b6e15b6b44e68c5401e773381ede36fab71c6b254520511ea12fdb5859057462

Analysis

max time kernel
81s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
Size 12.1MB
Sample260703-pyrlsshv6z
SHA256 b6e15b6b44e68c5401e773381ede36fab71c6b254520511ea12fdb5859057462
MD5 386ba4cd040fb36a0a2259bb191b3442
SHA1 931d8274a28d1c45ae1300acdbd42d93a91adaba
SHA512 8208179e4577c8613028ba552dcad093eed37732f2aee404449c35c93fa2e853bc553714f481b68bfa19954e39108077d14fe54ca59a1f78eb5e43a48eef33e4
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+Ea:2c7c7c7c7
TLSH
T18BD67B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{9C3D49D0-30F5-4265-B81A-8B9572F7113F}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{B6736E9A-9839-4BC0-B00B-F0043EBEFEE2}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe
Token: SeShutdownPrivilege	3820	explorer.exe
Token: SeCreatePagefilePrivilege	3820	explorer.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3324	sihost.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe
3820	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
5376	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2720	2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
2596	StartMenuExperienceHost.exe
3820	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 3820	3324	sihost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5376

C:\Users\Admin\AppData\Local\Temp\2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-03_386ba4cd040fb36a0a2259bb191b3442_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2720

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3820

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2596

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 12.7MB
SHA256 77cc7f535f05ad66731b62a208bc560224373222e8570f3946075edbe7d83fa9
MD5 93af9515b1af034e335e4609bccbb607
SHA1 ef8c9ec27ed4ab65447fb40aac5d47a0ecb6f373
SHA512 84d65158394a846de2964c8d5df4b13e0d317bf773de60247f7425dbda8a7b5aafadbc3f8fe6c9416135bda86c0fb1928de19dd5347deb6b6883efc8292b5ddc
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+Euo:2c7c7c7cW
TLSH
T1B2D67C16F6A440B5D17A9474C6A69736FA3378120B719BCB4394C63D2F336D0AE3A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 12.1MB
SHA256 b6e15b6b44e68c5401e773381ede36fab71c6b254520511ea12fdb5859057462
MD5 386ba4cd040fb36a0a2259bb191b3442
SHA1 931d8274a28d1c45ae1300acdbd42d93a91adaba
SHA512 8208179e4577c8613028ba552dcad093eed37732f2aee404449c35c93fa2e853bc553714f481b68bfa19954e39108077d14fe54ca59a1f78eb5e43a48eef33e4
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+Ea:2c7c7c7c7
TLSH
T18BD67B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 24.3MB
SHA256 fadda67c1df78258b586819ce9ab643b2268c168afa610288c0bce361489201e
MD5 4da62e18bceed3a776c5ec36ac6059e0
SHA1 24e00e249143a795cc4e69bdf8d4df3527f5e991
SHA512 320ef258de31324d428219af10f07ba28eb44f84e4fb64bd376e20488f021105531fa4ab4eea344e6c5e72c9a338d812b07eb71cc4710a9f84f863f8fa76a1b3
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VK:2c7c7c7cSc7c7c7c
TLSH
T13B477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockImport.asp

