7b565b9284dd31bf14f47691bd4268aac35c9095807b9280e661fdfc33ad353c

Analysis

max time kernel
145s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 10.4MB
Sample260629-c8tspacw6q
SHA256 7b565b9284dd31bf14f47691bd4268aac35c9095807b9280e661fdfc33ad353c
MD5 ce730e5a57652c715a491890645c7544
SHA1 b28dfa3b58f88483f57bc7536b525f67dc8ebade
SHA512 80c35627b0466d84650848b802aba50b7b2498c2fdbce32ba0978f3e565bbab30ff5f89e10b477693128d2acba6651a8fcc53eeaf95e31f1239b46e58c0bfe87
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0py+:mWqQjp3
TLSH
T1F8B66C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{49513657-664F-4919-B169-897EEC1B88D8}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{401B83DB-B6F1-4F7D-B4F6-61B5483401E0}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4156	sihost.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe
5360	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
3736	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1124	2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
5980	StartMenuExperienceHost.exe
5072	SearchHost.exe
5360	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 5360	4156	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3736

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-27_ce730e5a57652c715a491890645c7544_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1124

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5360

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5072

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 14.5MB
SHA256 73a71d26ab2c5f23d58219db3594c1ed4946826e7ddc11876764935051334ad6
MD5 03c5d2429888eccf3b9eed2f1de85f5c
SHA1 2542f9ffe96a6bbbfdf0b3da20ed47ab372e5b0d
SHA512 06826c3f51d9e6d508f9d706dc1530da6dfdbd506d372f4379b4f9f79f7cb26f9b30163ba4d9721f8173da1b3851dd8f4450e5981786c50a3b65838c466a96e3
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0py1vyEYc/b3w8O:mWqQjp2vyEYKbi
TLSH
T130E67C52F6E481F5E06AD174C6A69776FA727C425B3096CB0281F72D2F336D08E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 21.1MB
SHA256 c953dcee2704861de5dd729438df3d01eed6c951de9f8a9c87ba039310d23bb0
MD5 01bdce032a917b1024c0f2fbcc3131de
SHA1 be1b4351609be8b816432304943339bff0b3589e
SHA512 97e686133e378581a001250777e1dda69605dba4888322738a365622b161c0bc24fd0b5217fab4a2d8573a85dbe14895d803b2b16093a6f873367ae07810e019
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pO:mWqQjp2WqQjpO
TLSH
T172277D52F2A481B5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 12.5MB
SHA256 95afc52c6f1c1a6784bf47bd015f5907626d68152af3920cac55cf7b3f13c2de
MD5 f168f5d37799c8a89a8a81eb603d9e88
SHA1 458c185511ea9bfeebc5129ba4a2058a8f8ccc5c
SHA512 ae866e283e491c7c8358df4f54a888a2fb08f29170189bba31e9bf27c062111b6f488f62ddbf8eeb335ae750660f0b3595e228ae184ed45ad80ca5c800fb7516
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyeGn:mWqQjpbG
TLSH
T1F0D67D12F6A481B5D0AAC174C6A69736FA727C415B3096CF0245F72D2F37AD09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 20.8MB
SHA256 65e7a7f0a27ca7e776e635728ad7f11766a494baedeeca1da6f92b852cf490ae
MD5 82acd7dce66735f13206c0eb62eff525
SHA1 7b8f9305c3a311d644a5974474230c61072c3915
SHA512 bca17754a0da2406573ab2b2a5bfe551fa63a22d875da50b8f34f937ee22bd3dd9edb18a2cb596262f00c546ab9ce43e87f0e3103b6bf2d64627e36c945a68e5
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0po:mWqQjp2WqQjpo
TLSH
T142276C52F2A441B5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 26.8MB
SHA256 b0a8a895d20bb0517a2eda4be4ca983bb7824bd763c91333cbad071da95ed8de
MD5 c50a707b37625724b0619aff62efe193
SHA1 580dad234150624d8786365d815392f241cd85f5
SHA512 22c60bf704eb1919839d2c07f09d0570b3729607d8adeafb1be82bf82c39d4155edc14c44b25aed46334c3e6a44578ed6aa786eaed1949949b30e308980a3d0a
