a0d5dba702039ee222ff09576a74180dbc219aa09bf8a57fdafc23a1480144f6

Analysis

max time kernel
114s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Size 13.1MB
Sample260706-sdsvxacw3k
SHA256 a0d5dba702039ee222ff09576a74180dbc219aa09bf8a57fdafc23a1480144f6
MD5 9d4851f1546925026a8aeefb70ab7edd
SHA1 f5199f29cd5602160f61c66bf47b067f37efc054
SHA512 2f55b3032584554d2e40d11c438483d09c5260e3efc7b8dedc387bd52c41d7ec9ed8bf19d2c6b015d3a32cf90f08b41854950936b5bf02f344674cc036cd81df
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+:2cDcyGcDcy
TLSH
T1C7D69D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Checks SCSI registry key(s) 3 TTPs 46 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{07F63B1D-B43F-4146-955D-F863B8999DD7}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{2105DD29-343B-4958-8EE6-F83F99FEF4C7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe
Token: SeShutdownPrivilege	5964	explorer.exe
Token: SeCreatePagefilePrivilege	5964	explorer.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
2996	sihost.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe
5964	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3184	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2164	2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
5244	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 5964	2996	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3184

C:\Users\Admin\AppData\Local\Temp\2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-06_9d4851f1546925026a8aeefb70ab7edd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2164

