98e4f944046d6796526855edd1d1b4765267b2b948d89fbe09a0a53040b79704

Analysis

max time kernel
148s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Size 3.5MB
Sample260701-e1hrkags6t
SHA256 98e4f944046d6796526855edd1d1b4765267b2b948d89fbe09a0a53040b79704
MD5 70d66bf65e5fcc45ec2ef5c24e2a77ef
SHA1 85068fac4c7d68780e1ce801342b320b6182c67e
SHA512 76e519fa1dfa73d9899a191ae0aeacd89432f022a891b0a182212644793153a3f44c87c15805ac4779e4aa022a1bc5b21774f2ba2025854842e043f028f306ad
SSDEEP 49152:jYRw5x6M1vYRw5x6M1yJIUyYRw5x6M1vYRw5x6M1yJIUpD:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OD
TLSH
T13CF58E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{931BD14B-00A2-4EA7-9BE0-33BDA0B34F8A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{051ABA91-01CC-4A70-90B7-408135899A3A}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe
Token: SeShutdownPrivilege	2552	explorer.exe
Token: SeCreatePagefilePrivilege	2552	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4444	sihost.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe
2552	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
6012	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3204	2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
2492	StartMenuExperienceHost.exe
2824	SearchHost.exe
2552	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 2552	4444	sihost.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6012

C:\Users\Admin\AppData\Local\Temp\2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
C:\Users\Admin\AppData\Local\Temp/2026-06-30_70d66bf65e5fcc45ec2ef5c24e2a77ef_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3204

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2552

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 4.0MB
SHA256 86afc3d8aded4dd98ab74835f1360540ac549ce1356858549f665fae1c52aa3e
MD5 8209fa23cec5ec60cfa7c38663c2f220
SHA1 86d7f8933737728cfd260dcbd5bb44dfd28b22e5
SHA512 2459fe62a57606a04f54a90061c17f0dfc564d1de2b8469552908c82c9e1a2e2ea1376f992cbab1e4d2f90bd9881967eb0b9b9815e642ef86f848c4bb62fb2a8
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1O1jo:nPdPyBo
TLSH
T157168E12F99180F2C775583045AAA776EB36B9420B25CBC7D354CB2C6E332D1AD3763A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 4.1MB
SHA256 8998cb9d6c6fc18247d73fd7ba302a55f0b68bd08249628513c30fb416de3142
MD5 82ccc42522b70f6b7cbada85a7c1050c
SHA1 2925e315b1d98e4f62277cb2f00304a3c786738e
SHA512 86079efb0ab449fadaf4ca6444f94468d53fd2cba4dc63bdbcaf68a6ed5878dae3d8a783de3fa07cab746b25e7cd53a03f6852913d4b7fea88d0bae238b49b79
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oi/h1+:nPdPyi/h1+
TLSH
T17D169E12F59180F2D676587045AAA776EB32B9020B21CBC7D355DB2C2E332D1AD3773A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 7.0MB
SHA256 420516e5cb20738ddc3f69623173e15d0c995aada1bd77c85791711275cc4647
MD5 bf1e3910dd89f75ebfae6c077cd30407
SHA1 dc4d6b607f651ccb8abac8d3fafda1044b84ae00
SHA512 f2ece4785eea721a494c455be43c4f0c246dd9b00b67fafa0ec9707e3b75bd24b7dad830d2dc097a6d64418ba099f238d6606f99660555da1446fd7e5c88138b
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O:nPdPyTPdPy
TLSH
T155768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 7.2MB
SHA256 85c34e8c48ef88f1eb65573c60818e5e1e6a637806b628b9653cdaf684db4100
MD5 a62f046e92599d85c1038814a40f5ae5
SHA1 91032110518086629ba4a4474a21d540bf444322
SHA512 7af4ba89bc641e2fdf709637b3ac74235a195b10a737cfb70a3ae24b5bd22be70b3479104331584d6e333084932240d0bf91c433c69298ae7c1331591dbae5e7
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OT:nPdPyTPdPyT
TLSH
T19A768E13F99184F2C7691D30056AA776EB36EA120B15CBC7D364CA1D6E332C0AD3767A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 7.0MB
SHA256 9d4197c365d6b10bbe7a964bb7e06d3676df220b8ca1115d67a1779824d4c298
MD5 3b5c8835098726f3a6583d3c79abb6d0
SHA1 92079e4ebe5f7ffdf4842e3a6416e4bb95187524
SHA512 0f1c845b64379531574fdd4aae46efe42f0ee45e12ff4a4ee17f972eeb4595dce9be162815d5b35f9f80d0ea93ff866e8e9b17c12b881e57a016a320a15835ac
