35370242908ebd407e92bcbedab53da0239a41357780a5c7a3a4fd00d3e7665a

Analysis

max time kernel
132s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Size 5.2MB
Sample260705-d1keqagz71
SHA256 35370242908ebd407e92bcbedab53da0239a41357780a5c7a3a4fd00d3e7665a
MD5 cbaddb8936ab5a9d1986f7d991f582c1
SHA1 1325b32cb1d109c6c8e12bcbfb43e477f2d1a246
SHA512 53eb2717d2772c1f1f22627636271956be9992147f37481b5449f546cbeabb767a3fb864ef8ecc88630b59418bccbc6138a1cdfe5b5b42d2788980f931064555
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z:nDyD9Kz
TLSH
T18E464B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{9E71C999-576F-4D15-B0C8-18F7C776FEB8}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{FBBC0B0E-782C-476E-A4BA-31BE8EE18CC8}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe
Token: SeShutdownPrivilege	3884	explorer.exe
Token: SeCreatePagefilePrivilege	3884	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5524	sihost.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe
3884	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2652	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2580	2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3656	StartMenuExperienceHost.exe
2700	SearchHost.exe
3884	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 3884	5524	sihost.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2652

C:\Users\Admin\AppData\Local\Temp\2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-05_cbaddb8936ab5a9d1986f7d991f582c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2580

