw/h1+Qw/h1+gwnw/h1+Qw/h1+gwXw/h1+Qw/h1+gw+D:hw3wnw3w+D
TLSH
T123079D91F5A08272D0B68471C5D6A77AEA337C415B308BC79386DB2C2F372D19A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-467-0x000001F99B450000-0x000001F99B550000-memory.dmp

Download

memory/1848-513-0x00000201AF870000-0x00000201AF890000-memory.dmp

Download

memory/1848-499-0x000002019F2F0000-0x000002019F310000-memory.dmp

Download

memory/1848-480-0x000002019F4B0000-0x000002019F5B0000-memory.dmp

Download

memory/1848-478-0x000002019CFB0000-0x000002019CFD0000-memory.dmp

Download

memory/1848-469-0x000001F99B450000-0x000001F99B550000-memory.dmp

Download

memory/3096-618-0x000001F7ED000000-0x000001F7ED176000-memory.dmp

Download

memory/3204-44-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3324-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3324-24-0x0000000000400000-0x00000000004E4000-memory.dmp

Download