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OEb:nPdPyTPdPyEb
TLSH
T161768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 11.0MB
SHA256 f0f9a108efbce97708653d88618dd627c0e4f3e578a816bcd7d35a2a454dd674
MD5 be2fbb9762332e527e0e251e82ab7d94
SHA1 333e7e1c3e2eb001c011a653e88a171be6fe464b
SHA512 265166c7686f04c143092f01305604f3ea1aa8c62e9fd52541597bdd705d57e1752df0c9c083556ce76201fb64ea9c2396ee87ce2a217921237b63a274701f0d
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OFQvGA0:nPdPyTPdPySvyEYc/b3w8O
TLSH
T115C68E12BAE580F2D6665930497A9776F776B9120F31DB878350CA1E2F332D05D3A33A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 7.3MB
SHA256 03773634c7b929b2aa8c448a0f7e978bf6efa2cd44049656c2ad6c69b10774b3
MD5 0ef9f842a17a8bc5240e11afffa90786
SHA1 4a6224934dfc91f0046298bb97cee9f67e843233
SHA512 67a7d3053ae423d2cf9673fc1cdaeea2381cdfe21d611d82a21707157b74c084d25df75d39923b1ea59d1f7475a2d2883ca28f3ad482723699796871d5da8535
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OC:nPdPyTPdPyC
TLSH
T13A768D12F99180F2CB691D30056AA776EB36EA110B15CBC7D364CA5D6E332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 9.1MB
SHA256 ad1557d63f278677875852fe5f20b0da5f5b0b670bc52e8406e6de7b2fcbcb22
MD5 b93ae1ded7025820cad451340a884645
SHA1 5c9b1909325621dd6c94de6a60385fc23f3a7191
SHA512 666ebde259c67c2529c47ab2128a520883c2ff81eb090c7c74ab8c3189216921a9da0cdbdfed45365d3e83ddc27cd0c63f3f5521d874adf62f714d5c74ff73d4
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Ofoq2V6:nPdPyTPdPyfGn
TLSH
T1A1A6AF16BA94C0F2C7B54930456AA776F736B9110B25DBCBD364CA1D2E332D0AD3B236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 3.6MB
SHA256 dc71b087600fb6e765b6af8d90a6ece63fd1083099cf3e4b528cf5f476f46b68
MD5 15634188e6e0746ae610a4966ecf3ef7
SHA1 0b4164c9ae39af8c326e69469b93d5c18054bf8b
SHA512 61e4686ac534442da03ad77eefaac29918a12f76d68d52b3a1d9ea171fe2cec895d0d53f8f95f1a0d191586acd244d493c1252f1e9cd3888c8b4bde05c4c7f77
SSDEEP 49152:jYRw5x6M1vYRw5x6M1yJIUyYRw5x6M1vYRw5x6M1yJIUpk:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1Ok
TLSH
T12D068E12F99180F2C7691D30056AA776EB36EA120B15CBC7D364CA5D6E332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 13.0MB
SHA256 dc0a8cf3478759d5cb0968b894159295bac688f37975d022b459d5337be305c4
MD5 2bcdfa4e317f8fc7f7e37a71cad3ae80
SHA1 5b4649ab190d25eb572126268c2a7b54636eb618
SHA512 d33219c56f510f38e1195d40e3d4598e0222dd10ba485f6fc2de2175f17b5e99142bb734408a433d7d9e23b0082756cc490866659ac6010862d0aa3918bd9274
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O/QRQyX:nPdPyTPdPyOQyiKaUX+PNo
TLSH
T1D4D69D03F2A140F5D26AD9708A7DA3329B35BC064B7097DB5394FAA51E326C07F39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 8.7MB
SHA256 bff128ad53efb07d85a82e1b70c71ca4206f24b31334c264b65240de50d9c998
MD5 007357045e289b23e1cd93416e05f6fa
SHA1 c4d589cbae6544880387bebd1b79e593e297ba5a
SHA512 445c052e2766964b642c80a2c4f06909604726e72bda88cc1bb30313fa9baa4c4b51f4c57a1e497b1d5f442e1837700f0ad8bfbfd95072c2a7b2db074f37098c
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OOthHR9:nPdPyTPdPyOthHf
TLSH
T1E5968E13B5D280F6C66959304B5AA731E7B6BD114F21D7C7C354FA192E332C0AE3A62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 10.4MB
SHA256 1b15ab7dec95b63b2077ee3868e5aa227bf37ebbd40c82ca04a61654278eabb1
MD5 88de5af72a51bde273d0c1c6dbce56cc
SHA1 8ef34ed636cd205ffcf6c086c5fe18361de211e3
SHA512 193d310a76fe9c8484930591c08296c33db754d9ca4866a5ed0f7c94ce68a34d45b04a1ac03bd7cff68fa55390128f5e74eef751f02b6b60f4b6b45ec3c59d4b
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OBy511f:nPdPyTPdPycLIHuWhs
TLSH
T125B6AF13F59540F5C6699930465AA732EB76FD020B25D7CB8350FB192E336D0AF3A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 9.2MB
SHA256 d4a635f452af40b411ece27f741f825303acabe01248adcb5ccb58cf379e403b
MD5 3102e6b42919cb88a6ce32de2f3a9477
SHA1 060fb3dd4b56d9373aa1994e144eb978283e2167
