71dfcbd909f323b2b2b35b424f796a0668a4ae61abcdd6c531f225267493f624

Analysis

max time kernel
57s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Size 10.4MB
Sample260702-wycafagy6m
SHA256 71dfcbd909f323b2b2b35b424f796a0668a4ae61abcdd6c531f225267493f624
MD5 1332ea2d2468273ef2933e85d35d1c5b
SHA1 90cb34be32f35a3959e2110bd6d9501ce5c1fca0
SHA512 d77d706f09ce3a70bf77117781051ef2b2f2a9deca39647ff2ff744e08d88509d160fa8ba2ac487f29b771d2b9581aee4b884acd528461f78a97bb6e53e27150
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnmd+YPppCpU2hyu5x6M1pLapIkJ:JtcIkGnk2VhptcIkJ
TLSH
T177B66C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{D9AB36A0-33AF-42FA-BB57-6B6884FDA271}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{01E2B852-CC4D-4417-9FAA-F514DD2FDCA1}	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe
Token: SeShutdownPrivilege	2412	explorer.exe
Token: SeCreatePagefilePrivilege	2412	explorer.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2864	sihost.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6052	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
6092	2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4928	StartMenuExperienceHost.exe
2412	explorer.exe
5848	SearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2412	2864	sihost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6052

C:\Users\Admin\AppData\Local\Temp\2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6092

