02ad5163b01a6cff49b2450f38c4825c47cd6fb6da8115d553d3af88c11f892f

Analysis

max time kernel
112s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Size 4.0MB
Sample260705-d5wcsag18s
SHA256 02ad5163b01a6cff49b2450f38c4825c47cd6fb6da8115d553d3af88c11f892f
MD5 a53c209c1774f4328d6f6ea6ec658090
SHA1 9262a409baabfbccb2f0b932ef8505dd56be725a
SHA512 a09c999d914b49031667d5f87435bd52db4d2365c6500c2db0cf475f960047c0febc435ec6d9af651a92052a2e62b03aaca8ddb704b2bec6e9f8c83b1b70697f
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHA:nDyDf
TLSH
T16F164A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{D370C654-2918-461C-B8C3-7CF4F381071D}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\NotificationData	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{1A7692EA-C01C-4EC7-8F43-A510BCDF590A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe
Token: SeShutdownPrivilege	5524	explorer.exe
Token: SeCreatePagefilePrivilege	5524	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2184	sihost.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe
5524	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3184	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
3272	2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
1356	StartMenuExperienceHost.exe
5524	explorer.exe
756	SearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 5524	2184	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3184

C:\Users\Admin\AppData\Local\Temp\2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-05_a53c209c1774f4328d6f6ea6ec658090_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3272