SHA512 4e4cbb00d49afdd178dff05484f743aec9dbde51a26b70734811aadbd66dc366607dab01b75e7a9b1a48f4ffbb60fb6909927421fcc1a09bff6ed60071df7543
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Onu6JmR:nPdPyTPdPyu6Jm0G
TLSH
T1EFA6AF13F59580F6C6695830055AA732EB36FD050B25DBC7D364FB192E336D0AE3A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 8.6MB
SHA256 82a73e2033613ef329b9452e272e329de97d753491a6baa1f94465a62c66d6a7
MD5 0268297ec12b0f82a020106fca959bf6
SHA1 5f757ee0481b9634e5840534e38be921e9235657
SHA512 3be9fcfd9d88811ee6c6676799063be0a1cebaa4a0f7c0cd57898123daf1c544c4796ecd20bdcdfa083682df85bd40811e5b3f237ad8d118055d55f804f25022
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O5mifPf:nPdPyTPdPyZfPf
TLSH
T166969E13F59580F2C7695C30056AA736EB36FD110B15DBC7D364FA592E332D0AE3A22A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 8.8MB
SHA256 eafacf7697da88c2c80020c3567bbf1cc01e7d2e693f141396a345a7f31f5f66
MD5 a29e136e80b53d8937bd51c8754fc585
SHA1 b3ecb3aaa41316db833759f036fbbceb360453dd
SHA512 0cd13dbea75b5dcdf28e2ce6278abb36d4f9d3d6270e26534d9ec9320cb5ae1bc742ddf0a8e9f06b9a3474ca0afaa1da47f8fc9802038091c1ded0de88c0a010
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O65dKCg:nPdPyTPdPyQdKC16
TLSH
T151969E13F59580F2D7695930056AA736EB36BD010B25DBC7C354FA192E336D0AE3A33A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 10.0MB
SHA256 139516fde2f35dfe0733b9ad1a4904d727341cd0ae8706b47846be461a7ed1c4
MD5 8e372eae397b1d06787ea96aa69161ee
SHA1 ed4c5e75e222cc10cc2e86f1ef91725d57d0a0e1
SHA512 bd8ff9d6ee967445b7bda5e08529a8b107ed7f2771af87a6dad47cca232e05e12a13ce73ae5a934ef4db9b1708a5b73faa35a09cc29b806f83c55434e288d24f
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OIm7vjW:nPdPyTPdPyVjnDO
TLSH
T144B6AF13F59580F6C6699830465AA732EB32FD010B25DBC7D354FB192E336D06E3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 8.4MB
SHA256 9721c3880e3e2b2645489f6d89a5eca4ecbdb460b0098b81c807a1c07ab18d2e
MD5 0d974fcb9c952f94dd24d1cca9d6cbf7
SHA1 205f33694e23e2e670313909667d8913a73bc476
SHA512 331aa21490c6b66b467072992bb942abde21838d6467e464a7d686a8abc855d5db8a3069d586d469276437ee5811207687ba8735c0c6a98be7f2e2e5e492675d
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OjX2iw3:nPdPyTPdPy72iw3
TLSH
T110969E13F59180F2C7695D30456AA736EB36BD120B15DBC7D364FA192E332D0AE3623A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 7.0MB
SHA256 1dec2b0640a2ee19d8d65004d2a5be1c6ceab1a8e625f678386bdc470e75602b
MD5 b126f221110e5aff4ab6b3b47da571de
SHA1 73f36222f4cfc60ea7ed206948ce73109b5ab795
SHA512 9e27e8f33cc869ac5a97ac89a49c65080b91c59335c081ab574bc7342bd4e968097094dd7bcf977219611eba57fe93c40687382598ca8306e73fcf1345a853c3
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OC:nPdPyTPdPyC
TLSH
T156768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 7.0MB
SHA256 2f8a9711cb8206a83b37ce78871bf6c262faa322ea596355f79e2ab674452abd
MD5 2d278e9d8fe8a3fb552ca97999d49932
SHA1 fc6cdda04a2035740349993e6756bd96515e8d3e
SHA512 8282c1c154e5fdc1f492b1246b796c9f6deb7f0d244d16cf63ad2407441e22eed7f6bc28d1be9d2fd0182f897bcc38b6fb2f033cc67ac0ac070b8b3c9515ac8f
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oe:nPdPyTPdPye
TLSH
T130768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 7.0MB
SHA256 3353eddd6f87fa69e5bf9ef88d7435c2f67cb97a7467b8ca7332b86671a0c1e1
MD5 72ba1fa8b8d82139bf7811fd6e8d13ab
SHA1 dc0834c2bef5eba7180bf90d7f1eeab64520bf4a
SHA512 72fd23d9522a7f38c7831dbb2e79a737ef676fd8966f566e50e681eb82a131123a2235139c14b58401416c3b9bddee04cd0691387480327a4e3073908b83a089
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O5:nPdPyTPdPy5
TLSH
T1CD768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 7.0MB
SHA256 3a164bcda64c9040009d6160bbd4dff71d21d92c845c04680f994c0cdb40051d
MD5 b3003fd6463644457325fe82216d1ab6
SHA1 5baba92b6fe955a4daef74b8938c54db1f8288e4
SHA512 5eeddbe23bedf76b3dce6c10e450e709407f4e3646fdd0c7131149ca51a5d556d3e9008918a75dc43b5fdbbcfa77918887335e6178433d2fc3b05fbd8f64945c