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2412

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4928

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 10.9MB
SHA256 4edae8470a86a87ba38a691123f04c971dc002ce3b7e4bbfad85fbce8fc9feb7
MD5 bebe5f702d6b160a4d53c4b30b9359d4
SHA1 a18c27eb30a119a931b798897c5b946b4c8f2070
SHA512 5dd0ce7d601906ffe024ec0a02165437526301738a8b555f0faa93a249312557705d36ba85705d327c2bc761de886a228deef63e3239ad7cbb61b9e463d19259
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnmd+YPppCpU2hyu5x6M1pLapIkfjo:JtcIkGnk2VhptcIkro
TLSH
T1D1B67C26B1E140A5C199C034CF468732E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 11.3MB
SHA256 3494167336a4b4e7368b8a9cdeda40af0242b7bd735d4f0b0986286e71d391df
MD5 9e689e3c62dd8da1587262caacee8c43
SHA1 bf21674fbc28f7328de1433afd61a10b23b48ddf
SHA512 9cae202e6d93c6f12c0eafaf7e5ddd62e184235912a019819b82c9307eaafb71ec8c08c2f6cc3a2fa842e858a5b3bc17180de2cd4d4c4d28f392e79fade4739a
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnmd+YPppCpU2hyu5x6M1pLapIkYezSC6v2XMH:JtcIkGnk2VhptcIkP
TLSH
T1A0C67C22B1E540A5C1A9C074CF469632E7F17C598BF097EB6241B7C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 11.1MB
SHA256 18deb11afe84cfde40ed0c108645b9f7fc58b2d1808a97199e592bb560c3cbf1
MD5 babe100025df6b2ac874189b5f43a4c3
SHA1 409bfa74109f069e1a4f07fdbf698febdde4961f
SHA512 8a4257de38e03d89f1aa211bcd66be0bb812e8c46b51b0f8b5a7e49d1c12c9c6268d2483c8c0cd308c2cb22a6ffaa2bb225258e2b453789fed4f2c91436ffd7d
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnmd+YPppCpU2hyu5x6M1pLapIkc/h1+:JtcIkGnk2VhptcIkc/h1+
TLSH
T159C66B26B1E140A5C19AC034CF468632E7F17C598BF197EB6251B6C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 20.8MB
SHA256 f851abb8212e357055a753dee61d9f280dd635f1702932a6d2823167cb10f5c4
MD5 b90a22184357fe183e8368ba19280c07
SHA1 9c12e3b1707f7d4b56b36b1dd28d6630792a747b
SHA512 2cf59598dc46d0a07080271e60e3a7c98e8943e74334c256e0461fad43c6bb3c603619682cb8a17e9802dec14dae97b2fc798f4be7a0af43b9f10f6bfe830fc9
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk:I5Gkea5e5Gkea5
TLSH
T166276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 21.0MB
SHA256 240690e95d2850611923b4d8c6f15910aeb82e440501fbaa626100199280e944
MD5 83ca3fdca4b5efdd5fc957b664be643f
SHA1 f6a56cd1bca957d9b57f9b961f3efc3e00402ff8
SHA512 2595a24898f0a963bd08d969a13b0cdce403a1a2a34982b4451c228d7b0dfa7d087224f0a28df9d41159d2f9e915dc8b424702246e07ddf5cbf2d499836aacac
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkd:I5Gkea5e5Gkea5d
TLSH
T1D3276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 20.8MB
SHA256 5b753576c0ab36d20d6713249315607cef72ad78f07634e1b2e643d256944968
MD5 25ff1bc5877298ed85442c848e1804a0
SHA1 7e053f990c873a9f1e8d2d7b347b1be5016580ad
SHA512 c4c2aed366ff5b25574e5cf2b020ce3e204caf41dd74808cea06cb11eef627d1c16811bd7bfe75dd9a875b6f704eb1db9bd0d97db3bef274036d9dd628770529
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkab:I5Gkea5e5Gkea5k
TLSH
T13D276C26B1E140A5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 24.8MB
SHA256 4d09dc01c1ce006db55648d1362d0a9460ef2d9e98ba1943a478b09435a23ee4
MD5 41621d3c96bc9f8aa5009299cb4862d8
SHA1 aaa859c69d82e15fa8996f3bd8793e8576e06811
SHA512 9a179444787b76cafa8e4eca31d0f14934b322e5eff678aeae87a44f0c99a46d5bd880bb9f13de8c6d97ad951cb45eca8b9789bd355cd95f238630029424311d
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkMvyEYc/b3w8O:I5Gkea5e5Gkea5MvyEYKbi
TLSH
T11A476C12B2E540E5C19AC034CF568632E7B17C194BF197EB6251B6CA2F33AD07E3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 21.1MB
SHA256 363db96f12a644da3505fd13811066ee0c5d31a14694f015eb299bd010f0988b
MD5 94a760af206b376bb814d0c2c5a731a5
SHA1 e8031516ba02c137c2a3adcd5123491ceb91964f
SHA512 82044b41668398d0d20df8a2a771f2742bc1c2468a444aa3e2030cf8aaed53cb6e133b1a1b599cbd9879bc844984872bfcb0bfdcd9d221af0b03e2faebb6b691
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkI:I5Gkea5e5Gkea5I
TLSH
T10C276C26B1E140A5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 44.2MB
SHA256 cef0358c9aa18a5cbeca2f2c15d563ffc07ec587947e18836241b75984cfe1d9
MD5 23661cb0f5eec7f2f8d7809fb2005be0
SHA1 8b081f4a43b856ea349997c88640bd5deda70648
SHA512 8ae538b862443816f5f925cf4b1cd5467bfbc137442b2bae1fde5ea550b956945270aff9cbc373a703363773a130e1e23c41241db34fc541bc5d586358772885