Path C:\Program Files\BlockImport.asp
Size 12.5MB
SHA256 0937daf6aed33249c6c6e2a4eefffdc681d8a013bf3ccc4a3aba2c425d3a0efc
MD5 821da1f6816cfde7efb4e639389dfabe
SHA1 afa2c766dd2a23383c62bb644a71ac0818dfd2d5
SHA512 6a2236446e7059ede307f686eb17b5179e1b9e80bf334cedecd50e4ba300a49341ecd884322450335904c16e4263194de5b7dab81ce76f3a00b3813ca6761c94
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EVW:2c7c7c7cJ
TLSH
T18ED67B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 24.6MB
SHA256 d0018233e1320226117b661007c93a2dc8c166c91355f1e47b55e60296cfaa3e
MD5 35dd82952d0e29f2fa3eaea1828a0751
SHA1 81e3af1028aaad158a5269753eb0c7e4844d30ee
SHA512 c51b955fd4cd5b93ff014817c9b88707b00897a29deb2997981658ecb3d4de6479ab28aee4d62ae1e2e0e7047d6a979aca6f38561eec35fef9a6a1cbba5326e4
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vl:2c7c7c7cSc7c7c7cL
TLSH
T1B2477B16F69440B5D17E9430C7A69636FA33B8120B719BCB5394C62D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 28.4MB
SHA256 24f0e35312ae3c4cdbfc338c18df6885c52620f7e1f14e04193e982a079b7c71
MD5 b7bf12b479bb944d5db8761b02d7ea76
SHA1 5c9f17452a67d25deedebc80815711fdbda0c086
SHA512 80dc99b733852fc554a4733ada80c8adc0d16eba3f77638c50039aa3547313af1051e54d6532b72ea13d1dcb5be00e20b75006282a9fd23578a4f18f86087719
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VN:2c7c7c7cSc7c7c7cqvyEYKbi
TLSH
T1CE677C16F6A440F5D17A9434CAA69636FB7378120B719BCB4394C62D2F336D09E3A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 47.8MB
SHA256 9884ea9f8e06d0d5c9251f900b92dc0224da319ae901a39f1c1dd9fefa042bca
MD5 c5a4e40a72cbb65f4d59e9e9b22e3b8f
SHA1 61fc21aad14d37fce36e2cc900c97cda0d3ce435
SHA512 1b7eb5a5950ca6b9dda2f25dc6dc46b9c22df1a39c284fcedb8f35639b9514093338079fed3b8b1fb48bd03fc5df9f66104680fd17eb3ad1e0e7c5bec9497216
SSDEEP 393216:2c7c7c7cSc7c7c7czUEtQevvqc2W1cpV2XI32i:tYYYRYYYwE8c23pV2X+T
TLSH
T1E6B75B52F6A443E2D36A953486B58276FB727C0A1B3197BB4278F22E1F336D05D35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 26.4MB
SHA256 f3861d9ced5a6cd1bd39085ca67de2a9a16bd73cafafaf94a4f12aa18c3552a4
MD5 3e320e4a2f1df334d2e4d87d791396f4
SHA1 d1c9fcbe990bd202369c69c8a06dcb367b190e59
SHA512 e471d2e26479c2c40a6e264a7c5a417e45072d29a33162119d294d6793b7ea30b94a3f8646a32205c844dd48431a48216075068379ce3a1f677bc00572fcebfb
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V:2c7c7c7cSc7c7c7cHG
TLSH
T12F577C16F6A440B5D17A9534C7A69736FA3378120B719BCB4394C62D2F336D0AE3A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 30.3MB
SHA256 7b1ca038c9b87c8236f07b26ba26eab29f7dbf919a4de51b8dfbfa9de4d90c93
MD5 e2448aa2002c2c9b14991b0c2ce60456
SHA1 788adb43acf6d3a72fceb0e45af51d30d90d5dad
SHA512 2f1e0295b4889a670706ce0cf0b9a55afe901b22fff3bcf36f0f0b022de1e3de0db11ca05fd1ab583026dd0525e6cf79f321a9c86eab07ab55d3ef499e17487a
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Ve:2c7c7c7cSc7c7c7cmQsas+PS
TLSH
T1AA677C13F6A440B5D16ED470CBAA9632EA337C460B7097CB5394E66D1F336D0AE39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 26.0MB
SHA256 eff8c462c1af8988fe49c28c6c894c037a4a0eda6b60eed03d0ecd77da2b07c2
MD5 fc5903254b5aaa267ceb6b653b03a5c9
SHA1 0e1c897344849d5f68329f9a0f3b338f9431280e
SHA512 ed00a4c7c95fac577b7c17775f1b19b8a908831020ab4e41dd16867db1ff506a5b7df181cd5f8d7140f1951b13e7ca97b8b8a060ccc3f79d4c698d5795839181