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OM:nPdPyTPdPyM
TLSH
T1B3768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 7.0MB
SHA256 56182e5986f582fce1d342ceb671bddf2adf6994fdc7b2ec4dd1a11eba31415a
MD5 c1e47467081f60260169ed25107b17d4
SHA1 9119fd8cced94a3a13faa3468c1ec767f94a30a5
SHA512 b5ef2ebce8d69127f9763b86ea39d249aba4d4ddf47f8402e52f7c0514c3de80c0b0e4d361e7a38499c2e6e243a487428f9919bc7c635d8f5fd59c8915287606
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Op:nPdPyTPdPyp
TLSH
T124768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 7.0MB
SHA256 ede735b1c84b94838817dfe32fb141fdd53232ad4788066a08d54af00e66e31b
MD5 4c9c360d0196bae6edc5687565dd0a56
SHA1 36422c947ef90e210279efdf96debebb4ad65caf
SHA512 9f6de4d5a45216afa3ae62b92e6c2ddec37ec4b003d33bdbd1d7ef4f099d7fcaf914b144dca7ace7652d1793dddff0439e71beaac21d3373c6ed5b6a34061dd7
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O2:nPdPyTPdPy2
TLSH
T17D768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 7.0MB
SHA256 3c848d935910057c748ad91cd60dc27dc34a094299a66c80bd341445100eea23
MD5 47a7800f5aba6c4902f567e939f50126
SHA1 4d4823ecb55bcfe00e825fff54c3dd0533aed357
SHA512 fd7c849828de9160c8b09f75035d18ecb79be09c8dfd6f0da3d8a656fbceb2c20608117d2d40d1fee87c079a0735098da521c28ee1576153e3a80d5eed782d2d
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oh:nPdPyTPdPyh
TLSH
T13B768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 7.2MB
SHA256 7583127309cd40b8cac443f961ec336d737f82e1fe96583a8e0b7bf6e5e0c93c
MD5 1817a45b973847920ff71aaa8d395648
SHA1 336bb9c3265bccf3aa7fb9876a06b2750c0d3d56
SHA512 e7dbbb6a1496994a1a05bdbb97990215560c6f2e3ebae26dac8569774ce287cda23e660edf3338c149455947c4a45d306bbe4b116dfa5c55696da0cfc4d1ed79
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OQzfu:nPdPyTPdPyEfu
TLSH
T133769E12F99180F2CB691D30056AA776EB36EA110B15CBC7D364DA1D6E332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 7.0MB
SHA256 1a9bc91dbb8cf24c8270f50623e0c01d26a45a06a8e072c3c442b7daec50d912
MD5 a64fd9ee42bd529e4e83870ba45e3341
SHA1 7032317f9777a3fe5070276b5c29cd17a4b0a179
SHA512 eb4ed22dd246f8a86d6dfede379ce99275908d0a18f1165c0cbbf9d837b8245c1a4301058c9e422a9dda5f0803b624ce6382b12a41954e4a62320d6c7e6ba7e6
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O4:nPdPyTPdPy4
TLSH
T17E768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 7.0MB
SHA256 6904f81f688d5c6636f518e03b67d906a15c9a2081907d54914de9f926e30a5f
MD5 69cca617dce0ead1518f467f2d72b578
SHA1 c13d87478af273e4831397030283f77a3455b548
SHA512 f31cf670324640b88611c7b7adf35d25f8d7ed5c13be80d628837c27ec55d5a90084b0852eb3eaa9c6229064274ca4eba071b3bb7ef22baa7b236e955c075f3e
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Ow:nPdPyTPdPyw
TLSH
T164768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 7.1MB
SHA256 70ef33f4d9fcf102ac088aa6d7f5504030868931bb7dd330312a005d5401e77e
MD5 1b25ccdf3ecc1ab28eb3dc831efd83d2
SHA1 f23384fce86c4802760a3b095fb7bf22b8da54a7
SHA512 6024d5433a63b72481944800958f34f6d1a6a7fa589920e0caf9b09546db35dcc464088980854e205102b34483ca34ee1d33a2c2bfb67380d8c297dceacf6bfe
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O/s:nPdPyTPdPy/s
TLSH
T19E768E13F99180F2C7691D30056AA776EB36EA120B15CBC7D364DA196E332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 7.0MB
SHA256 c68e0aae7b2dcb467bd9c6a93d2cf757a54ec15b3409e25ce8a62fa2e4050845
MD5 00178e3e0709e96b321f20c1b0ba3a99
SHA1 88ec0d7475b765630d630218b48b0aa0825cc4cb
SHA512 d9683dff23db94d8073d94ee94559da40c3c4402071475b6816163fe069bd6cc9d3c5e98062970bb9df5be45db1e3623b9bd35aba35f527fb40dd2a30b59c52a
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O9:nPdPyTPdPy9
TLSH
T195768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 7.0MB
SHA256 6b1c7d9bf588795d024991c6b80a4c06d2d27010a8c0251da63a1ef2412c7aac
MD5 6e3c0ca8f02f31bfbf8bb185804071ad
SHA1 906a25e09e5b17a0b5e50533c733d13da42d6a4e