SSDEEP 393216:I5Gkea5e5Gkea5VUEtQevvqc2W1cpV2XI32i:I4RaQ4RacE8c23pV2X+T
TLSH
T118A75A52B6E443E2D3AA9534CA728272E7B17C1D5FB193BB5135B28E1E335D03E39221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 22.9MB
SHA256 086514a3b0b0dcd44023c7efb0a900dcfc6457c00ba8848f54509945ba565859
MD5 09628fc87f6fe8cd7528502f42bed2ae
SHA1 9fd6f77d3812a37ae968741c47ab0ed49be6b941
SHA512 c2d1159598b568e330a8e3034a664708dc8428eb39709d9b646fcf4eeaeb261c05f527fa11411f27b039fb148403e57491adf7a60d753e6c866afec2d443591a
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk5Gn:I5Gkea5e5Gkea55G
TLSH
T118377C16B2E440E5C199C134CF568632E3F17C198BF197EB6251B6CA2F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 20.8MB
SHA256 e501e90571b60ac19116af6d193c229754bd03e029cc44461a0528987db0b524
MD5 1007b63f439bd4440c6d69334c80e957
SHA1 2321367a1fb29e5f5b85bec1ff819b084b5df5a4
SHA512 4f07370808156c8946d0b959a724968818f02770b07a7635a07344cc4fd963e87a75a12164d10c1e41f226ef0d85c65b1fa73659de5a295fc8bf6d034b45e353
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIke:I5Gkea5e5Gkea5e
TLSH
T161276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 26.8MB
SHA256 1169a87e1686a22a4c96b5a8119a53dce9f475c2ca2dba9c1fbf221924f5295c
MD5 a18737366afd530fad013e1f66af3082
SHA1 661c3182a36d00c05a6a34750dc34757e5c0362d
SHA512 63f495c41d6953d4db82669e64816f51667a461f9c93851268b3d6dc7670cd9b166a7f8303047393a3e3b74e65956767133c9c1dc47125290c8d346ed30e9ea9
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkEQyiKaUX+PNo:I5Gkea5e5Gkea5EQsas+PS
TLSH
T113576B13B2E140A9D19AC174CF568632E7B17C598BF093EB6254B6D92F33AD03B39712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 22.5MB
SHA256 1d63d5fb997b18ff7687a4a7a44c4bed3131c1b6748386273cc4c7a2a32a6e16
MD5 aad6ae9bc2ce80654cb7929e625c59f7
SHA1 12d9e036d476936667b076ed3a05382f8f1c5e30
SHA512 2b93b5cb77e58619f377bac551dc29d2b0e9838a26ae500434487600ca54bae9aefe316c199f09f531f23cad6fcd483ff002393024871c520d161616f979367c
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkEthHf:I5Gkea5e5Gkea5Q/
TLSH
T1E9376B22B1E140A5C199C035CF468632E7E17C698FF197EB6251B6C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 24.2MB
SHA256 a27f68dfe0f7cfeefbfecb05d663e6a09ed3ccb4a621864bef9079264e511203
MD5 d4587f6c1ee1848830d60e45cec7a85a
SHA1 9b9e75127b6ad0c09abc28049f667e1570dbc4ed
SHA512 c0bd74eb8d6b5364ac9b15d6206df1ce1253f2a658ce13ff2cf801dcd836d012b556bf108fc9a750a665e292c844059263e5844339ce64f076bd816f93fe6a9a
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkmLIHuWhs:I5Gkea5e5Gkea5m+6
TLSH
T18A476B13B2E540E5C199C134CF468232E7A17C598BF197EB6251B6CA2F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 23.0MB
SHA256 d30251b79e1c010546d5f027a121ab1901864a0af2d1bcf7cfeda82fc8b03333
MD5 c828f17f7a5a8b662f5a608a371f4678
SHA1 6c802c567b2858dd8d922d1c46675f863627d263
SHA512 959a1656080f135c7089bcedc498b4c7f4146be15a0f455b07d6f14de9335eb8d3d2fb324a498f325663d8feffeb8dab57412ea526782d7043e3f38a747187fb
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk46Jm0G:I5Gkea5e5Gkea54l0G
TLSH
T1AE376B22B1E540E5C199C034CF468632E7E17C698BF197EB6251B6C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 22.4MB
SHA256 578400edfd98b29212cfd2d6210258239cc47cc08b391b5e6e8590dcdd68e5f9
MD5 c08f48a6296ddb99750fa25f5a336b0a
SHA1 37e951a20331d1f1654603de5e95a8998fef23fa
SHA512 09c6b53419d102c430b477dc7a38bd05ad31fcc00c287e192c23d77f20f4b3ceade27fdbc29cb5140936567ca867eaf6063febc6f345da9671a0456579c80825
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkXfPf:I5Gkea5e5Gkea5Hf
TLSH
T17F376B22B1E140E5C199C134CF468632E7E17C698BF197EB6251B6C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 22.6MB
SHA256 c47b6539e73fa8af78d4548392c65a8bc704d9bced760a9a854c0a23ca40a430
MD5 7460826bf8449dab3bcd3782aaf3e589
SHA1 a852f362c578d3d6e97394a6f083924e9bb32a15
SHA512 1c47f11b77f34eff450de8158c7c88fda3b20b50882a6309a19f8e90ccfe179fb3aecdf015636b37e18ff5a334b6b4fa9906dd19eac8fcfd850eaa75c06fe213
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkadKC16:I5Gkea5e5Gkea5JC16
TLSH
T1D0376B12B2E140A5C199C034CF568632E7F17C698BF197EB6251B6C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 23.8MB
SHA256 aff6f069a7da8c093f70a37588664072c5f3b07209b1378e261a9845c850c6f6