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VM:2c7c7c7cSc7c7c7cW/
TLSH
T19E576B16F6A440B5D16E9430C7A69636FA737C120B7197CB4394E62D2F336D0AE3A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 27.7MB
SHA256 6611a1dae7568629fd4f95cb19daec312d03020dee5868ca2d58cd422da43ce6
MD5 9805c51947bbfa20503602571d28cae9
SHA1 32c9012f1743cc9d61a30e110e260083b2755e32
SHA512 2343c1b08b885509fd9c89a943718a29d6dbd87c41f4e0a118e651c8827f73475432f919c4e1968f0b30bcb5e30e2fe2d7aace55ced55dca0157a45315cb00c9
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vk:2c7c7c7cSc7c7c7cE+6
TLSH
T11E577B17F69440F5D16A9434C7969636FA33BC120B719BCB4394E62D2F336D0AE3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 26.5MB
SHA256 785fb48bc64f1f065d53ea6cc0af51e873295056d73c9b0c86ab8809dcc65efe
MD5 4e5e60eb89356abf86b2480b09d11798
SHA1 0d26751a1093680b840558760a69f8bc22f3a3ef
SHA512 3053ce7a2d3b465bf888ea0b97aff3411b6e2de7cac0d44d210fd61b77c84e8af1ddc8e00676283747391a1514c6892f2f71fd3ce9d1624825e7f311ee469ec3
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VQ:2c7c7c7cSc7c7c7cGl0G
TLSH
T1FA577C16F69440B5D16E9434C7A69636FA337C120B719BCB4394E62D2F336D0AE3A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 25.9MB
SHA256 19613bf00c594cc1c22458b7a3ec574ed5a399a37d794dd788442039d0370b8d
MD5 4c5ce7f65901ebd879814a8b6df36095
SHA1 a0a57f7efae6b64dd88fa6cdd7c3dd557a8eae8d
SHA512 13b3a1d6b816367b2927223046b1b07080693f83533e230eb96a70757697413121f26240961b713146ba82be9adba5a0e25de19620086cb8e70f161203d9d8fd
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VX:2c7c7c7cSc7c7c7cpf
TLSH
T182577C16F69440B5D16E9430C7A69636FA337C120B719BCB4394E62D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 26.1MB
SHA256 bf79754fd4f86272a3996433d380abcf1dec95855deea130ab463db725e172ce
MD5 7ccc1d564ab93d3a00478ebd2f89f64a
SHA1 d36fa9412204b45c0bff9c4cc51fd28e6341f2b2
SHA512 0843cc8c38f5b48ad935fcad11f01475bb6d868e86d22bbe1e40b64feaae570e3f8a3641a1e1e984e157fdb8e734196bc12fa825fd32cc0f1912c9c36999fa1d
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VT:2c7c7c7cSc7c7c7c/C16
TLSH
T1B5577C16F69440B5D17E9430C6A69636FA337C120B719BCB4394E62D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 25.7MB
SHA256 0f0d92274d90f388829267c7c910f864b67edf65cb251d8295ed09b2488b9a49
MD5 efe381399137efd1e594a4545adfef02
SHA1 10e01c977bbcbaef502a4b19bc97d47d654af3ac
SHA512 0cb5ed7cb1e6b119457a8f178aeb58c1783f200602710454a7c0e17e81f97da7e921d09e349265dc113f39a927d45e993e428a149fe51917ab7f701adf29b978
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VA:2c7c7c7cSc7c7c7cF0
TLSH
T1AD477C16F69440B5D16E9430C7A69636FA337C120B719BCB4394E62D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 24.3MB
SHA256 7a87f3116318dadd66b4536622baa0ddc301d9227db8114553733fb63a2b84e4
MD5 4ab2145f2b7905b84cf425c23a3d86c3
SHA1 d6db1efdaf1ddbc0c54c421b817df971e109e800
SHA512 165928c9b22d442dd7bcf97e5989d8c611a2cdf0d7498d7a0c919488f5ffedac7a4af9de4ddaf201ef597621775c3f84b3a48f7a7b10e47b5e2d0e03a565bf9f
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V8:2c7c7c7cSc7c7c7ca
TLSH
T1D2477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 24.3MB
