50d00ea84a36752a42ce68c81d06e759a120a5fb36e6479c9ed77249eeb7c922

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Size 8.7MB
Sample260706-waafyaav4t
SHA256 50d00ea84a36752a42ce68c81d06e759a120a5fb36e6479c9ed77249eeb7c922
MD5 c27d3462b414ecc83978d548dc523dd6
SHA1 9a0fcb84bbbe7b8f6476315c411c7a1d9701acb1
SHA512 e17215d9b0191eeb05e838623df2b3eec6e6dbc401ed30c1c28df15630ea1897539644e6b524e6f68d1835e92b8fb2739ebf077d8e65eb7d3ef45d0c95f5a7eb
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTY0oAaldmdmnpz/h1+v:JSWyZ/K0ttYVAAT1Kmd0x/h1+v
TLSH
T1D1967C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Mail\wab.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{5A394072-FB68-49A2-B162-8AE53BF62062}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{3431F8BF-556D-448E-952B-E3C47D3A2864}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1532	explorer.exe
Token: SeCreatePagefilePrivilege	1532	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3336	sihost.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1132	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
5932	2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
3764	StartMenuExperienceHost.exe
3808	SearchHost.exe
1532	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 1532	3336	sihost.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1132

C:\Users\Admin\AppData\Local\Temp\2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-06_c27d3462b414ecc83978d548dc523dd6_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5932

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1532

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 17.6MB
SHA256 1df61fc1811d273621258e100e5700ef0f1b54b62c63f62f376bfd6a252e4e51
MD5 64a6f5b47a085ad023204db92deb73df
SHA1 8feaa996977f4cc54e0e93cacacc796cb289f947
SHA512 97ceebd90a0fcc0694c20fc7313a09957c91e1a1b35ebe23dce07d7703c2f1c75589e3ee147d4b3f116a6b6e05e74029e3518b5cc31f6f119d4fc180270e439b
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vQ:zyZ/K0ttYZTEqoyZ/K0ttYZTEqK
TLSH
T198177D03F2A440E9E16AD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 17.4MB
SHA256 ab0fbfe7393b4c9430919f03ddc6b3baa59456fff24df9d1e8a31df92c079cbe
MD5 8409f220ff17ba37b3e23b1be0b23f73
SHA1 515aada70f033700c12d8386e808c8a80b3cc535
SHA512 a6b7dc4475f3736228102939931b4804ad2b5481193892b790e8573f58da836fe5721fd9e6ac3ba9f0c8d718970f196b74de7a4465c57d3b4888954d689f855d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vVb:zyZ/K0ttYZTEqoyZ/K0ttYZTEqX
TLSH
T11B077D03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 21.4MB
SHA256 7a30593cb4395245c9b8054bc1f003b2f5af0e4eedc99898bc3872f4f1a1fcf7
MD5 730a2a153df68e30938f2690837a50cc
SHA1 9873bc0c77de2b2e4179fdc9f852ebec0fe71a44
SHA512 d6743bb8913ed4d27f45a57bf966b09699e796c61e64d4dfee10fa15ee5cf8d6844d38aa1a44642f1e38a0580333b9d60bfe81d347beba76bcc4adeab58f613b
SSDEEP 393216:zyZ/K0ttYZTEqoyZ/K0ttYZTEqJvyEYKbi:zyZ/K0ttYZTEqoyZ/K0ttYZTEqhA
TLSH
T190375C13F6A440E9E06AD174CE668631EB727C494BF1A5DF2240B6D92F33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 17.7MB
SHA256 47aba6453d03783fccef64b2acb13c1f8fb6f6db1acb4432a65b706382e09365
MD5 3a88ddfea4fc879c4ed6636794c2bf66
SHA1 305603b8029ce2fe1be2601d1d970f6ec701b220