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1356

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 4.5MB
SHA256 55e7ff3b69244df753b1eb766cdbc17edbbb759d46685da2203cf78bb2596aa2
MD5 4aec8b0002fb96c1f1f405f5918318ca
SHA1 260c79bd0b304813df3f564fe2fd08431ed58183
SHA512 14dc94097c54f0c004db095dc5f495ea2a85f149910b7b2eb757cfc0eeaef8d218afc49aad7b2e778ae05ac5644b828af7bd15f82af8ad17cdabaad27aec6e7c
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHGjo:nDyDNo
TLSH
T141263A16F5788373D0B6D4B5C5D6A77AFA3234424B308ACB8246C76C2E236E19D36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 5.0MB
SHA256 1bbdf7d37caedb558b64b3fa18b4b9a4f7a69ce9609a04619539ed47cef9a76a
MD5 0f150551d36862a7c1f00b25e48dc393
SHA1 ed2f9f161761ffef0c05e317be4c11119121392d
SHA512 ca3d29325f8dfd6e082eb60643cdd7168f6b8e843cb5b1627dbe276580c4f2af09b0a324d1ac238e64e02dac2199bacc40465815bc64c101aeefc5afad6edd29
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMH7ezSC6v2XMH:nDyDx
TLSH
T12E363A16F5788373D0B6D0B5C5D6AB7AFE3234424B308ACB4246C76C2E236E59936739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 8.7MB
SHA256 2b0b92c123ffec3ffe06e583589290c1f571c9204145f4888aa05d59ebd5c3a7
MD5 d88baec51f0a239b10db7d04d114a5d3
SHA1 6197ebdd38d8662bee2a8c86a1bc234d3fc76741
SHA512 688f813e88c7d310b9b7bb60903de342316c18bddf8cb43eacfb6a2073f833e49401455175f6806117d6ebc1896964c0cb1ade77f7a43260346993434863586f
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iep:nDyD/DyDW/h1+
TLSH
T1BD963A16F5788273D1B6D4B5C5D6A77AFA3234424B308ACB8346C72C2E236D19E36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 8.0MB
SHA256 1a6f30b3e0ea0be654dae09fa34ce1e20e7884601b97ebfa37cc64faed071ba8
MD5 e14514c8aa847eb173f5b255675893fa
SHA1 ec9b117dc4e93ab14cd96a040e5275522cbcbce6
SHA512 8deac5425265ea1dfef708ab8e6dde2494922a78c8d123973f5d8c4aa64d8daf76b657b863dfae0bbc0d2dd3e6c9341e18106c2d03b43accefa0b23b786e65d1
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeM:nDyD/DyD
TLSH
T1A6864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 8.3MB
SHA256 7a6cd99c62d98107ee4787bff61d57bc6ef6b01ae6f8403c99d5e0c49077022f
MD5 8cf9943ae2f0e6d36eacdbcbd2dcfd63
SHA1 8470a00302f3a425c64a0b4810416e4454dcb1e3
SHA512 9fd7be4df6125b7488dece64621698c3c017b8c35c10737874f453e6de1b2558295d5c381f68684c0c7cc940120b3cf87c143ce0211b351ea1675be05de58885
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iel:nDyD/DyDv
TLSH
T155963A26F97882B3D1B6D4B5C5D6A779FB3274420B308ACB8245C72C2E236D19D36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 8.1MB
SHA256 32ffbedb23868c53a5a6547dc7d4ea2eacb5360e58e945950f5c0d33234b783d
MD5 27f9a304d5e26d178c9d8af9814913e4
SHA1 5a0b64e2fa480b6c476a3850e30ad531e52fd098
SHA512 f3087f15b243c6cbcb7f1fd50f453bdb9f486019211ecccc4ef93eb5171a71575c4d9617982bf6256e6040fced29ed8d0b9e802914c784a9ce3098a51c4b2851
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iec:nDyD/DyDIb
TLSH
T17A864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 12.1MB
SHA256 d56d4a726a177ae68df81e6c1d7c36a208fc04639f214f5e8db2f9a2949b2ed1
MD5 46f5c5398664b1b7b02f5384b1032aa6
SHA1 223461201952dc773b614679efa27e862b424628
SHA512 ccda51b576a50a06c0a7b80063ede1edaa610832f28f5d7266ab8482d8c620bbd8bcebdb8eab455e8823b2338ada8e2f956169471cab6d0c30f68b2a16a67869
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeN:nDyD/DyD+vyEYc/b3w8O
TLSH
T155D66C16BAB882B2D1B6D074C5E6A676FB7274420B308BCB4245C72D2F336D19D36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 8.4MB
SHA256 95e42e07e512530ddabc8d7c10be9ffcc216373f4c94b0501fc0aceaae24b82e
MD5 72d0e8f1b0807f2bf5a126cb373e2f4c
SHA1 6641dc51d1cd26cba8ccb5a706903316c6474daf
SHA512 33a74f7647a4371ef71ec68339ec3849ad03e2ba1e6653c36dae94b982ab3c0b5226069a1a781db40fc4c494808e2e926b2bea34af05e86741950b1e9d910460
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeQ:nDyD/DyDW
TLSH
T1CA964B16F57882B3D1B6D4B5C5D6A77AFA3274420B308ACB8345C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 27.5MB
SHA256 1702db5097e7f4fb8892a754b1c7ef0e59f38848a77b77e59915def66a810e80
MD5 88f0ade39065ac98231894911ec3cffe
SHA1 16b67d96dc50a8b55ee9136c75a8eec930beeba7
SHA512 b93f2a70ed361d2cac30cb9d82e6843c3d48dae4b0d51d5e664c991e3387ebd881ed3be8e7780d257870afc422c2d9a5f45d2e905c387aa2fc0f8fdab731c9aa