SHA256 cdc5f534e336cf5c1b4455197a8556d6ec5effbcc9ad99966c78fc171da12cc4
MD5 b75c0f557adce7f4ffb0b816097387e1
SHA1 987244046b7adf19cb14960ecdb1ddecc89d0dce
SHA512 6935db830eb158da3ffade19f06da6c88bbb99e1d4b5356993bca62bd0a796eb9b76504c67f13c8ca7303343e592f60897d5f40653b2383cd33f84a3f71c0b6d
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VH:2c7c7c7cSc7c7c7ch
TLSH
T10F477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 24.3MB
SHA256 b4b7a2766828894d79f4c25684f3b98323d7f99a3e161dda4c79247340da97ec
MD5 7919de0620fa0c7db379610e6ca25ea1
SHA1 54bbd5db561c74c35aaf11048ad2606e16711c0f
SHA512 b52cecbad58ff049eade70a1f61e788c23feb49c145251bb8547363b45ae1dcb19fa791f58f20ee78d2a27750666e475bf8cac8820de444a0d395b2d9ad3e127
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V2:2c7c7c7cSc7c7c7c0
TLSH
T1FF477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 512KB
SHA256 fded04c6d782f8085d397cfe282605c1f1fba531c6920ee79072db343ae14316
MD5 617b2b0ae1d67b13be09ed264d43ce6d
SHA1 590eb6699ec92ca1ad8e13a6f505a26f4339042f
SHA512 cfe4a7598b722588f276f633ada390fe3031f745c28c96a146eea93d5bfba3c2682c682cf9a2c82a643437e98e9e029a34789ad9d302ae90fa0975e4e233a1f2
SSDEEP 6144:wExovdPwklltvNvnJGMjNubhWAqrZgVDFeDuf4sl2QExhTcItBg5+rgurkZ9vIU:wESvdPZz/JGMj4YwHfRlz6YYfrgueRJ
TLSH
T116B4AF42E68240F1DBC63570157E7B3BEB3D8B4A0128DF83D3A4DE615E32611E52A29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 24.3MB
SHA256 3a57aa878499b7f6c7cc7ba3b4dcf8b092a7c2b6115fc2681080f31fb5e3fd87
MD5 94d962612bcf82a66ad60f47dd5f16ce
SHA1 4da786d287924980df838328809fab1342e8c1b1
SHA512 1e4442fb3b783b7091130a5223d413fc22141cca82f285b9fbe0d3ec8ce430b2b533d9c441336b143c8a05d1e1895e3fee3a2545d4625ff66eb550b4d9528db3
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V8:2c7c7c7cSc7c7c7c+
TLSH
T101477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 24.6MB
SHA256 7d1c298ce0bf99e3fb490f200179b8459bdc7d9c0eb33c670da7e7ae046c6a09
MD5 6162555531d007d9169d5133f1b7a79c
SHA1 68275db38e8eadc7e97a6eac8f834d41378f00a0
SHA512 c93127cba3b6878923adf2583731335c7cad7fea5a8ee1e68ef7a747cbe61a1db15f87c2d2e388fcb8f136ebe7f76cc06e55c3b3feb5d1ce2020646bc6e55d1b
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VB:2c7c7c7cSc7c7c7ccm
TLSH
T104477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 24.3MB
SHA256 7ecffc0c4a8783407cb22ebc486fd053047473c4401e068209c10676da62708d
MD5 0190ff76260ea1785f45a7f6ef2e943a
SHA1 6a5b4973d44f44f69b2152997a49eb01f558e8e2
SHA512 41af4f64fb652b0ce9f5566177bb8394ebe351c96adf58758e6ab961d988523420f7bf9a30be4099e7d417d31b90f4cce23c306c8b0b2f2e3476122d656a6b6a
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V6:2c7c7c7cSc7c7c7cA
TLSH
T176477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 24.3MB
SHA256 d4659b88151ff56d671f0030aa0e7f23eff7a8f9373b1f7c93b0f74180b4a16d
MD5 696a68a78eb8c70c64e64c2165519994
SHA1 a829126d7dacdae87ffcff398d04efe22520d0d3
SHA512 0a38cd0704fa6a1ec43a93811b66a48617ec297cd6ff6ea30fc8e930bc30c369c7a87c95ba9668e35882819771203fd6784385ebf0207882fc3a20da7e85d36c
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V2:2c7c7c7cSc7c7c7cY
TLSH
T159477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 24.3MB
SHA256 a3be00fe34bbf1520be7f4c284db9ebce3696e1d55023f02ad792d29c803e2bc