SHA512 2ecde2fe3365e70333ff9255efb8817d08b6e7c478600e632b84d1d5e5c18dfbbb36d032d63e0df3336a5f3e6964c2cd8be0e46aad9f2acf381407d277dd1a3c
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vt:zyZ/K0ttYZTEqoyZ/K0ttYZTEqT
TLSH
T140177D03F2A440E9E16AD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 40.8MB
SHA256 42cd4f134e8e9ce26edc4722ec47856665067489808809cdd3e1f400ea4499b8
MD5 cc1100416dcebb0227faa78a2b2563fb
SHA1 b62894ad37e6c5b5a7789413283a459d15f45116
SHA512 07d42236daec1364c075b525b4ea7006f8ce9b7d5f5dc7edfc05a54803fd193ee4364f929ab66dd544c62d5fed0f0ffa1608427453f3b3a0ba9fd634fc2d03d2
SSDEEP 786432:zyZ/K0ttYZTEqoyZ/K0ttYZTEqXE8c23pV2X+T:uZ/K0ttYREqDZ/K0ttYREqXEh2ZV2XG
TLSH
T155975B52B6E443E2E366D134C9B18271EB717C0E5BB162FB2174B29E1E376D06E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 19.5MB
SHA256 68b71c97ec0acff3b782f1c26979a71d3a78b6201ef3b58477f0f650a77fb147
MD5 b1cf69373b7bd0be019e54ee65bb8400
SHA1 6d4432a5493eb401b9456ae5f1001a734b683390
SHA512 7fd09b5e60c76e18a59eb9a5df23ca7ddae14e1af39cabb42103c45c5057dcff5a997482c24b8ce327345fdfc408371a576e0f14d77c55a18fbf6dbdd472fa4d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vwGn:zyZ/K0ttYZTEqoyZ/K0ttYZTEq6G
TLSH
T16C277D13F2A441E9D1AAD174CE668631EB327C494BF1A5EF324076D92E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 17.4MB
SHA256 2bc7cdc22819dc8489079c43a76c24d70d08ecdc3ee8522c0138379dbf7a52e6
MD5 587fd20fdd20dab8a841f5385504f591
SHA1 95f4650ca02f1933794e961ae2f5bf31c1043084
SHA512 f5c7725137bf2e03e079e25e3b6973edc29fb43ccfb633f2866364f75114da57d21be905e7f1d22a7edc3365d6c5643d8b35a90cab8c361eff3d2844072afa0d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vL:zyZ/K0ttYZTEqoyZ/K0ttYZTEqF
TLSH
T18C077C03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 23.4MB
SHA256 8fe70157ac5e73a32071f7970844df14b7de4578319b223e660977f59b124c9a
MD5 f5f0b7a3e1e344a6ec293d1708c9f7c2
SHA1 7025c6c36f28677245702422f805c2b763dff2d1
SHA512 c5eb4a3c8dec3bf730d29cfa339d699b73e6c73936d3649dc6a2b33eabd531998b48344a438dd9393b0792f3bfc5ea546a75ba8f7c1e6f89b033eda79eff25bc
SSDEEP 393216:zyZ/K0ttYZTEqoyZ/K0ttYZTEqHQsas+PS:zyZ/K0ttYZTEqoyZ/K0ttYZTEq/Fz
TLSH
T14E376C03F2A541E9E06AD174CE659231DB327C4A4BF1A6EF328076D52E73AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 19.1MB
SHA256 bface519ae22026a183e58505a09557d491207c65cc5ba45a573d9ac9b916e0e
MD5 38e1c3dd771523ec91cebf062398cd5e
SHA1 839e22a144b9e12777d7e6833bbc9da41a4c2939
SHA512 bda995e438533a78a0a88ead97f84d6180dfb3b86a7096f7b451cf29dc64aa9d52fc323a9158b9af6ca6fee618fb0cd7d037d350e8aa3d0a19f10f74490013b6
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v1thHf:zyZ/K0ttYZTEqoyZ/K0ttYZTEqD/
TLSH
T1F7176B13F2A540E9E06AD174CF668231EB727C594BF1A6EF224076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 20.8MB
SHA256 dd41c5fb760eaae469588d9e3bd4e22ea91392a8d19a6975415115ba2250f5e2
MD5 da9d8b359196b8061bb4f95b6b025bb0
SHA1 c4eeadaf88ceeb59ad67569a6ab769656862bf48
SHA512 d1bcd81abe127472c3e442c598e5cfd207deb6141372e1d0fdc35629c67a724c698d00aa92e208816eb46ce564896ddbb82709e05bd4b44609328853c585dc01
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vVLIHuWhs:zyZ/K0ttYZTEqoyZ/K0ttYZTEqn+6
TLSH
T1E3276C03F19940E9E06AD174CF669232EB327C4A4BF1A5EF224076D52E77AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 19.6MB