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pc:mWqQjp2WqQjpSQsas+PS
TLSH
T1CC578D13F2E441B5E06AD174C6A65732EA327C465B3096CF1284F7682F77AD0AB39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 22.5MB
SHA256 b095c230e34ba3eb0b98588690fe32c53d7b113ff7dd382903cd58edb6095511
MD5 98bae5f2534871997ba371f09cf77fea
SHA1 b4d896d5600fd65111af344837029a55c1c8423b
SHA512 708e9634f9e45a8c916df8e6be8fe1389404e9f1481b2cd4a47043372861647647b4f7b908ece6078fb779c12d79c148f15f0de5592c777c368fddde9b531371
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pO:mWqQjp2WqQjpq/
TLSH
T126376C13F2E441A5E06AD174C7A6A736EA737C415B3096CB0285F72C2F776D09B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 24.2MB
SHA256 6f73739dcad26867cc211eaa8c1b1457e5c92ad75db8b6370e9b861c82ee5cb3
MD5 30826a15c6ef80157ee6fdeeda4f4874
SHA1 28c5da89dd13ef31942ebc38921226b2c5ca3d9f
SHA512 74230921e08b3745176e578c1ff055f7b380a690705662ecbf73182426bd3212f964109ae0964e8b24ce1d7a0226cddadf9a2cddc735dd3d52d574e26af24f16
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pG:mWqQjp2WqQjpo+6
TLSH
T112477D13F2A441A5E06AD174C6A69736FA737C425B3096CF0381F7292F77AD09B39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 23.0MB
SHA256 6e3718881331b8fc1a980b01bffde5fbc992e9be572e9755e3280ce7b9b07f87
MD5 d4691579abb9f9f2702a967fd717e13d
SHA1 da7e9cfa48aec30afaf7efab39c1856d68833e03
SHA512 4a4b6f09806f3464f767ceeee834ad9de14adbea49bd761fda183697b128ae68b23d092ae0eb954528e096f557be848526dddbbec41ed6ca2cfbe755c2f9586b
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0py:mWqQjp2WqQjpCl0G
TLSH
T101376D13F1A441A5E06AD174C6A6A736EA737C415B3096CF0385F72C2F77AD09B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 22.4MB
SHA256 9706cc9a4272321f6bb22ede4e35cbaba62463c66eb20bf76f325c9ab41f5b3d
MD5 8514b1f5927047da38013708b28cf808
SHA1 62f59f1481865593c9bc744edc5911cd5a28df3f
SHA512 d06b0cfa715ac19c14308fdd2e88bc47859e3fd527012b9e5f446013709ca518cc8bc352edec53843cae0c31fde55f6085ed4c6f872c07d443fe9c128bee3e07
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pR:mWqQjp2WqQjp9f
TLSH
T11B377C13F2A441A5E06AD174C6A6A736EA737C415B3096CF0385F72C2F776D09B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 22.6MB
SHA256 f30da7f3b637fbcfb22738a8c0df9338604025166a19236b1bdaef8c0d9d8912
MD5 e8c226e6ed7c6ebce901f6d4f7eeb251
SHA1 e6ee31294b475afde380823162b975a7d81014b7
SHA512 d92ce00cdab8bb6e7282726b3dcef6a95fb39731ba036619d30b113f503553f8285c626128dd2e7ef1de39517d52b94c2f7e9b2f3032841206e22bad02f6ad62
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pR:mWqQjp2WqQjpbC16
TLSH
T1DB376C13F2A441A5E06AD174C6A66736EA737C415B3096CF0385F72C2F77AD09B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 13.4MB
SHA256 53c01e1e83fa6290ab5ef507338ee116e4e2c5d9450f0a943851097858eafce2
MD5 a223caf1c3302768d304ec49a766b736
SHA1 08b11d684ff1a597c3b7c42442488675386b6d07
SHA512 49e0037912413b1dac8a8f15510f4bf76c4f2aaaedc80c12e96ff15070d0dbcacf715948b489b5cc352fe2c914e55ee0145f04a49c335d41a5eda9c3a0ab4a3d
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyQjnDO:mWqQjpdO
TLSH
T1C5E67D13F2E441A5D06AD174C6A69736EA737C415B3096CF0381FB292F77AD09B3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 20.8MB
SHA256 3fe4d02d77b16f9609372aaa26b4065182736e59c9c56fc1595ba8ff42bb5ce4
MD5 e71f6511f5718f4697bd5a3c821e1fec
SHA1 4e2f68766db804835a6def055c1c947a4465174a
SHA512 f88e95e7fdabe9e05b4ab4b5de95d96847bb8ea8f7e5e41a6ca0844552ec6cc18bd98b0c75eadec3b6f7b0f10da41aa0111e3f2f17f26f37796c5e80f93e3317
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pG:mWqQjp2WqQjpG
TLSH
T1CB276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 20.8MB