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5964

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5244

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 13.2MB
SHA256 8944815e6eadce64ca5d9d159b9c8296b2ca12c7d0f9eba706df8f0511d518a5
MD5 b6bde5b5abd139a522b56aecdde1bb3f
SHA1 793c4f7232e24c4ffd0f3ce3cdebc540e2f65cab
SHA512 2d074adf06baef2c426117d90e7abbbf45cc458914201135cde6883c5182b7adbc2e644011a666efd3da5407919a0a8844aaf246bd6a583c58b0934a018acfa8
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+:2cDcyGcDcy
TLSH
T14DD69D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 13.4MB
SHA256 c9be72fc07c7c499b851af1ef354df21510d712ef57d988607c079143e1bc507
MD5 ac70e6d309bfc36146b245daac56e09e
SHA1 1bc573a6cece91dfd41bcc5fbc4c7064533ece82
SHA512 c03e7065b42119207dec6c01f555fc201bb17e7a14207b96d1af1fb489ca6787a64d31a46e66664db6dae734dd230b5ebd36a6b4297c6c9e2138ddf44886c73a
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+4:2cDcyGcDcy3
TLSH
T192E68D17F6A440F5D06AD5748A969236EA72BC120B319BCF4390F7192F33AD06F3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 26.3MB
SHA256 9a0c18e886affddf537b55d5fdad8e8b7a7ad4b90037e0d92fa3128dcbd38d4c
MD5 c88451d35fe747110d1806e73e2fa781
SHA1 49e62854ee75b1a2511ea54d1fe4663009986fd4
SHA512 7e648675a6456ddb3d870019211b2cfd590b9c830d7627ca2ef5857b4113b25158d2a6902e7446cf2d407f4a6de69e629468591bb70da1616d00efd7832d938e
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eQ:2cDcyGcDcy2cDcyGcDcy6
TLSH
T123579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 30.4MB
SHA256 b5eec3801b6a848453555fff32d481179a2afa79078e291b10e475825e4a2e5d
MD5 b8c6f9f574d7338ef3b35649c3e6de30
SHA1 35416961e3499c699f02ed64744ea4ef75b83530
SHA512 ab51f370e0e470221236f948163659aaa73d05e496f62e3898853f85dfd762cb132d5005c40ab87f2328cde8c5d56ca9502a5a2bcf7d552e7dac5c9867ca75e3
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ep:2cDcyGcDcy2cDcyGcDcymvyEYKbi
TLSH
T13E678D17B7A440F5E06AD5748AA68636EA72BC520B319BCF0390F61D2F336D05F3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 26.6MB
SHA256 0ec50071706f01f46f76f2990d01b2ea112f4cce7df3e190b929d4eb9e6bab90
MD5 0fd0fde3bc2577ff9d077e7981e2f387
SHA1 ac140ce21da5cd0dc475a43ca4db7e38fa01a304
SHA512 0a28a4a893e45443cccf4f8024a7b44fd3e88e217a229c09517c7cca80f6b400ab92153f68223b42a67eef373dfb776a3702f74d7dcdc096b8d8f175c500262d
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ec:2cDcyGcDcy2cDcyGcDcy+
TLSH
T123579D17F6A440F5D06AD5748A969236EA72BC120B309BCF4394F7192F33AD06F3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 32.3MB
SHA256 400f44fa61cadf913a5488f9036554aca327e779d8da00da31a1fc12c7ae574a
MD5 535670b18b10d78310bd7b524314603e
SHA1 fe09e17814dfea683789bf783a5ce0b1a9493a97
SHA512 7c2cb00489f8d88721260cc5d345438e423961e9c14f89a17e9c742775c53659dfc26aa78d3b984b2d018a290c2ac9adb69e793b2e93e3466c723a57d929f7f2
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ea:2cDcyGcDcy2cDcyGcDcyCQsas+PS
TLSH
T1CB779D13F7A440F9E06AD5748A6A9232EA727C520B3097DF1394F6691F33AD06F39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 28.0MB
SHA256 8a2a95390ce524f467b6b5521099a13d71b62f71d97c03f4c918b26743aebd72
MD5 2118a0f2bebdabdc12c1adc1889dec23
SHA1 c1f41fa9a567718c990ff3de9a33857d5a290919
SHA512 9dcbe8a9f9fa71049cea277cf279d270b547fe8eedbf166772dc5a26c9b71778a04b9a5ff1b5d03f03401d269c0c72f0025ea628e226614a5d789964e2ccb187
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e4:2cDcyGcDcy2cDcyGcDcya/
TLSH
T1B1579D17B6A540F5D06AD4748B969236EA72BC520B309BCF4390F7192F336D06F3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 29.8MB
SHA256 a56f2a6621f50e3de6b60f28fda1cef9ef76baf57b6c267356a43a7a0995b9e6
MD5 613ec7a8aff344f2ad82a03fbb69672d
SHA1 3b1261ce2cf8c59eb44b084b87c7e5c769911570
SHA512 bcbbed60e8e1694e2e2e648c9a2d424e0fcc98bed33fd8301731623df432df093ee5f3b81876a0a29f1f8143b0603ed1a43cc34b98faba3d91fd9401e6280547