SHA256 d6467d232980b5d6246e805faa6c0796f511eaf9add7f6607079d3bc6ec19423
MD5 18bd125f2dd65a3e09a6cb6af6f10a85
SHA1 d30f2250bb39057efb45ffcc1d3e57fa419d5b48
SHA512 47921860d1f1ceee00520920012160340ac84dc054daf7079bf173799384f1202e68ce2ac1fb0e54b9c59676b7d098f6f5b11fe7db40c428a89121da54823932
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v96Jm0G:zyZ/K0ttYZTEqoyZ/K0ttYZTEqfl0G
TLSH
T167277C03F1A541E9E06AD174CE669232EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 19.0MB
SHA256 e6301a3d42395f0c55d20a4f0bbad7980525982b17f5b5ae51592239fe165cda
MD5 ece355cd91f9b0234f8257cfcd84b2d5
SHA1 d698eaac4d536d3b2731dadcea5e0e74914b2968
SHA512 a6c6e9e0d8599414feda895eaf8e3d67b5d8a79343efc2574d5f603da372682178a8cc4d3a9c58284ad20f1d283f88114266da5ac28a9994f076140e9774037d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vWfPf:zyZ/K0ttYZTEqoyZ/K0ttYZTEq4f
TLSH
T112177C03F2A540E9E06AD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 19.2MB
SHA256 6cf39bcafb5cdd5c156e9b9dc2b6a3ed268069a85794dc2bb175744d6e697579
MD5 d31118a5ed2f04058328436fd73e9b16
SHA1 1fe10a699abd083c0f28e87891dea2879e26845e
SHA512 e66cd0bca51ec1f496f1bf121742ea33bb838db15bfbb5629db9f2ce2cdc444c6210425fd2301f18fd37c6c84e7a8b47420e76f33428cccbea73e320553e6fc7
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vjdKC16:zyZ/K0ttYZTEqoyZ/K0ttYZTEqSC16
TLSH
T12E176C03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 20.4MB
SHA256 5c95c726b3642c794ef7098a3067cc8c8a6179ee1ae4d7494da7d80a66998a91
MD5 77798daaf594888f8d2e7126445654dc
SHA1 7d3317b074581ff81af878532743ddd2ea95c0eb
SHA512 6f44603a0d04c8619b19a4b199f5a8aa44b4c761c4bbfd34c18478c380b83243f8695721f211c2d3599705a79e6aab252e37ee39408d2e0ca126fbaed0d1d756
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vmjnDO:zyZ/K0ttYZTEqoyZ/K0ttYZTEqGO
TLSH
T147277C03F1A540E9E06AD174CF669231EB327C494BF1A5EF2280B6D52E77AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 18.8MB
SHA256 48e15fdb235eda21b54b24b2755e25d3a1610caf423dd67e8462c03696283f12
MD5 f5a9ebc0d35e2de909f5ceb47d73eb9c
SHA1 a2db18b45a585cca84fad34809a3a9c7ed4a0d6c
SHA512 4a4fa2a359baa983f4c5a3e76b0255b9824b57716318ce77531d5466a90ff6e64ed7ad47bb8069e1bdfbe5b64167e2f81e7c249e181591c30d16d875e5a45f51
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v82iw3:zyZ/K0ttYZTEqoyZ/K0ttYZTEqY0
TLSH
T1B5177C03F2A540E9E06AD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 17.4MB
SHA256 6904bbb16db0c370921a65ee95418fd1e9b8438d651e3145d8537bce951734e2
MD5 d9d8bd30494d94708309046b1733749d
SHA1 7f51112933e5126d8c7445eac0cfdab3d63cfe0d
SHA512 8e99bc5e4a2a79de43b93e8c9c47a2e9a5e76432c6074ad2b18e3a25553f7f44d101f084fd75be3d2b6274348753812b74c632ef766821deca02e084a950af26
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vl:zyZ/K0ttYZTEqoyZ/K0ttYZTEq3
TLSH
T180077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 17.4MB
SHA256 9ff02acb6028c78585d426abd372877a7ecec01bfd4c61b8dcb2c19070e76140
MD5 ddaa2024a545cce06b986ba55d591d9a
SHA1 f876f76e2605f8022c379aa5c466afb4d9db656a
SHA512 2ce8dd99230082149f00cc90a67f9cb32470e1aea30640f4944abe4a004aaf7d590720d859c0dbd6e0db27254d3f39881a69398444e1afe03b37795a4f193a13
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vx:zyZ/K0ttYZTEqoyZ/K0ttYZTEqf
TLSH
T1C5077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 17.4MB