MD5 80d39442e9bff59589168e0dbadb829f
SHA1 f469d19daefb9e3f387eda6d709763adba8e1639
SHA512 ea6e04b7dd75ab14cfd8302ea36936ea4a99a8b99cfbac6e799aa4fa9b77cbf705885732c011e552fd70a5adb1a5e48bc153bbaff1afdfd7a90ec3aa8ad5fe1d
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkbjnDO:I5Gkea5e5Gkea5bO
TLSH
T1B8476B13B2E540E5C199C034CF468632E7A17C598BF197EB6251B6CA2F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 22.2MB
SHA256 4c8a2bfe93c0f406849215efd0e76195be60ee1687275bd3b2caff67aa994033
MD5 f5edbd95d146dc0683264b742df7004f
SHA1 134952f2c76e60be9e9804a276d8268cb7f430fd
SHA512 b335fec898992c51a8e2b06a1c1f9ea89072d6f75e22ad5a17c2a8c258e2f7f4ebee12a00b9d68fcee1feca262f54bc5a40df574e63652f79bc20110b60378d1
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkl2iw3:I5Gkea5e5Gkea5b0
TLSH
T160376B26B1E140E5C199C034CF468632E7E17C698BF197EB6251B6C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 20.8MB
SHA256 9c1020c96bac6e778b89b80eb6b7c339531498d365b83ff9a16b7570086d73ba
MD5 7d96fec90bd6a9ecc128be4e7dac79a3
SHA1 c5c47cbf4f28f51f90de15dfcd03f663205156c2
SHA512 3d33a6b4252d71545d22f20084655142ff61b6b79e77564748a3065d0cff0950fefdf20b0adf7937a013562c4b9e431aaf8d147705126e50b2fc53f6af593af4
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk0:I5Gkea5e5Gkea50
TLSH
T185276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 20.8MB
SHA256 78a826e0c78ae25d2eb8bb93f3260750d0d11c98895fa22eb6b1e1c4cd0b7ea5
MD5 0daf9dc32c11fa907184a612590be2d7
SHA1 92dc29ca65981d5c3b05f2b935520d0735aa576c
SHA512 b641c1ed3c95f486c823d1233d7311885817c5da935fa687f99f18d6ffdbc9d3b391b201492c8db0b311e78d3f2e20909df581734fe3e7f4d4bdc2b3c27251e5
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkc:I5Gkea5e5Gkea5c
TLSH
T1C7276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 20.8MB
SHA256 e5fbef5d786678032b87373916eeeca43691b8e06b43c73720d06a29551f34c7
MD5 f55942bcf12d3c9edc90887571f3731f
SHA1 2b4ea7bbe15fa1191438836180acb18bd229710e
SHA512 76431da000b9da4a4c78e1120852ed1b7aae6c435089a0639427df33a0e7f3e0d1377d9c0cc284ffd568bf8ae4c13b581d9531e734d9c0e3fd86bef2c72b64e3
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkP:I5Gkea5e5Gkea5P
TLSH
T1E3276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 10.4MB
SHA256 36fb0aec8a3d6d4dd730a244297f9a9cd6ce1d31302571d0aca12f0f2cbd8159
MD5 dfc944dd1ff0ec08643108bea32dd903
SHA1 a726c1660e8bc39d25f3470bae0312788f9c5324
SHA512 0b06bd03eb704da4de8ec35f261b4426c3d6466f9e0cee9f85544d4d8e7ce77fd1b02c91520cb7fc2c7bffaa03a8806159172938793d4c4fbb7db77164a65585
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnmd+YPppCpU2hyu5x6M1pLapIk+:JtcIkGnk2VhptcIk+
TLSH
T173B66C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 20.8MB
SHA256 fea91fe622a1f79524e32ee0f5a59aec8343923abc3a423d43fe0947f7013fb8
MD5 5a8993aa26770e6dff37e72774cc3ee3
SHA1 6fde0b534b4bf9e4b4773c7fb33eb74dad4e3e60
SHA512 0a101f008eeea85506ddfd76da5dd8facd2bfe211bdad002181afe4ff12c9bdeb80fff70f61383d6b2e1af0ea0dd2c24175739bb565846dacccb91eebd548817
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkE:I5Gkea5e5Gkea5E
TLSH
T1C0276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 20.8MB
SHA256 798ae1d8c122ccb8341cc94d4958e456fc0bf4d47dc61d8f9c935c0d270bf6b0
MD5 d3ee78c8ca0f3232037271c3fa1187d2
SHA1 0deec328cfb41de75c597be5238ac45f389ba4b5
SHA512 4c65803d58f74e3f2d39755d62d139d9134aafa04d102504e66c0265f3a5bc6fae83d34d6a6a4af308d987fce3da8397896fdb9bbb3bd5457fc901b2eef1acc7
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkf:I5Gkea5e5Gkea5f
TLSH
T159276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 21.0MB
SHA256 7f0e48c5a5f6faf5c3dd0185d0d1d6a9f8db0baec3c04e644cf1f33dc5b91396
MD5 56e3b63283e5bbb38da241833f87e80e
SHA1 cce87609c5237cc83756901e8a16695ac075d5da
SHA512 19e60989a0a68b00cd7f1d515271aaeb98afae0c00d4f4f97e8623f2d2b6ec975accf47b2e75d304798d409603d80585c6c279a78d078d68bb9f75a0a74c5a91
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkufu:I5Gkea5e5Gkea5um
TLSH
T137276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 20.8MB
SHA256 90ba76e8ec0ee5d9090341a66897770897cc80c5da315fcf48b60e4d5c24426e
MD5 d7367001784183b82012297f6d38966e
SHA1 ee1c46c6f97f38da3685f3df967459a2d88c9c3b