SSDEEP 196608:nDyDvUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:eUEtQevvqc2W1cpV2XI32i
TLSH
T18D575B91BBE883E2E3A6953484B682B6FB717C0E1F31977B4139F21E1E376905D25321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 10.1MB
SHA256 ac96799d97c675e052eb4de3ee5e7c8e2c65ea0eabe1987c73d24ccd97178509
MD5 255c27579658457977a381372abcb905
SHA1 5a9110eca999da3eb16cbc735418f7a1a1cf128f
SHA512 6bc623120663329b524dc3b94ba24d1c2b79f9db324a37f0997aedb51e91fe818cfa41a81936af5209759af5fa2d8f32f2b7d5e1b1fa2e9c04fbb60b79ec2024
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie1:nDyD/DyDTGn
TLSH
T129B65B16B67882B2D1B6C575C5D6A77AFB3234424B308BCB8246C72C2E336D19D3A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 8.1MB
SHA256 8f1dd293f162029ac0c3ae7c11482c2ba6a5b411754ddfbaf2d6ae27cb48ebcc
MD5 48b546a6250ba3aa5615f2d8bc33f9b9
SHA1 022ff4783ee4a48f84e21f7de03e9739f5841bc3
SHA512 172b9a8ceca12e544ebfc7e333b5efa63ce3b20b2f44410c04e19d80aba4380204628f5f90a21de90c1d68084e37088fb0271a379cfc2e37eaced66aaa795e29
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeG:nDyD/DyDQ
TLSH
T1B2863A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 14.1MB
SHA256 c131cecde9ff619096f6625ccda518ef3e472b8938c2f1cd0b6e7e018629e2ff
MD5 030e0d7a4ec0e646c3934e0d71981b1c
SHA1 5c0f096a8090bafb2ade6bfefeb2d8f3d1c35774
SHA512 2c74c6bb064d8a3b1f095962fc04797324c920fb0993fcfb57e87d47dc45e5fa21b8cd38ecd2a018022fbf618e93ca254eca67dd07e06275d126ffc8eaad50b4
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iee:nDyD/DyDaQyiKaUX+PNo
TLSH
T114E66D13F2B482B6D07AD474CAAA6735EB317C464B3087DF1245A7682E336D0AE39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 9.7MB
SHA256 469b5b07604b559e43cd54d1d7c28e19c6298f85120341122391c01881d7c99f
MD5 5b30e31d6626c08d11e988f894eb9fd1
SHA1 00b0bc71fcc823dd106c6bebab8fa29f380ab9ca
SHA512 8b61b3b786d8e89a186158945938bd1addef79a85cc328b0333d07f01d3f5cf43fda183d7bc1d2ec0c058006e14639c5630fe48d0771bf0a852321a22ad2f037
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeM:nDyD/DyDathHf
TLSH
T19DA64A26B5B482B2C0B6D475C6D6A775FA723C424B3087CB8245F71C2E336D19E3672A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 11.5MB
SHA256 8d54821f09ae8617b10cb713d17834dd71e6881353f7070f1c467892d50e0e63
MD5 858ce5eed8fb6f8e568824d946ddb8f6
SHA1 2a906315ad919e983aa3eba3e501810ce7311b5d
SHA512 4f6c805c1053863ed97214500f23c41c997d9c0dc7b8de8ac0cbb901eeb3407bc539040fac0121965c1a9628f562efc01703a0fc20b205935108645178392e70
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iek:nDyD/DyDgLIHuWhs
TLSH
T161C65B12F5B882B2D0B6D475C6D6A776FA327C420B3086CB4245F7282E376D19E3A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 10.3MB
SHA256 b40e02fd77f30120443e172042b5123a1aec7d8ccb06fa97d274932413fb0c2c
MD5 620d2c7572a7251d87b75c932c2ddbd4
SHA1 90a950061021fe61854c0cb170df470e5491ce5e
SHA512 f7d38d5119a399e54f6a48d0c4198f985cd7b771a3769b6b493c6a1e8a53b162b91582b7fcb013fd9c70be55c5d3047c1ceb0a11b415c94656a44efdf7547282
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeQ:nDyD/DyDq6Jm0G
TLSH
T1CEB65B16F5B882B2D0B6D475C5D6A676FA327C420B3086CB4345F7282E336D19E3A739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 9.7MB
SHA256 0f05fc5ef9e9c276766c763fbf86286ed2ace266dce6ada0abceb46911df995d
MD5 4e4a72bfd0abf6d4e9ee4788c6533379
SHA1 82d879ca211b1240840aa5960fa33e5c4cf92fc9
SHA512 2f2cd46ccf0bd5eebcd443aa74992ff6d4120dbd19bc437094d109ffe3053eeaa0da0dfbe9225360382072ca0b87d32be7e409bfcc8fb7ac7f57df3c76e54471
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeX:nDyD/DyDdfPf
TLSH
T152A64A16F57882B2D0B6D475C5D6A67AFA327C420B308ACB4245F72C2E336D19E36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 9.9MB
SHA256 60a49b3bef0088179ceb2a6c13bd87ae737df60d1e30d4483caa0e31ad892396
MD5 4828433a18ad48652561c406501b9197
SHA1 8128c9a00f68d00949c1e9a7fd673a535563f1da
SHA512 d61afde1799cf5d26521f388c57d4842d19ca2029a9ae9cf92c70c5bed10611be41ef2fda9dec5dd8c28c158ed20fe896c3b2ca7bb27fc6f7d2c6f433cc42690
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeT:nDyD/DyD0dKC16
TLSH
T187A64B16F5B882B2D0B6D475C5E6A676FA327C420B3086CB4245F72C2E336D19E36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 11.1MB
