fb8ed8537cf0cdddf9545dfd48d239508f56d43ebe13b85d1f8860bdc4e8f5a2

Analysis

max time kernel
88s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Size 8.6MB
Sample260703-pbf7jsdw5m
SHA256 fb8ed8537cf0cdddf9545dfd48d239508f56d43ebe13b85d1f8860bdc4e8f5a2
MD5 e0098470e001aabbc60d23eb66babe2d
SHA1 5c5a32bdc5cd56dc0efeabcd1f772d43966e650e
SHA512 b27eb864cd2761586386206637e11cc17b9d372dc928afe01c791c47bddc276c3833bc972e819d8fde6f9334a4e180369282603a2ffc0d4e5db348832ae680ee
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTY0oAaldmdmnp+jolzb:JSWyZ/K0ttYVAAT1Kmd0eolzb
TLSH
T1D3967C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{631F0500-9C0B-4953-811E-9684B574DA39}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{C0E89DD1-5E54-4DCD-96FA-470986DA4BCE}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe
Token: SeShutdownPrivilege	5872	explorer.exe
Token: SeCreatePagefilePrivilege	5872	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3352	sihost.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe
5872	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3316	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2084	2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
2744	StartMenuExperienceHost.exe
4676	SearchHost.exe
5872	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 5872	3352	sihost.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3316

C:\Users\Admin\AppData\Local\Temp\2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-03_e0098470e001aabbc60d23eb66babe2d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5872

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 9.1MB
SHA256 becd66d5e1fd974daf91fde7cb06bde9ea93660011a17bf6882311caa9ad4fb0
MD5 d12d308b6d576dcc542b2a4b0c017699
SHA1 9581d57800693b733f6e577928742881043f8ab6
SHA512 d5b009707889f90aa53d4e0bf92186c2dc652a2d8ea0b8295076838478b4d830b816cf140914338cf494ffdd5ca9cf59ce0358d1aa35983df214b5cf6b475137
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTY0oAaldmdmnp+jolzdjo:JSWyZ/K0ttYVAAT1Kmd0eolzZo
TLSH
T18BA67D13F1A441E9E06AD174CE669231EB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 17.8MB
SHA256 6b9cb4120b009c9207c467d17b6f357b4466c661422732db72a6452c07e0aef3
MD5 07093f2933ae4db9bc0abe66223be42b
SHA1 dab60cc0c5fcfca4485515756fd45c3743392f61
SHA512 aa938ad9d2c2555691b44efebccbdde2974020fcf86c3bc9d8c31b0d98ec686e6dbcc4d3220040593024583aad846ea3977fcf97d44d3781d80b2c6f86718fce
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz6/h1+:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0
TLSH
T189177D13F1A441E9E06AD174CE669231EB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 17.4MB
SHA256 6cf4575516b97a819899c879b39dcda4ddda028502e66418cb165e86cd70d7a2
MD5 627636add26ea7c21d9e36acc69823fd
SHA1 2df80b543d6b518e558d5f7c5b93aa9e48c8e8f1
SHA512 850f1f2067f14827b7718a2411a307504400d70c46456562ecec76c3a920c631a628a1c46051cbf13db4493b9b29356b2d5ec8eb26e273e271898f17267f0c8e
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzr:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0R
TLSH
T153077D03F2A441E9E16AD174CE669231DB327C594BF1A6EF3240B6D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 17.2MB
SHA256 32ccbaa66257ee3940833c1f9af084279a917e57c8911670c2665b07aebf463f
MD5 5a05fd31a1409343f6b098e547654d5e
SHA1 d848c54bc363a6c78b83aa679b81098fd478ef1f
SHA512 c7a020fde10548d73e2686220c4bdc1a9fd0cab6e223fb5789dc7d8ed8b4aa25628ed5f3fe3cb2b836e7316ee8351beedfc5a76ed0650f47740be812dff0ecdd
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzcb:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0I
TLSH
T102077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 21.3MB
SHA256 1226d20c0c2e96d265dbbc780ac18daa3055d2df55e599d3fd2c3bccde85efb9
MD5 816e5807dd670ca58f5a2da48b4c99c0
SHA1 482202b04dca6ba4d0907bee5aef245a14aff122
SHA512 1a79ba79121ba90228e796c67011ba679c8291013579a034e79755a06cf1bfe3bc7c19848a1ba95c2193a89b04448ad5f34d8aba175cdedbe75d27541032338d