SHA256 c468fc0800b6087adf1304e1a23a116c39e17bf7b3db616a35ef4618a3072f6d
MD5 01a56db2a9a498cc2f8adb2887eb7b79
SHA1 f53ae8ae44206091015bc940bfeb38b08d16e120
SHA512 b6df33fd2792d69d754d4f932b59b0a114c6f0a3f64610835212b1523b1fecc74982b2569da068ca12210e9d83da4d29f3517a913aba26f8a411945cb3c55a94
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pi:mWqQjp2WqQjpi
TLSH
T1B0276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 20.8MB
SHA256 3b528ed6086eef88b77a064bb84040efb4078efc56c326034422a060f3995791
MD5 82f80d6f4b958c9f3690315bf8df8aea
SHA1 216309e9890fb8c6ddf7fa48d12256d99f0b9cf8
SHA512 410914cac4dc6a6885c1a4677484c83d95acdb971c1b9cac64e6c07b7e86c52f192c4b212d9f9bdbb4a9d184ce7fb5eda6d7a8b6dd563df19215f059c1747d2c
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pN:mWqQjp2WqQjpN
TLSH
T1BC276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 20.8MB
SHA256 555a35b177c2ee2da7ea13b6271e9834e5db89ee650de7d5acc2db0617262cc9
MD5 77845cb0d134e56f562eede1348f8fbc
SHA1 bfba4be88c66b51fc7cf6ffaa3863849bac8e05e
SHA512 7f31211f592837ffe0b761081650c7965771dbdc0cc01f8221310a60c9fd85858cc740065748b0cf8c130fa1784493c59b481214da04c1e2c09747ace7e2786c
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pI:mWqQjp2WqQjpI
TLSH
T101276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 20.8MB
SHA256 ae5206a370c017f3baaef37b2861fab2723bd161bf0d9787b567f33c7fd9a03b
MD5 114e3abab7c7614cc324f05760c0ca53
SHA1 551b6319dd2cbb970ce557efeba25fd9b8ac0eef
SHA512 8bb165aa800f7d24e448f654432c13929649dddd6d6c2401ac0107c124e18c4f2061269ef529329a486d2f462872149fbe8be43eb9a213a80590e1418f20c189
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pV:mWqQjp2WqQjpV
TLSH
T188276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 20.8MB
SHA256 395e6f0404cac7fcb9f5e5c8e89f34ec2984115f1ab173a5e6cfe3535c223d70
MD5 15949828113327c7bf06c0e8a6f41f3b
SHA1 24a90fa362e402d5a7f328115e008d99de1ef760
SHA512 24e2b6d0807e569b83356d623d43426bf0a46ce0ae026464889e29dc86271328a50ca95feccd977594968a4819160066c0a34aa813944fca80a13f2a0982afb6
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0py:mWqQjp2WqQjpy
TLSH
T19C276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 20.8MB
SHA256 59e00743e1988e89675fb997a245d433feddbc92d54495b3b16ccd684781e8fd
MD5 b8ab8141c95e42a9e76734a565d37f31
SHA1 fa5111d7f8c9dc929b83a2bf9a2cd6ff6a5dbc76
SHA512 134af40bef644428f8047e743720fc785cf5e7db68437f636e343400e537a8daa974cb6ef0eb7af0a9d0086ef4c0630c19857c7bb3209c229de24fd58c9a6319
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pd:mWqQjp2WqQjpd
TLSH
T155276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 21.0MB
SHA256 f6edf77b2720a673efa867ec9835454455692f1ed24cbd72fa6589e9b7ceff08
MD5 a0b217cf6bb94b038f149748d9bd0691
SHA1 2cf4400c54c878bbf68e8fc2d05ad65d07db8fd6
SHA512 05db002ede1cd648be2d83a3de95cae2c4e79c2cf59c1eb892f4cd28c683fb5cc73be93cb19fdfc1b73f3008f4a9a450420a64b04d9c416e793b8c46c3fd852d
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pf:mWqQjp2WqQjpgm
TLSH
T120276D52F2A441B5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 20.8MB
SHA256 e75b5cb744630fa3a6db1c2d3319b614498ceb3fc7b03395e2f85c5c588d9b88
MD5 e37e424200c912849f1eac8f9747af93
SHA1 5b060c095c98113a087f15cf2e74c9a3eef5ecdf
SHA512 ec4b0bd9ba42b1908b5083a1a09837324917f335efcc21b48f3f7775d2961ee07eb779f3e150c05af293b996e3e6e5aab831a2aa1d4b2e875e3ac2e04cf8d3c6
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p8:mWqQjp2WqQjp8
TLSH
T14F276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 20.8MB
SHA256 b5d5c31fe36aec13fa87dfd717d60cf745c7dea28801451f7ac4377bbb535713
MD5 af673e0d2ea928ed8f04a94a851e5e87
SHA1 0455a3cc82f6cb9499fa0666f7e55880bc23fc66