SHA512 124b7266c609e13836deac336b107f019ccb7c349d4a25da5afaeb68a24cf5e63567f1a715f16a2c21c4afc2516c75f454fee5c2e52871a10f7c5ddde5c5dc60
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkC:I5Gkea5e5Gkea5C
TLSH
T134276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 20.8MB
SHA256 419c07a5c92c89347f81ffb4a28a2e167d1a88d8a32e789833066f2089c9afe3
MD5 b3ee3bbbe0d85a4a2dd8305d7edf0aff
SHA1 8595c44a3172ea349b3d828454768da7b0d4caa6
SHA512 a648a9770e918a48268481ee3e0cc577b91bb665f778be8f31019c65f5e6176d12e9d4c904bcfe24c95842ab97f7e01405ea4f51d21fd06bc24a78d4c380ee28
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk+:I5Gkea5e5Gkea5+
TLSH
T12E276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 20.9MB
SHA256 e031bd0aa69a6808c4967ad1e1293cf0378083ce7d4e70aba0bda1691080b550
MD5 3aad97c6056922336069763978c3389d
SHA1 a0d311bd1179b3f050357c545715ea523975bc28
SHA512 33ad28b931ad2a6885e7667050cb26ddd96f67b712d2e86d4fc176bb375608927126869b1538a1780c38b37a125b27cba9acbc85fbe2ec468aa54f365954b4a7
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkps:I5Gkea5e5Gkea5q
TLSH
T1E5276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 20.8MB
SHA256 126924a429db9a023f7268e26a0221aba16f798f7ef564548f33786a1e714b68
MD5 24586f0f5350aafada06308bbe248cc4
SHA1 f81ddc071f8959d55cc8ada8e3bda0a084d8e054
SHA512 926c843b7923cd24512653bd82fd070d1520bd17ef96f6abf90e10324f04154c1581c8abbbb8508936f267fbab96d8fc6129b429c1b65a78643207173275b264
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkf:I5Gkea5e5Gkea5f
TLSH
T1B3276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 10.4MB
SHA256 b0407d107d085c5460beb6ff626ec3bfa68e58706ccc98d6b767a46fdf797745
MD5 952cfe0817f5f9d0d616a83e92b6ee8f
SHA1 0f70b8daec73fd3fecfcf3488ee966ae77677896
SHA512 8fccab0460ff731f196742f1954b4b372161478fa78955d0de7f6e870ed11af7a2686d50e181c372b536d9752152d86114c496bfcdc16fad931eed6d3659d822
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnmd+YPppCpU2hyu5x6M1pLapIkx:JtcIkGnk2VhptcIkx
TLSH
T19BB66B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 20.9MB
SHA256 046fbee05bd754549dc6144ba253a0b44d467591d79dfcfc53e1d575f4cfc96e
MD5 4c6e6ca8c0cb70882a82a5bac73a1516
SHA1 aafde9dac30fec841832e0cfc1e1f657a8db3857
SHA512 8c5402c7365ede92e830b04984c8aabe48f887b353b84d7ce285e6b6b24bdba88ebd6e046f249578f91693e7429b0c4c62c0fe3e7710e5b3aa483c1f9da0feca
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkYT:I5Gkea5e5Gkea5y
TLSH
T14A276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 21.0MB
SHA256 33ad2ebd5df0c9df57d524d59642d75508bf65fc59ce46d9c1481032a8d9c489
MD5 fb593339d339447c95a08b4e7578260c
SHA1 bbde1b71dfb3b596510f7ac99487a3c4201cc359
SHA512 90492b7c3e9577634fffa6933572c7c275c04d7fe932dc3d91c68cf091762843be7973d21ae2d402d289a62b321fced977a7021dcfbd0dfc1e60bbb046eb2fa0
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk0tB:I5Gkea5e5Gkea507
TLSH
T1A7276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 21.2MB
SHA256 d5fc732ad1afa79e8514b1ecbf50769da45562ea80e1739ed6bd4f4a46c3a4e2
MD5 3989339b390d88cf37ecca5b12d5aedb
SHA1 0502d823057ae6bce4923f871d6ba60b39ef29c0
SHA512 a2c42f9e8e7488607740cfda556848f11fd4a34a61d95b712b62d6d22f0731dc30bcdeac917dd0d43f2ab422371ebd02c326265f6378ae1f678422e1f61f8176
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkHq6:I5Gkea5e5Gkea5Hd
TLSH
T148276C22B1E140E5C199C134CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 20.8MB
SHA256 9641a84fab7342b9903b347108c0b187f13a97d938194b9040d90597d46ee3d0
MD5 61e866e5c25302fa5e58c55a3d6e3681
SHA1 00483d3ce375009eed0f3325ca76bc7eca44a3df
SHA512 0ce44684320ca626aa8df9a1bb9579379b13440a9568c06b0eba6035e904d9edbf626b05b22d9f7afae50f50e39a51162490b3cb710ef5da7d4477cbe7edf3be
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkM:I5Gkea5e5Gkea5M
TLSH
T146276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 20.8MB
SHA256 36e0b2e10b9307d78d28fedf2f7201654f85bd98e9362244cc0299c03673cf89
MD5 b2505dc6fbb748c1aadc358c36ce21c2
SHA1 9ce66e6beb74991c8bd766cd033f26840ad360f7
SHA512 0d91edffffb7046fb6d9a094dbda52d7292fecad3e6a89a532bc1e70b9e6289d33a30caff7ce6b4b323aa44f87a51e2c0d076b1a36275c78ca981720da3b2ee3
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkF:I5Gkea5e5Gkea5F
TLSH
T1FD276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 20.8MB