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3884

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2700

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 6.2MB
SHA256 107129fbd1096b72cdad4a3e3a65910965c9a144bc4ffcdfa3b8bc3c2d9a5d3f
MD5 205ec729aed5ffff15698fe75a2493ab
SHA1 41ad310f7e28f93ce28dc15758344bb73391821a
SHA512 750f4ab384abc0d9d8d9f35d75d24960e08abd4f72cb360f42752565cad995fc8ac92aa13da6c0e0e64996a79086993d4d8bf3052f80d50c725e1e7207a92a2d
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0zlezSC6v2XMH:nDyD9Kzy
TLSH
T10A663B26B5B58272C0B6D075CBD66775FAB23C524B3087CB8245F31C2E336D19A3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 5.9MB
SHA256 ce321a7ae5befbd80aae9e3ddc21243faf16a500b4216b7ca9489662b07f2e41
MD5 4c876db1bed8d0df98f505331be12082
SHA1 d27ef0c8c7a129c119c85a77f3f1cc37df4084ce
SHA512 98997de8e450ea11be8919c90c86bfee36a068d811c91e977d3da5ed28a860352c26f556132a089ce9f6effd39aaeb0d721fbcbfb78ad5212e35dc0f1e49363d
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z9/h1+:nDyD9Kz9/h1+
TLSH
T10B564B26B5B58272C076D075CBD6A775EAB23C524B30C7CB8245F31C2E336D19A3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 10.5MB
SHA256 52ce29c3e24c5e7d10a59c2f02de67f252f1fbd3774f9f31909fc8b02bc38a06
MD5 2f0a73fac27fc46cc1d3710c4632ca5f
SHA1 7bafd4e38a677e59e18c8e221dbee26a016bb387
SHA512 87ad9a357e64b63021d1723ea56fc2dadddbb4c722fd0d7a3de0f625eceb1c3117791f781d4649df1a528925e8c7e163bdcbf5b52a9a4e48f59ce979f32da5e8
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5x2:nDyD9KzoDyD9Kz
TLSH
T121B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 10.8MB
SHA256 a0768e1884d3283bc6c16c6680b0d44dce1cd8f9073442b82a69e48230bc8cfa
MD5 34d9cdbf311a1090439f9716fc9e9246
SHA1 47a7255402d74846fdec0f9e6d30a49f8728c74d
SHA512 c8f44ce4c8a494ef4990d3a8dcdc11b332e29f0c192b82034b3aeba08ddad59eaf49f33852b176122242aeac23c55606a690f6ebe386ca097305cfb9857541c5
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xZ:nDyD9KzoDyD9KzW
TLSH
T1F9B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 10.5MB
SHA256 5cb3f5eb0ca689f344a9af634fb137a25130d3d0168b33f43ab23b9181fa594e
MD5 1ec69b4fe8e9877ff06307ac1e74b8fa
SHA1 8c3bd3058ee615f4e1b0b32d19a4c4a47dff7246
SHA512 bd5d2bd51f990da1a937196c9af05effa5159ab2c0c75d7fb8cdfe39d57e848a8c6260ed84d1fd28d6e1644b88b3537f13e95cf5c9f6ed372975c5634024c28c
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xg:nDyD9KzoDyD9Kzfb
TLSH
T116B64B26B5B58272C0BAD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 14.6MB
SHA256 719bc08c7ed00c235b21684d25578cddef5bd28df87c6cc540906e60bf16c813
MD5 8888fc4d6e7d7884ae926057a717ecba
SHA1 a5ef1e35131aadc6fefa75c3980ffd25e11ac765
SHA512 9ab88b7d2fcbc2142734fdce570a9ee012993d1503f27efcb51af102267e7b1582deb3f87c4ac51dd4d8ceb2024c08999d2de8f83a9ddb48a4407d6aae9180ec
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5x5:nDyD9KzoDyD9KzFvyEYc/b3w8O
TLSH
T136F65B26B6B481B2D07AD075CBA69675FAB23C524B3087CB4241F71D2F336D05D3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 10.8MB
SHA256 f132deaf5d89fae69b7f92b86887db68f5862163a73bf2b312a11d683c6161f1
MD5 05ebc5209e4c661d51beb16aa742e226
SHA1 78f1d7c027fdfee9d33b9a417690df427967b80e
SHA512 d9942dd3c9e607e71f5571566b8788df6cde8a365c38a3919717a37496b13ff068e446599d4643f684ad2abf81e2197434df5a18e7718c859a4ad002316c39c0
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xs:nDyD9KzoDyD9KzX
TLSH
T195B65B26B5B58272C07AD475CB96A775EAB23C524F3087C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 34.0MB
SHA256 c8314637542962be770c330d3047e896bdc35ca3aec45ebd013cc19dfcbdfaf1
MD5 60b488e54e3d285055410dd446512ad3
SHA1 adc64739e8eac0af97897ec2223e5962e8a32b9f
SHA512 45e524fec4bfbee19030a14ceb3456d9b6ed9ac8cf5b8fcc5e3075dbcf6df2b73d733403fc13f4fa887412bf755e04d70c6bbe4077b6d36a149b59d38640b0d1
SSDEEP 196608:nDyD9KzoDyD9KzgUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:0K3K0UEtQevvqc2W1cpV2XI32i
TLSH
T139775B51B6E443E2D3AA94348AB282B6FBB17C0E5F31977B4139F21E1E376D05D29321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 7.4MB
SHA256 b15fbe266c62ded06b7eb6cb235447361ceba1e87b09180112264b8edaea1f37
MD5 e9df6ce977b72f485c06c3341ec4291e
SHA1 195865d696024ad59aabea7b06d27a3cf4eb2fe4