SHA256 8d4d045ae03d90ce645cd9e4b7afef49364610e119d9d5805c7e3e3195d2a777
MD5 13fb99d5c51bbd0f1f66190c04b5ad04
SHA1 72e5cdb1474acca9dbd7bf05e80b894fb6e79fc7
SHA512 5531eb711849cedf5824e58fcc63c6743a33b2b5e65cb33926e19032cdfe3b64d980720ad4d372fbd73479bfe3e5860d42d7e5907a6bfa19dc0ae6bb652c079d
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeC:nDyD/DyDZjnDO
TLSH
T16BC65C12F5B882B2D0B6D475C5D6A776FA327C424B3086CB4245F7282E336D19E3A739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 9.4MB
SHA256 22b60acf49d0a84906912c202cf08122ff736dd3961cd3b91587e27a8e8f9450
MD5 714c85ae0597f72984457a944e4995cc
SHA1 ce67c5d0d4609614975665c9d13c9cbdbc100b40
SHA512 a552f79072f0deeffd4c857f636b1ac018254eb7be4b682496551488dc950137ab5b9814fcf836818507d8f94883e19112f85481a686a86ea1c6db91cfd70c12
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeA:nDyD/DyDP2iw3
TLSH
T16CA64A16F57882B2D0B6D475C5D6A67AFA327C420B308ACB4245F72C2E336D19E36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 8.0MB
SHA256 8b82d1bf2e75769608f4eca5c100a65c1de365849f7c6bf447ec6f71a998cb03
MD5 4ed5397399ec28224ef2b6e09e86d1f9
SHA1 bac08550e9bd671d3a8fc8a36dcbc94efb4a9c34
SHA512 80e7a4b025381766b30bc898deb2fbf36d862479d9777105610214808fddf78071452fc16267182623fef9e91ee915ea20de7edb551906cfc457be556af5d144
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie8:nDyD/DyDu
TLSH
T12F864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 8.0MB
SHA256 3d544c8927109df596941604b0d8efe704c355ba6903602b1e22867ea59770c9
MD5 2a04b448926bb56150a8d6f7f7e9f245
SHA1 0f4e6630f25bb314a2dcba92aa91c801a8424609
SHA512 65a2192257bedee86dd2fe7ce186973f61b6839a55a3aad4a9fa7022ef458b3536b62dba3460cecf8642ec8f88a74dae1a16985f1e75e7ffaec8f0fad3c6d48a
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iek:nDyD/DyDq
TLSH
T179864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 8.0MB
SHA256 1c2e2bfb77db7ef8cb387b2e79bd466ae530d62fe7b02cc36294d6ad90aa1994
MD5 ba3bfa4587d2ff95047d4699d94158be
SHA1 c987279937bb44eead51b017f1ec7a54177ae8da
SHA512 706ba00b68b959b03771f8f5a12dd9e9bedf26b4aff7fb28b85a06ff5480b571eac4335a05281fd3323c53ae109eec42feb76ce5ce4c4e65c3eaeda9ff448e0b
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeH:nDyD/DyDl
TLSH
T1C0864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 8.1MB
SHA256 ca30b9a0499270e1539e6e4e0cd9e7ecd6193d5e1474e9954811aea212b88664
MD5 8bab5c9f25f852262e58de1db6aaae75
SHA1 42f53c2395acc19c31ca79e090d779e98a9eff4b
SHA512 570301e2579dd478e9bb5e533121617a4599d153f937d4ab32ae99eecc502ac23209bb8dec6dc90b5253516642beef5bc7a8482e6a8de0d70b3260d2847f8ee4
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie2:nDyD/DyDg
TLSH
T1DC864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 8.0MB
SHA256 29690a97deb73a157db13b66ace3ee26b97f760a92c9568e727c7a583701e19d
MD5 df08ba8e23a2879e7e6d84234c3a8982
SHA1 42e60c814649399efadddaba43f387afa8fd36fc
SHA512 51b2449ed14aff673e62d7c5ef742b2c7064cf04e9d5cc9fbbe02e992d58cffcc1ff79ccc13d9ca4f3dfc7e6f526b06a6b02b1c9627cbf7b8baf47f723cafb78
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeT:nDyD/DyDt
TLSH
T130864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 8.0MB
SHA256 6f26753cbfc816881bc052e74cb981568e61d25c3c478c63303d4f812235a887
MD5 aa22de3a3fcc2f22757dc72cde5f58c0
SHA1 5ef5d4e47322475e95c5a07c823a8602d5002a6f
SHA512 37d759e0a1ea6c6a65b19657f1f766367778a71c81cb63b31e504f2a9fbd3df9da7b376b103be9432d036b6884a6374fcd7231b25c12cb5c8241000893454772
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie8:nDyD/DyDK
TLSH
T169864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 8.0MB
SHA256 fd626af78971158d8b777c8117cb049d14be1b10cf5c33a482384ae7731b6381
MD5 8dff333f3208dba62289cb32fc08656f
SHA1 4683eab283507ff112c71e04874b83fa7c50443e
SHA512 f94aa7a5938f16d406c0413d873444f29d0e00ac4dcdef5ed160719e71ffb855bea3d9d12cd84e3cc6b85f23b1307afa457fa0825799b30e401630dad9f8102c
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ien:nDyD/DyDl
TLSH
T114864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 8.3MB
SHA256 eb4197b6e4ca3272f429ab2c2a2a1eddf7dc8165ddbf18ba4dbff300f1c4da92
MD5 e93caccd5caec5fbfb3ac831ae4389fe