SHA256 e4a7db570b39f5f068fc913d4a09fef7df435304bbb05e0f55d2f0e807b10b39
MD5 9eeae567db1b8b6cf0b9d3f0468cb381
SHA1 1ebde8ef6ab82f4b45b7c256267bf8d2fb5102ec
SHA512 6e3f6cbecd47b94dee9b8a912686eaa70cb443e3853bb715bdfb377b15bfa3582527f3e48bca50aa009851b86d1e7dbfdc9b1e793afa5aba425638664fdfb8b2
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkr:I5Gkea5e5Gkea5r
TLSH
T1B1276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 20.8MB
SHA256 97b2e0e46911d89c97945d889029ad7e554eec9bf7167ac620bd4acd248de545
MD5 539c06daffb69fbd0b4c0a15b722d1f7
SHA1 5fd50ceea32904ee596dc78b0fea6d20f2624ddc
SHA512 5fa7ea49889607d9ce7528f5cc08a68eab36e7bf68ffcc46141759d30a4193e3f7f47abed141f310d843cf6bc9be5c45206c0f7b462162f58c229d69cad4932c
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkQ:I5Gkea5e5Gkea5Q
TLSH
T1C3276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 20.8MB
SHA256 5eec1103eb641c9e533dbef900e5e0073f6fe531326a0fdf712f8e632d4613b0
MD5 fa266786eb6b85cefd7b539fe249f708
SHA1 9afd6d360475ddf6a84794a5fa85240ac41ec2c9
SHA512 d99c47813542d96174b7f6d29ef8fd0942f0da295c08030c46e5e3db7f61e331ae7c72f3844e594763bbfbce897eb03cfd5f2bfbb64412e8993d3d3fab724c79
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkG:I5Gkea5e5Gkea5G
TLSH
T13A276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 20.8MB
SHA256 90238d85df30e2ed68ec0730ea2feebd3bea1ab92401c3ae65a2ad8362c7b2fe
MD5 2069bf11363ba1fc2939edbe4cc4f21a
SHA1 dff869d85df624d6d9a38fd1bebdf4aeff155630
SHA512 da6de0e00656bf6028cb9237f01248b0d888868bd474bba4febba0e9612398c147054d7937f161711a9429957d4035a638458c41950f2bf44b2d79857e3b6c64
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkC:I5Gkea5e5Gkea5C
TLSH
T1FD276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 20.8MB
SHA256 aeb492737a3d7e533203c4d70540f8d6b496a483d2d431fc0df8efded2fe9ad2
MD5 37249388a0e5159a08b4f0e286757830
SHA1 5e539a2250373f2fb56836180da0e7b81cb67c3d
SHA512 51822f1df8a3285f7260bd7fc96b6f49af9332f1086b0450f7b2c18af895758ddb7884f6a1d51ef49ce51133c97f720717589dd58d05254532672139abb73942
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkX:I5Gkea5e5Gkea5X
TLSH
T101276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 20.8MB
SHA256 af5a8e1925dced986aef1922e730a9d6a553667e508e96e2f220d678581666d1
MD5 4501cf9aab8503d96ebf366cfa75ca91
SHA1 bd1fc693971e38b3804e7f9b073f5515f80f4375
SHA512 e2bd236f019d0c04572118e67e61a330c4b9270a71cb6b6eb3f96d23f8bc1643874b3220d98a10ed657d21236e2b25e36f49ef4aad0257fbcc52011db04f6c8f
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkT:I5Gkea5e5Gkea5T
TLSH
T11F276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 20.8MB
SHA256 e1f84cbafc74c753ac7f79c3d4cbb2425719c6294e9659584fa39310f5e67260
MD5 568005e7a94e42ed133d408afe7d3802
SHA1 6a40c6228eb0f5022367c4bfefd0878ebd707301
SHA512 31ac4a67e60eb32ade6153ad03adc19d4c33fcfc4cc112ea5243ea0853f2d1a7c193c63d063a4a98e8ffc320ae0d85c4c8380cb632af4d891a787f873b0a2f76
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkE:I5Gkea5e5Gkea5E
TLSH
T179276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 64KB
SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
MD5 071d69befc4545d16c8415ee31c5afdc
SHA1 98106920c20562db4df0d21c498f51369d927ad9
SHA512 994fdea351d7be4c5434f4840958dad54941761c7132fb3cdc5aa3821de5c697829bc462ca8428d6341e9076d304a231f945e48f12c618c86ab01045a26eda17
SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0UeG9ODBZHlsP:2sXDsmJDZzgyQsRDptkar4Vyg/B
TLSH
T14D530EF819C0F18AF8D1D571A0C9B33926EACDE5BB5047DB7C172B429EAE4800397D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 20.8MB
SHA256 b690358996b0cec4b43d609b03fb92563be0d95b4188bcfec988fb660f09c119
MD5 11be48f0bfe123fddb11482aba5c406e
SHA1 3cff34d9db196e48fc2be9a2036741a7f907d5a1
SHA512 b781379fe073bbb6059f73f6e9bdd8545f6126e26507d9996f395db3834cc1f793fd43e42b4592e570b1183693485396e6f3e82524e229ae665af99807be2ac1
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkd:I5Gkea5e5Gkea5d
TLSH
T17C276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 20.8MB
SHA256 95b5e5fbcbf03c5dc383a7a552aaff509f6e2d0b5b229619a51e2249560901f6
MD5 d610fcb6334dc6b4b3aee04f858565f9
SHA1 0041f41c4180be0e9d54bc4515c5e03af207a5be
SHA512 45204454365ea3b28b54b22b09b5b4fc260ce31a240d7f5e218fa8ba6d222bacd7a1a919a620a2194447b1d949a33f050220ba3ad4e0d1c4a44a4f7c71077313