SSDEEP 393216:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0AvyEYKbi:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq00A
TLSH
T1AC276C13F6A441E5E06AD134CE668631EB727C494BF1A6DF2240B6D92F33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 17.5MB
SHA256 ec326d86793becea6478d06aafeae4114ea375c0c3af9df89ee491bce7b65e25
MD5 06ae06831c150c8682e6694634dbc440
SHA1 47ace8107475a5e2ddd6ae5d4ef20040ac9654c8
SHA512 8623ebd0d74cbb26c4656ba1f327c3d00fe4eaf70f959577cbdfb0a574a75cb82faa7e4a8179d27478b562aca6851f1c246fb42b580f227e64a60ad21e059fcc
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz6:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0k
TLSH
T1DD077D03F2A441E9E16AD174CE669231DB327C594BF1A6EF3240B6D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 40.6MB
SHA256 c3bc8c1f7a081e81511d79fa376514328edc24b38d76498b826014d0cd8c578b
MD5 102e5fb4de2b9ff74bc4389ea56757b4
SHA1 086be35c3d00943d895a4f6502cff1e6518e8ac3
SHA512 d9b8a83e01807f5b7c03a965b6c79e8783a384b709ae1e6afdcc56e1fffef100365b8e463990578bef518812c66f731741594043653fb083712727831346d3cc
SSDEEP 786432:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0WE8c23pV2X+T:uZ/K0ttYREq0YZ/K0ttYREq0WEh2ZV2W
TLSH
T10A974A52B6E443E2E36AD134C9718271EB717C0E5BB162FB2174B29E1E376D06E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 19.3MB
SHA256 fdeb4c5f41e0712ac16e1b75ad36b3eac2a54ffaa5a229be3205cde2944ba51a
MD5 16d5474141679b0d7b7f66985de916a8
SHA1 02084d5754c9ecc67da2af44413ef77f5e62fd13
SHA512 818288ba7470b15d51cda0b06424b70eb3fabc806c243ca90f6aeefab0dc28f9ab4038275146ccebc5b92748a2b774937aa0f93e64fd4cefc0a075deb071b9c1
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolznGn:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0VG
TLSH
T1EA177D03F2A441E9D1AAD174CE668631EB327C494BF1A6EF325076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 8.7MB
SHA256 5e38260fd3c592dc3597fda035be17c7e0fa3fb71246b7ca90b144d4f8d61b00
MD5 2fe48fa66136e1a1e50416d965b73ad9
SHA1 bfd91773911cd34ff3e76a42ec6f11d70ea6ddd1
SHA512 19ec686b43a9b35114d8dac894d35edfab4c9f67244c64fa3997bd51bf499ea4d8d228166df3ef483889e75bc99f271c77df452156f81a358f5e9b35120ea320
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTY0oAaldmdmnp+jolz8:JSWyZ/K0ttYVAAT1Kmd0eolz8
TLSH
T115967C03F2A441E9E16AD174CE669231DB327C594BF1A6EF3240B6D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 23.2MB
SHA256 35904cdb35dbef7d92eac4195ffba77f8ffe4afc3ddaa66e969ef053f64aa34f
MD5 7fa50ad6599f9017c08bb8dae02dabb8
SHA1 d45432df852e9e9c3c9fe5cc0ed7137d2d66099f
SHA512 56de1800cee19ccecebc5f9edef5fddc49ce45d1574a2982362b18bbde5206b44d0d7eba55c05ce7302d598a3f9f68a7fe92cb059a1002987aa288cdf627fcaa
SSDEEP 393216:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq04Qsas+PS:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0EFz
TLSH
T101376C03F2A541E9E06AD174CF659231DB327C4A4BF1A6EF228076D52E73AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 18.9MB
SHA256 55423de8d316b6a8a023061c438ab1a00c93f09daaad4cc071d41ecdc7e98588
MD5 06235b05beb61b09b4bfc474e291d172
SHA1 906170afcc0d9e8ee84b6491e63d512d461d250f
SHA512 3ee939eb66ad140ad0877a700597a25d73d2390738f0f1e4420cc0781e7e257e96944b378e91a6426c7e714bcba1329b1f833bbf1ba05312a79c0572e73daefd
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzmthHf:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq08/
TLSH
T1BF176A13F2A541E9E06AD134CF668231DB727C594BF1A6EF224076D52E33AD07B39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 20.6MB
SHA256 7c112eeedd1dca6b13bc93806985f5c783d8440ba137393cdb800248862c4c06
MD5 7d21f7739ded3554d9c9ae68685147dd
SHA1 df550985536f3b377dadb01e6a8e4f94b75d8f02
SHA512 375a0b5075249541701b1cd47f6b6d5d1a7d86948ce914c9acdaa53792b8426b7a2c928e08bc67247ba3fafc696394b18095683ef4ac12ed121e484fa91c0c5d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzkLIHuWhs:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0S+6
TLSH
T123277C03F19941E9E05AD174CF669232EB327C4A4BF1A6EF224076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 19.4MB