SHA512 a306d83730f37b4cf51711f5cd5090cf67ac3476ea171249d2a81edda6e1d50e91b1a9f94fe7b2e76047f1b30c0c800d77546668110a7c5f6951174685d92a93
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p8:mWqQjp2WqQjp8
TLSH
T155276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 20.9MB
SHA256 2198f1195c45c776f9fa919fc2d0a67a6a45438aecb4c0a0502db9a0bb562293
MD5 72ae6522731bbaaa0cf56ff111a33d9b
SHA1 748210376e1a8036a90428d696553737c688aab3
SHA512 a65f66ae71f24c022770b261f16287a96362ec77dd34c911206caed3f8c468ff441583bd8e93eb640fb4b89cbeedc22241bd2af5d5931219617d490fddaa3ca8
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pg:mWqQjp2WqQjpg
TLSH
T117276C53F2A441A5E06AD174C6A66736EA737C425B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 20.8MB
SHA256 a6afaf4216105bba78a7252b401c090c5d96dece6e5c939a4529731f4c9814c0
MD5 b82ddeed2a1714e0e330cb6a0ee40880
SHA1 e52aa1f4e486cad8c2aeb3026d4906b77d456926
SHA512 ac246d6d67536d06a425afbed1edac4d7e0257e216111aa630765ba72b2f0384222961a110319b6acb4d8bb20eadd600236ee484ec2beea326d2f3ccd52bb277
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0px:mWqQjp2WqQjpx
TLSH
T1AE276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 20.8MB
SHA256 bfdf880d7033114c567309bbecc5dfcc2c3ea08aa04f12fe63fb71e898085399
MD5 6dddf4b532c3d5c03e6ddcd920e11f8d
SHA1 7fcd58d33bad0a29bd034afa03bc9fcb7226a66a
SHA512 253b001378f87dc2dad80c70ef99d3796d33bcc56b845b30de3decead36bf65b8ec735afaabc79d92139883c9da1ec8c419f34093785d8aff850f9cfb27920c4
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pj:mWqQjp2WqQjpj
TLSH
T123276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 20.9MB
SHA256 2a013f0a00f1854dc1c18bd491171edec56d24525ed7c179fa0f1cd80682aac5
MD5 3fa4808408276f3709e570bc150a35b7
SHA1 c894f912708be60543129c3e22a8150c64193990
SHA512 f56f52bd752f8a5e8a9d7ecad3e4c52d754cb2c8edbdc1d5187a75f23fdd881a983ae82aac8facc529e03debde6d938d34b5f7d2dea76eff70a1a760c5c57f20
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p4:mWqQjp2WqQjp4
TLSH
T14E276C53F2A441A5E06AD174C6A66736EA737C425B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 21.0MB
SHA256 dc0e0089dd8d7cb4afe3f0fe409475ddf5b9b809d3dad6c71e7b043f5e2b785a
MD5 5f833f1c9f0cb9c7067dfb1e51503ec2
SHA1 b29c4aaf85a308255e3656c29c9dd3caa0daeef4
SHA512 0274d7aa847a4df78bbc4134e6618164cffc429b4d693730b2bccbbea483aeabce271834401cf8c298ba6b9d69a5dfd38297ee2487a81aed02d204efae52e37e
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p8:mWqQjp2WqQjpC7
TLSH
T175276D52F2A441B5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 21.2MB
SHA256 dada5dc9c79d7de90aa854b688037d050d1073d06174eb36b2f79664ac2551b3
MD5 dcc4ae2cfd405963588d18958db226c7
SHA1 5ee757625969983a2aea40e23ffb7ca214844969
SHA512 a71e3974546b657f162d3d4885666d592840b6d17b1888262476b7cfd31111960758b9f382ef52f4a4388286a78de7026a1d9f763538b09d98f6bc05a38027f7
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p7:mWqQjp2WqQjpld
TLSH
T145276D52F2A441B5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 20.8MB
SHA256 516cf4db9f23b946a07ae4b6312f6eaf9ef85cbd090465a550dbda7b9cd00ebf
MD5 91010d690ff5f20018468ebe48ae9bd2
SHA1 d755964cef599ee50322d4829f2ffcc8b25c46c2
SHA512 d3806e35bb7f86e37f0848e6b8393559c283a793133c5eaae337698224ba15441ef9f32a589eda42d147ca71554dfd3153c6b0a3387b935df96c0c530d293177
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pC:mWqQjp2WqQjpC
TLSH
T1A4276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 20.8MB
SHA256 9522195d278ad180ee21ac3ebb5efda238ef8074ed92a13ea8d1d60387fa2dcc
MD5 12be93d86e3be7250dd66bda04154e83
SHA1 c4480c3740542f9cac7ea91d8bfc8ad29ef3c685