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkV:I5Gkea5e5Gkea5V
TLSH
T16B276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 20.8MB
SHA256 4db70774f5eac0c0a718b451391ff2746ab018fe226145d60d300b2cca201b0a
MD5 12997c7917ca58c8a50e050d30a098be
SHA1 22cb223f607b81f9f1bd3b8a29719b52265d0cfb
SHA512 970c78abb3a70994399308cfa6e68af8b05512179bbcd0f3e5a0e8ab6110636fba7dd7cfbd777b5b2d911b9588da7ca580556088b72b5fe196ceae110018eda3
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk8:I5Gkea5e5Gkea58
TLSH
T170276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 20.8MB
SHA256 8ecaac331ce73daf8843f4c70b94b96b201851f79521000e420a52b94f775c1f
MD5 93774ce0995cb38aadf56db53d66f3c0
SHA1 1b6e32835d60f1abda9ffd3eb4b2bafe464cb4f4
SHA512 cb6a9a64e4b0567d6d4aab76ba4901cd0cc2fc3ae1355cd554e9f32cccc88d3a412148f1332f01e9b882c92911128268d21f4e7fde1c959d9bfe64ca5df6960e
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk1:I5Gkea5e5Gkea51
TLSH
T1BE276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 20.8MB
SHA256 9790d8e994e362e6c5b3336ac35fc34866250f49fef75c1ddf01a96c34e6b9ab
MD5 0d2c227ecf9806ad7ae2318279fdc6e3
SHA1 696c3935a4618aca518ee165bdecb88dc0f6d01e
SHA512 266a5a03ca814a77e5d597dc7683c5aa3d89a71f15462c072f87403cc9bd9991187368163499a598b44abf5c0303be44a276c4df568351aa784fce202704f5c8
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk0:I5Gkea5e5Gkea50
TLSH
T187276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 20.8MB
SHA256 849d52682f3d904f5789a428b65e065222371356957a67602eeea4f2b099d8ba
MD5 4ce76c3e54b082c21e95983cc1403cd1
SHA1 ae2fa7999668d5f51aebfd0a950384b914df6bef
SHA512 b7555ee78f95012c70c6d161d01df5c19d1873eb2714dc0ba6d14bb7ef7cd2c66a121645870cf44c20c6995977c9daf89c47a5f779ad943ae311524e208b2ab3
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkG:I5Gkea5e5Gkea5G
TLSH
T127276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 20.8MB
SHA256 c766539d5becdd209a53e4b5cafa44ed5eae67d73e59eb98501350a5d5828eb9
MD5 b5af154cec854a2bde0d69dfc3aa38fb
SHA1 48cee959d8cc576ae1d71b3de178dad23379a890
SHA512 282acf3f1d438fe7e3aa72c5055e5f6820ffd0a267264aed26da9a67267af9ce7373b6be73a6d6948a2d9fcfdd5c484c4eafb0422ee2489fa0706b7b8598e179
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkg:I5Gkea5e5Gkea5g
TLSH
T17C276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 20.8MB
SHA256 fd134d40c9923a2e37a8aea4025c6f69c21f2cf0bbbcde8efb242ae5ce8755fb
MD5 67f9cf294c4d33be6e488f56f293c44f
SHA1 b4587ec28a43dd4d7e56cf736e59388e3fdb0ad4
SHA512 ae4c3c421b0e628decdec7e5d145454a6a62901b73158cbbfb084b1d76a798dbe3a8119937948302fcb623847e6ce76c534f4555d8c35d7e2b7b69e86d380f73
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkm:I5Gkea5e5Gkea5m
TLSH
T116276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 20.8MB
SHA256 c52f30cebbaf3960f85ae4031f038120e46a0431c10d7f2380190f89b95b98da
MD5 1d0660c6e250875fe67381da79b8ecef
SHA1 899337a90aa4f5308f1cb3a8e2b5d83b8667482e
SHA512 9bf364eaf9826b18a4e89f9906a455a5a2810fe3a09ecb484baf43208b6c59a233afe77aac1708cc2c2274b249cc032df2d2c5bfa8a462657a958b02ac7523dc
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkd:I5Gkea5e5Gkea5d
TLSH
T171276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 20.8MB
SHA256 2f1e0c692179a5d2c2f96e2dcb18c791bd06e5c7ffe83ea3cc783620ce27a7a6
MD5 4a843d0f9fba97cee70647de0fcd30fe
SHA1 06339c9561e9ed44aca9309f27902f5e3fe10f24
SHA512 ed4a85a468e05add6c329cbad850bb5ce284608ead0fbde30cc11aa98aab34bac01ac48d1e122fc66252521c856263ffcae059f00cfecce5a0f934c42a4503b0
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkM:I5Gkea5e5Gkea5M
TLSH
T16C276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 20.8MB
SHA256 89fd56afa4a5f095554aa0b6701acac6abad30c7077fab338e076cb5662411b1
MD5 2500f949fa1312375155ac878d843404
SHA1 f639fc7760e67315ce8b71e13548e9cc6958b772
SHA512 85d7065ef569f9a97cfe2757b11c0de92cd3a0bb748478de8885da0709fb5a24c1ea076496a769cba6bdcb1efb67d87d6cf4a43eeaa0768bcea1ff45b18d3b90
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkH:I5Gkea5e5Gkea5H
TLSH
T1D4276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 20.8MB
SHA256 ecb145fddc6e009dbed513ece28674e37f1d078c31178f51caa86df2dda94372
MD5 54d83f3a45c810d0368a0a9e56e26e65