MD5 41ae0f583c52f230a9b1d87b48c8746c
SHA1 133fdadf1a83aef137f9df328cf9e85096ee003f
SHA512 28d6e150321637ffec5ab09ece290d4d06b06f2f0c0cb6619a90b212a07b717bae9e86c82733fb4006e95e9d2940e28c701d42cd5208cfa4b2b6183720e5182a
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VZ:2c7c7c7cSc7c7c7cn
TLSH
T153477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 24.6MB
SHA256 cbea99839ec62fa4871fa80fc71d2b5a26d34cdb742e6499610e6f6e4e956cce
MD5 76e62d02d3125d21820b718e5dc3dea3
SHA1 baef8752bf9dcd74df4c61d558878f8b49df83dd
SHA512 9f13759316d75fd4aaefef2d179f2ce94d545c9b4ece434f341729a13d5b62b08e0155dced465bc3c186eeb757ddaf60cf457e3161d6700eac4eae57117376eb
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VW:2c7c7c7cSc7c7c7cu7
TLSH
T1CF477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 24.7MB
SHA256 43a4647e052ea8a016813161241f995798adfb5b5b4df8099ff400e937760109
MD5 9a36dc3f20d66b65d944456dba7d638d
SHA1 f238b45718588a63e24fb4c5f735bdadc5d3b3ac
SHA512 fdb232d1733cc2e84e166d320334ff0c4e461daa9011ecd92ca9f19176d4eadf31908a434a81daabe3e1a635aa2a0ebf816fd43ff396a0c46c96cfaa4a6a5351
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V1:2c7c7c7cSc7c7c7cpd
TLSH
T1DC477B16F69440B5D17E9430C6A69636FA33B8120B719BCB4394C63D2F336D0AE7A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 24.3MB
SHA256 79af85776741af6792ea130703c7674e2d905f4a857027a9298ccd20bb3ad829
MD5 9468346bae9776ba3c1030044ca22e26
SHA1 e7515026664945d4f5a4427d50f3abe7ca12dae1
SHA512 1d1281989de143ce4468d477deba76e8c5c4441b60de5d2ea2a1f34d9ee32b5d68eec3bd69a0cf2d07bcbbb284ddee2f0fb3936f70ad371d497a7ebf5eca27bb
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VU:2c7c7c7cSc7c7c7cm
TLSH
T15D477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 24.3MB
SHA256 a9f79501477823b3c9e68c8a757f2b3e6bf4abab761d723f3ac9539ab4c084ca
MD5 f3f393c7abc51a15587f5d5154e06a05
SHA1 ec3027e7be6aefbccb47e3ca0eab69f1c948851f
SHA512 f4bfd82eb8c26fdd20840ccb091d8c12afeb1a0afab7375c7d53aaa08b9cce11d8dbdeeb9b21c4db7dd1fb65c5a5d069ec8f1ce6139100d1405926ef7d427e83
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V9:2c7c7c7cSc7c7c7cL
TLSH
T1EA477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 24.3MB
SHA256 4f0ca82922fd515c545fe25680b7fbd0c0508e557248914970f3bc2bf18c3413
MD5 8d3ee7ef34c7847d0705a74e84ef07b3
SHA1 acd5b1e0b51f2ed545b0859b6c618b8e107feb35
SHA512 f4a8912df95520a6f35c296c1f4b84734064343f36f546697b7d1d686a8b64303d5f52123eddfdb69b35f997f2faa49241463e7fd214cbcb283592db7a05cac3
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VY:2c7c7c7cSc7c7c7cy
TLSH
T1DF477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 24.3MB
SHA256 ee5f671c0c4880c0e33dcc7d7d4b7315346481d3c7129ea98776f473553cb6d5
MD5 981014e4595f41ad693215522f359ce3
SHA1 b21060801bcf60e1adc690114f502cec52be9ec5
SHA512 583a6c21d5194efe2f3662358736c9f83f5c606e7aca2b64c484b4a2f495c0063a8534b917c3d7abb24c2149d471578336efb05c66cba2b56783193069dd0498
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vu:2c7c7c7cSc7c7c7cY
TLSH
T116477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 24.3MB
SHA256 fcf49c16eb1a93865933d00f77eddb4e52bc129584071c3ea6eb8e28ff6c361a
MD5 ba6db5f98775f554ef9ad695cd7b3770
SHA1 f0d9f1bf7419b9fc24e86f141d4e237cd6863068