SHA256 47fa73ce3bad013ebb379bee6f2b279cbd4fa78cb0ad104adae5663c13d5f4c2
MD5 f84824b054cd6914e8614e46f7e35f0c
SHA1 98a189a53493d280f5a685be90180cab65d45d3c
SHA512 fc54039d2b9cbe76755a011235fe843b4931ff33b3f482a47ac5f2985d81832d401b64ae6d1821cb5e87439127471cb49cb0c1744fc133a590c3469bbd37943c
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vq:zyZ/K0ttYZTEqoyZ/K0ttYZTEqQ
TLSH
T189077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 17.4MB
SHA256 52c83e61741f9f0c15e802e26885757754d7f28a93beea1d7819ddf268727128
MD5 05d26de1a906e010ea00ae20075fed75
SHA1 0d672ba0f52f86393c91d01de431f754abc17efe
SHA512 3612d4ba8768ebbda2b80a7a34178e1394d88532bc670de814dd376dd1582940a04c4e724585dbc7ef44c1d8f66d3f85ac567cf8ae5a1243360d36dc5b40a6a9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vn:zyZ/K0ttYZTEqoyZ/K0ttYZTEqh
TLSH
T1BE077D03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 17.4MB
SHA256 e5486a7f98068e2a12397d0803ae5e97cc2d44812541647d7095decc0039181f
MD5 617d564c1a38b19d61d8db37e0232fa7
SHA1 0a76723142d0096643f3ea74b9655f12a03af747
SHA512 b82beee6280f6e1675d123ecb2f7d8848dee218c56b7e57ffe43d70d95c02de955167a9c18ed4f1be713d2c68b9d7839619b42ec8a5bc3e9bdf7fd71ea08a963
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vC:zyZ/K0ttYZTEqoyZ/K0ttYZTEqE
TLSH
T1A0077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 17.4MB
SHA256 587b6e582ca8a57232d68325ea2b64130a4782a98464fb50741c0833dc937788
MD5 01582bffed4ecd3760f3752ddb878b12
SHA1 65d67e716c3f37e7cf9191022496fa0a1f7abed3
SHA512 4a69b75c1c653da4db0bfd8b935e5cc75ed1ad5910ff47b20fc6205c266e275500a427ecbcc2bf8561aa9cbfb21f5254ec901246508111da96231b924e13071e
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v9:zyZ/K0ttYZTEqoyZ/K0ttYZTEqb
TLSH
T1DA077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 17.4MB
SHA256 d3e989de601aea38d3b511c2a4a9f244fdd4467d7d82b5cebbad13d5e753ef90
MD5 a0dcb033a71bbf90032de8c8bb05e721
SHA1 df601019085658326f4e96ee5d4866bc9685c966
SHA512 b23e82dab0e918d7710388c4bb93757b8c7b832b826475a7c7c6bc3c1682e4e2814c16493b69fc2bedd7679f67f4b72ce804d6a7096a29222cac0bc23a0eac12
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v6:zyZ/K0ttYZTEqoyZ/K0ttYZTEqQ
TLSH
T10D077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 17.6MB
SHA256 06fb7c0b66c6a4e6aa9940e04e2868c86efcb89a99025113994c855286b99a0c
MD5 f14ed46603b0a0db1339c2456718c070
SHA1 4c2dbcac5a34dc08bb72b62ead2c0bf7a8b2b79c
SHA512 239f6dc79118b9dbb5810e4b75daaded299dc6c1dfd8e355377fb5db21ffe3bdf20188baece4efe4ce0f06e96733f1501b6dd95af9c5a587e449f8ab0ca54e1c
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vVfu:zyZ/K0ttYZTEqoyZ/K0ttYZTEqnm
TLSH
T14E177C03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 17.4MB
SHA256 429e87db0152d714d4fad8e481f005034911bb9218f8466e5af9d1bf1fd58e87
MD5 b1c5f7eb111f6edf89a89c0d20568b9a
SHA1 7f06290c08cf5aa2901a3b64625e1aee2339378b
SHA512 fe9ea0b6e8d6ee0fbf9a44c79c8c8ce67afa1473da2698ae53022b6636d5a2365fadd96124724f5a6eb25ba143a53add572b95ee5ee74e173a0591522b0a684d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vz:zyZ/K0ttYZTEqoyZ/K0ttYZTEqN
TLSH
T191077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 17.4MB
SHA256 ce17c8c671df9c8fe410ec17b030528ff594fd5b8a52b11140f543701e3d6cf2
MD5 4170fdaaa0493befc8af099ad677f2c9