SHA512 5c44ea94b8d247b422d7d6aa8360219c5008b5faa103a23eb76ddade14de83aab94b1af03bd7cc8f1cf674f6b854a34c7aba1e3761867e965464318c2d945355
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0zOoq2Vjnm:nDyD9KzOGn
TLSH
T123765C26B6B482B2C0B6C175CB969776F6B13C514B3087DB8245F31D2E336D09E3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 10.6MB
SHA256 ea4906a85f9d91fcf3a0dffaae615f64d25c40594203b70082363f2f689ccc88
MD5 51b1708ac039c120d38e00a66e1b45e8
SHA1 83d1a72451a4a37286bb6eacddc4f22c67b5cb29
SHA512 9d4585fb15d004988cc41bba47bcd166f1e003e1bf6c75cb8c9ce873ede0dcda1cb9574fa90f35f47c35f1a7047d12894987d95dfa3c479b756ff2bba8fff800
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5x6:nDyD9KzoDyD9KzR
TLSH
T1A9B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 16.5MB
SHA256 f38099403f9fc9fa203b11bc18d46948ecf171b380f54f7dd1be15bac2e362c1
MD5 15a17663c65c1d057570c28e593aa99d
SHA1 3e372162f39218e0e25b872f8acb698d573b7bb3
SHA512 1286092e3b74b18070cc1f86e3f47a83d015712cff1200809e0d25fe489e9dbfcb67665d8bdb593a8ab25d56f5a42b54e4f009c30fd0924bf8c839ca2e70c88b
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xq:nDyD9KzoDyD9KzjQyiKaUX+PNo
TLSH
T1B2077D23F2B541B6D06AD474CBAA6731EAB13C564B70C7CB4245B3682E336D07E39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 12.2MB
SHA256 1952edc312e4f963e7f74aba2c889855d2e8c1aecc85d2e3b059d9eb21adced0
MD5 36ddce9c98dfa0614da4d3dc2ecf51cb
SHA1 dfdfd0b367c95847527baf7f8a6b683750755d01
SHA512 c81d81f38efd746ed3219a7431fff60f006458ec5ed3c30d8989f755e9ce3ea7fae6c7283b99f977f826634fb87eaf7afbaafd6d375b5cbd4ecc9c9a4fb94680
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xo:nDyD9KzoDyD9KzPthHf
TLSH
T14BD64B26B5F542A6C06AD075CB966735EAF13C514F70C7CB8205F3192F336D0AA3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 13.9MB
SHA256 e70d70a1be2ba26394d39ae45d23b41f48237eeb145630b586985314b97b17b8
MD5 ac0cdfa4fbfc2fa772447b89e4b0c27c
SHA1 949b5ae100241836cf4bc76e392505838c3469ca
SHA512 d4429dcc6b8cf94b7d6b5a93e822bb598107ad029f97c16665f78dc225e044cb73354afbed6f71221048c2ff8a954d664b35a57e6e09694f441bfba4ce0a877b
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xQ:nDyD9KzoDyD9KzrLIHuWhs
TLSH
T1A6E66C23F5B542A6C06AD075CB96A735FAB27C524B3087CB4245F3192F336D09E3A729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 12.7MB
SHA256 f9c176dfbe10d1cc470811353db91b5fc3ba39630937829a7bd2cd63562779fb
MD5 a21a1be81d1a01feb2d2665789ca155c
SHA1 f6e8f7d146180169e1f3d75e865a289d3a20030c
SHA512 1a56426995377c0a109604d9a54ca28793bb379f6285b92af63b97229103e8476effd51c74d0928cdcd23497b81f37fd2ee955c9ff3bb801dbabfdc181e72a68
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xM:nDyD9KzoDyD9Kzb6Jm0G
TLSH
T1C6D66C26B5B542B6C07AD075CB966735FAB27C514B3087CB8245F3182F336D09E3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 12.1MB
SHA256 e3f6a94777cf7f81039e42e6d1b6c531dc0b96bc6f926f4e1cc1ca4cb64fdcf4
MD5 9165153347f16e2bcc1194c62109c50d
SHA1 fb8ef879b88695390d01393a5ab27fd5b6750568
SHA512 cac162b9c5a6a2a2c29edc58b77a42b42048975d1cf40bda09e4d08e1b2da117892c4e2187bfe0d9e2cca6c2be7e42f3276e6995a0e039f28cdc36ac4e2be8a1
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xD:nDyD9KzoDyD9KzgfPf
TLSH
T158D65C26B5B542B2C07AD475CB966775EAB23C514B3087CB8245F31C2F336D09E3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 12.3MB
SHA256 6d5acd9037289aa00b8c5bd8ff57b6621ab2562255fdde5025ea3e17735eeed2
MD5 d62141925c7e8d5f9dd71166168bc0bc
SHA1 70b7942237e01531b58df55a321159d0d36d68db
SHA512 7fc046c91f0aa3fd16404e3706af1d9fd1f8bdcd42cf3fb9f3c8f7ace64a66b76a9ac68e585d470660ec3c9b54eee67846049c89759a8456c4c43d9373402754
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xf:nDyD9KzoDyD9KzxdKC16
TLSH
T1F7D65C26B5B542B2D07AD475CB966735EAB23C514F3087CB8245F31C2E336D09E3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 13.6MB
SHA256 69e36728e6cafe3118d59ba3c695398a6e49face0fad02d8840ad6a0fb4b3e24
MD5 638fc8e3d6eff94319abbfa2ee2015ab
SHA1 d037d8f0d4ed4c385a6f434529869afcfa5bb322
SHA512 4b1e2f9264d5b87ccdf715eee130f3bf591f50f34237eef2b0709d812c95ee744032aa14530361f7e5bb3f2c1a612dc7e68e214f8176b34ec3b6d42ea3a253f3
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xO:nDyD9KzoDyD9KzgjnDO
TLSH