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eg:2cDcyGcDcy2cDcyGcDcy4+6
TLSH
T119679E17F69440F9D06AD57486969236EA72BC520B31ABCF0390F7192F33AD06F3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 28.6MB
SHA256 41a15e868e690337a3eb16c09afb2c73c4d499840d19d080d4d0d65576d09a26
MD5 5e51e68e27b100d0b3549403fe14e492
SHA1 49bc5420f6e5d5ebbaaee3d4a33daf16d5c358eb
SHA512 bde717c1753ce5c8e1d37562b5cffde953fd0735743f473186b31d2c16c2d1fc47937b2a48ad8e69546d7a7781510cf796983730b3084dc377da1c48534999f9
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e8:2cDcyGcDcy2cDcyGcDcySl0G
TLSH
T12C679D17F69440F9D06AD57486969236EA72BC520B31ABCF4390F7192F33AD06F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 27.9MB
SHA256 df298e56608f51d879cb4cbbd6756f97b0fb81bbb102ea12a64ebda5418bdab7
MD5 6437595f304f9f024eff5fc6c9a9b3d9
SHA1 fa3e22619cf7346753ad8187f2e05ee6644511c7
SHA512 b5d0823d6aedd77557c5ea4f27e7b947d19469e82720be89ed70f8688871aa544300981ca3523dafca283c4b8da068605917f83443607d3801f14c69575186be
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eT:2cDcyGcDcy2cDcyGcDcytf
TLSH
T1C8579D17F69440F5D06AD5748A969236EA72BC520B31ABCF4390F7192F33AD06F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 28.1MB
SHA256 1c9b42bf7558196c316a7093bf2a43fa78857199a581069183b2a696633d7adf
MD5 e077a6f0adcb42da8c8399770f716a94
SHA1 5b68824e3f6ff4757b0ec594b3c7bafdaccf7819
SHA512 0db3995ee8261c2aa7c2d514b517195fc90384b9a6bdf4435b4ed81d826b0a5087d58c3a86df12c79e5e3f0949bdf273a679e3db8d5698dbff28e9f026bfb125
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ev:2cDcyGcDcy2cDcyGcDcyLC16
TLSH
T165578D17F69440F5D07AD5748AA69236EA72BC520B319BCF4390F6192F33AD06F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 29.4MB
SHA256 a996365e70a3e919226ad30d25b0726637d6efef13ffe34b92a05aa81710e761
MD5 b27b6b118b3573aabf222edf42f7e8e5
SHA1 21bff79c716a26c10cca24a5ff9d2810204b20da
SHA512 8afe513a408737e2ecc69cbf9fa0d2d2e93b779dd9460d74de522a8e280fad3ac20ce0b280e3a02ef26430d4f33b36dd50e954d6f9bc8682048d1a0962488ea4
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ee:2cDcyGcDcy2cDcyGcDcytO
TLSH
T17D679E17F69440F9D06AD57486969236EA72BC520B31ABCF0390F7192F33AD06F3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 27.7MB
SHA256 b95ff2220090587fc71e99c2fce5daff0750192d7902c0153e4a7604d3a3570f
MD5 175c376d419cafb6062a1aa0271d6b55
SHA1 6bc100564bd11492b384753dcf1cd97a257fb6c4
SHA512 00a65e3904bbdb70146623600bcf504614b354c9e9988c0cc7357f2c0a06d9d38c1d6f7a6f54fbd748474edde491335ef222f65561ea3567748f24472ec14b07
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eU:2cDcyGcDcy2cDcyGcDcyB0
TLSH
T1B2579D17F69440F9D06AD5748A969236EA72BC520B319BCF4390F7192F33AD06F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 26.3MB
SHA256 eab38dfc8fb19ed5a5f6aa04684ca1d3f8d6fedf4282dc85230b446e434cdccb
MD5 f4832e9a079e5c327f7e8e87bb1bdbc4
SHA1 4abbad8ba21326185aa9d842f1b5dbe2e9c60ee5
SHA512 81325df9b03c7f652142b1bf730c1de1b4e556f88a7156b3e1a57d981801e975c7287c741459d9f0b1d0053577676148cc83ffc58cb766a0c541011e73a83712
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eA:2cDcyGcDcy2cDcyGcDcyW
TLSH
T1B6579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 26.3MB
SHA256 e679d81939e18b5aa603e55f16191926d50fce850d18f2561f13bbdf53145071
MD5 e8990aad703a6e29bab4633ed2c5f770
SHA1 dff8d21c790574da8ba70c5a9cbd567fb1aaab74
SHA512 074e764328e7b41ab1d71778ee03405ece7c13bbff7425affbea7621d0570995d3fc977a83c3f4eb28e6ac484998c53e6fcac34b16f1a21371dd8ad6db4afaa1
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eY:2cDcyGcDcy2cDcyGcDcyS
TLSH
T18F579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 26.3MB
SHA256 4e91c709891a7e416d74498ad225161bf564b0f430827d968b6e420a0774770e
MD5 afe318b2a40b6a8200f6376c65918acc
SHA1 61c27911a533c84f5ac6870281c9fdd317a873b0