SHA256 43c70a0c8541688d9055324b34e9225f56799d9264be4959d39ee124f9d19038
MD5 a07be32f70b12be59ebbc33f535f0ed8
SHA1 7020308ae57031246b93f456a82a214610cb0fec
SHA512 195e92d8eee1dde4050a0faf8dbadc59f7f8f3252d5a82bbff9532d1b52d73eb27bd78741741943341d5b589eaccefaff7eb4564bd66b80705967ed3c53b34f1
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzm6Jm0G:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0Ml0G
TLSH
T1AB277C03F1A541E9E06AD174CE669232EB327C494BF1A6EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 18.8MB
SHA256 0db870feae59cf820c21d77686b257b59d214e88e5a0cf57a5e88e36c0b14159
MD5 d91b6dc0da08bc3dba9675f2d7728fe7
SHA1 890d84f6789a6e038deb8ece1ef1012d608ef3e2
SHA512 bfa9751d35d036a2ff65a5e9a94348f5b5e08d0cac2f4b0a1146179e665c3d8fa73182fab4e41417f576089925e72d61e8e7e7e071e8ff00eb94d92b12f0b807
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzRfPf:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0jf
TLSH
T1BF177C03F2A541E9E06AD174CE669231EB327C494BF1A6EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 19.0MB
SHA256 1d7decc2b347ede689b8ae16f8d7f7e97fec4255f90fceb076c03b55600ebf8d
MD5 4ccda8127ddc446a33492fc25b7c3f05
SHA1 30d375971ce6e44aec5cfaa89c950937e40ea902
SHA512 8df7b2a0de1ec9a0ee202113260264a88a4b9975a9a2c136a3b7ba95a4ffd72ba4ca9f1c5e0774cbcd0fddd84e931b6f11f2f98d1dab841e6f7efb5c77c6b371
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzYdKC16:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0NC16
TLSH
T1F8176C03F2A541E9E0AAD174CE669231DB327C494BF1A6EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 20.2MB
SHA256 670401fce5545148468b790ae4ca3b97dc419d61e258e49ccf385995d5e55c67
MD5 d7eae7afed6af78ae8dd1fd4011d43be
SHA1 06dbcac2693173931c7f3a65187c246186e3f424
SHA512 6a9558d744d34ae971a62c491c23af7c9d25fa042f6c99f2ee4534e7812b88d38347ff272ed5cffe04560751c955f28d8e66a3428d8ad08d3eb64fb5dc8cc581
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolztjnDO:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0vO
TLSH
T13A277C03F19541E9E05AD174CF669231EB327C494BF1A6EF2280BAD52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 18.6MB
SHA256 10835530917e1732cb27c3070865d6a2dcc9978e663f8db87962161f612601fc
MD5 d1acaf40ea61cacfafea874884db5fe6
SHA1 689bfd27094777c62874d55b9502f97039082855
SHA512 22bda06fc90e1573300c2252b7f00940b4a6952f355e1aeb38b22d7f75a9ae732bc87e47e19cc54af8bd156857616cc27f624050e8778a380b63b2ed256f4fdf
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzD2iw3:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0/0
TLSH
T163177C03F2A441E9E06AD174CE669231EB327C594BF1A6EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 17.2MB
SHA256 9fd2b2d91eaa2990a5be543006a3518d7bc4c53ff485ff6ac813b74993427096
MD5 3417c27739118a94fab692cf84e2359f
SHA1 b3c12e574d32f6ae985fe6cfe65d4ab74c33431e
SHA512 c5549de757da9512629500b21406b61a7462738a99ebf641d1dac35d6e1c1ace109fb30bcb0c050ba9673de9f7c33a49077c0f9f569ed6a1db8e60600910afd6
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz6:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0o
TLSH
T1AE077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 17.2MB
SHA256 125d31d52dd25efb367b45a3fafdd71b0b291e1c1505c9ac8fe43999e3befd1e
MD5 8d6d34feec08aaa3662c1f4c526e85fc
SHA1 9c59cd11421292debd87416a52bd4f3dd31437b5
SHA512 6cf70c724c8a78434e3c62564f4ffdf75cde34a4a864ba5a11da0ff9c43f129c47291b165ae8fd6a1de8fccb4720f2b47c33b01ced72e77ca645bdb38170a014
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz2:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0g
TLSH
T197077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 17.2MB
SHA256 c3733ec472797108144f9395eb6a5288adb1d0f4084f650575f8fa95bf922c08
MD5 e609d5a521bd5351bc72c69f590b55d4
SHA1 604850f095062b94d3ae80e5113c8d539f38b325
SHA512 f13392c6d88725b7481003ccc9c13e82e58aaeb58d6f6daba1d07ddd84aa832e08fb2551bdb47fe61de88c6548b637d9819591195d9c9d12f328adc7db553c91
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzB:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0T
TLSH