SHA1 7150e3b2d5b8fe04c44da546cb41cc30d482ddb9
SHA512 4cff701a113a68988c7363d000c4b23699fa414f879c2d5aa057e603b73764c9a50be3ffb65889820f2eef893a0e78974e452e3da1925bc5a7cf1d075e878054
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeB:nDyD/DyDIfu
TLSH
T1B9964B16F57882B3D1B6D475C5D6AB7AFA3274420B308ACB8345C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 8.0MB
SHA256 54c506667609b0cf6b8286c07996b9c14aa405ade0ceed2724f9a20af2333c2c
MD5 6887225d5e83004a77cf7e135ea66aa4
SHA1 11a809c3002cf9714b5225588ae0b0231655f6a9
SHA512 8cc1f48f9bd1b7c11b15564189ac048bfc5fae9f86492d1b768c984e2e92c319b72fcdfd9a176fd527f16ba74d82c72ca0172dbe5a36a84afd96e1d4fa402d7b
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie6:nDyD/DyD0
TLSH
T14B864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 8.0MB
SHA256 7ea473e38aea1f56bcd7964b3088547edabf39ab80ecebb8cb6a3e43efa1094d
MD5 55c6347e449945387895a8c7f8b6bb03
SHA1 4b9af4f27e2d6e2db1e8c4dd77d170d6bcfbd6c0
SHA512 fdaef96a93e67562dff67813da2c9f7f33c6fbf1faa67d64a01c650b27e1de43b3a49a82d9e01320f50822012e8db9cae52816b5313c67a12c511e229dd99fe3
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie2:nDyD/DyDU
TLSH
T1A9864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 8.2MB
SHA256 2954d37ab8a642b37f2d5f20320a4e6964fc5c3666b8be2ad04cdc88a0fefa2b
MD5 c26872d9e076736c75a2129a664eb5df
SHA1 7ccf01b4fd0a867b0803507413292d930a803c30
SHA512 1f85c447a732dab3f02df443e132621832002e779d018e560b12ac00baf278c9507e9e268f8cb20b386813f454b66ca53805404d98fac5eab9ba5a11ba1ef589
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeS:nDyD/DyDbs
TLSH
T14C863A16F57882B3D1B6D4B5C5D6A77AFA3274420B308ACB8346C72C2E236D19D36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 8.0MB
SHA256 be7caa39d0be8ace2164d29b96021c453345ab24c2fdefa731e8689f0e39badb
MD5 e418221bb9c6b41985670393aefa1fbb
SHA1 8d449af50c8224496987439dcd7f605465440b67
SHA512 5feb71b80b6e206ea888bd4b7d60a68c6f4991dc99774ac047a8667b826207529de41001143960696108193deade95367f8af6aaa24521c6f317be3828f6298c
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeX:nDyD/DyDp
TLSH
T1F7864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 8.0MB
SHA256 5a26ff1cec6c768ed02c76e9d805c2bb601d800d9637dc9952b471187694e5ac
MD5 c765e6cd768bcf4be7027fce2a82c09c
SHA1 a755f7b61db4f119c37b11e6f746d664bd432297
SHA512 21f6026750c0dc2e5e74deddd84f077324a570b5dd06824777c6ed5bb0cd70e2060958a0eb47712e6392131a1f3aba78ca256f4f8c34b068614c7cb9e6a1d6fb
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeZ:nDyD/DyDL
TLSH
T124864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 8.2MB
SHA256 7454284e5263e335e09eb15f6fd32b4b29a4bc5a01eee3f36a1adb3fc6a4fb67
MD5 b8427b69c0e6ef7ec694e05deee7078a
SHA1 66b781559b2e070a9ba2bc4b4bdfcd2aeb626e39
SHA512 fa083f38103d0b2f8fafc7c43446707490603b1518a584feae3f51d280f16d1e243f30d71f45552dec4060ce38a794a0b3d839250d61336d9dd77fd88be585af
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie6:nDyD/DyDOT
TLSH
T157863A16F57882B3D1B6D4B5C5D6A77AFA3274420B308ACB8346C72C2E236D19D36739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 8.3MB
SHA256 7cefc53ff2b3ec126fdc1466f5e46e8281aa33b0944ba5acd5995436a7201b3a
MD5 225e02f6e93ff87ba63f06670331b23f
SHA1 f4b1a7cfd98e639603de945225990b6aed8f6eaa
SHA512 ed5790246cdcd88007727740ad925da870a8912eaafc3bf656aa3961101a7c3131b6f60f15a4e5a1afda9d29f970d80619427e771d6a94206ac2d32535ddefe0
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeW:nDyD/DyD6tB
TLSH
T162964B16F57882B3D1B6D4B5C5D6A77AFA3274420B308ACB8345C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 8.5MB
SHA256 f9980c59694e1fd031c20ea6c0cca237516125cc77936e9ff1dbb1096821f7ba
MD5 72cc7421ac0283e0775b1e31c58d4457
SHA1 89ac7dd7440f67fcbf91571fa9753dc9e43389a9
SHA512 1a9bab3197baae96deb9eca4de24bcb192a310fd53f327dedcc73d1e9f524d75a72c98b21dad04d419fe65c879f467881b8673becee6ce0112ea49cd63ac809c
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie1:nDyD/DyDtq6
TLSH
T1AD964B16F5B882B3D1B6D475C5E6A779FA3274420B308ACB8345C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 8.0MB
SHA256 cba09e7d3564381e988f120eba6991e35292131eccf73ab23bef0f63712f296d
MD5 3f8132ad84260cdcc3b960561dc05385
SHA1 075a37056e949fadb42f504c452bc9b80468b18b