SHA512 f7f9270782067a3ad9fbb46195e3d446587329f8cefc89af7e0ce678512224c3c09a6c2363631f09a7ee32464702fd50a5c89211975e4d915c6c1b4d2c75eda4
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eb:2cDcyGcDcy2cDcyGcDcyd
TLSH
T15B579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 26.3MB
SHA256 55e4215d481cd095f3595c3ddb35b5e74c8c837e63bc4c8c56943c84b1d6a19b
MD5 e139ad6b9f3e6f0034673e1d2cacc81a
SHA1 2a4e05489ae8e8ffeec30051aff4dc55de3f37f2
SHA512 3dbba330a0cd0735e95968c85af86cc0d6e43a419fe1bd10f4e841646a29de99d21375565f27d6cea9f1c9ffa5e8c0198177d0372533993922ba553c5702e2a8
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ey:2cDcyGcDcy2cDcyGcDcyY
TLSH
T117579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 26.3MB
SHA256 a40deb9d605149686313b97f7d72fe76a6478e73627609e7013061b5d5fa31b4
MD5 59b4bc0c4e2f6eda3d98a71de0cd709b
SHA1 22469e94706d69e5984495a8c2fe22daf673e598
SHA512 218ba1c1bb7ba821da31549a1e76bddaea10ac7419116e962f3ef09bb790777b58e3bdc31bef2ea9dbb2f4b74e506162912e275c617354d4763dc0630db2e279
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eP:2cDcyGcDcy2cDcyGcDcyF
TLSH
T1E9579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 26.3MB
SHA256 5e00783eb485bfa47b0ac39b771b7edee6ab6a32cfef6b60a6c22954b804651d
MD5 4bbf27622590334a3bfc9728fddaa8c0
SHA1 e0f4ba4c2d1ea724011303208d245d3e8e42e2ef
SHA512 cd18fee0405f718f3c86ca6467fe413de3489614fb64f2865dc8edfa7fe1e39637d813b6c920acc03eb55d4aa86328ac192a7b71cd73f876f1b3cdafdee0eb0c
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eI:2cDcyGcDcy2cDcyGcDcyi
TLSH
T11B579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 26.3MB
SHA256 333118ee9ed1f071f7ba4101bb472d867ad1cec2b242dc44b3c981fb225b93ef
MD5 5801be01a5d2a4576a78fe8f35ef9bbb
SHA1 4c8d414168a7ba33475497157a057a17eb2f2a86
SHA512 e94a8c8c1aab20d3c0832d5bf100ee0aac931842fa359cd668fc5fb33ac8c1353aa01ae7c314358097eadb680307927b2ce7f54891bc0451287798ddf6b33025
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ez:2cDcyGcDcy2cDcyGcDcyt
TLSH
T101579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 26.6MB
SHA256 d966bc6f557861a71a65d959a302d26fb19a749c58da0369ad4e60f09b795143
MD5 207fbcf4f9b8d461f5bb83608ab119d0
SHA1 9c7d635f0a1ef14eccdfdb816258092025c154fa
SHA512 73327cf64d9bd03d2fd4bcd1c0722780e0599fe9302ccea4d627bd447cbcc4641e4d74143d35f2dadc9ac4bd27d6b7eaf64c6410a560ca197acb25dea66d8425
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e1:2cDcyGcDcy2cDcyGcDcyQm
TLSH
T129579D17F69440F9D06AD5748A969236EA72BC520B309BCF4390F7192F33AD06F3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 26.3MB
SHA256 0922dde791791106ff0156c724ee52d65ae9f241d660737028706daa8e691f38
MD5 05bb4a6812e047e03ee29121368402ce
SHA1 5c27103bb7bfc9138dd2d07c664fa7b1e79c123f
SHA512 65f70f76a49b7dfb50ea7c2518365a46ac119ef6449c8f0d880d1dba7846243e86c2556cffed0ae6b9b89e1fdc49752c2aca4e2e24d848ed1ca996cb0a673052
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eu:2cDcyGcDcy2cDcyGcDcyM
TLSH
T1DE579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 26.3MB
SHA256 0c26533f5fd8c72664b7497a2ee5164e90c1f8ff3685b4094060fde759c8755a
MD5 843677225bd37d392dea2b1a8bdef7fd
SHA1 62d14c1ce02f4e339a0df85cd3052728852fef76
SHA512 dce7ba87617f786b3b586532fdc2642d56efc4ededc2e0755559010e6a6812010eadc108011a14d35f1571bd22dd94caaf0af38262b5822bb10c58cf7b79ad6f
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ei:2cDcyGcDcy2cDcyGcDcys
TLSH
T14B579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 26.4MB
SHA256 655121aeadf7e0e9c32bf947c187a7644372e24830a97137cf73e7bdc7ff1d46
MD5 d0b628198d94f96c26abfece85703ecf
SHA1 2bc88c699b349fb40c9cc0c9658c2ebcd7e414dd
SHA512 fcf9be90cfaea905795f8172593978376456001e09e0ea83a5817408d63fe751ef3315e09f1e9552acaeaeb403f852cdc33e7db15bf53bf27446c12ac004a0f1
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eO:2cDcyGcDcy2cDcyGcDcyw
TLSH