T1C8077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 17.2MB
SHA256 749cdce3e6bc5a82df1762dd87bdf8004fcb66d4a78d8166367c3749e8db1693
MD5 4d252b4d05978f471b3461522f84f6e8
SHA1 54ad45aa0ff059242d3afbdef26d9ebcc719b318
SHA512 59654eed4665ddd423645d1339fff8425afad8e1c3fb00ed040b278ccb5db39ce2a9b3191dbf6ef63aa6dfa94f66f555e786e2aefd529ac99a6a13e9b814dae3
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzU:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0K
TLSH
T1BD077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 17.2MB
SHA256 25f89a382309b8d9624cda614a4c0013c3ca4adbc5a3504bfcd61703e5f6ed6f
MD5 fb478e7822de8657ef8a7f3901bc9d17
SHA1 2f4c1368735ed585e3d6aa484479360024910f27
SHA512 c184c632ffbbe8ec665988bb87ec81fbcc484d373e0f04249a091d63292913128794b0547da2ba64eb2c7d89dc5d291c33a2cdf3f915725899fbbe0974de55e3
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzR:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0H
TLSH
T11E077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 17.2MB
SHA256 72c18b45bc117d2e499f208108fcf19d7b18658e2c843d874733484612a5940c
MD5 494e7701939781bf5c519858a00bb9f4
SHA1 fd0f64e9d72c6fda83698d64f38022bf01fe5cc0
SHA512 8ef8f7e93b34c2e57585e7a03bff58c70a7586ee514a42f58bbbd1151892e82238298aab4fdefc08bd6c61b3935a19b0032cb1711579032c41ed6037bd54f818
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolze:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0A
TLSH
T1FA077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 17.2MB
SHA256 1b9c2e8759f72c6f9a93d14b95cd0412b219e6048db5c6ee7fc521ac1a7608c7
MD5 8c21fcf7d4bd4c182ae95b3a0b5da866
SHA1 e3cdeed5926f0b27193eacf385e919912e9e4026
SHA512 8066744ca3aeb9bef59f73cf0ccea5bc6a1d811f9aed9ebc1764209b2593c452c3c64012e8afde4ab1cf87b832091d0f9ee65f602f2380b13ad11673553bc694
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz5:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq07
TLSH
T130077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 17.4MB
SHA256 ddad12f03a56b4625cda1ae8e4ff22afef2c5e24c39467cdc19b704604e31dcf
MD5 82f68d9f4597af5e78e9bbfdeb1ab2c4
SHA1 29404101b79ae25bcf5dce288cd472cb1ed668f8
SHA512 5db418a2b6b3617fbb39dcea4316179de23e0412965fdeb57b227dc4f3b3d5951715888545a7137a8147dc2f8b84c24d9417399f57b45c7f4c7bc6ec89f7c38b
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz8fu:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0Km
TLSH
T139077C03F2A441E9E16AD174CE669231DB327C594BF1A6EF3240B6D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 17.2MB
SHA256 18ca1f44757e1583b72d3626a705dfcc50b290bc99e42a34f496f563ebf15d64
MD5 4ee81817c79e3a16f82bd87144d5193b
SHA1 365435d1dc6b72ba6eba2da4b1836066ccaa9078
SHA512 1ff86bed4913bbca5cbd8574736483a1e2351df4c247b16c834821ec669ad2e548d961c82e3405d0765a81415bf6591cc52a6617d4253ec8f8fc6560b68eefd4
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzg:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0m
TLSH
T10F077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 17.2MB
SHA256 8164a50588964dcfec1d53635b53414e37d273dbe15605fb6db8ee56b4729baa
MD5 dbb54b665cbdede75d54159bca8dad61
SHA1 55bb9ffee5d88b3e64a52e7f448cb0acdf4b6375
SHA512 79d0d2f3acf6dc2c501842a28bee0d15ce9097789e8ad35338b59c292aa325ddd5206080062ceff9a6538c48f791e7f8ad94b04f47ded2ec4219db4b60d61b6f
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz4:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0a
TLSH
T18F077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 17.3MB
SHA256 6eedcaec3f6d009625587d0c3e3141e2342ee17ee3d10f3e079676af0a3081e2
MD5 98d22c98a936389037669a44cc762191
SHA1 f8234c466c94ffff88ce80d509cdea8b5da5dbdb
SHA512 35c45a8380dc934fe4a6fb33c952199ec46dfb96623a187b343faa604e07c90b903a416201f508b8c12de48227fde639f9a3919f6ea89ca78287ec8896e9f630
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzXs:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0W
TLSH
T136077D03F2A441E9E16AD174CE669231EB327C594BF1A6EF324076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 17.2MB