SHA1 d740b4ab318963ddc2ec9081c202d7fbb304a802
SHA512 3a165377fc3ef9c3974581241602e7d96dd01fc325bba001f3075fb7c6245ce5fc63b6bc47eacb30d4310509e09bd1bbd91ccdc8a7ed78de29e6b54bd7f79aef
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vX:zyZ/K0ttYZTEqoyZ/K0ttYZTEql
TLSH
T1B9077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 17.5MB
SHA256 a1dfbfbee8477da95e7c3591ba6cd780a8631bd8e88f36dbd7ec715eb5d233ab
MD5 b10c9aed24d8a88e073805d5de8efad4
SHA1 0e1a7b5aa050f3d79c494d620d939be1d69687e5
SHA512 c33ef3ead81d8777737925ce7595f398c365eaf1ca25e3c736f15a2265ca9c8208d0f897e2b3dfbf49d9816dd0a5b53c0229f4fca02c5edd9b3fb4b7191bdbd9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vWs:zyZ/K0ttYZTEqoyZ/K0ttYZTEqN
TLSH
T190077C03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 17.4MB
SHA256 c363186f096f160b506d2e8749f35a65cb79fca79d082b54008b01c922ee12b0
MD5 4f8e15b7679b87eed526878d6c2c00c2
SHA1 2ea7c82c3b77a5ca4eb5fddbdc32555fa5c6ad02
SHA512 b1f579aa29d6b0b5d5f5a8a6d30dc59e24f56c8f227fc7854b65c79c5d420e93a55d2630c7388fbfddac7b57384270c5087e35757cf6f1da42c70352d9fa1c5d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vO:zyZ/K0ttYZTEqoyZ/K0ttYZTEqw
TLSH
T1DE077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 17.4MB
SHA256 f19cde2ac437a32dad7d39546f4e232e6be3f717785416c151f2d3aeb71ad630
MD5 d0474eb871b2a54e465a75de7cd1606f
SHA1 ccc6686b10cc5f677ed7c8cf2440ca0e332c8fc5
SHA512 7fc9aa0038e03bda7e5ebaee27bf275d409bb5142a68e419d96f61854c194a025534e92eef12e17bd4bcfebce3dcadc2d337a74c8729b5386648a4b963bd8acd
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vo:zyZ/K0ttYZTEqoyZ/K0ttYZTEqy
TLSH
T154077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 17.5MB
SHA256 90c9f2d74bb72501225b25590943f8528e1c43117c80d5dd8ac6bde9806d494c
MD5 b7fde819940a663757a8b394d17a53dd
SHA1 8cd9e45b63d719e1cb1c978aad3dfdc574a5d77a
SHA512 7145a1623abbe20361f31425e4ff5201f842ab8c7d278231c56da7ac1004308b5868cf6eb2dec6f36cc3371d55edb610c45f67560efe05a9dfabb082c0b845b4
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vzT:zyZ/K0ttYZTEqoyZ/K0ttYZTEq1
TLSH
T119077C03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 17.6MB
SHA256 5974f55d157216c90e410aac344099b0e835d53309317f3471d0dbd48734a953
MD5 efd8a6aaa0dca09e823d7c2c37d22e4c
SHA1 1622f28b665ed440117a589d8d508ec066bd9e82
SHA512 1df535940ea20f6c3fb9a8f57ee4774894e215df7f4ac44136b2f35d2d1d6e9bb3bab9ae44a5792b79bcdfbb3ea05c75f7c3251102768c0f9b8862be05323344
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vLtB:zyZ/K0ttYZTEqoyZ/K0ttYZTEqp7
TLSH
T13E177C03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 17.8MB
SHA256 32aa4f6cdd8a35287a4a338ad04d63791a3388fae0756c1ce1e0718e6b33f420
MD5 25cd253715eacbc3094b7bb606a32a69
SHA1 095d2b8fa4a32b4b082d3a5aaec9f554e3deae99
SHA512 6fd8a1e1f551c1378572394026d647bfc7998c5ccef4300e9e6613c778451ce68d6ebd82ea18cc24f7ac592ff4c0539e0aaf733e60c86533c8273ffb41d170f2
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vsq6:zyZ/K0ttYZTEqoyZ/K0ttYZTEqqd
TLSH
T185177C03F2A540E9E0AAD174CE669631EB327C494BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 17.4MB
SHA256 a2cfd3f90599297f822de547ec98d9a4773b0883835f2d1b7a72d2f8efa8f869
MD5 8ca813a8091c8331c4b02f47ffce2042
SHA1 7dcace67a144834008804f99f99695a7712eaf80