T16A579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 26.3MB
SHA256 3e3cceb9da48874c86ce73ab02d4c50b476fd53481d5254aae18e1257362f28e
MD5 a1925acc088464f2412d0ef4d0b924b3
SHA1 20ab40ca9234f970f09c6f74f952ae480a9af11d
SHA512 2c12f85ebe3b5592ccfbd815b3db407d58f4bb6d4bd61ae993fea92d74804b9f17f102f2763328f891114c60ef46f5ef52fc1c31231c7b4aa5c0a553dff68ad9
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18er:2cDcyGcDcy2cDcyGcDcyh
TLSH
T110579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 26.3MB
SHA256 7ed79eb66d90260666047aec11784d4013a488c6622dde1b40c9613a9d3c7707
MD5 af3f259ace667b45bc9427f02182445a
SHA1 b4c68e20b195c140e88ecc753280b9e02829b4f4
SHA512 ab4283991a6e85bc4ad3061f20ab4f81706daed6c9f213eb0220d0d7861bc24632c2ca64def798d541a26cf74a520d1c6867799702da5251aa70238ad47addef
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eN:2cDcyGcDcy2cDcyGcDcyz
TLSH
T166579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 26.4MB
SHA256 7f477bf8bf67c1a33a342bd0416a744d1f1be6c65cbd82c8907f4d2a3fb91d7e
MD5 4388ca426dd7c447a1aea5b968bf8ef3
SHA1 161d82db16fc94e252adf4b641cad0cc7affaa3d
SHA512 47b79c66a7c1fa946c17cf55fce01592d28c40e0037f73679ea751518abcf3dfc947761c7ffe5f98cfe30a09abc85fb0a7c957e8f4dd889c5807301d170fab75
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ee:2cDcyGcDcy2cDcyGcDcyo
TLSH
T19E579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 26.6MB
SHA256 f64643ac1be5a515dfe6ea281709d1473cdb46a5d019def31314d35bc066b75c
MD5 b15bdf59ae15f98440f75d0e65d7d216
SHA1 4b7e26e42d4a0a94ad44e14a6b81cd534947c0e6
SHA512 870127e246790ed1435a4039d397aae9a50e48e8d860a421a21ef275de013454d3b57184231392e5bf6b6af42aeeaa15d84732f6959c2310a7c2e5481b34c750
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eC:2cDcyGcDcy2cDcyGcDcyy7
TLSH
T125579D17F69440F9D06AD5748A969236EA72BC520B309BCF4390F7192F33AD06F3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 26.7MB
SHA256 189efe9945d4c9faa8bc095c62bdb9f07fd8ff30dd07e5f6929810566741c55a
MD5 3bdef69ab572c9747c48a8ff10f04988
SHA1 9d3982d858b30e3ec4f478f0fcc5c33125fdc7e0
SHA512 1aedf518abc14839eadc2a376e28c01dc38edd7d23643a8e6eb17d21dd04c74c24d870a32aba952ac5d4228099c670479321e65b1ccaa9e8cfc1b503c2bb421b
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eJ:2cDcyGcDcy2cDcyGcDcy1d
TLSH
T19C578D17F69440F5D07AD5748A969236EA72BC520B309BCF4390F6192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 26.3MB
SHA256 652606e4c91802f1281d49f63128cf75b6e86fb618e63e746d680db6e7f1a7e7
MD5 af77b121d15a19c1c5e2fdaa57df599d
SHA1 f4a771e7f03638b0166a0623302544f26c0672b2
SHA512 35b97e45855f53e453c1d369a65b16bd264a5db7c388341215715c4fc126ebffdac9ddc43c469681569585af93079d11d0fec0d855ec4b24f4b45e72677bd428
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e4:2cDcyGcDcy2cDcyGcDcyy
TLSH
T1DC579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 26.3MB
SHA256 52f0929daac8f456a869d58c99c978ee34e667c24600513b15f2a4154aafaeec
MD5 6d00ac32d0d270db88390a6ab57ab180
SHA1 03372a35fe3bd81bfb66a972a39f6896f7360384
SHA512 1dc9db2c0a33f9c0828bcee1a7bed7bd8a1d02ecc860ae3cd83ec6b9f5285d19c9d977864baf223518c8afd99d967a5771e92b9360afcfcd1cb446c8ddc8cafc
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e5:2cDcyGcDcy2cDcyGcDcyf
TLSH
T1F4579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 26.3MB
SHA256 6f208066801a28e234ec9216885765dcd00676a47ac58cb328b99745ce5f41c3
MD5 d0479acc1949458a8b2cb49c70847b1e
SHA1 31d395b5dcc71e136d493071e6e8028b625ab009
SHA512 0472390b1e1f595370310732b1609e209ecbffb5e8a4c7b0ddd9e6a8bcc6769412d4517b63bbb2170df1f627ca6e1ee2ee696dd513dbe11a2e2ba9f8722aa28a
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e3:2cDcyGcDcy2cDcyGcDcy1
TLSH
T165579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 26.3MB
SHA256 aacae3520b3361947cc33b4aa30353d9650896a6a2c4314f47fa682cdda93b1f
MD5 2bb67fa376b52701f51adadb0a06e159