SHA256 8a347f6214f5190930ff7785a2fd5f0651a54f40d5493485b653ef2796ecd792
MD5 b9f1251c971341c78c679dbfbf6ef51b
SHA1 839e83344806a976194ef1e17cfa2c0f67d7b628
SHA512 128cb0632174d0aab8d9af4fa54d515e21629e8e7f8758642e05e13553ce6a7cac338cb2599a73bd2eda583845bbf6821073f41fa28d14d13f7b243212dc1523
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzl:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0j
TLSH
T1D9077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 17.2MB
SHA256 06a9d0a6fe653e11148ecf8d329555916ec8dbc64c31382ffb1b7abb4cc0879c
MD5 664483e74ef53697649e9b96b2885c5f
SHA1 8391cab28af9c0089d7c9edc0c1f21a814216c63
SHA512 20521d6c1ee21e0f704c1182b2b459086778aa3f2b0ad0e721c1ca7eaef5688c58662498a72a7ecd3b3f2da860b0f969c8db60ed52849c98a307701762d3f38f
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzH:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq01
TLSH
T161077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 17.3MB
SHA256 d2585c54220d497a19202515a3c336e0faa5c802be0ac3db15d273f19596c6e1
MD5 fc5d5608e96e377501fc72f1b7b34c98
SHA1 f7d492be405c96a5b882fe9aff9a3d4b27d98f3a
SHA512 ee975c52005fede93cb1fb6eefcc66d4e29c9c113936446b127c54b71531f3a1ae843db304083b4b9caa234ea5aced89b0b0ddd3e04f3de47351ef1a3921e030
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzqT:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0G
TLSH
T158077D03F2A441E9E16AD174CE669231EB327C594BF1A6EF324076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 17.4MB
SHA256 18f09ca86dc0d7a5d7e9b5528c08672e6c088f738d060c1e5215dacb296735ec
MD5 6e434a9b0dd99924d8553201182e2f0e
SHA1 e1c0bd05938297f3a9490d7c728562a2b0e45f55
SHA512 0f5871d1fc175b1386aaacff9ad4df1fad8df04d74b67b42e31e170d50b8c968834ff8b43b953885e65a3edbe6c642220fba22ac5c36c043afad3854ba34f0d6
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzOtB:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0w7
TLSH
T16B077C03F2A441E9E16AD174CE669231DB327C594BF1A6EF3240B6D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 17.6MB
SHA256 15caf352eb907d489513a7838a994dd45e0ab642db754b8c25be13cf32e0647e
MD5 cee6ce477ef4b3d5ff8c86a03ebd22ba
SHA1 1198e64e0637fb1ab5a69ec10f8e433d6b5a34da
SHA512 aab5757357f5fff74a8bb3c657bc559dda757a8dfb88515d84f623cd521cbe9fc10034002b69e39826234775e9e97abfe38bc6e30fef6e2ad2fb5aa934907ec0
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzJq6:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq07d
TLSH
T10E177C03F2A441E9E16AD174CE669231DB327C594BF1A6EF3240B6D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 17.2MB
SHA256 2eb8e586348c9bea0e633ecaea16ce07f06decb3fdd733ab2ea9748aca9688d1
MD5 02744c986e06ea07ea7a11d501308897
SHA1 eeb8de9794048e599bc73f4d870c983818cb316a
SHA512 5c6ce62c44b8e4691547bfb2243ef1ad6a198daea0ec87bd2bf5b80e215c6b989d2b3527e3a462332f61cce9d9d464cc01d6937b58901ab903d4b55bf553c004
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzG:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0A
TLSH
T1DD077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 17.2MB
SHA256 6f95292b042040d4b958faa9fd573c877d682dbf883aea7a209dd0d5967bc6a1
MD5 0a9209f051c6649bef4134e8d7cc08b1
SHA1 a39ef7f651b15648b55e43ec9c91498bcbba19dd
SHA512 c9aedda5620045fb1c922c1c247eeb4fe51fc73c2b78857cee0301be7df89a47d7f9ddc24b89c1e4e9fd49d910edfe0cc9401fc981be767efdfab4ce55f53f26
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzr:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0x
TLSH
T1F8077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 17.2MB
SHA256 f9fc79cd634a4c854f897e7ba3dc663ff5fd6597a8351c27777982a3bbcd0d8a
MD5 d07f6e64a080271e09f6a7939f751dfe
SHA1 86c96a929819e1ccfb8f7a7c7d5bad5cd483c035
SHA512 ebf15e9b3884f822f19c51dce73171b470cfaf5f67c911add2b57552af4ecce89d54bb71c9435411475d47e290a2bb925dc53401ff5ded9d777e92cc7844cdbd
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzJ:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0P
TLSH
T1B5077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 17.2MB