SHA512 42b2b93aaf4984b39471c5cb6a920f268b34c45f93c56d961676a29d15344f080e81443c70666f94db2c8c4f7bb5a332230e4723c389d479b70e12095539ea65
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OP:nPdPyTPdPyP
TLSH
T156768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 7.1MB
SHA256 adc27d1f2e58975270ed352394a17404a8e066350540eb207cb4c5e6a9e1dc89
MD5 ff26326398425573d2776c7590ef0493
SHA1 192dc3fd80b58a5218d29b0c5bbbaab86a101b3c
SHA512 2cf96503b85a7deacfa4d2539d709fe40fa2eb992a68772dd94486c30b6152601d779708236b5d870eec7a69e76b327d3a3de246b0e461180faf32f11818c6e0
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OST:nPdPyTPdPyST
TLSH
T115768E13F99180F2C7691D30056AA776EB36EA120B15CBC7D364DA196E332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 7.2MB
SHA256 c1f07cb2b1c1b26b0c83c4a0c78fe8c32187ce606e6b41a73cbc095521992825
MD5 d541d1e58877a561950000dae4b24194
SHA1 44e7ad0fda87b84338189f0a6427b28a7d5439f6
SHA512 eca5e119a98e59e138c7f12f76e414338f606fc8a6b4d0315ec07b64abecf31362c0c3c91aca8c193462ffdd19863e2db3db6053ede7c4eec61de2b274b6deaf
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OiLtB:nPdPyTPdPymtB
TLSH
T18F769E12F99180F2CB691D30056AA776EB36EA110B15CBC7D364DA1D6E332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 7.4MB
SHA256 31aa6ad0480dcc7909da62d82f3eb209028300b5a26bfebfe02cb96ad194374e
MD5 15951b7b6de85d3f3077832172befb50
SHA1 365f99aa58d5f8bcf76a09eba0fba8c7030d7718
SHA512 7c9f0c3b4eb7372383ef17ef1405b30e4eb240e56c69390dd1655d9b0d8de07af56c49db4b3d70078876a4013b5f276f8ab22d5a1580a98fc03ea597747ce068
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OwCq6:nPdPyTPdPyxq6
TLSH
T124768E12FA9180F2D7791D30056AA776EB36FA110B15CBC7D364DA196E332C0AD3663B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 7.0MB
SHA256 6064437dce2de3b3028ba1a7c2879bf9019303920bf1b8313e5d16e17ab73b6e
MD5 f9fdc4a62ba0fd5cb19a36f4be42983d
SHA1 702cfc425fecadc0ea16a7d4d3e84f5547186c4d
SHA512 6f6a815c76e37cb4e3ac75d1c36d6cc8789b0defe8cc0c5a2083c95d5bc6714878e1293d3e1ce5b69893c53fe9ef974160b8e97155a5d2aac04964cbf3a0311d
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Ou:nPdPyTPdPyu
TLSH
T183768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 7.0MB
SHA256 4c54f7a6366689b11dfdc03018b5c2e2db8f88311ad84bf251b5d0803b87a5cc
MD5 01761a6d6103113d74e83954fe5ac4d7
SHA1 5e9df045c609873299b8978204dabf8f8b2d1f65
SHA512 40d60c3c975c6b74a5635e5158ce76ea54b869257aff6144a3188a96c4ef3750286d6ba032b6c06c9b05338cf4638c8dd0579b871286aa5ad041e8ccfdc5b052
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OD:nPdPyTPdPyD
TLSH
T11C768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 7.0MB
SHA256 f90e7af8eafe1ef2a898b3c2f92054702fbfcacc02035ad3cc5730469a9aa02b
MD5 75606cdefc440857a5d5538731d814f5
SHA1 dac4c03d14f74574f686dbf414425c9ca574dc60
SHA512 08359fab7bbd9712ed9222bd9ce645b4ac6511c51bbe129ddd70672dbccbf69825201ba89036560bb60843bb2d2087781753fe5d89831e27b334dcaed9087c7a
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OB:nPdPyTPdPyB
TLSH
T1F1768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 7.0MB
SHA256 0127c2bddec33e86cf069cb1fbfbbde41c8a759ffba2bd25df16e67d01f1b402
MD5 66de19be10939a49e99612c7eb143850
SHA1 3f2b53b4d9394634038fc6098e2fd2ae68720c16
SHA512 4713c8303d33871606a43f490a41b8a239af33c36ee026f4cdc361b85705ac6e2f522801d284a04fd455be095a93595b72acbec51a8a2ccd56127414a0ab6165
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oa:nPdPyTPdPya
TLSH
T15B768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 7.0MB
SHA256 7209be880c543dbd8d6f6b72151169e8eb374617a7ffd8e0e582dfb189fe366e
MD5 95be0c421b43ab703a5b75079a8965a8
SHA1 a1331ca67df5139fd9990c587693bb73ed716ee4
SHA512 414754f430799526ab3b3eeead8b74043a3182d2d38fa1cbf75fc0409f7b5c61d9f9065a8a0569e93139b63af7ee95f47837cc380378938baee54c8e3ca2a20e
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Og:nPdPyTPdPyg
TLSH
T1A9768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 7.0MB