SHA1 712c76f879435ded68d990a563a71e52b215ce14
SHA512 3a46703917d8e8faa739254e5a6079b8273b08291b3d1ee97446314c4af1594eb977bf8b841badd6130d2625eef73103d1f5602258743dc47d1a61df18e66bd5
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ec:2cDcyGcDcy2cDcyGcDcyO
TLSH
T145579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 26.3MB
SHA256 325c742168285db070ed1ecc5f4f2437db5f5aaa82f58ab48859809eeaad3c14
MD5 86bf29ea219cb5f29da1c2c42c1e73e7
SHA1 0fb3fb695f4564d49cbd343e51b245488604cefa
SHA512 f3edd00387ed3cdc61e89d1952c2097be3aed03f59b456f7d9552d0b19c57149977504c6b4edc3f6d7afa252f66bd622676f69578b9c5332653a4b7e20a547f2
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eq:2cDcyGcDcy2cDcyGcDcyM
TLSH
T1A2579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 26.3MB
SHA256 7fc86e7edef916d0863c0de585637b33893c0889d49202d2875d30c111d5fcf8
MD5 9f3b0b35d21ac64de9f0e14790dcfd77
SHA1 962760321889ffc855d880ab55740802e48e20e4
SHA512 66eb9ee11f03c70e11e5a2aca9aacc2a68eecc1a869d0c5a5e862721249d82ff85ec56559af7504d4311c67d79157ba42b75b4facd652079502bfca1061875de
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e+:2cDcyGcDcy2cDcyGcDcyY
TLSH
T10D579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 26.3MB
SHA256 55f22c1dbd66142b95623d86bbe13d0e25ff537b4d32e8daea10e2e99d4c688e
MD5 bdbd31cc7f945f42d709d7c19c8b7a9e
SHA1 9d40b40850b87e9b1489ec640c334dcd07bec62d
SHA512 e9f466f5dc2d837d68c110daa5cb03c159f32d1a4104a93c60af4ce18509553cca3a1c138d0a46b5254b94eb61172669347ee919c9e33f16168b0df35e89ee1e
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eL:2cDcyGcDcy2cDcyGcDcy1
TLSH
T1BB579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 26.3MB
SHA256 2410fcb9eedd1471fa57a060b82cc8bc5d24fd86946ee20e07433deeb00efa05
MD5 4e52d6c90c996543892fba40e73dee1c
SHA1 a336183c0f2c0d2a6d5461b6c8def6b3532a7092
SHA512 204516d26a347f5d2923da9a120eb92721361aa346c0e044da95089552d7e4df0e988bd22cbe78b95ebacb3144ee406fbfa3f1cf1afcd7a9b86d29c9ce83b28f
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e3:2cDcyGcDcy2cDcyGcDcyp
TLSH
T12D579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 26.3MB
SHA256 07e0aa009db7d8c4ba52cd449fcc4b88edc0d949a9dd31295e7c176fa53e566f
MD5 64e3fb5ee639a9a4d060a72bd22047dd
SHA1 e47b3aca2e064515e90d74ada05a90e45a16f8d4
SHA512 760978ada1fbaac3380b5651df7388ef93e5dee88c95c04d24e98bf3a9e1aad07bf34fa5c41970a5b1a18f9359e5953535feb2570ea1a9e1fa8b4d39258750fc
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e4:2cDcyGcDcy2cDcyGcDcyu
TLSH
T1CC579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 26.3MB
SHA256 4a0bbbea6e40d7cc7829771da8dc49af5719f5c4752e463e74447fc25f06b588
MD5 ebf1a427eae650b8a1e9fe2c60f40cc6
SHA1 184ab5b71f778f1115f9b0e5e8b8c2b18f73b35d
SHA512 f93bdfc9dfa7a8162a05d7174a890c53c92e88059ee0822381a2f60a0fb58ee617fdf6219c7c41050a0fe4095a878a90ddcb4259da856087d0a4607b32cd7f1b
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eh:2cDcyGcDcy2cDcyGcDcyv
TLSH
T1F8579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 26.3MB
SHA256 7107f6853243f9d9d1bfc711b30271ef707c9fba8ee965c3276c5b136f415930
MD5 452d3ea59d1daeb61d77fc0266b2219b
SHA1 b1c48ae95aa9eed0346854420850bd0ec035094c
SHA512 edabb63a6c5517d0e7d9d9345adca453640b24fcc3629a99d58062dc858f52629eaeb6469bc84dd4e43790890c87195aceb823d7a0fe4d45c9af93e732c254d6
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eh:2cDcyGcDcy2cDcyGcDcyn
TLSH
T191579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 26.3MB
SHA256 42da2696ba32654ab2e4447db5dfc3e99312a2463a30ccaf078ff155e33f6ef7
MD5 41911b03ab91a99d316c5e9af5268395
SHA1 44dc463903b1b162baa6dceb1e035995ddf9406e
SHA512 eb560d285b9af14157d23782cdad4cc2773726855ccfe7a0b4aa0fc55a207587a1d37b522dc0fe672ae0bcf69640ba98bfdb6817431dce1c49953b946012af4a
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e5:2cDcyGcDcy2cDcyGcDcyn
TLSH