SHA256 b764da15fb08d2a96f7e506228b9ecb138c943c5041ad5e2b8d02340cb50c497
MD5 9956e8193d371dd4690a0267569d7a28
SHA1 e2838a6d10b604daed338ed3f5446ad6e33a3baa
SHA512 07dcbb140a6e8e724d31104cb4e6be273f25943d015d7714868ab67e1e679bae67b61f5e42b6b68222bcc1bc9f3cbf7fc237ac105cb99aa59ac7f77c77400c30
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzS:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0E
TLSH
T189077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 17.2MB
SHA256 69feaea719ab465aeebfba753c1ec0b852fb2626535be51db59b84bfbae5cb1f
MD5 be90e1ade6f356cc65888a1e899b6ef0
SHA1 978f4dc94841b8b1560aba00db368d34147139da
SHA512 aa60944cdd7c66e2147b55f84ff4d62b211f2e81f38e33c16edd5b0c02d4d235c7e088e39b653d56126392c7b2f22010fb116b1310d8b0be3daa2abba790505e
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz4:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0y
TLSH
T1AB077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 17.2MB
SHA256 5b61114f55737f1a6af8821900e8192be9b9d2334793dc50379cfec4a1eff307
MD5 a2cd6e6e17a98d69e93a1da5e30e3047
SHA1 d1744f8cb5d223a1285df0abeecfd5eb085e16f5
SHA512 5f5c9449b8b8c72b309bec2a9adc615f0acdee46c4c5ed92feb89b558ccf8f3fe38b59c8e5c14877b0d1a41b1e5e32d915805ff50260afe54d61731c298ba1c1
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzM:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0G
TLSH
T183077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 17.2MB
SHA256 007b16ee3378fb349c4cc624f72d63874b55cdb6912eb8c53b5848412ef2db4b
MD5 8e3e5ea581c7e05d650cc78b79449694
SHA1 00fc002940a67fbe907c118fe65a1051eae49e0c
SHA512 31c944635491d3e16999b21848a5fd59d487f05a76bcd93810544c1f91746df580a696a63f7e6a6c75c66d544a9c908c58e91cd802aa2761c403048efa0a2332
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzB:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0z
TLSH
T11D077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 17.2MB
SHA256 a14fdc89f9a70aaf45c21416d09c716c11bcaff49e7622ef32c553c59e5a2146
MD5 ec9755413ff578e6245ffcd8cc3c017b
SHA1 439b86c03967d1e32ef648d63d39b70d4f1b23dc
SHA512 2f9aabc565b378b2d27279b5d195c07d4fe8b6fd78a07affce2e71422fdc31542fae36aee4e7420142e54e1a70c97353aedd91bd7ab6918933bfa8092ddf6b74
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz1:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0/
TLSH
T191077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 17.2MB
SHA256 46a45ec1fdfa6ac007182d85bd5058b2356761bd3efaf680b64a846b8067f93f
MD5 a2e92b653f11b0c28add51e512992dc2
SHA1 28ec68ffcb900c8c9a85aa8b7bd5dee9f7ab144c
SHA512 c4c7338ff14c2a9f0533e00d8f59100def4ae66c2a6a3ce86572568430ee8911589d08e92be8d62b2fec44b0b974fc21087d5200b204d11075eafdd186d5a4a8
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzq:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0Q
TLSH
T16A077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 17.2MB
SHA256 36577290fcb73837a854456d27d2be01aa802449d2e4b410b2508a14daa4efed
MD5 e2b0f3095913a21927b257a0b53eff0e
SHA1 ec569b903e54a62a9d833ddc8d40f36c0eb915d1
SHA512 2a9d2d58afb39aa2f93e897044c0583170d2a4041ef4ea3899e68f726083fa8e61f3e6c7f3c04a3dde9e63312a9b43b5c9d454f4ec154344fccb40b42d677de9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzL:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0J
TLSH
T100077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 17.2MB
SHA256 a156d8aead16ebbfcf7da6841f1f3bdfd7e8633141b8442aecffeeae895aae6a
MD5 50d0a9bba2ae03efec6a4e4135e1fac9
SHA1 4ba2759e2222681163ddb1d867d1f9b2bcea7b94
SHA512 ccc255263c954e574c4ee648af71bad33daebf2465626b22b01b75c95a4be7e72f5079913224a2ab2ce4059172ff93f724e7b3f516ca38394e6af92588a60bd9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzT:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0Z
TLSH
T1B6077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 17.2MB
SHA256 4416a2bb947db66e16f973cbac66d2c9e154c7786e9dd5724620eb729509d06d
MD5 aeb08be19783ec46f453dabf984b871f
SHA1 31640f48edebddb8298b2e4ac903583ff0690b9a