T13FE67D22F5B542A2C07AD075CB96A735FAB27C514B3087CB4245F7192F336D09E3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 11.9MB
SHA256 2339176557a0675622b9cc9af8268f2027a7e191a054da4a1473566fb0dc2b92
MD5 24d1c143dfa0d99b5ec09960b32f115b
SHA1 c4726edb5b6d97dd6b552d6591e1e5dc4e80eed2
SHA512 be06531a28c4efcbb9776ac6034caf8337476a75da881d557150b469659f035cfe4e97b3ddd84eb1bd8f755f52c906022a722f52996fb03d43d1c07add2b4927
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xk:nDyD9KzoDyD9KzC2iw3
TLSH
T1F5C65C26B5B542B2C07AD475CB966775EAB23C514B30C7CB8245F31C2E336D09E3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 10.5MB
SHA256 3058781316cc451f8afedd699ab5ff90eea13d3020d20334677f21e5c0d371cf
MD5 7708bf68474496f63c07514a0db5919c
SHA1 4b7b6352eeb028370deef76183bfeba61055e933
SHA512 194de1158c72b09349c042482e3b1abb93ac1a3157acffb12cd11985d726904a3b5f2ae8d94574a8585f93bab31034aede93830e3c8dfa12ed1ead1a3996a4cf
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xw:nDyD9KzoDyD9Kzz
TLSH
T172B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 10.5MB
SHA256 3fde7383e2907b3d05037f70e16c6114c747b3f3cbf1b8add0683d6ad5e16e07
MD5 d95bf4007c5bd162baf1501f1eec8e0f
SHA1 2694a2c10da1192b85ab9ddb2ab0c511c886afda
SHA512 ac2af8db5ca37a974f62d44dc9399483a3ea0e596dc37becabf4dfc1e17f17ca7913bfc445bc38098f240552f694d9f28db4601564758762e06e3c445f461f57
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xo:nDyD9KzoDyD9Kzb
TLSH
T10EB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 10.5MB
SHA256 c951041f2c33ccc238a7c0664929ac33ccfd18668dc597b9aa86d91f4dbb9e2c
MD5 dbe370875f2c09db4be8d21b4f798ee1
SHA1 fb3ff0f2709505ebbafcbafbf1589b996a833734
SHA512 49df1ba0c6dcaed96199aea2ac90053d20d1fe8363d1cff8df42a33c706d61f52f3438f7266182d40d1034d610cca431691bc672d241ce0923727ac716066365
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xL:nDyD9KzoDyD9KzM
TLSH
T18AB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 10.5MB
SHA256 4b0a3fb550bcf370d4bfdacb909ef7ee68450daa38ae6dfc72e553cac43a95f8
MD5 292d44adc65e5a3e5ff8adad9f86e909
SHA1 8a0c657a2a1e9ba4d37b7a43f72c5446d1fe19b7
SHA512 e83fc25ead29985e6ff296dabce9138442f9b8d00c9448a7c889c939522efb521cfa6341203bac65c9bfab4b5a23d3aa5980dc76b8c8af59fd61ed71aad4f984
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xi:nDyD9KzoDyD9Kzl
TLSH
T123B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 10.5MB
SHA256 b51a9c0a5ec7f4e19d7240a6a7afee3ce4aa05626a91a50f2520caf1f5a6d761
MD5 dc6bafb7d53f72c6db28d8a5b3372cc6
SHA1 871c809f9c88efcf9bb51037d150381433be8b5a
SHA512 35538e9fb34f96e620cd2f9aed545f06d8b9c23639f04c8f0cc92a269ba52012122f671a5bbb3badff33666c3281206d00b04cc254fb4e3dea05c872478dabb5
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xf:nDyD9KzoDyD9KzY
TLSH
T12FB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 10.5MB
SHA256 f3d00dcb740c0589765fa27b6aa2034daaa5740d89c55a6f93e72afb0f8e8c12
MD5 23896f2889c6a13535fc78927a70f487
SHA1 67db130630c952582c42244c94721400f1f5a29f
SHA512 83a5c5b60d00c7ba010fab933ea6efa5b823f2c70e8c54f6d80a8836df98bb1413bb3b8e9d46ed95731588ed24cbe3a61d8bef76c43ecb8d2357fd9f5229f8ef
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xY:nDyD9KzoDyD9KzP
TLSH
T1E4B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 10.5MB
SHA256 81496c460f6e4cf10c03948c59a1bc322c2f698e8e318a6be35a55fa8326373e
MD5 68756b6ff4f86e6400fa583bbd8ec240
SHA1 cb5cb54d885dc2a8a796dfe3f85c492670788be4
SHA512 9c5250af320eaa295dec59867847bfa6c22d3a815a2287e41e41edfb3f6633eb22d14088fe7e54b3b6b89b808026201c4636ccfbc513adc815e1f4eba20ac8ca
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xj:nDyD9KzoDyD9Kzk
TLSH
T152B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 10.8MB
SHA256 b25d7daf1184613e3b5b656ab0c30c6b3c437e1d8ba7c219588f264df19ea605
MD5 0fcb76ee05a0ed25b178f5b510fda2c9
SHA1 7333b37fd33d58f976b65d63e603ad0a49e9deb9
SHA512 7f1fc814496a473ee659dd671523c552e4c2b7efbd33d0f9b991aeb79348c8901201f90e3b6df5cb4a001b685408eb7658c2a6ed09d6d02377f534f5986b6b07
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xF:nDyD9KzoDyD9KzLfu
TLSH
T12EB65C26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 10.5MB
SHA256 8530cf41575d12ffe6d8f9342ed341b94488beb898889122902de9f63554de76