T115579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 26.3MB
SHA256 089824c8c7fa601caf296360fcd029b21d597ce1fc390699d8ceed02d029644d
MD5 aa3d15ba1d7d5316a0796e40fede6f1b
SHA1 bff6bbb5f9d2e5da92b283ea70e8c53f39283d1c
SHA512 5f3b42b30057cf532b6f0fc1ec235118b5021a9ececd71264cdf97cbde305eedfe0b62ff5a2ec4bd1edc04b7b33a16efdce0676649215fc5527037e4bf8bf1b0
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ew:2cDcyGcDcy2cDcyGcDcyC
TLSH
T172579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 26.3MB
SHA256 3fa22f9ad4bae2ed8b3e8c5ee86de7db21bf6d78b64c8fe701d83a9bc1cf5ba9
MD5 87666cda019a7c5674f54d8eff13309c
SHA1 93d30cbaffe18619ddf8197160b33fefd5820b5d
SHA512 6621a8c02c862193dd157482f1f32716283d776b0e3b67dbf0b6ee3c54c70845b12b302dd4e986ca84014561ba0ddf20e0b511b0cace0d73fbc0047bde723778
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eZ:2cDcyGcDcy2cDcyGcDcyn
TLSH
T11D579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 26.3MB
SHA256 2a769801f656c986b76479dfccf4fd3533c5f09cc95267db0d73e6aa375a1580
MD5 a9d726e7129bc11fd22df873ec3a5aa6
SHA1 3781c41d80bd90ac7a0d2501b0586b63a894fb87
SHA512 1fbe4b31e8245d8d4dff52ee62663689421d247492f215ed5a43c5c15834ccdfe7a114c454d611055fddce98c9e025b5477a831aa840e4ec7e7f8232e0cd429f
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eI:2cDcyGcDcy2cDcyGcDcya
TLSH
T1EB579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 26.3MB
SHA256 b86cef95098052bcdf4a01a4768cc84329afc336855e223aa1c40fa4b57fbf6a
MD5 288329017996cbb667bee826dfbdfa9e
SHA1 a58d2733b63f759af199d96791247a2a83e6a084
SHA512 e6abe4b9193d7b3f6569fc67a269a787a45996a22ad7a7f69903b7b5eba3a244ae86fa5e0d6d46183dc807d7bd7c164edb0397d75c83ed40c0dda998e7253f70
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ey:2cDcyGcDcy2cDcyGcDcyk
TLSH
T183579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 13.2MB
SHA256 dbc38dcf7f0b3a62b1f8fbc7606b996e1674d8ba283bca664ea9856651ac74ce
MD5 4045b33fb2bf609dd7e5e508a1acc135
SHA1 0645e98ae5a2dd9072f56bf8e96291f71ff0cd37
SHA512 cc065fb3b57495f172a0132dfe25b01d47afe0ef118ea27712373d1370522f56cb58823a6989ed2c8c4e17d450bb8d97b19561a5ae233033eb0931adf40eef59
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+Z:2cDcyGcDcy+
TLSH
T1D3D69D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 26.3MB
SHA256 83a7c77d12e8bc34092e725dcfbf34521f5cedb37287fae1c87756329e203d69
MD5 9df27700c87d4a8db558d59004af593d
SHA1 ed675f2c02c125bdbbec25f8bccb905c2dc3959c
SHA512 c32d10013b6770b4d3661fb89e77890d443b42c26cbc013ca248a3891ec74bcf0cdc9a46da05d596e2485f91bdce66509b76d6609ae0bfe64d056afaadbd05e9
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eC:2cDcyGcDcy2cDcyGcDcyk
TLSH
T11F579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 26.3MB
SHA256 3b9e54570ebd74867379235e408d5ce6aaf9367d23446f1994ead3a2bc7b0573
MD5 4345af0375885108dbe2a2ccf7b1a50d
SHA1 2f980d4bf075c376552ddfcd379f5fa4239a6ef1
SHA512 b4a0dcde12110caf6a2fb5520314afae7780996ba181be58e264fa8eaa67a8d2a7c807e3efb83d8cdae50521b0115000ae24d2e91fc0addda6bad8a9e29e7573
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eh:2cDcyGcDcy2cDcyGcDcyP
TLSH
T129579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 26.3MB
SHA256 bb4cceb71048c2f3c01804600747db860fdda6bd0ddb49fcfc3a729be6e4bdae
MD5 50ce0347231d3382aeb71a0052b74fc2
SHA1 6fd1b95d25e69c28e6474945fb17259cc325927e
SHA512 3ef77f8e8bdf484be5c22461f997603f1ce8d822f269a4b5cdf6fbf674a807ae41fd2b652a5768f6be6172bd513aaf8adb4427dcd45f18cebd5998e00c0ed39e
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18ej:2cDcyGcDcy2cDcyGcDcyx
TLSH
T1D2579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 26.3MB
SHA256 864bd919f86def8c799387832e6e65adf277b836498a1d94776676a18ed13ce9
MD5 063ff44eb215d0c34beee87241092ee5
SHA1 45098d9640ffd62747cbb225dccaee930ca05a44
SHA512 d3437d7fe343f53785373e4a07ae183da0e8ca9ca641b022f102a00396050ab6c80f1b668392e22ac256bbbbd03533af0c9c125269cb8194cef20be83f6115b5