SHA256 9c30a07f69da9263c0c06cb52cb2bbfa66581b0e22198401597fcea143319a89
MD5 f62db1a48d259cc699692fd8531c049e
SHA1 8ab88fb56ce93cebcac73f6c6ba7b87d1a49103e
SHA512 10ee21c60c374cdde270dda8339490fdbbf296d0fdeb0631e152ccffaec14c706173bbe416daec61ac203a76fae326d5cfad9052dc6cbca9193dba13defd8195
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O0:nPdPyTPdPy0
TLSH
T17C768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 7.0MB
SHA256 f7b2c2b0f15dbe71f0f95beb8738b38c8214ab9ecb992066d4366c51b1fc7a0e
MD5 0a6a5e3c0782b66f4c04bef86423817b
SHA1 2e25feab33cebf3af710b7b498289c3ef4d3678b
SHA512 9effdf0ee32f60646f33f0d46aa7d12f85111a925821491d64b4bd28b22317b3a2a6a27407b7d6af35e975d581d4baaab8ad8b1381048c5312847d0665d7a6e3
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OJ:nPdPyTPdPyJ
TLSH
T176768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 7.0MB
SHA256 4beac9d76ea70ba68c53ba50f190ba73d14271f340afe84eab4083919a97f728
MD5 42afba9ffc57b14c5f2b72b3f552a7d2
SHA1 464f6b09fe0cd92f44d3c2f80e4f28e20559c319
SHA512 d385669cda539a56fb0c416e76a18f185943b42794f5b0b5e7a95caa68d88a061f8321af47f425b791c3e308841909bcd7a3fdf677b1486f11f412bf0fdd8651
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O9:nPdPyTPdPy9
TLSH
T1C1768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 7.0MB
SHA256 6fa8b468aa9d8fdced4085e830bbfb273003934126cf9d674767a5a4739ec08b
MD5 3f4e33b5296c321a1aaa0b7cecbde247
SHA1 aebf775b6ad1b8dfc5f26bebaa9ffa30caf6ff2c
SHA512 e9871f2317c934409ad2d39217a1a1d516407b67e7012d77a5f9890e10853511627d04dc81145a0e340b24d3e0eafb0aed9ac156628bebc3e654610719dc20cd
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OC:nPdPyTPdPyC
TLSH
T108768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 7.0MB
SHA256 7da4752b94da38b829e7a83942d416eb87ebba42080486724818d9c3ec81a879
MD5 bbdd6a8dffc18383dea197024884d6a1
SHA1 2eebcef73339e0342669acd4b251571c89bb63fa
SHA512 01fee71fb43c6c3604d5ba808cdee367f4216f26060eb1daa6a5b7a2aff891812af88dd38d86aa9ec88395b79f153b6548b9f3dbd202e1f78146ecc322e54505
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oz:nPdPyTPdPyz
TLSH
T1B5768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 7.0MB
SHA256 8465dfdd66281709248b0f3845431b4633c0ca4b9c7f744e6cf88877025c9f8f
MD5 06dffe87f22e2083cb295be2ef6f11ab
SHA1 f56ce3ea828ff2825a31089894bf3c791805fe2f
SHA512 90514d7b9232d1b37a28f9e5a2b3485badb5709946682546198b3d2c638925283509e138cf2b1cbb20b21b1bdfbcd9cd4053d129e84d07ba4ac1f5d8fcf349e2
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Or:nPdPyTPdPyr
TLSH
T15C768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 7.0MB
SHA256 4aa73eaeca14fbc838a3125e6ed8970cc63e6615d633b4468ff070baa4aa62fd
MD5 086f6819ca93498dfc6bdbdc8a449aeb
SHA1 27b504102f48faa8ee22e0953e4c76807c4000f6
SHA512 e04b78e971e05a8e9d09f20031506586813e876d8efb26d6506247dbbb316f99a9d8422fc7cf96d82c5129252ec394636b9efe33690ee4c5f78ac9398c2ec6fb
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Ob:nPdPyTPdPyb
TLSH
T1B5768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 7.0MB
SHA256 3d576722734ff9257e1a4d4c87636126598696ab801cc1dff4b89fcd6c044906
MD5 220445598830ddf770c9110cb88235ed
SHA1 6ea5d09fb2994ab6d51f640f763b171d99861134
SHA512 b4abda781f538eb566dfb7e5fa2eda9d5a145a3e25f4ecc945bfaf4ce235b48dc74825e02124addd17970b834e1e3ff8d3b67c13861cae38ed296f43a2ff7e77
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OW:nPdPyTPdPyW
TLSH
T14F768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 7.0MB
SHA256 5fbf5478564ad501f31b8d21c23659aacf076d30777874e88462b4ade2ec46be
MD5 da1ca6fefe39567173d3c63d09ae3a15
SHA1 fe7c3b24972a2dc2ee9f025a211028dff418bcb8
SHA512 1d9788143ae906505dbbdec1c9cc0dbe0cef39c5b9ab15586fd5d13dbccdf0e388c8d790807d4ce794a9f16839232b45948d94dc8749d8a13b24a4cca7bf5f2c
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Or:nPdPyTPdPyr
TLSH
T10E768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 7.0MB
SHA256 8a5edfff2a1b16c4898d8e66c2e18996f1dcdc0ce6cbc3edb9c031a895aacba5