SHA512 299b39684a5a41f9ff8f5d2a02d59f876e5d2198dd46fb4fb00a71c7f3a0a4343e836a666150dddba3bd3a7fafcb6904023a5e6a24c2ca7de805ed07083f90a7
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzD:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0x
TLSH
T1AF077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 17.2MB
SHA256 f5aafc49c00340cfdb15c4c5677ca36bc172c5289861e042e9bceb7b51c120f8
MD5 3afb713325c6648bd6fc529122eae7ba
SHA1 de40588631e850b25ef5edf62541132e583cd3c8
SHA512 b613d5b700642af8cd52cfbff4f6e6185c9f09dc19aaadc0a675ef43ec525d1aebdbd0b054057f974869a555848283d72e012e63f4350b8c088027bd343ebf93
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzu:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0Y
TLSH
T1C9077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 17.2MB
SHA256 e749c378c84f88e0f760f717265af7a39350ae9a8cd73abacc03b2f6692f4604
MD5 51005890d189e0235a47bc52786c9455
SHA1 a98f788a5536003767592f9838e461c5bf1a553f
SHA512 33a32b02b12aae9a14dfd477a526a0a4dc0aa1ac77e248702e2679de637c15292f89107af7c17c41b06df2eb8a5b0a4d02b1fb18553a57805fa337e3d190c19d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzz:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0R
TLSH
T1C6077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 17.2MB
SHA256 869d03e60aa0e3a074e3660221f4d0db63331a3e2631923b52edd3fc5aa3dfdb
MD5 4f3b57cbd36a1e809ca68d63aad97730
SHA1 89c69fdabb859362387093ecac2b81d2b9b8b4a6
SHA512 7945c69d317a252d42c3dd77780d1ee24a63f7e48abdeb7fdc5d2090ea7341dbd90b4db2e1dd273609def3c201082d3a2cb1fd126e71d264baffa58bc673c406
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz2:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0w
TLSH
T1AF077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 17.2MB
SHA256 e523db0437cf585d00711ad098953199741ab8c579decb0c3a289bed22e08e7c
MD5 e3d4399607d6f2737e1e45dd503cc238
SHA1 d51cec7b1a03f537218f38a52d6418c17748e6b9
SHA512 30a832bbee788eebcb2a8beabb4c47814404e899c5340b1e4fc3f1048d1f75d52a8c16c70db6c25a3b9b9b140b4c348f059a3e2e53d6d9bcc23d0e33f88922f2
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz4:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq06
TLSH
T1D7077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 17.2MB
SHA256 5f5c46a88388f67405e41f3766fbbc5498eebacd9c18974b86d9bcd9c503d6d2
MD5 4fdfd4cad6adfab007cdbb95873d8d29
SHA1 8ce4c80bc135ae633cc9e921f804483280ef20d2
SHA512 4907f6e75a411dc1f5a0ba74e5857b4f774baa30e8f1f81d48e23a93e84a271c7c937b4078b1c68b3386b80d699320f109e7162b1a77cb93ad992f6af5191fef
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz6:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0c
TLSH
T194077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 17.2MB
SHA256 e6ebea0a61761c14f3b3bd10f54850b490275f6fc6853be4718373919351a7cf
MD5 8c2a5d21fa0001b81dd85fbd740d725a
SHA1 9cbd3a43ae7c389ffe56785bca08bb55250c04da
SHA512 8de3bdca7d7e47786185723fc6024e1d4f5941466846d92d30155cca28e3f6d1eeec4b9199611e60fbb0bb257c56228afc41f2852345585c719bbfa01c2b8856
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolz7:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0J
TLSH
T1F0077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 17.2MB
SHA256 d4730a1ef8d33066a06e9fec9185ee6b14c7df8e242961d77f59ef2eed319f62
MD5 1b88df27c6a2eed0e07899b45df616bd
SHA1 872bd75083688f1704a1c92f166a137be085ed0e
SHA512 b6053097d8cf604eba5ed31de8a761636af029e0a520ee75bdfacbdb69d9b9fa111a357bca657b1d27aded786b92bb093b06b7271ce4ec345074381183f3d231
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzW:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0Q
TLSH
T1D6077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 17.2MB
SHA256 38c487c59e5a34bb0a81113bc6e19658685c26e70b4de0adfd469f6e2e28ffff
MD5 0ae1c9621b9b8f00345d143128061c69
SHA1 bd00a1ebcaa8e6da6a002d87e074426c6f4b87f0
SHA512 f844475f3bb36e76df4997ee3c62937e0fc41aee1b8521af85a5bfb6ab6b1fcff0d02cb8038b746f8e8d4ef6d6c2d3c7645f5f84378f2f76b4294aad80a844c5
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzF:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0L