MD5 482f40d21d90190b307c4dcf63ff45ec
SHA1 34968a37c2125ff720aafaf94413c3c28bee9f79
SHA512 c1a51cc8e99533fc5b392e4b24ba91c46354c3db53b380d3184b9470a76aaa66749b05bdc03cc1901015c0881669e8f298dbd857315380b86f055f6a92adb663
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xe:nDyD9KzoDyD9Kz5
TLSH
T109B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 10.5MB
SHA256 811210bbd68149330b26e4ad48ae1460f44e08af1687803cffc55a00360c3189
MD5 add37e7a08cc95b22a835cd5a577eeb2
SHA1 b15ca4a960de16824491a56232a532d18ad98fae
SHA512 4c96f188336d0997968ec4bbb252befaf48523c8f4d5adba6a8c516a293b304437ad1e480fcefe0a8378555e165a21661f17e310ec63d53124aa25017417089c
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xy:nDyD9KzoDyD9KzZ
TLSH
T130B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 10.6MB
SHA256 f696326906a90e311a5171e3726af9de0ca350f4559c793b9950ecd4e909d2c8
MD5 e05d52bcd768dcc8a29cee33ef376e2e
SHA1 bde1a2e05afd9f6558d3ad738b227c3853692cbc
SHA512 7c885012bbbf96300000864dbd10dc625be9722bc48b78da3b015159d8ca43e73621411b5a1e1699c771738fa61d3bd244e4600ad07dd495e1769a49ae326c24
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5x+:nDyD9KzoDyD9Kzcs
TLSH
T1C7B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 10.5MB
SHA256 5b5189d0f5dbfe79928c435ce23e88849b1d657e671ff2a16e18a860987d0a8f
MD5 403e7518dc149ff9821fae35e8acbeb0
SHA1 572c4ffb9698273d087418c02339b08c3fe6ee03
SHA512 560f2f2af2b961498e3a7ee2da87e66da96bba10c5b531a303e139aee2c4fb8f16351c2a452084464d6e96fe7435aef57f19e4ff49291a08e87afba528977f56
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5x7:nDyD9KzoDyD9KzM
TLSH
T15FB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 10.5MB
SHA256 85b81cb8e5296913872b8e4811a92efed13581daf407ddf06a01d6dfa2ef32c1
MD5 c8a63759d002547d17e216efb35e9d15
SHA1 4493826c6cda18efb4fa389c13af6e0ca82d44e3
SHA512 542b92c707752ce78951aa6c9df7327fc3e4f307917155d907ed23a674c12ea2949839020bc2d45bb4c495f1a90fc849ebb76782947b06d3b3981d8a43edef38
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5x9:nDyD9KzoDyD9Kzu
TLSH
T1ABB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 10.6MB
SHA256 b642fb6af797ce1d257b5dbabf11f64ba432cb7444ad8bc045a648c866e33c7f
MD5 184154c6ca2596ca362e4fdb2bfa5e63
SHA1 0f44e687566c4e8276be98f091fa5e4453f44ba0
SHA512 a40428f76902b27b22392783ee8558c028d8bb6d186c60f36863bd2e6bbd6bbac6d5a387f4916281cff64255a0d01e97117129549ba36659b87ca039fd83a8fd
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xu:nDyD9KzoDyD9KzNT
TLSH
T1C9B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 10.8MB
SHA256 21e4bf825df87cc11ca1a8d81347a2af91dbd4f3c9302085f81be0173012042c
MD5 26071df374abcb1f585e494c2fa1dca5
SHA1 9970cc4139d6fc414fa21fbf6025576cb90577e3
SHA512 2fb1fa25eac8b7cc4183c4c74f56a415ac529d98b7e9f319d99ffd19d0a3334c50e7257aee38c21d3eaf15051d8c3e5b818f897d7f72db49c782a71ec4664380
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xy:nDyD9KzoDyD9KzNtB
TLSH
T1A5B65C26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 10.9MB
SHA256 40394fd09298d6b42390c723ff39249766654bc468cab7fd239d8f22838dddaa
MD5 94b37ea83039ad55e1db4b12088581aa
SHA1 8f5276c38d64414440cdf09c2c0a72aaad72524c
SHA512 5c8e1368433fb4c8d206d1b445135b1fc2adaabea35c692b13bbda92c6b6ed3651799dba4e19b4fe4001c31ce19344bcce189af2c21a0596e24a94eeeb8dcca2
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5x5:nDyD9KzoDyD9KzGq6
TLSH
T13CC65C26B5B582B2C07AD475CB966775EAB23C514B30C7CB8245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 10.5MB
SHA256 d37a7333e67cb29cbe7e2d238beac95775cc95a1c5459d535c124cc463e20868
MD5 bd085ee37fc36b2c50c2130ba4f1a39f
SHA1 8a30c005e1009cb190b22bc5167b01fe6fba06cd
SHA512 89ac6a9b11905e8bbf3f6812af50d48f064333ee55d0d384a1fd12f1efe0bdbf07486088e230ce7b2a4199728f62b34ca178a6f0aaae2147c3b0e21799f9338a
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xI:nDyD9KzoDyD9KzP
TLSH
T1EDB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 10.5MB
SHA256 eff2dd1048eac84e7532c134932cf925076ef3fa006da9e5b3d08fa654d6144d
MD5 ffc13fe1bfc9310031e0177bfd6393d4
SHA1 6aa571178d58092a96a937ac35e1f08aa7b4c7e0
SHA512 36651572649ac9a07f1686fbede38c93269fe225020feef04dc96750eee78d3669327f5559b09e1f4add49207dbd23490a7d4e5c298336aee270e8ca2bbddec5