SHA512 92fd64476dc0ed46faae814a36a706883f57c2d75b88de6cb76377d7bbe7d2e2a96e0946129208c77f9ea4c17dc5f1a6009ff7bc2721fcd83225c2ad9b2371e8
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeU:nDyD/DyDq
TLSH
T1E8864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 8.0MB
SHA256 6751a5dd62000626a890448ab195346a29fb037db74d1cc76c467145da75baf2
MD5 eafe8bdf0ad36edc61e05ee735b346ef
SHA1 09fa56eebd2db9aff9746d931bb954077340f12e
SHA512 bbacfd82fced1e80762f271f302bb05f7687570a82b7118d26ed0ec3acdfc9b1b70f16c10b49ee8e2789b7edb7180819af67f5096cb6c85e1c9317ba68e5ba6f
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie9:nDyD/DyDH
TLSH
T1D2864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 8.0MB
SHA256 5db9d7a833806018dec28dbe1049a6dcf0d24a27d85cad117db4b18264bd21bd
MD5 e017394e0a51f2da97b44f7ee524ff31
SHA1 ad55009d7ded9df4210c86119d7d1b8f61fb307f
SHA512 9384e4899286cb86fe5a2cdf95d88919d8da27134afb463d35cdf574b179f3ea2d37ba63002e60b47cb909cf19b4e22cbc503566e0b22aac7aa71d2e90735d35
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iej:nDyD/DyDd
TLSH
T178864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 8.0MB
SHA256 1b26f1cbe2e86a0cfc1438505eb491faeb86ac1e1f118659038ff8b6a9338931
MD5 87c1927463351ba4b9e481af6dad86a1
SHA1 2754fde9acc56a2436320a244b963584cbb7a257
SHA512 bcd120bc1d1a63041f09533f6766094716e258924d06d4cea8c63bf4c1f93224d846272d07cff2587eed378f4045cef18d9ff52f0e439811470f68602c2eb23d
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeY:nDyD/DyDm
TLSH
T1BA864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 8.0MB
SHA256 9e8747b53e94a7302a86d258c6ca8044af260b3cf3f3dedf11f0a2860853158c
MD5 5af0383c12dbb527a0428ab80d7c0d8a
SHA1 53100d8f227bf2006413484aff02309cba6d5bbf
SHA512 e2f5e1a313d915eea88f72957a3588ee3548a6e2deb64b065322010614e0864f2682edddbabd2c5ada0724671bbd47361cd2ace073a396f2a0dacdec5e4559d3
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ieu:nDyD/DyDE
TLSH
T18F864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 8.0MB
SHA256 8b07908bfbdd2fcac4d6ded5482cdc481ee6fb1f3ae2ada797ff47950795f5e2
MD5 cd9a000aaf40c583d210f73682349b76
SHA1 d8a73028ed38f1b1a14e1f0c30ee809fa667318d
SHA512 a2f24da7d5f85357dbfcd5e2f3332c7ad74bf318dfbd7abc2e8e2af94efde9813e53e1265f18b9e3078dd7e9612dfccf5bb138da472e5c1c423ddbdfd35af92b
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeK:nDyD/DyDw
TLSH
T1D7864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 8.0MB
SHA256 e34568deb3a0a9b8563a0b2b799b5dc14c87962623cb7182abb1bf2b1853fa59
MD5 cc19000bbf4e83be8678d7dd8735d8d0
SHA1 4fb358b52099aa49ff09804a2f66d85a0def6b4a
SHA512 b5631beae51f49a807fe1d6ea956d32cda5e8be83bc9795c6d899310690a245cc89e762e1a45855112ec1a38cc655d2d987c1e6f4b9e982fe79412019c5d3a95
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ief:nDyD/DyDN
TLSH
T1E1864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 8.0MB
SHA256 4c0815ab954f7fd902358859912a3a58ab94e00e59059db7e77997833a2def74
MD5 654eeae650d1b5df2076b56f31bf149a
SHA1 b9f0e99e96ae4538117171f44d9f0a5c3476fa92
SHA512 015a7773897b058d0582bc86e4770ba1ecfafb7accf3c5d01f37e5c0fdbdfb050d9ebd1146324a4b8732baea79042abaa61eb4c11f78bdc55e1d49da7350fd91
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie7:nDyD/DyDB
TLSH
T153864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 8.0MB
SHA256 25d9f234fc92f1517f829ffe44ddbe43f76fbe31ca25e54de941b52043e040d3
MD5 d0a7099728c858dc54cdf200569f09d4
SHA1 0b99d0467a0150905d54399e5aa69e39b4ea5dd9
SHA512 d1ead2c770957f1e8f96f1f11dec09c7d5b9b9c44cb2c94a44b68696b2d82ec4e56f15430fcf66c511ff98a378590be772fe67d4a9dc9e658aac5050d019aabc
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie8:nDyD/DyD2
TLSH
T1B4864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 8.0MB
SHA256 4ecbda0eb1004c301acfe1ea6619a010535b0e64e8132974234c9c3f9967d7f9
MD5 553744d5b188d9fe01fe1abcb3aa721a
SHA1 a1133f28bd41803f0c71daf067c84cc70cd93779
SHA512 cfcdd2981835f429a04a6822c2e78778238797e462c1d33afb2a9cf234667ec17c0c09db0b6d075994f84acb5c957412c3a44c255ab17c287293ad5a1ada21fc
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeV:nDyD/DyDH
TLSH
T172864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 8.0MB