SHA1 afb46d799261af3156a908f89487a900f1bd3349
SHA512 cae1e6b98286fe53bc34197ac57aef9e405150018dba85beecffe77ef1dc38617d2d19f4cf755ae3b16a08c222133cd2ab5d78237f6542e563f10957a4926cd6
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkK:I5Gkea5e5Gkea5K
TLSH
T18C276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 20.8MB
SHA256 ee9cee73a807a6220ae80eaff9c295e96bef364131a31bcb0c8ef43fbf1e9dd3
MD5 885c83c676c9517d07843859d50fbea7
SHA1 de132046a77a7ff574a580a7a36a41c2d200c3d8
SHA512 2c5cdbc674d9459aef9eabc1798426bec1215cd07d8b73b97b192d7b5b5fbd92cc095c044eb3e68d2736fb9d1d16138d21f44a8c0a54c124967fae0a551a7893
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkE:I5Gkea5e5Gkea5E
TLSH
T13E276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 20.8MB
SHA256 993f201042c6ea6502cfdca3cd69d941a218e4251d72a6239f6e19fd0cf13028
MD5 1d8d94eda410fb962ceb7f1024d5558b
SHA1 6b4d96fdba9e0a03402bd67dca0ccdc5b5c954dc
SHA512 73ac4cf2143a9aa9267b421664f3696dda05ab22916433a236af93125d946b89b2096461af554b2d320a2fac6dbdf6ecc716e1083c73c3e367130d80426ea309
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkM:I5Gkea5e5Gkea5M
TLSH
T14C276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 20.8MB
SHA256 992eb0d02f888643c01acbea2acd288aba03987e354f8d2a94d8aafeeb49f43f
MD5 cd463884a9f57aaa7c9a1048df67fb17
SHA1 1b0dbe558040eefecabc24e41df8a85a8aee2729
SHA512 f8858b4ea384f5e44cf41d23fcc385cfec65f4b382435fca4cef30c3df35f2fe3b53a519e1a36db24814b59a5a7dbfb4f6eeb78df5a310e8badf4cb8c397d957
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkF:I5Gkea5e5Gkea5F
TLSH
T14E276B26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 20.9MB
SHA256 37e8be73fac4328227b1755d6d604cae7f8bea323588c4687f991631e1453c7f
MD5 1d57ae5032225e7d79255023d9bcaab2
SHA1 9572d311013aa4d93a2d69046a23766168a4be85
SHA512 5cc1b60815986b917da64ff4c5f091b28070dc71ab0e46c291b3cbde192d9691896652dfe9497e4a0622d097ea2f8cf6688b169af34e65f3b0a8a4e752ff0155
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkQ:I5Gkea5e5Gkea5Q
TLSH
T116276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6D92F33AD03A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 10.4MB
SHA256 719b1c2292e41a86a3091807c5424043479f2ae29e019106d014fd45707bdef4
MD5 86c0bbdf1f1f341257354fc503c41541
SHA1 18ea99aa462d40d3275235bc34ae7d68879a35a3
SHA512 3b4a3325259b48bebead0bc6e65b13f158b85359dcc7d3fc84e825af11f160c65df8c1851a66b34325268184ea5d51a9e66c9061b8c4bdcb9f140c4f76cf7c1a
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnmd+YPppCpU2hyu5x6M1pLapIk4:JtcIkGnk2VhptcIk4
TLSH
T116B66C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 20.8MB
SHA256 a5d03542ce1a2c06858090ff2794103b3ed7f8250fd6030b321d54d98eaa8282
MD5 35f7f91571349d918f50df20055074f6
SHA1 87bd3fdd31296fa4a197ae63f4f8d1ac060bb8dd
SHA512 e0e1a4e4170b4c1226807c07c4b53a0d81878f11b70e22db013072a890a48c31c978a92d23667ebcb8162128c3d93c6e341bd2e03c1854e20ca2badeaf1911df
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIkcj:I5Gkea5e5Gkea5cj
TLSH
T167276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 20.8MB
SHA256 ee6e80e0ac98659e9c3589e1ebb4325b5c398ce61a51b0278f0cf7b71f4f9f77
MD5 cf78bea680423644fbe57b4e1b1299f1
SHA1 a0b9814f5733fa7bd45e5b97612c915cb73299d6
SHA512 ea8fce291ed7538ebe114592027895df17ab5ec21e6592b1fd864b5edb2397acf2edbaa0f589140df1da23a9ca5e43252c67e018d647176d289cfd0acff95786
SSDEEP 196608:JtcIkGnk2VhptcIkntcIkGnk2VhptcIk+D:I5Gkea5e5Gkea5+D
TLSH
T187276C26B1E140E5C199C034CF468632E7F17C698BF197EB6251B6C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2412-397-0x00000000068D0000-0x0000000006963000-memory.dmp

Download

memory/4928-427-0x000001B2E77B0000-0x000001B2E7BE4000-memory.dmp

Download

memory/5848-420-0x0000027B801E0000-0x0000027B802E0000-memory.dmp

Download

memory/5848-456-0x0000027B81D90000-0x0000027B81DB0000-memory.dmp

Download

memory/5848-455-0x0000027B81E90000-0x0000027B81F90000-memory.dmp

Download

memory/5848-470-0x0000027B942F0000-0x0000027B94310000-memory.dmp

Download

memory/5848-454-0x0000027B81CD0000-0x0000027B81CF0000-memory.dmp

Download

memory/6052-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/6052-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/6092-2-0x0000000000400000-0x00000000004E4000-memory.dmp

Download