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xJ:nDyD9KzoDyD9KzO
TLSH
T16AB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 10.5MB
SHA256 9900fee88862fc24edfcd09b86830d1e3e0f97eb27fe15d1607d625a839c6529
MD5 8942fe77c2578931a5c3cf07a6fb1d3a
SHA1 9a66d56cfd446aae96096745898b69a660d8e713
SHA512 830ecc516d71cb9a06079f4c251374c2adc7c207415acfde20943425a8930fc285aa0758d299c9f3d7674e5e804a6ab2af96738003ff319701b7d927f58e6bdb
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xn:nDyD9KzoDyD9Kz8
TLSH
T1F8B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 10.5MB
SHA256 43bd754e8a549daf9a8ac31359462b112970d9a2306b0b382d3cd49e7f0eade7
MD5 c2594432cc1b8486e250be914fe40432
SHA1 d659f01bffb52048151d92ec9a64b03ced9eea63
SHA512 fe1cd27ddfb6baefbc92e192c869f50c442e8229723aefae66342fba366f6252611bf4c48914cc647997a40badbed8d8a0b5cdcbe4dec7118d008cf3a8142f5f
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xs:nDyD9KzoDyD9Kzb
TLSH
T109B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 10.5MB
SHA256 8246789610b03234c1f68c40ecddac8ef8763853fedef23ea44db3e47f0d3a61
MD5 93b898d48154d6221178595c0e5dd397
SHA1 cf2f868608b1ef568507caa81ef3b4441f741f1c
SHA512 628f5fbce415958e838b8d70115ed0916159c26753aa22668530aa0e1a569dcc62b6d787bc82073f1ee800b60081feac93ba4ad03f89f9ba8eb9820b5b5cd6a8
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5x6:nDyD9KzoDyD9KzN
TLSH
T1C0B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 10.5MB
SHA256 64c270f66a27537ef110351d337c7811548ba9b459aa690263b955a3396ad0c7
MD5 2dc1e1e538aed4cd6f143d3d1c93610b
SHA1 72bccc1b058c0a4de22456922fc3cd12a6e60f4e
SHA512 5d334e065db7801124bab4b6ebbdfd51d7b2700e2e0ac9fb706990bf962476d035ecb67a01f2fc67340f0bf40a579d5412d8da6ac5269991817944f22529d35a
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xO:nDyD9KzoDyD9Kzx
TLSH
T18AB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 10.5MB
SHA256 ea59c41cf2f77068999bd51727311c1044c5eff191f33499f6542dbb498823be
MD5 9b5e3fcb74626eb236e2db4af340a9e2
SHA1 ac2364af9bb7bdb7492fbbcc8b94ba5f98ca0755
SHA512 55493c4736db9bdbbca41045edf0414dd9548185aa9fd18a62e3d885de12e0d7e501e3b179ef3caf1ae94dd5658cec65a5456063177a225f19e51b476fd9cb5c
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xb:nDyD9KzoDyD9Kz8
TLSH
T10AB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 10.5MB
SHA256 41eddca4889772eeba835e34eef4b8e414f28eafec7c89aa81c22461166900bc
MD5 d23343f6a7ce48c444399822db384920
SHA1 3998175068ef9b1124b8ed10b25882f89a4453a5
SHA512 dbafa270a16369da36bceea14f8255b11b21f553898db6fa02e5a5f7ba53a4b1283cc63bf74f29c27f730c78e61afbd35e2b0273af63995123ec3661c3e31614
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xH:nDyD9KzoDyD9Kzk
TLSH
T1FCB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 10.5MB
SHA256 83c5c50acb48cea0b3eba13bfceb98d34eb701d4cb85336f1df7ead50a999ca5
MD5 89d64fdb2c3be60c5e828f21dca9cff2
SHA1 5323e6284dcd78bec9422b67535a2c46939adf65
SHA512 ffd31c2aa4913b46ba7ba432d9af4bd19507a35a117a68c173c42083351d5857c72b758f9795d6dae0257134a775fd1ff4483ea07c642d0455f1fe4a169a212a
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xI:nDyD9KzoDyD9KzT
TLSH
T172B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 10.5MB
SHA256 c26e312bf0da16ee4e6f51f6df8f9b05dbb57ebe4150611761dabd32add848a4
MD5 98fd769de90e7343179c4593a0c9da71
SHA1 5e13b496a5c8872d861b439021a8af4942996f43
SHA512 d19e78c7bce87ec694c8a71adf078685ea73ce3a100b4a49e2760e377ae37fdca8b0d7f2693936a49f7fc81d15fc4647dd1e4c2c2a08e87687480049ab5e8a37
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xx:nDyD9KzoDyD9Kza
TLSH
T183B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 10.5MB
SHA256 b3f4d541d5fac830df9ac8575732f4072a4ff1128af5bb023991b0dfd7b0f50a
MD5 17419caa347848c3fc780e007a3abb4b
SHA1 14e3330fc008607c247b58d6f22e3a245662f5cd
SHA512 6533d21a10b4796c75ab134c2175c07353bb22544766f153c086da037cd14757625d41ac6d75ad4d46fa6cfe10ecc7945ca999493e941617790034d37d3313bd
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xx:nDyD9KzoDyD9Kzq
TLSH
T1FBB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 10.5MB
SHA256 45f1d560c8db5d5d8b4fa23a1cdab21e77e532c9f0c8732c93f11fd7b21d04c3
MD5 0a50a938f00f77cd37594ca906feb0bd