SHA512 713c35d7a3351657aef28e7208cc7d4b342262fe38d40cb59bfe19179801df9a66b3fd8de53f6dca480c4630b969f0dc06d9064cd04c2761e84b69aaa6393087
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pv:mWqQjp2WqQjpv
TLSH
T1FF276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 20.8MB
SHA256 62efdf331acf6181b658937227aff8b473e6d7185da1cbc61e27c8ffd23ff2d7
MD5 43438c88162c37d28a0782c40399ce91
SHA1 861365843df12e19e67772324c2c01fd3bc3885b
SHA512 0027427a8102306ecd209615c2f051f9e15b33fb99d4274a900bdb0bf6d5048d36539b815fe67a10c60b5cbf40250da7b0e518f6f520cbd35715c4113b8eef84
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pl:mWqQjp2WqQjpl
TLSH
T103276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 20.8MB
SHA256 6632f1f1d7ed77ad633041ac37b18ada32ce42709c7aebde61148e111343d214
MD5 f6fd152181583fd33f6071283145995b
SHA1 830236cf22147584b7398e40998d1ff51df492ba
SHA512 e308f914114c99f3d32de4c5123ce05ddc926aff3c2eed3df91c3c2d9c4689a971f815812c782991265290bbc7553c7673868af3e0592a2550cf343883b0fdc6
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pe:mWqQjp2WqQjpe
TLSH
T127276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 20.8MB
SHA256 c9bd35987c303a794074a93f25a980a5e3072b0f9408a7612f26c715d112978a
MD5 53784cb54aeed2d93ebc920968b5845b
SHA1 adabb04eb9f94d07fec9b6c2d57bd42b20f87ba4
SHA512 8dbfdb74b3aad01d3bafa9060afabb64052bd35743a942523dc900d97b57b9101687473cd89e73f3674a1261837880d7deb186b9656d8c0ed3ad4a73b3634608
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pc:mWqQjp2WqQjpc
TLSH
T11E276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 20.8MB
SHA256 2cc18156845449683d726680e45c08a50c6e620300e106a6e4f66fe863dcd41f
MD5 2f808578e00c3e2f16c557f257ec16c5
SHA1 624b08cf3e6c1937724f2693c1273ab2e90b4082
SHA512 3c704fb287a2c84729b3431f2a9e651d0ac33650f14a4c69a381b40d3dc14f5e97794b275783595fe1c9758453acb333b203d15c2e674b71a765dcc65ac1426d
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0po:mWqQjp2WqQjpo
TLSH
T1B9276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 10.4MB
SHA256 0eae3c6a0b266840ae9db37c2bf7a1fc8e916316453bbd0a5a3c18b20d41d3dc
MD5 f2163fff338d899dee610f90b456edfe
SHA1 754204d8b3c33ebc8337b0b7b85c4162e5c9d2b3
SHA512 929cbb26d6d76293dc5727f1eba450edd5bc26688a949bbc3ffa9180e791cabec4b505488a098d1abddddf7e0fdf4109034b365d8799fa292a512e8a29301547
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pys:mWqQjpF
TLSH
T14DB66C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 20.8MB
SHA256 b506587ffb17c1e80b8c5a899fe78df1f03f81ad98ca452c29e470a63287c898
MD5 4ab66569025bff97614fd5534c47bead
SHA1 c2e963a96316f4a7d135c93bdfefd9f44d02fd01
SHA512 ac1f20e8162cdce5c9cb6a50249089753ccc8231dc111e4f02ab67007695db793536825c92748f7ac7ebbc8fe1f8cc76248d6efd8323bf6bdd4be7c13d6015ce
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p5:mWqQjp2WqQjp5
TLSH
T1DB276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 10.4MB
SHA256 6b62cbe873616c3aee960e388d82fdae2115616db22df29bcf9e2234d0d7ec3b
MD5 938a9d931e2d90337c814369b6176794
SHA1 6f00f7e96e7155af7bb41662411cdb9979a0a7f5
SHA512 92ac7eb3a99d0bcc7e214a6cbdf1b244ee5a3fb406fe6196019ec046f960db40b385c0458f3f91404b9f4e92d129410f1e2507de622abd631aaa31978644b826
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyK:mWqQjp/
TLSH
T1E8B66C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 20.8MB
SHA256 9a8ec304293afdb591548bde5975aa158206413e15034952e19a5087475162c7
MD5 505c45919c7fba7106cace712f59a832
SHA1 bd659e30786b0eea0725d80eeaf5d5f2837d7fa4
SHA512 0cd7c8959ae7eea1cdba85ed71e409fb64ee4b6591eed35b74ed70a7b300260a9780cf8ddd36273580ca57dffe86912e77d71d0f38464eece07a687bfef18488
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p3:mWqQjp2WqQjp3
TLSH
T144276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 20.8MB