SHA512 793395d95970ce5adf7d5e943cf2a1a4c2d6b2af3be0139e87f61368af3328270b820e2a17234a84592a348213c2922d9e1641deb67d5ed8cd80a556b1ea35f3
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v9:zyZ/K0ttYZTEqoyZ/K0ttYZTEqz
TLSH
T174077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 17.4MB
SHA256 2edefd13c64cad23df437e4f88b7c70ac4f0c25494098ebf2c73dd61e1e62409
MD5 a46b9a73f9cc1aed8cacc6cff63aefc5
SHA1 586b99a1c2e05b224aef80c13c81491e271024a8
SHA512 9dc212a4b91e342a191de0f28905e457c08e3ae552de3a70ba680f1f896a5b6db4288fd5249be981afd18c4e9fcbf1de382eef5b8fa0055221470d74e9e5a2ec
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vo:zyZ/K0ttYZTEqoyZ/K0ttYZTEqa
TLSH
T1BF077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 17.4MB
SHA256 ade9c2c94bc2e59b9a9c0185440fd12673f9eacc2b07d498b774f30f7f929bf9
MD5 842197f44767ab1644ef3af394a83b57
SHA1 1e318f4933dc0c33123123732f63c11674252e65
SHA512 abd1bdc67d5c4a4eb0ac662283ecb133446d67d2edd5fb146dba376c8d50914ede1f08f073449223955c66aba0309523432ba787db94f70004b9c2a1e8871589
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v+:zyZ/K0ttYZTEqoyZ/K0ttYZTEqA
TLSH
T17F077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 17.4MB
SHA256 be72fb5dc828ded8647d369d436050b1cb6aa9e564ece6560ce1a813cc467ea7
MD5 67c205b886fc4e36a9776d90b32ee68a
SHA1 c164c243b6b165691d882563fa3b8738f53117e0
SHA512 d1dc51704c0493e153cfcedee48b3406b10569f207dd7de0556e0382e03570f1e1fc56a85f902755020796dbc802d522a8096117f92ab8e2d714291d835fc468
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vx:zyZ/K0ttYZTEqoyZ/K0ttYZTEq/
TLSH
T17F077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 17.4MB
SHA256 52097f6622c5a5e70c1a923bac2b8b32152b3f6d42992a573be888e0fb27dbfe
MD5 0918105b8a5efccf280030734823f395
SHA1 5d4d386805f9c6a4808da63edaa2179f5fedd3ea
SHA512 80eea3e3c3dbe4b9b8f406b389e1738f2eb27f3700350b14ab4360b1a3a46b5ba75e0e33ed24f248364174cf38473e925a6b2a8b59204b2764f6561767fe026d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vD:zyZ/K0ttYZTEqoyZ/K0ttYZTEqZ
TLSH
T1DE077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 17.4MB
SHA256 568637f3f73b0d56c42c149af3917dd8a5983fbe94a33715ba71c7bb179f1f15
MD5 8f17f659d68087bee2fde4510f3232c9
SHA1 479c2b69791994eb76694ebdf1e70189d6a01642
SHA512 adb5dcc4c7ef9afbeaef2b88c81e2120901f1b22dbf16a5d0f7ded89c699f76b9b6b0d8b449dc6696287b0f50015cf89cc6cae4bb3723321224c86352e0731fc
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v/:zyZ/K0ttYZTEqoyZ/K0ttYZTEql
TLSH
T19A077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 17.4MB
SHA256 09d2c6d73727c6eb5507014d022bb4bc3d76dece9c550ee2b1f68233e10607d0
MD5 dd05bb37f0b4687a366351ba021772f7
SHA1 e8e164d0b5b16140cb39afe7ea739248ea911e1f
SHA512 98450879b59179002155ac96d313c2396ecf1c123176937e9d81d80c8f72c6a8554aebecd68e384f9be6208f1078a02957d0c6ea7846e6b8bfd582604d12ff70
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+va:zyZ/K0ttYZTEqoyZ/K0ttYZTEqI
TLSH
T1CD077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 17.4MB
SHA256 1cf964d5c9cb51c95fb7872ec5253cf1b85f13a9dbd010b78f0650433d655f39
MD5 174b3d1ebbca3e767efc66d160ebaea1
SHA1 b8f2c6f4b0e10917fa91964131e87ca677d964ff
SHA512 c5610a688f84494f831f471c23782dd7d69f35c2233e2e0f7e5c565fe8a72bddaf63bd616b32933d5fe4624366431541aeccbaee8708ee59bc214eb2e9a7b3e8