SHA1 ff099622294a03ad262d9fad211d64493a507ef2
SHA512 f5b20725ca0e47f2f12e23ec8aca5247c123802d146ec00b0be15e1a81e0fdab69d89fac2ba4a021f5e517fef88291a225058ef2da5db3a1b04db0ed801b4559
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xJ:nDyD9KzoDyD9Kzq
TLSH
T102B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 10.5MB
SHA256 687d275210e6ba40945eda052fd6035e20dd6ed695de5018364e2cf68e6e9645
MD5 c5dd6509503a5dc7fd2c208ac1a7f983
SHA1 51a57bc73fe38f859a5623152327fb817eb06e16
SHA512 2314988455faec8ab94abda078f58d404309e41417da764b6875985728544fd8f10c463364c42b0b7e232988a594d2d74f989d953fefcb981f9459f0dc789ea7
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xA:nDyD9KzoDyD9KzP
TLSH
T10AB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 10.5MB
SHA256 91e5c3f641c5db08bf13fe852c53e3b1fdb47136e569e9de72f513a25e68adc7
MD5 001d0a6f42038971349a9434d2a49104
SHA1 431939a6ba9b759862fdf3d13ab48e4fe6f01f7b
SHA512 bcbee7130132aea9e6fea53f55a56c3c2f4a13dae946afd4e7cd251d63bfd0d3f341276a34fc641ae90d2544ad10428f1553863b26fb183c7bdd07bfb0d9ae4a
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xJ:nDyD9KzoDyD9Kz+
TLSH
T176B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 10.5MB
SHA256 6ec73293a0c4a72bed50ee17f977b0a7b7aad1530d2fb970b9b1ffb4c0e5b504
MD5 dbf083820d46100bff8088460a29a8fc
SHA1 72cf3bb2486b58b7738615e3689cde4572d5176b
SHA512 3668dbde962a00adee2ca36ee79a96770315b65b0ee82ff127d9a8b7d1284eb86eb21e1f2de9dbeea2c0fdb91a2b0615fa543d45cf473150715ff39bce113bb5
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xY:nDyD9KzoDyD9Kzn
TLSH
T1C9B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 10.5MB
SHA256 e5901ba8489f1ad69ec989ec0cfa62c852cef9dbcd9da26c795f72c9c45f50de
MD5 85f5d880097d4cfecd0221e7c6426ef5
SHA1 0c08de314300080760a8cfccc18a1f328a8d8cc4
SHA512 3086a87b08cf66b0f3dffbcce610030cdac3ca5f3d35cd9a812e93d3ce2b1aaa082d5e8e079e32cde00a76dbaa6838b6de3941505343e1e6757d8dc4504bc722
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xC:nDyD9KzoDyD9KzB
TLSH
T189B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 10.5MB
SHA256 a08ff5f79ca34daeafe23b567b3d9faa8473133270ce5a7b50752c63c813bc71
MD5 9188fda1c3d97a01f69ad4410ea6b068
SHA1 6bedc06b0a07d3b797135f3306582d49ddf2281b
SHA512 f7cba1f73d269b8b49b0fea81c8a0e99e9b97b8d6aed1f54234cfadcb2980e6ff8f388882a50d3ea545644b7b39ec102e3350f782b4a7aa9d11993ce2e1b6d49
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xU:nDyD9KzoDyD9Kzr
TLSH
T12DB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 10.5MB
SHA256 87fa9854778dcb087a6368bc3f949a08a8c7af1ebc81e0f66d868b2dab497267
MD5 13a6b512ca466508afe8e388849d919a
SHA1 9d2e63130bc092c37e245ff0db61b966f828c555
SHA512 81469d3a2645e6c0a113b024ae0b4f1035bf2f71bf95b3244e2059160723ab5390f4bda5737c85881294084b3ea2026fb6ddbf2823743081d69352aeb705083b
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xS:nDyD9KzoDyD9Kz5
TLSH
T10FB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 10.5MB
SHA256 0596168ee1902eb6a4b6fb3c32f9bbefdc780339efe6491804047b3c95212e79
MD5 a79fa5fd0f59d3477635a4f4339465b1
SHA1 d285e085103b720b2287a25bf71582c1fbf94e54
SHA512 8d87cbd012ca49109827e02bdb60174ea8c0038a7b632c2e7d2a7e4da32df508d5930e5352803269c613158b4dd5e01356769d3735cd49079c594083dd641760
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xx:nDyD9KzoDyD9KzG
TLSH
T156B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 10.5MB
SHA256 52d49df4b21dec57c39c48da9a0174ff7a58795660c6ac43b370bc7249523482
MD5 63c4bd751f394950489b3cf130194458
SHA1 a9585d39d9bf2ae29c3455da1e79ff06dc6dcea7
SHA512 284063fca0b87a0156e9727349b562acedb0fa8981dfba53929e486d81a30d582249862f8e2123a01b9750fdc66c137f83a672bb5201a4837753628bf4d93217
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xI:nDyD9KzoDyD9Kzb
TLSH
T178B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 10.5MB
SHA256 ea4c3ee71308735d4877bbaaf6aeb0e614f4f654c854421b8dad18fca1a9dfb3
MD5 9b52856367d1f1e1dca11b30b5d89153
SHA1 27c94f34d63f4796410e780b5bef4ae0632b7d65
SHA512 785ff71d0042b0a97d3c5b6743cc119338fa41daca251aa668842df8a05823635975294050418acbef9b0d80e32e094ad05787aaa014d0abab352b5c01604f87
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xz:nDyD9KzoDyD9KzM
TLSH