SHA256 f3c2849a112e4b6d7207f4e723bda983384cfa2cf2638388b7ee11c56f55d9d5
MD5 32f76f521e83d213e698491286f5adb1
SHA1 6484ba334b526839c4b9b803f6a589b78ee52647
SHA512 fba4e1b2ffc2bde20fee3017a508a971a16dcb630844d95d1ff042821683d3941a39b7a061676750320122c4fc169076ec2acb47a27b859f80bf417d613b473b
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pS:mWqQjp2WqQjpS
TLSH
T169276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 20.8MB
SHA256 b737070ec1ac1a643b53b461433778d4ec85ea6698ba9b6223482df6d248b988
MD5 79d2e6ffae8c4fed009e6f5d3170928e
SHA1 3a799fd600a54ab5add9c1d25d3cbabccbaced3e
SHA512 88972a9a7d809c3768d52efde3d5b5779e2a74c5c910975c0823a735dca3b7c19c473b619880ba12fc8fc9643334c0924dc5754faf2ca7f8312fe083aa21e7cd
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pX:mWqQjp2WqQjpX
TLSH
T129276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 20.8MB
SHA256 5f5f2b16f198c372635f9024b4cf5b316e5c46ac41096c1e37d56a3e2ee6b7f0
MD5 a3defa851d5e3f63eb49bb6607a37292
SHA1 29edab68fdb7d0eb20a6162481a93232eda643e0
SHA512 6f452447c9a36a0a75f815ec725ed2625829a996512e8ebc74bd2fef2e043f053ffdb26619bfa06c3c4af4bc78ce1ad6684dde0b5c80b88c3eddff2a28842226
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pq:mWqQjp2WqQjpq
TLSH
T1C1276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 20.8MB
SHA256 e5d501638beda9d4d2659842b9e5a1487fbfbfa12221b685abf280ebaf1b4481
MD5 34adc7cd4096262d45b61c11f669183d
SHA1 3db40731497b5c601a7aa0e91555cfb789195e54
SHA512 b4bf9cdc441719c3cdabe6e548c32a2e7088848e879c504fa45ad229c05d9c1b660248ccb6b486ff035d45c362c230ba0b8d6ff3128f08703a62683929498bda
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p0:mWqQjp2WqQjp0
TLSH
T1C5276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 20.8MB
SHA256 35ecb4031c2a319e0f2e8b2ce3d42dd3ae1aac07cecd3d1716290efc253e1701
MD5 24744f905736fb1991ff4ecb625a15aa
SHA1 f18937890ea8c908246fbc1bda155ea1b80e1b65
SHA512 202a12e04211ff250d239461188dde7b784a1ca4bb73930134acb058e868e7bdd45d2b09ebe9527178449a52a6309b93c695d8ca311688b901162b229936b92b
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pu:mWqQjp2WqQjpu
TLSH
T111276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 20.8MB
SHA256 485b8109baa7ee5c03b6f135c4250b9cb2fc75f89f112abad3a7539e9ce3d790
MD5 650261bff11d1cd73fbc2a37e25eb59c
SHA1 fb635f9d51bac024df46772173aebaad5b980cb6
SHA512 31e8b5dafdc7d467c4e45810add628929178d7f034071a789d189ae017a31dcd7eb230dddf3c9e42b16f900d5bf80fee087d912f92a10726054dca65721708b1
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p0:mWqQjp2WqQjp0
TLSH
T159276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 20.8MB
SHA256 90c2ab60d4187dc89bb6afb469fcf6e09f6fb8a866aab6bef537472e8e09b2ac
MD5 e814cf70d71bb26b69221857042bd1e7
SHA1 d23c1f7350c460f109a0c5669d4267b0cfa8a9f5
SHA512 fac4fae301f3482c435303b209cdbb04be83a36509f6e454aaf6882e99212eb64418fa37b297afc9d0d0826fd405e6a1d436c6b9e981a7e09ed9fb449b66f8ca
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pf:mWqQjp2WqQjpf
TLSH
T19E276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 20.8MB
SHA256 658f4817731ad7645989676293f70d4c1a2384e183a7a42e8b7bda691576d436
MD5 7541798c85bf161037e893e4f4287d60
SHA1 f9f270259eef555569edb8da6c7e0dd92300b3f5
SHA512 38708ced7f9e02a2108688e212e6ff40fae1aba8e331c7266bf920dc8aed3604d6bb1e5e8296f2ccb1e670a9b52969401ca1bb007cfcebe3c8d87d403504d0c7
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0py:mWqQjp2WqQjpy
TLSH
T150276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 20.8MB
SHA256 f08fde6a6950399e1f90134e736c906c1a3e0f51bcfb68c43ac972c0687c6f20
MD5 7c56daad6b4720722e47f5e8073c9ff7
SHA1 ce9f017e61d98b8d7feb1aaaed56531d6100f0f0