MD5 ff5e389a578a030444626295c282da57
SHA1 2785afb99b7a585c513c270ffd3a85d8ee007abc
SHA512 d483418e1d4effe278b1e822348bf6c5e0f93567ab0fd19ea3f39a07a49516e9dc65266ca0e6f1b1017372462d60084a2d0f03efb9bebde9ae6e945c3efa876a
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oe:nPdPyTPdPye
TLSH
T153768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 7.0MB
SHA256 5fd068104ef9ae7870289ef42480704329ab5df14657665abba3b951eb210f11
MD5 aabec6e16915b3320351abf95bcd216c
SHA1 7349d645338c5d222653a16c6d0edd521a0404dc
SHA512 ce10b5c39f176b800eae8252ea963d94eb2a76c7503757c5dfe9445d2c3c761e592e60c358ad7f987fd208cc78f6fb6eb06ad9c91baa756429d0bae7468891f0
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Og:nPdPyTPdPyg
TLSH
T16D768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 7.0MB
SHA256 d16309d46caf8f19529a613edc8640a320b0c7c0894610b5725bcb7953e81b4d
MD5 3503d170cfbe70ecf257b1afb21766fa
SHA1 1da8edd84d681759fe1fabd13eb62da0ac1cbe42
SHA512 052e9a0841bbd8c934e413717ea9a26f98a14c029269570a130dff13f217a007b0e4b9d71db02bf5e9e99f3eb861675d76c1a82e83bacc81355376fe9f8d1f7e
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oy:nPdPyTPdPyy
TLSH
T166768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 7.0MB
SHA256 13597cc1d1e54023c7f389b1b5afd2454349a4c693cdce9f92f59de7eb7ac656
MD5 8855658e0c94ff5f7353787acec5229d
SHA1 1da3525cd5a0ff8e4648b6d474065dca5fe2d7c7
SHA512 fdf85a948d3c168acae1dfb62be9d2d80a3f8adfc2520a76efae2c201ea5767ca6dac49aa1d69ea1c5bc3941921c0ad5569c7667b9136e8ff11b10d360cc341c
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OA:nPdPyTPdPyA
TLSH
T15D768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 7.0MB
SHA256 b720765543533ad30f8562d9509f2047b927e677df93d0dc0536f03b58fe6678
MD5 3fc87feb740b105c6fa754e18c88f790
SHA1 f7d961874904736acbca3fc101004cb66a92a6e8
SHA512 3125da7d98f50817b094db42e9c6d8063db10233a8f5d75608b3cf2d4bf11fbf5e840c9298b4d93cf3190b6386e1bb55ca97821880eb1c59f1e386e8d2672df6
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oj:nPdPyTPdPyj
TLSH
T1BD768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 7.0MB
SHA256 43309c4b77ce8e42cf7b2b6e415abe721e8491225275238c2491cb78f0b67a09
MD5 a9490a80f6ad14ecd9dad619c870564e
SHA1 1593eb1f741d535cc27cb696040b770b120b4f7e
SHA512 5f8b4bb8f50581e32eca03d709363a9d3a9b6f9263b69b5aa78ed7fbf2d2168b858d6d10cf7b132249405e9030d66748456fc250a3cd6e29454fd3d1401d7f74
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Ou:nPdPyTPdPyu
TLSH
T159768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 7.0MB
SHA256 41f3bf951521eb37d8c248f8e7da0d07b667d4da5306e39ea00bdecc12a2ce28
MD5 219059be7dd69ddbe83af061f8c29846
SHA1 0726afcad977f05210e165d132c2eeffe9c707a7
SHA512 38684ed2369a780eb4aa07cd8f7946ca72b3c14b442d5f43e2035aba551a12ca6599dc3b43141e48d7827a45a4893da70dd08ec23f3f66a63fb3e930f95d879e
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1ON:nPdPyTPdPyN
TLSH
T191768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 7.0MB
SHA256 0613f8ecf27ca1785690fab4d365465f5b11bc723c9c528fdd69076521912f2b
MD5 26a51c64595462b0779febd0378a15f3
SHA1 ea52b834017e2238281d7cd7605a74772eba6d31
SHA512 9070159c8ce2cfe2d41998040012afe594e1d913393d22ded53273148764a9a5031e6ab507dd0fd01416b5a19f2ba4c2378a0e35afea6c20d45f677885860358
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oo:nPdPyTPdPyo
TLSH
T1A7768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 7.0MB
SHA256 90e359caa81e6f4e291c9338b585be70cda611244c6e9e0c33b064f96d4ec661
MD5 6af45316af1eece31e944d2c0afd910d
SHA1 e233daff45dd2e59c53da2cd6b71ec933be5e033
SHA512 b8fc2136fac475a06025f7e5e5f1694cead6388c19467c5a9a7af77afe2863954910e48de34e6a844c4620c61774568414cebe90b3dd578bdb8b5ad9bf0e1455
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Oi:nPdPyTPdPyi
TLSH
T1DB768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 7.0MB
SHA256 1f5e483690817a112de8e2c521f2cf7190a36eb309e5f5f2701e6583d10c76d4