SHA512 e84f57204a5145549decbfd634fb42dc493de18ad11cc25cd8b14f3bd2fa6d0e01208c7b735f747686da6c80f95607761efa5e1b1b1181d90de93699a7e3c7ae
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vf:2c7c7c7cSc7c7c7ch
TLSH
T104477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 24.3MB
SHA256 4724d025e8f4156e669acc3e5bfe75af4691a9f14d6367a4c19fe8906a0fb725
MD5 e8dfb48478306893133268ad4de44a57
SHA1 3b3805c7133fa1dc63e8697544cd19c977d6be5e
SHA512 761e8b2b00e1d97d8a0ff056d9a90def16de8e95ccacfd710222378b0da09ffb0f11ce5bbd78d5b3a4767856c6042d6f6be6a28f52f47ee6282748c955f6c128
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V7:2c7c7c7cSc7c7c7cV
TLSH
T145477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 24.3MB
SHA256 ee7315901433a302c0599be77c85eaaaec60a1cd4f55a788e6b34632df92a461
MD5 9652baa81ae05ec326d36739f216be58
SHA1 c20bafd886f9564976fdda19fceb1f978fe65ee4
SHA512 5f777f95c2da1b18813ed514e43ec29b5466c7a91be4b2f95d1faa54b07ea34cfeee21445479a7d21eb3fc8ef57ff15824151d22a40fceaeab5db93f23dc6cfb
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V8:2c7c7c7cSc7c7c7cK
TLSH
T119477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 24.3MB
SHA256 5ab144822facf826991677fbe5559188c451facabda0151677309e75beabf73e
MD5 69ff7bfb441a3f9babfbec3832682788
SHA1 e81e88f723c1d4084f1dc642d384be5bebaddaef
SHA512 f2c4a82f96f5a4757374eebd356b94c339391a9b3fa63324acd72fe5f72400372e3e18ef3fd282b4e2249fd942a89ccf421a8cf78649da6a929f211aecd6572c
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VV:2c7c7c7cSc7c7c7cr
TLSH
T151477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 24.3MB
SHA256 401b837713d4edf061fcfea9d1e273a417627723e5e86c3dcd5bff6b29918e92
MD5 ab467546b9e36e4d4d899ced5ff86adc
SHA1 dea67891d33617fa238b72a8c7ff0861e70be0df
SHA512 950bb21fa6d305f683686bad3f97092652d7e4ffcbc4f0c80643dd2816fb0463a232b53247cb8c36dee302215bb6e0f2da3a67ce72fc9e80e7bef923c8a76a52
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VV:2c7c7c7cSc7c7c7cz
TLSH
T12C477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 24.3MB
SHA256 d668488f06e4984f6ba8516274bc076db37bb191a87cb8ce22a96df7ee7bd2a5
MD5 09b059f6dd721fb366901dc6c4589b32
SHA1 697d0ac398dcf1343fd5c77fb3f16e94fd5ea2e9
SHA512 2441f8f4bab9f04fe28c62d8b93ae422202b085fc7c60f7500bd7f02e31676385193ec8c827d10cf2bd172bab2fd01106b69bd97f42af2670ea616c878e1f79b
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vk:2c7c7c7cSc7c7c7cO
TLSH
T1BA477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 24.3MB
SHA256 f735507a69ef552edcb4123276588d50c5096d7279070871e599da6074fb6eda
MD5 66f129b04c6010d3fbe0cab4c0ce9b49
SHA1 6f79f0fdfa8984125365df5da21b495656164cc8
SHA512 9bc91c6bc632eae6f4dd8a0367912d04c5c46d925334e62a1876eee26997b9e6eb0be09d5e8b640215bd9e0551297df3482d4b82f1d3257feaa42f3d86c78362
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VN:2c7c7c7cSc7c7c7cT
TLSH
T180477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 24.3MB
SHA256 473277a8b08c0044a1d8721f682fcd56df3dc20c00ad670863f7b635b1c54ac9
MD5 b4350f7b33339cdb46d48b4108144ed5
SHA1 092658e20875b0b26a26786a7b1747603dd7748b
SHA512 3d33924877e2bee70fc6f89385b6de06cc8cc1b526e5c106f1d59be66ee6f6c7f63133fbd67b872db2cf39f6515bc1fe61a9c288d82a107d94e3949c27f359ca