SHA512 3c7ac088f95e61e5631f2c70bd6a2a64ec68ae2f66ab6c9ba616b5aaa859e68c60f4dac9c06680fad45cc2bfe417fa2622a79cfaef4a7beefc04e808dc9125ce
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pB:mWqQjp2WqQjpB
TLSH
T182276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 20.8MB
SHA256 faddd065fc328a8e4736d98eec1b7632ab87f3768107631c12a0c9d2789f0824
MD5 422fbd7e8cdba519591498ae6cf083fb
SHA1 8eed3f415ea053b8e226a8dc9da9d11a822cd2c8
SHA512 6c3ed0392d743025546255d48a71403bbf5e0a2e8af95ee706418fce446303695297e6bc196f3e6c1d4abdd188e48a52a14ad9b829de200d4db15116ec214f46
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pc:mWqQjp2WqQjpc
TLSH
T11A276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 20.8MB
SHA256 e139aaf3a76610231ac6c62eec6f752998d83b4064a480e8cf8a22b9a67412ad
MD5 b00b558923fe9512ccf3b1d9e930c143
SHA1 11c9a4890e47aa388b9e16b491226716989e8ebc
SHA512 a18a24975ca15c58be91732dc2c7423a54eb430da45ea3b58d72cf8e06dc180af1ff97947cb230c7720c1c8acdefb7801345b34226a2f7f81742b63f0e87051d
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p+:mWqQjp2WqQjp+
TLSH
T1B5276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 20.8MB
SHA256 38d1af0e82d0b92debe050b1f4c93c7b47fea3e045ac976be8bf74349824ebd2
MD5 cd7dd28cc6ebd8b89fd9b488386ab839
SHA1 cd2fef5a65cf4859bb42d4c19369d48881c12e53
SHA512 34f39f90a574daec3460e35d372f9a439ba45a91090b2d9c275e5f005c59cabc091a8d559506a4a92fc6aa552ea1e5278f512aeb0691f126bdbcb6b188db77c5
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0py:mWqQjp2WqQjpy
TLSH
T1D1276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 20.8MB
SHA256 4f56e991d0b0078fc9c006e84a7c04345c89be6becd238df81824fbd870ac9e8
MD5 42171dcc02861220073bf82fef7b1cbf
SHA1 28f557faf7f0df1b1a68806ff2b78a5ce6cea20a
SHA512 cac4e38a7b29de3f18f4dff242fa912227a7fbf71b2092330c8831b8358a73c11a968939abc755d27d93eedff6e23ac832db372d648382c1cee99a2d05e70b6e
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pD:mWqQjp2WqQjpD
TLSH
T1FD276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 20.8MB
SHA256 c691d6c7f1c4578bf149e39aec85764052f38e679bad1305b1c00c64473d9a5d
MD5 5e855cb51cfe038e00d15cc4b2a2b493
SHA1 31c47e75fad992dfddf44872e0d5fe1ab6d7a9df
SHA512 8f54ef72a3a18e23bf930a49752bd8f60ce30ca667d3ebed06f6f8d40612890b40712d2b4b3cbf27a405a57b997e92869f4237a90da31c53d5349b4043606929
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pd:mWqQjp2WqQjpd
TLSH
T127276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 10.4MB
SHA256 ea05b2ec947ce2dd083aeab19f76ca2e7c3fe58f2b95c1b89f57ae43037970d5
MD5 f716e03b2c4b8e50c6d58c5d7b9794de
SHA1 3a845453a6ec1a2f3bb40ab75f523f3db3f1735e
SHA512 9182ad641780f6db1ce0c3ebd13dadb48b8218c86b36e85b1613054ef1d512466cac903a306fb6fb2d284a6fe443782b13c8064578da73619ef919026c7723f7
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyZ:mWqQjpY
TLSH
T186B66C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 20.8MB
SHA256 38057ab05bae1cd91148d4f6f3b40f4af9356e16b5b2b537a9629bf1785576a5
MD5 add8c27904662747af676f949769adea
SHA1 49f712504b386d9cdd80090769dffa677471855d
SHA512 17f506a7a5c10c7a3d0b49f94b660b0aa8f2fc4debfa2ddcc20fd8bf2491e2c5a8a8b111825393aece7283617b6b87816986b16b7bc4373357b0eec82d5827d5
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pY:mWqQjp2WqQjpY
TLSH
T134276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 20.8MB
SHA256 3dc1fd26b35aab570630ed8459210b8374175c41149b53bd815c7e99e30eea03
MD5 354bbaaef6025f59e59339960b564332
SHA1 d29582e86c81a05106a987413c7fde66e2377ea9
SHA512 48bb060bcc5cbd06e5d542ba2ab27d998e4e608b4e4ef9913a43809dc6ddc684125dafa30ff3ad94d218ffeabbfcd88b976a3ab29f4bd1b06c49f661e6baf3ae
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0po:mWqQjp2WqQjpo