SHA256 a8ee31814ce205e42ad69d6758221590bce8a27af445305f884631a8e66004c5
MD5 75cb9c245896b04f53a115452f30413c
SHA1 ac1ca84ba3b617399d469a068069a31022ca3efa
SHA512 cc32dc017dec53e0d42f654404284fddb87a1ee5c0e88da35e5c2ad2f2fe682f6c8f5393a8d16b25a07f7f3731588e7f2d4b9df35489203fedebd7a39fa50084
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeV:nDyD/DyDv
TLSH
T16A864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 8.0MB
SHA256 c7e66b5f7df85c6f0c21088874b30dc227cf7d8a62ee3c7801e096c2ce5010c7
MD5 4b87df872ac0b842d62e984b92d3ef95
SHA1 3103e8d13e34cbaa7943f74a92f9857cace22171
SHA512 792fcf3f281e691abab4d282ea83c1dcf6dda373786862bbfe8098e4db9d8f340e5e7872b8d0ad074bd776c24f8b5f0d6302149c2559e0e87b6d68627184a0e2
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeN:nDyD/DyDP
TLSH
T1E7864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 8.0MB
SHA256 1e65e275a9ab35287dbf678029e3821d58a4dac1a0ab0671b656dc10014e3066
MD5 b537c6fba1bd86d7bca65d63d4a00c03
SHA1 9fdccf8f0ae39fe8dae9c56919ae47f2001652c8
SHA512 133dbf11a6e7a49f659df4893f24c9113de2855d919ca24112d9861635b407d3c372b2bb6ac9c074d6595e1df1efce8de87a36d41f68577352bf8ff3e81a4d65
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iek:nDyD/DyDa
TLSH
T176864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 8.0MB
SHA256 616ddb707be7e0d12c8356f60ca6633a8f1df8118868114299791115e34b1894
MD5 74074eb83c3ffc261517714e958cae4b
SHA1 bc4010ad4efc0617b72b01dc7aa47a692d75b7ad
SHA512 caeac71690880cdbf541d7b5f45534c43daefbc4c7bc1924a8ddd9398e03ba51699fb848fbfe7e6003bb37bb02d1890a17442c21f33d395342d977c2732453e4
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeN:nDyD/DyDv
TLSH
T11E864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 8.0MB
SHA256 80b8dac3688b9749b28f0eb8307983b3526c48dbabc1e4c0def8b2f592fb409b
MD5 04c5bbf8faddbcc15d4e61963b869c54
SHA1 5636481a6dac912109a48af49e0e1a221c1dd6c4
SHA512 8de04ac02f8345aeb8d6210fc9016b4f9278dec5e2e86d0f7cebfae0f7575c2bcb14fe791322e6d7069dc9f784b0f4682571e2c75d6edb9693721e715f11b297
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie8:nDyD/DyDy
TLSH
T109864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 8.0MB
SHA256 bcdd2569814f7ad8e0812a5e4a1417f968283911cf6edaa40dc0ae01c344cb2c
MD5 91d14ae477d9b4ca8a276ca4cc61b8fa
SHA1 1fc765591db2b950d35232321c73eb9537292e66
SHA512 7683f265aac101924dca53fcda7eb545455eeb34c5e64d2fc77891fd835048da61ed3635c7b9bd29a2ffa6840c8dbb530f02283265c2bd0919c546e425a0aa73
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeO:nDyD/DyD8
TLSH
T159864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 8.0MB
SHA256 1f3d06de305b405b3e9542d5677fbb1ec7362174e406e49aaa7a28aa835f3af3
MD5 056214df4de1a45da0d0b1dad53e15d3
SHA1 d72261f992f346f14da5ead3e0355c6082687804
SHA512 599515666108c0e422f15386579471d05c8cf4a5358c9b0fa3738d0a16169e48ac732b0cbbfa1cffd9f5fc8dc3b2d2f6bdd2733192a64f528b517af3286133cd
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie4:nDyD/DyDG
TLSH
T1EB864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 8.0MB
SHA256 166c04512e785e7abff7338b0e336bca887b3f2ac1271c505f04f0c5cc14e7ed
MD5 d6915759b14aead2c6f1dbd18b997a82
SHA1 a276c490339fb9aa6188fd37c6a9a76faff2ef34
SHA512 0313c7c440f6356fb79277503ae73915a61ab06d78e044273f7eb64a48b47ed1cf92b8cf9c64fe5a04a33fc96f2972cb359e04be62ad45b930da9422d76138f7
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ieu:nDyD/DyDc
TLSH
T1BB864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 8.0MB
SHA256 15bc47161c909cb914f0933dd4827356f494bdc1ee8c3931e519538c478b1132
MD5 2d7750e05e9252b6d108cea9be1ae0af
SHA1 4fe8a91635bb437f272f24ff3d0f25a289b922d1
SHA512 a81dbc301356aba37e2aac1907eb73a8661413368b6f3cc173a6a206800844575406a3356a8f3cfc663e0a5def3c1861061de396ad62c80e35593b7d7f52ae9f
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iel:nDyD/DyDn
TLSH
T13C864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 8.0MB
SHA256 b0300bbf808178db16c7a1971405815dc56473f3f50206ccd104bcdaf2fe8d8a
MD5 e2e42ad7434ab54e05295b0bb384557a
SHA1 ade534bd6e3b4a2c125e1f02b35f8fc6fef2fb40
SHA512 71fec42d4b1a692f6c411785e3f03371b4f9307fb77f48ff4753f7464997437536dae48e3b69a0a380d6e1024e1130c7a6985bc0f0245c1269bf5b065dc4e6e6
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeE:nDyD/DyDK