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vK:zyZ/K0ttYZTEqoyZ/K0ttYZTEqA
TLSH
T181077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 17.4MB
SHA256 02bef185f7a2186bacd115181f0fd14f57d568532a1102fbcdfd4de2259e216f
MD5 c1fbf3fba4d391064a144c3682927714
SHA1 91aa79c39cbe1296a677e502b1afc155436589f0
SHA512 7a4fe458c38c44b6d90d9cf477ddc96134cdecee7b964ecf12f22315a132d33e4924e9e3121c05d8100191359bd87108ac7237b0c5975f5cedadd3e9a6761849
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vF:zyZ/K0ttYZTEqoyZ/K0ttYZTEq/
TLSH
T134077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 17.4MB
SHA256 3e89645ccb9d59afc1b50b30c6855ad81312dad8acc801890fda1214d948e860
MD5 8dc89e2124f206e928c4fbed8a895b48
SHA1 1cc9009015a8325d7963d973f72eb23cc2c198c3
SHA512 2df54ad1672b8cfe548bb054d34f059f0ea9382b2dcd2c2b1d52e39ca7848f328929d71bdae0a8b8f68716ec62231619c5584da195fbab2c5353ae862aa9d230
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vk:zyZ/K0ttYZTEqoyZ/K0ttYZTEqm
TLSH
T108077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 17.4MB
SHA256 fc89522329c0b6a5f2e68d38d22982aa96550b2126358d96dddba3735dedfbfd
MD5 907420ec6f9342823f8022d7ba2b39ac
SHA1 b480646103cfaadf6db0aadcfdc91f0afa0fd5d4
SHA512 4e27d123b870716820b01368b607dee8ad9801ba105daacc1f9de456d2d1a205b9d6373f4e49f9755634c10fd881e9c3f4f56afe07f98d09b94b30266b9861f3
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v0:zyZ/K0ttYZTEqoyZ/K0ttYZTEq2
TLSH
T177077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 17.4MB
SHA256 d5a98bed63a14916b388200161d8abdf9a6f42f0ca16529852dd8cec641c8e2d
MD5 d998769726e64059601372de7294524a
SHA1 74daddac333bf58ba11349b5ffe9a36789e3329d
SHA512 7c6afd1ab4561059f5306e0163ec4d3d6dc0a77ee5cd7c3b722ad84dac78aa9c9c8bfe5924e9493e9049f4798869a54eb3d437edae5fbc3592d9bb4ee49bad60
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vk:zyZ/K0ttYZTEqoyZ/K0ttYZTEqW
TLSH
T1D2077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 17.4MB
SHA256 cda856bdbf09444bfe461333e75553b8958882e81fbcd218c1a8a29bbd32ea1d
MD5 0e0fb883b353d0580acec391bea6d4be
SHA1 13927369a51d84bf9786beef5819269d0ca12882
SHA512 ac7e5ad5a6ffd34de4040d892d4cd35d6719858abb1b2c54eaefddac973924c7ba0a8e82e740c76e6561bf1737bc4332525e98930498476a9b28de74a3545b83
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v9:zyZ/K0ttYZTEqoyZ/K0ttYZTEqL
TLSH
T144077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 17.4MB
SHA256 4446755fcc9df4133fcd92f5166cb349abb4b64f6a4da6a8fc15f726a2aaa88b
MD5 b98becd520be6dba3538d4125af30f25
SHA1 5c43c30548d740bc6587fbd6a15f5f6a57735633
SHA512 53438d547bd592ef09492ae9a4159116acf3fe24adada9d992604f288255588bc8fd278e5f9482c777f86a9422519781e859498286e1db7d47bccfb4bdd34f34
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vA:zyZ/K0ttYZTEqoyZ/K0ttYZTEqa
TLSH
T199077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 17.4MB
SHA256 46fee5b25653b774c2d01d06a7ac51eba95d92b75f30582a4090b581f9d56128
MD5 9e2d48d1594804f32c91cbae2d465130
SHA1 e7c9e2f1c9878b6e98f4c5d35f7ff3c589f7561e
SHA512 76dc0def9a521708092621104a6b4ddb5ad05b85172f1ad40fc886538a6a7ea1d0bd640ac250e5750fa74b004f4477b093e2b1d34353eef52ea9918a4785a973
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v1:zyZ/K0ttYZTEqoyZ/K0ttYZTEqj
TLSH