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eG:2cDcyGcDcy2cDcyGcDcyM
TLSH
T1A3579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 26.3MB
SHA256 45fc4591153ac56915fa04ef3c7fd8cd82b91037b6660e3bbe732c9a436ebfa5
MD5 f0abd4ee372bc324c440c1c9783f01e4
SHA1 750bb3444826d5ac187ba1c3ac6e2d0b3f687b53
SHA512 1a2d6edc5f6087d14369b9495d84e74bd8c4b9483a13133189e742c7298a4d83ea27896fa366642e3c385e1e71883e91fc2e8da29f66cfa47647e81f3e1b2904
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eA:2cDcyGcDcy2cDcyGcDcyC
TLSH
T1D5579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 26.3MB
SHA256 750cf05e350a1b6252a6bfb904f4126a51ac88dd47eb7165140dde37f87a5eb8
MD5 583469a94492597e9137fbf8833a22c2
SHA1 c79dbca2f3dd6ce1f2b1d277452942209f479e02
SHA512 74e7a1c24aeef1ef7ae1c52b4125e09a19a5a42e51ee3d3db7e525cd7d2fc3d74288aed9212674c0377118419766f937cb869593517b19d82d3ed664f56dbeb8
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eq:2cDcyGcDcy2cDcyGcDcyo
TLSH
T1C5579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 26.3MB
SHA256 ddfc5f2d42e15c7947202bb8c3fb9dcddf437e850fa5e3f52899659f3863ca2d
MD5 4e779383fe62938384cbbbd934f534c6
SHA1 aaa20f0588242da036d889f2e68795b42f899c9e
SHA512 870d81efd3e14a98d4f1d08e976db471e8da68db6bd574225660eb2dea33bd35718e598fb608fb44d33311a2c79f3b1627de25a99cd6313925fe9ccbc86ae5c3
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eu:2cDcyGcDcy2cDcyGcDcyo
TLSH
T1E2579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 26.3MB
SHA256 3400631a5cf4d297eb0bfefa2f15d2784b98662f4067cbda90e33005d934bd72
MD5 25e00e33310776b02ffff4e69e4cc044
SHA1 69132424b880fddd09a6b204215fc3d49a1bb346
SHA512 2375474185cd541a8df27243571be40db0dcc1afe6e904c9cd62e7b037d6bffa3fdebbd83f86990d887e172beabe6ef8f5d9c07663470d6af6f003032199b0ad
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eu:2cDcyGcDcy2cDcyGcDcyY
TLSH
T117579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 26.4MB
SHA256 57dc434d79ad0a0e2ab518c78223b1d7e8ce133f11d41ee44a2d88e98844817b
MD5 7c9364c281e580cb3a7412731ecea280
SHA1 10d3a8265229de0400997b5688684b2f13ec8f6a
SHA512 045b9fe8e3778bc8e38530bd80f20dc732b3a9fee95a2767fe3e8e8b582ee26812b48ddb2ed15135ba8e69d2846717ec1f259cbf314fa68a1d68e3f71c03c77c
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18e8:2cDcyGcDcy2cDcyGcDcyK
TLSH
T12A579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7292F336D06F3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 26.4MB
SHA256 723abe9307d45e83ad793c4f6e3b9a3b8d38902292b6d76f7a21ab840b78dc9d
MD5 73aaf6db8ed79659a898c21983c3996e
SHA1 f62678ecc24caec10728d944a42ddacc2f50e3a7
SHA512 72909429430657f9bb1d3a0c5f100d7b5e1b00b805692b9bf6382067550a988af66a6ab705a524293a72d0e35ef7cbadd2c4bea4851fb8c25095e90232016e35
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eS:2cDcyGcDcy2cDcyGcDcyCj
TLSH
T1D9579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 26.3MB
SHA256 40c2bc1da59f349351799df3d936c50f6d30b8d0d67f6fab03813e9bf7b87f64
MD5 8ce02cec2a034f099479ffbf25384d98
SHA1 b85b79266a73e66192aefbb8c18e73baac344430
SHA512 6df6e157c37d389d2de3cb6ca443bceab5b3e5149429bc7e201c05a7beb479143324ac2c1824650a1eda00a788b2c6f0afd10f227b7399cf0d57440ace2f858a
SSDEEP 196608:l8Vb618U68Vb618US18e8Vb618U68Vb618US18I/h1+E8Vb618U68Vb618US18eU:2cDcyGcDcy2cDcyGcDcyAD
TLSH
T1B8579D17F69440F5D06AD5748A969236EA72BC520B309BCF4390F7192F33AD0AF3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2464-359-0x000001FC801E0000-0x000001FC802E0000-memory.dmp

Download

memory/2464-391-0x000001FC83D10000-0x000001FC83D30000-memory.dmp

Download

memory/2464-375-0x000001FC83E30000-0x000001FC83F30000-memory.dmp

Download

memory/2464-374-0x000001FC83C50000-0x000001FC83C70000-memory.dmp

Download

memory/2464-405-0x000001FC94270000-0x000001FC94290000-memory.dmp

Download