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V8:2c7c7c7cSc7c7c7cW
TLSH
T1D1477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 24.3MB
SHA256 28f47d5b23470e8cf6d5763cbefffb8f5fed3bb682a3adf8eb66094440376a56
MD5 04d42bad8051effcba256088775fd6a3
SHA1 deedf18cf87b630213e0360b711b914750b8e609
SHA512 2b8afad489cee39715d484c2db8ab928120bb8b0d00792aa8770b5f6bca90c10e8325afd2a5b478242bb06df42be15107dae5c66760b63dea176f82ff81cb178
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VO:2c7c7c7cSc7c7c7cY
TLSH
T1BD477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 24.3MB
SHA256 61c785c497652e8ff97dc53c86a86a9c89567b393caa74985996307df7d8615c
MD5 5232d90a9c28422d4ce2172263597a5f
SHA1 06205cfa37c2b0b189d07d7467003fce35cd9d3d
SHA512 498a794ca786820c05d6d42527dd957f21de57cb3d572056e5abbef3855c8edede1b77f82fec5fd366da694b6f7c0677b7e9e1e13efe17d8947c955a82bea14a
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V4:2c7c7c7cSc7c7c7ca
TLSH
T1ED477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 24.3MB
SHA256 108400539ebab784168bbc816ad9aeceb91861cb06349c44c8024b3672d4ca14
MD5 5972f650c0324b302c3e4305ea2f795f
SHA1 09240e9738e4f548f0eaf055f9d61025c6cf2b1f
SHA512 ed9033ca2ec03cd16e4beee2c94f4af9b647246b8168cf68365135ffc134a8c5e600db81680bb651f1988b0ba8b3124752e5754a3e90de66e94b9dc5af45bee8
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vu:2c7c7c7cSc7c7c7cY
TLSH
T123477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 24.3MB
SHA256 c6ffc46fbc36ff1b6d5387af6894a214dcc1a15abe81fecaffc80e2febe9bdc0
MD5 ce94bf13cc787e9a678aa27cbc3ed903
SHA1 e67af328368218383f644508751dda22416f60fb
SHA512 21d71cdfff02c07798a304dde69338f7215c2b12eb6bbf8379ce0d92532b70c902e16dcd54bd1362cdd976a6e3a301f3c1df8db82e3260b69713c578a6a4d941
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vl:2c7c7c7cSc7c7c7cb
TLSH
T1FF477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 24.3MB
SHA256 681d3fcd961884c00bdafbdb7366601ddb1da6b9d80681060207129404f1e02a
MD5 452e55514d1b50db7173e022c1d52934
SHA1 2191d21640c0b015ef842453cd11798a2cd20870
SHA512 df04509b2e3c5c492dc62fc5cc4407e2e3f1be69523a1c5470fce8cb015fc3acfcdf02ef793ed986575247425bc2385a9d785fd10877054ecc101ae8bedac95a
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VE:2c7c7c7cSc7c7c7c2
TLSH
T127477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 24.3MB
SHA256 08ea1d0a765fef1b6527b269a0e130cc8bc783c4e940608063425776a3622948
MD5 7ab3ef4ad228720a73af7da48005a8ff
SHA1 3534a2a8ad7894f5c1608671b9afc50f357529a4
SHA512 8a8907526fd146570d0d9df5b3d970d497fa17ab693b6c89c10e1a9de89b4c0455d60ac635261e5e48b5a76ad56b3def0747504991945b7134b6e168f1580144
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vv:2c7c7c7cSc7c7c7cl
TLSH
T184477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 24.3MB
SHA256 522978490623765fef67fbd0b0a17d5eee02363e6ddc915ddc46e6b5c3b537d7
MD5 826cc8d63668af71bf9e11e8b1133e1b
SHA1 5f40742dd1920335178361651db1981f4f946883
SHA512 28c7b86881cd1d6025a2421e549fbcf37cae516065066beff10d51b037a6cbb76a08bdafd797bf234d0e160d4ffef25494652c71d7c6f9d4414989e775e9dd2e
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vi:2c7c7c7cSc7c7c7cQ
TLSH
T177477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 24.3MB