TLSH
T14F077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 17.2MB
SHA256 5a0c6575283c3a9d6edba9b8b437c62e1295e9588f9b673466660a77986809cc
MD5 c413943dc61d3bb4647a365baa5c6f26
SHA1 9f816c6eceafc9bd9e53d946a8a5eb9ec7084f49
SHA512 6fa96714853802d5c81340c86ccaf68039b790efe68d37d938baeb22193c3178b078e06017f9ab02c2bd2a233370e6a29169fc198d7ff9397b87fd997da285a9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzw:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0+
TLSH
T189077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 17.2MB
SHA256 e14240edb4d5817fce60e8b4e532f927649a016e363ebe7cd0cb4fec8b2c2278
MD5 66a7b8da7677ac50391b440e5595e559
SHA1 2eedc7004412b950ea1945eece2d82e9e52e6556
SHA512 859a9b4170a2bd1e3adec3253b05a48333dcfadca585a115b4b47c9912e7aa71f8942b9d3bcef374f29987786b556ca6517b58aa2d649e1be6149da8cd7cdb9e
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzq:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0w
TLSH
T1F0077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 17.2MB
SHA256 46f3664d8e1f8dd300a5adbc3f3a93ec25725c4218d3a68c27fcacb87a3eb9e0
MD5 c0129a3fa573b602ca4d9616491a00dc
SHA1 e292517d8d2ae7ed12aaf6d7eadb247991991fca
SHA512 c13d9f8c0ed58c7ae7f47eb7f67cc984abb0ccba05d54d6b4396a06ff678eac3aa5f298ecdc928b237ebe5f5d11145df7fe59a3a538844d904f36fccb73c03cf
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzX:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq05
TLSH
T198077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 17.3MB
SHA256 a67db561f141b9f4f2204028615efb4906f36a163c0d387ddfbb13c54d890d9b
MD5 1b9d01c4d427597c726b3dd7052b1730
SHA1 9eb01a59c9e6ba13b426122dcf7d9f6f0c3777f7
SHA512 baee576efd2ef2449573f029af773eec791f44b5ac0b3b3d88559b793e94e12c704e9f3df9ca41b0695449e6a1cb5859ce39709699200fb8ef9038918720aad7
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolze:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0U
TLSH
T1A2076C03F19441E9E16AD174CE659231EB327C594BF166EF3280B6E52E33AD07B39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 17.2MB
SHA256 81043379472e707390cc7dd85b0a485a5a3987866b0a8e528cb2b0cd9caf092e
MD5 afec8ad236ab25e37aeff050feee9c69
SHA1 3a0f69be06c20da8f379e806553fe7fc1b6cdfa0
SHA512 2a10782ac39638af262a621500bdd34aa6c63dd99bae627cdd7b193bb6d843b963cb5abfe41bd6bc6c96ae956e284e6ed83ef151aafbb60c1bdd63f461821ea5
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzG:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0E
TLSH
T143077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 17.2MB
SHA256 abb720dfb3b45356fc80e5dc040c999a20ebd45e4888ecef100f2db3d33a27f2
MD5 011ccbad877d6915dfb8b2bea2e76417
SHA1 833dc9f15caf4ebb0a582a1854698db2c5fa7078
SHA512 04d3da3a047af5c3e52456658932be5c34c3556740cc96a33eb74423afca5236ffa990ac0a2caf47449d45dbfc8f053f2e696957527d7f1656dc7f12d26cd139
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eolzlSWyZ/K0ttYVAAT1Kmd0eolzsD:zyZ/K0ttYZTEq0xyZ/K0ttYZTEq0KD
TLSH
T1F3077C03F2A441E9E16AD174CE669231DB327C494BF1A6EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
MD5 2510ff22aab74c2ba735738716005a2f
SHA1 306d676ad05de19254b82e221f183ff918e4902b
SHA512 b06c9137817610963efc14c36895253ac8c2eb5af5c9c5e3bdfa59fef8050d9827e4d250b571051c52d7141b4d69702cb0e23a14a114c3e163b1b5bdb2911f1f
TLSH
T1BEF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4540AE6C3E3B3002F494BC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2084-40-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3316-28-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3316-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4676-228-0x0000029103D90000-0x0000029103DB0000-memory.dmp

Download

memory/4676-201-0x0000029103C90000-0x0000029103CB0000-memory.dmp

Download

memory/4676-177-0x00000291001E0000-0x00000291002E0000-memory.dmp

Download

memory/4676-242-0x00000291053D0000-0x00000291053F0000-memory.dmp

Download

memory/4676-202-0x0000029105000000-0x0000029105100000-memory.dmp

Download