T179B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 10.5MB
SHA256 21099dc80d2296013a4efcfe9dec09a4dadae4faf4c7f19dc9e4907d21c87615
MD5 bb096d2035b672364524356ea67083db
SHA1 b5ce133b53fc2520f1c294cbafa9e1b619179dbb
SHA512 92c576b60b4661ab9303eb5019cec71c05f7b2ff2efa34f650f280755032c233c2aa53a1055e47a4588f95df67a92f2f02bba3762908b547ded772b1caaebdc4
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xW:nDyD9KzoDyD9KzN
TLSH
T1A4B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 10.5MB
SHA256 3e891d7227ed4b6608eacbeb68635183e2fd22aeaf4c48d08d87d3efba2a97b2
MD5 aa6077e5eba74ff9e77f0b8b2b8fa979
SHA1 e9617682ec61725c3af6bd390910a2e8c1db8909
SHA512 b383c5b53e7d71eaec550ff823a895e8fc03e944290b27f9db19ca5028b46612388b930a5be0f6c02af7b96e022b58e56c46090bc34edeb17c111c467b07cb62
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xo:nDyD9KzoDyD9Kzv
TLSH
T1F9B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 10.5MB
SHA256 42dfb3c321a71b271b196be7b4eb81eda8ba45c3f0e6725cd8f1e42e8a1932c8
MD5 c47bd8218a9636f4f5553e417d364167
SHA1 75ce4e986b935429a7edaadceee16511db17d56b
SHA512 0f7be908dafa7a1b4f8bfc07f631aa364404c793bbbe1efb2ad8039351bbe6c1dd0adbb13f71c074025a3b3471953245b6988746b5da6f9f02e0519e351c535e
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xw:nDyD9KzoDyD9Kzn
TLSH
T108B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 10.5MB
SHA256 a62f10cfeffb7f91e9280a8d5781251347acfb61690598c227abf771917c1af6
MD5 ae250e7f4553c4015f1de043823848eb
SHA1 a049c1f95344e448791a1f5486f402a2ca6778c5
SHA512 fcd8249d6cdf96160bf1650146b29ea96fe37adabaf326f7845e6fe215a5a3d084a492b925d32827cabd2eca15b4d623659b1df17e7fe0c97997ba049d78f121
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xR:nDyD9KzoDyD9KzG
TLSH
T118B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 10.6MB
SHA256 6231766eccad6cf065b47e1d02b0dc2f57427a31fd9ff95197e0ad89dc00985e
MD5 3f4c31637f35f61ee47fa90cd6825199
SHA1 e6445c60ca0d887c08e955a4fe4b5a59c01fbab7
SHA512 a292032c106fce986ccb9a5a6afac49a2478f6f4ddd49e7b29d75193edcfb4d6f0ee2a80c1a963d781c7d66fbe9e27d92812ff882d1dc5d1ebfc32b7e63dd478
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xs:nDyD9KzoDyD9Kzn
TLSH
T141B64B26B5B58272C07A9075CB966775FAB23C524B7087C78245F32C2F336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 10.5MB
SHA256 14c5c24f2f4475e49c390206245bcfc5d01b2a776b5da8b83d74fc0baf460210
MD5 b00ae36668b38e24ff5d1d3d3afb26fc
SHA1 7023741f5d984e1d2aed84befdec1b715e798a00
SHA512 300258fed25ac58280ff03536df288902d83e3ed673e06fdb94155d0cdb85c868fe2d89eb2b8af2b63ae27c8c4e6908ac4ad672e96d368e7a86fe1b004742407
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xM:nDyD9KzoDyD9Kz7
TLSH
T104B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 10.5MB
SHA256 fa8e24804c542b474b9f2d29e6c259b857e2430aaf3420f7524df7fb4a4a15ac
MD5 778b691fffa3e23353bd9647dc6b00ad
SHA1 40d911404a0fb4381bec6c10c39980823040e0bd
SHA512 e9d820c0839ecba4bd25ecaeef2cee635ed39b9d9c6893671326f5266f21f4e435c452b7ec749820c3c8ea64111f9fdfffc27dcc2412ab40eb1a69cde6302a34
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xi:nDyD9KzoDyD9KzJj
TLSH
T18FB64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 10.5MB
SHA256 18b802e2ed4e1745fdb29d857bfc3c09dac975f0c65dd321d578aecc0d9d83d3
MD5 97d3bdbc75489837289688da72185747
SHA1 1e27efc411c93f67925d372e243d6842b1b5f8b0
SHA512 c8d09a21f87ad57952c31bc183a4ea3cd6b9d1eeed7ea36bdcc4166977315e5bdbbd9bb14008b3824f6a402f1dd2163186a445d6f3b9d8b09562c5cbfce069f7
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHEhx0z/u5x6M1IezSC6v2XMHcu5xk:nDyD9KzoDyD9KzTD
TLSH
T1E5B64B26B5B582B2C07AD475CB966775EAB23C524B30C7C78245F31C2E336D09E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2700-463-0x000001DA83120000-0x000001DA83220000-memory.dmp

Download

memory/2700-507-0x000001DA97140000-0x000001DA97160000-memory.dmp

Download

memory/2700-480-0x000001DA96E30000-0x000001DA96F30000-memory.dmp

Download

memory/2700-479-0x000001DA86960000-0x000001DA86980000-memory.dmp

Download

memory/2700-493-0x000001DA86CA0000-0x000001DA86CC0000-memory.dmp

Download

memory/2700-462-0x000001DA83120000-0x000001DA83220000-memory.dmp

Download

memory/2700-461-0x000001DA83120000-0x000001DA83220000-memory.dmp

Download