SHA256 4970cdeff9cdce25d72cd6a7503c475f2c19557cc969bfe99738e6f71795e227
MD5 7d9cea68fba40ed664033fcf36f0067f
SHA1 84b489a8de91f1a197d5f5a6e9997be54ee77a7a
SHA512 fe23183f212c85b95af040b355a3c54b1c75b1c607679ad0d045b5fc2bdb2b04b047160e841633754a9c557725fb697de8fee2bbb440fd44ae5d08d450283c03
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V8:2c7c7c7cSc7c7c7cK
TLSH
T11C477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 24.3MB
SHA256 742724c4f112e51ee17be982ec93f5a8903a4f3fbe60ef604989b785290c19ef
MD5 ad3d74f33e98af1e8b228c1a1f312a82
SHA1 057b7b77d0a9ac913d2cbaf732e8e49de9a15289
SHA512 35b05f0447a72907a50e52b21bb0cfe75c95cbb7245620ba2d4b7e4ef407c09bcdd98bcfd3623b2abf50219315d1df58880de7c26708ace7f076022705d3fa53
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18V0:2c7c7c7cSc7c7c7ce
TLSH
T1E5477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 24.4MB
SHA256 d8fd34017c06b9852217d1123672cb0c7432ac6b2bab418ecd7b2b4d9e7d9126
MD5 af45e9402862f92f47727969a8823270
SHA1 c0b9df0200e48f98c6b96477f5bd3f3fdc12cb01
SHA512 e66ec1bf1413bb0602dd0f98c1e01c53241358e7b1db2b826c26f3867a7e971ef8ac92aeb6cb2d2304457d596bfbfc466f1ae0a84721652b672d0990beb47f7f
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18Vo:2c7c7c7cSc7c7c7c+
TLSH
T16B476B16E69440B5D16E9430C7A69636FA33B8120B719BCB53D4C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 24.3MB
SHA256 d966ce49b72e1713fb8a292db604ed645c4d05a996f41f8a294d7d5e56da7165
MD5 f402e47cc0bd348d06163e00ed557d8b
SHA1 cefc70344ace69e403cb3ed9fe985bccd6a2ac35
SHA512 2abbe49ed9feebf257bbc6e99c5a87410f59412034bd770fb40801776f980050bf117dbed4de0ed427051d5dd7cc9573a315dbe0d5ad572839b4cbecaf2cb851
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VA:2c7c7c7cSc7c7c7cm
TLSH
T156477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 24.3MB
SHA256 862d9aefe25d489b54830658ca11baa1f33eef1e6e52fc3a68ddc63bba8a779f
MD5 a43050751c28984fc4fe409b230d84a7
SHA1 4adb45e1089117cc50340d2650133805bcdd73d0
SHA512 8d3fce560a22848ce7b12a4f6a59db35cbd054e291d20643581a32860f81960b5d2c436a813e7dfc5f3f7f40dc3df7558b63e4393f14bff432faaa8a3ea08920
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VG:2c7c7c7cSc7c7c7cWj
TLSH
T1FC477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 24.3MB
SHA256 713d39053cf7216ab4e9255e29a80ca3e83ad7aea2fa015865a35f5d58618ac3
MD5 0759c672519222e302e70e6ea76afdfa
SHA1 db9ca53255e695b1c626f143ab6fe5c137ed8412
SHA512 3e0c9e10d808891f5c65c6ecb9b17bef0ba46781bd70734bc39a52867930da5f0b6cc16f8c493b309dde7e89ee33b54537a9ea2a0aa6289e1a32a4d0a5250ded
SSDEEP 196608:l8Vb618L8Vb618D/h1+E18Vb618L8Vb618D/h1+EO8Vb618L8Vb618D/h1+E18VI:2c7c7c7cSc7c7c7cMD
TLSH
T10E477B16F69440B5D17E9430C6A69636FA33B8120B719BCB5394C63D2F336D0AE7A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2596-535-0x000002EF4B340000-0x000002EF4B4B6000-memory.dmp

Download

memory/3608-403-0x00000251BEE00000-0x00000251BEF00000-memory.dmp

Download

memory/3608-450-0x00000259D4840000-0x00000259D4860000-memory.dmp

Download

memory/3608-435-0x00000259C4400000-0x00000259C4500000-memory.dmp

Download

memory/3608-436-0x00000259C4320000-0x00000259C4340000-memory.dmp

Download

memory/3608-434-0x00000259C4220000-0x00000259C4240000-memory.dmp

Download