MD5 3f1b6418834e3a1666f9c63387d1cf3a
SHA1 a98f7fee53d02818e3b86cbdf30a7bca8a013151
SHA512 c0f82b4d80ba08b46d8630225bc0f7027ebf9b870abc5976d08129ff3d5ff3f723001ba58f32d0367e1a2ed70f07232633765a4a0fe0d5917afc3a5a9c67bb5a
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Om:nPdPyTPdPym
TLSH
T160768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 7.0MB
SHA256 60f6ce3956d503451cb7983ca428610fe67147950fe15092a0697a0838dfe462
MD5 b42a451eee3b192279a2ad036c2ddcbc
SHA1 8b2287723800833e141e0a1367f054e76e9dc24f
SHA512 f2d504981b32e175539f16ddbb154176783dbe930dde93525c4e82c517a47077f068fde71a1937fad75ca6c9acfad91200ea3636d7c2d19c2da553e4fc419841
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1Ov:nPdPyTPdPyv
TLSH
T1EC768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 7.0MB
SHA256 5e41a9df58a817676d64a37e5f99d336926e21493360b4e01da903bdb31200b1
MD5 1658823ab3625333440483da6a421814
SHA1 ada51bf884214e986bff99d1c1c7f85610e8939d
SHA512 0b8d97a7c30511b752dce3377e84da0b14fedfb21d024f8bf9d7a174f2eba9c1875d3f5f2d58a11e198d3993b37529b77668ed4c5bfba654271ab9080dd6b236
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OZ:nPdPyTPdPyZ
TLSH
T131768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 7.1MB
SHA256 cc87e54db633611805dbc1e19a75df08ee6bdbe3ba3fbb9003aa051db004c01d
MD5 e6d742dfbb1c0b436460fe4ae1c23c0b
SHA1 c56e336364b1e5e5922c1a8a7361ff94c3585049
SHA512 763427e5c9faf2736ef09c578922a4b6d95d960b8b98e31305f7224b6c5ef11c6eac1c4e4da96345b48431c06d36a4a50b536155987cca65db934d122033d741
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O2:nPdPyTPdPy2
TLSH
T1C1768E12F99180F2C7691D30456AA776EB37EA110B15CBC7D3A4DA2D6E331C0AD3627B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 7.0MB
SHA256 4829590259bc50aacb969f9d751d819ac2606a6013b6bfd6dff4f30cc350d952
MD5 0ecd82c0f516abb25485b2c871e1b6a8
SHA1 d16d897f62196ce8a0500756a6cc9a1ddcbdd06c
SHA512 20ce1d6963aed85c51eb44639b3bf4305a35df40ee65a35638c2e51e1854034906d6fd2f7563eaee6cca5b70fcfb9add54c1184770373abd1c99ffac12f8bd8d
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1OO:nPdPyTPdPyO
TLSH
T19A768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 7.0MB
SHA256 a39bf3fdf9d29acc6119cd83e46517f98032ecce7d0f32d69e8ac4c3fc563089
MD5 d61c2939cf5910b06259f0a6054a4280
SHA1 35cb552de3474c159068c0529d2dd027fb77becc
SHA512 da48bc548abf7f164ccfd0b3020c05302f75cf6eb6bb86aabb4b16a1e7762de349af8748ac56942fe4e0d8ca226f872d1d65bf0eb65bb32edb184e5da9b570fc
SSDEEP 98304:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OAu5x6M1wu5x6M1Ku5x6M1wu5x6M1O+j:nPdPyTPdPy+j
TLSH
T117768E12F99180F2CB691D30056AB776EB36EA120B15CBC7D364DA196D332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 3.5MB
SHA256 050d17e7b38113dd2e3c96a60372e67741f270411503f4b95f3645fc05380391
MD5 fffb5c6194f07523ad4b9e8f9bc88c93
SHA1 6eee9d4fa9161f7c3c1ddea1a8e76cb3f491453b
SHA512 0ac7d6f6e4398399d57d6671281c504c851eb9f3e41fd1923a337817e335c1b69287d6f9920cca8d505e2a43985e262b828b30619972318645b24509696f0638
SSDEEP 49152:jYRw5x6M1vYRw5x6M1yJIUyYRw5x6M1vYRw5x6M1yJIUpkD:Uu5x6M1wu5x6M1Ku5x6M1wu5x6M1OkD
TLSH
T149068E12F99180F2C7691D30056AB776EB36EA120B15CBC7D364DA196E332C0AD3767B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
MD5 2510ff22aab74c2ba735738716005a2f
SHA1 306d676ad05de19254b82e221f183ff918e4902b
SHA512 b06c9137817610963efc14c36895253ac8c2eb5af5c9c5e3bdfa59fef8050d9827e4d250b571051c52d7141b4d69702cb0e23a14a114c3e163b1b5bdb2911f1f
TLSH
T1BEF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4540AE6C3E3B3002F494BC
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2824-480-0x000001CBD3100000-0x000001CBD3120000-memory.dmp

Download

memory/2824-508-0x000001CBE3B10000-0x000001CBE3B30000-memory.dmp

Download

memory/2824-494-0x000001CBD3500000-0x000001CBD3520000-memory.dmp

Download

memory/2824-482-0x000001CBE3590000-0x000001CBE3690000-memory.dmp

Download

memory/2824-462-0x000001C3CE930000-0x000001C3CEA30000-memory.dmp

Download