TLSH
T1DA864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 8.0MB
SHA256 665836750fc971976c8d6005ab7a0f738a0b5a8b2c120833a876a82ae0bdbbcb
MD5 08ee009b00d9d27fb6b3ce9b57c7abb2
SHA1 8525b8e77e39adbb8f112e800184c1bec2a856d3
SHA512 740d2aef3bf438a21a7263e790313bb53940d06f058b29f90c689958eadfcb5aadfdb8eb0f92891c26a51af769afe2bb390139bfe980de201cefc88c333a6262
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iev:nDyD/DyDJ
TLSH
T15E864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 8.0MB
SHA256 86dce798a277eedc09be3de94982ad639ca2fdd7de7e88c623024af09b236e11
MD5 37bb4b94ffc77b7373a014e6689d6ccc
SHA1 5dccfc6d7dbcb49ca65c71d678ffcfadd6c92b67
SHA512 30f614f11d13e65d358cff08751228cff4bcd10e86f946c6b6116d2cf43a013b412e0eb42f98277333077072827e809c8063e91d4f4fd826d185dc4e52ca465f
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Iei:nDyD/DyDU
TLSH
T1E0864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 8.0MB
SHA256 3477ef5e342ced40a4a39a6a09b8ddbb55eeef88214fb3d0a4d33a34ce1c54e9
MD5 9d4f9099fe62711d3379f473ef5bd843
SHA1 fefc72a931e59616fd138ecf84aad54e016e6206
SHA512 b5e397394aa81e09c3be4c4102af69c082b4d4c53b578f0957bc33dd1cad05d9809934c6099987b5c2acd5137539a9c23da7f8e52a07ba71e7bb3a186c3a0efa
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie8:nDyD/DyD2
TLSH
T1A1864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 8.0MB
SHA256 2e973e7365251288025e885337188246f44c7fe6df9a44c1845446e79673bcb7
MD5 ba4f1e284a985407bd5e6f7cbba67c56
SHA1 fc5147a5a2694cea448fb765d296e3a87935fcc4
SHA512 7edb84c11f4f2a368989de10d614b9033fb7bdd98bc0859559e7829a93d6aaa62268105a4ea814647f259dd61c8b66c889b6bfd154ad3acc704ca9db66727d00
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ie0:nDyD/DyDa
TLSH
T139864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 8.2MB
SHA256 b39ed844d9314637ae5ac28b7ba562ec34f9e3eb20bf09bfc52756f331e8e3ec
MD5 13ea07fbd5da9f7423f8c232325930d0
SHA1 c19389bd7f16430da3d2c78532e55bef10d75ed9
SHA512 0818fdd0db3b93ffa828c6f3b3ee39054cb06aed31c0c892df37049bb4e58b3a1b5ee150463865f92dfa45b691c5c1e8589e510c3db945d601a9c9f8eecbc703
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1Ieo:nDyD/DyDy
TLSH
T184864A16F57882B3D1B6D4B5C6D6A779FA3234424B308ACB8345C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 8.1MB
SHA256 d80265abb7bd59dd19b09f648ba04fc7baa2555f5ee4009717c8f7c9cb866866
MD5 d6064a921ab5b555aa69e993edae7b65
SHA1 fcc1e22c74c5b45a6d1426a749907a82078d3c47
SHA512 f83aaa54c322541e0333149554bdac4bc849826bb0860e45cbf548ac2531bd7b030ac56786583e858f26ad1fbd025a4d8f4e751c1881d48b0e0b6397a80bc6fa
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeA:nDyD/DyDC
TLSH
T136864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 8.1MB
SHA256 14e5288eed7bfea81aada547c7721f7ced17e9ae520b9f0fddb8da10a88d0841
MD5 a1004c99b1e561d9d1b36fbec7cb0f23
SHA1 9fb77134155297475f7431b7417b7a363820e065
SHA512 a3a7260de3ac2573810f73070628d29dfb82ef7fbb539b32572dbaa7e1620e07a3b1ca32d815ab3edbf35dbef6d0a4194e74421af6c4b3834ba35fa22eebe508
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeG:nDyD/DyDaj
TLSH
T144864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 8.1MB
SHA256 24e89d20de83871c4d8cb3f4c4ae4f9f3e402bd88e5205cd921f9ccc301f5d8a
MD5 13d2ec7c1b9899da09d361da2179f09b
SHA1 82c8a891685f5fb29b83f19987703ed2af1a430d
SHA512 b06e060b7b5013b1665b0e63bb35de138a13eebe54321ed2a762bef4c7b0729e1fb77addfe40721e265ed552e2dc5b182f2c57a98534b6a8052b6e6fc4d706bb
SSDEEP 98304:Uu5x6M1IezSC6v2XMHcu5x6M1IezSC6v2XMHNu5x6M1IezSC6v2XMHcu5x6M1IeI:nDyD/DyDID
TLSH
T182864A16F57882B3D1B6D4B5C5D6A779FA3274420B308ACB8346C72C2E236D19D3673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-463-0x00000212801E0000-0x00000212802E0000-memory.dmp

Download

memory/756-509-0x00000212946B0000-0x00000212946D0000-memory.dmp

Download

memory/756-492-0x0000021283C10000-0x0000021283C30000-memory.dmp

Download

memory/756-475-0x0000021283DF0000-0x0000021283EF0000-memory.dmp

Download

memory/756-474-0x00000212839B0000-0x00000212839D0000-memory.dmp

Download

memory/1356-633-0x00000182829A0000-0x0000018282A92000-memory.dmp

Download

memory/5524-632-0x000000000EE30000-0x000000000EEFC000-memory.dmp

Download