TLSH
T1EC276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 21.0MB
SHA256 740ef27d6060371429370bf507b84dd2621bfd6aa50e26151961f078d026c15a
MD5 a2fc45c1b6197e007255ddaed62d6441
SHA1 2811c4fffd4416193df4fdcfd722eab5fc789edc
SHA512 1731aa56c520dde1e2834d7ea2c58811480ff2131abd8abf19153d7730da8154821d553e83c5c3d9407e8eebfa3554d599e7d0e02d32cdc3758d59a65cc2b223
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0py:mWqQjp2WqQjpy
TLSH
T160276C52F2A441B5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 20.8MB
SHA256 12aec5de104527b0a789d9a0e8d88c4f1ac3f02c2e81a7d71ea9c76f8349e515
MD5 3a3eb6dae2c53b9f8f2c51a5577be148
SHA1 a27ef22ff1321fc4d73e3d877e2dd75951b48d04
SHA512 70830ffc0edfe663d0d3c983807917e32f9a535f445a55438438eac57b84670866911cef429c0adc0617f329e1a09c12ea977407eea31c78403493b386062963
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p6:mWqQjp2WqQjp6
TLSH
T1EE276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 20.8MB
SHA256 7e4a78573e0a046b04352601f61951a636194ddfa4833fe31f5bd2cddf70a784
MD5 2903d96c99287023bce3a6153e2ae59f
SHA1 11a7ef2e5c3b0253650ea2fc7bcc02d078f34f9f
SHA512 e2db9c6abdc5ea5edbbecb6b22201965853af4b58123751e5fb2c967888b5473b0a077197c6a9d382c07af99f9b333c02eef1ecdb332b2074d3f4f78668cdfe1
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pX:mWqQjp2WqQjpX
TLSH
T177276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 20.8MB
SHA256 71f15186e731234a33eb4a0e590b5801b7e63a5a2719541cc89f86ebad22e22d
MD5 a9da6e9630561100f7e9c1eb05e14b92
SHA1 d807038a6b8e8dd2740c33bc9793e175ab0f7bd8
SHA512 04d5aceb69ad3de2befc48501099c4ec5876844ea4f3ff9f043e8f39f6bdd3843cc3edafdc6f13967aa2c69d4d6a650b7a6d6ef9e794bf5b104b38b6c78fe19e
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pJ:mWqQjp2WqQjpJ
TLSH
T1D0276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 20.8MB
SHA256 950e8614cd42e78105b9ab850f89ec7d62ae7b5fc491cd01f938aa15876afaf6
MD5 172476da1008c1b35e4af40bd62c7cce
SHA1 1a0a4605642078468c3f2e9e70e0cdc255309e43
SHA512 269dca7f5b2ee1abe0603c5dd77151c7e914c259c5663e9b4b3064fbcc7930e573fe9a45a895122c8ea14816577fec5aeee045ead8a00b8f8c14ef6e8210631a
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0p6:mWqQjp2WqQjp6
TLSH
T1D7276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 20.8MB
SHA256 43df49881ebbe543d36b94a598fe905e1e280e6801478648dfc81461e9c6d9c2
MD5 9ebeb61825359e250515e371e2283dce
SHA1 eb059f0d480092ed71e45706030b790355602936
SHA512 7b79eba6d5e5fd0cefce5c64161dfa8b17dbc43411b7974a0d71a2ec7ea85d5df35263f1d3ab8e381b376e8c7829f7aa6215818fe5090dec4547a342cc1ae9d0
SSDEEP 196608:Jw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pyuw/h1+Qw/h1+3w/h1+Qw/h1+8WqQI0pU:mWqQjp2WqQjpyj
TLSH
T18B276C53F2A441A5E06AD174C6A6A736EA737C415B3086CB0385F72C2F776D09B3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-27-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3736-20-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3736-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5072-432-0x000001F0DD480000-0x000001F0DD4A0000-memory.dmp

Download

memory/5072-387-0x000001E8C7D80000-0x000001E8C7E80000-memory.dmp

Download

memory/5072-418-0x000001E8C9F60000-0x000001E8C9F80000-memory.dmp

Download

memory/5072-398-0x000001E8C9C40000-0x000001E8C9C60000-memory.dmp

Download

memory/5072-388-0x000001E8C7D80000-0x000001E8C7E80000-memory.dmp

Download

memory/5072-386-0x000001E8C7D80000-0x000001E8C7E80000-memory.dmp

Download

memory/5072-400-0x000001F0DD080000-0x000001F0DD180000-memory.dmp

Download

memory/5980-624-0x000001F779C50000-0x000001F77A2E1000-memory.dmp

Download

memory/5980-627-0x000001F779C50000-0x000001F77A2E1000-memory.dmp

Download