T1E9077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 17.4MB
SHA256 6787b81d8da79e406cbfac64e91e3816d5dd8e12d4671a4007142a8d4cf8482b
MD5 f92e2fe994adb9562a23f70d1d5da5a6
SHA1 6ce5e410c23391609383a94a50c514b2d17eaf1d
SHA512 f0e741ec164e475c0e07bb91e66c61654b109a2177a4c1254c9c1b7af38062166ca3fb55bd00088dbd0fa4fd10009855255c0be0286e717f79b69db90efffdd3
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v3:zyZ/K0ttYZTEqoyZ/K0ttYZTEq1
TLSH
T1E9077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 17.4MB
SHA256 45dead3c6c05de1b99646223f939eb288b84ecc23270089f8c5a430a0145f9da
MD5 3d914c713c107c7b616661c1db4d8352
SHA1 3f6f8a0164b06d4a104dc1a9231eda231fb8f107
SHA512 6743065db2f329ee662ee1068da61c8980131e4c87ade26723104966d9c424f605d9383fd40a98f099574f0a6f5b06a29da421bfdc74802a558aeb454a8be6a4
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vB:zyZ/K0ttYZTEqoyZ/K0ttYZTEqn
TLSH
T198077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 17.4MB
SHA256 c8e23e385b0a63b22784a2f38db53354acb6734d1f3d65c6c38366f02255806b
MD5 3c13080200e2450a5fc9803e9856e283
SHA1 f1739eccf13cf3b357ed3ef804201dd8adc1ca08
SHA512 2b3f80e66440381ba4c4b343164b3169c7d567f8d85e0af3e883a5d33db048761634cb41fe4fbac835dc41b9f51a33645574917c07edfac111b3e1aa723aeafd
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vv:zyZ/K0ttYZTEqoyZ/K0ttYZTEq9
TLSH
T193077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 17.4MB
SHA256 fcc5fcd7c2d878cacfe9bdbc41a79b1813daf30e8209aca54012597e62dbaf27
MD5 d0ea287098ca83dc7d03c2a59edd17f7
SHA1 44930eba01aa6c253be5c0d522567cc23cce4078
SHA512 ebd7c9a628c0c3fafdc6c8f674ca48aa080b4b1df62504eb3eca9858a4dfb2cc30f4d7e0f48efbf136a7e35756012b13946e6024af77fc7527bcbdb99c03aea2
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vw:zyZ/K0ttYZTEqoyZ/K0ttYZTEqi
TLSH
T177077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 17.4MB
SHA256 49e0665054c7ade91f3fdb42636147e12c2ef08db7809929e278cb9d014e0bd2
MD5 bd515ea7164fe2de00ebc9657bf7dc2f
SHA1 3835651108ba6661c77f611a1395ef25359dbcbe
SHA512 3362fecc677da911fd0be052e2e98b78c16c9c34bc81d9664f294bc129db8a88e231085f7c06db4aea814f33eeba4a28e44db13e41be824a52779b4c049a9b60
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vJ:zyZ/K0ttYZTEqoyZ/K0ttYZTEq/
TLSH
T113077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 17.4MB
SHA256 64d35a695d077350f7d104f45a56aa034695267a452058d843ef71a9096633f5
MD5 2bc87be1dbdfe641e944da43ceab989f
SHA1 c69493d4f32a00bceea5ef384c4f7abb3dd76fe1
SHA512 997644c0e37fb8b28857f9b81318f3261db5429b511896a5e081ab872c68c16966592ab9b337c6e3725f930f2af049e06a4e0e6192ac43efeb420410a3f1f59d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+ve:zyZ/K0ttYZTEqoyZ/K0ttYZTEqA
TLSH
T183077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 17.4MB
SHA256 134af3cb7ce96139ecefe0b14be2610deeee9ebdf39eaf020a7267d7b0600f46
MD5 c55c53781fd12f4ce0d8ab000b230a95
SHA1 d670a11c032810a1ed4cedd33c1cc8241d69b301
SHA512 0c179d7f12c682fb747959a66e7b6a12c86ba78dcf842418342acdad5c3c547dce43704f25749027f0ba80d43bb4c90d4566d1dbbaa0b67c1a8f18640ef174e3
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+v/:zyZ/K0ttYZTEqoyZ/K0ttYZTEqh
TLSH
T17B077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 17.4MB
SHA256 dce2216b533682e77d7dbc6d311e7a7ddbbdcff6b41dd8a04501705a22460ec4
MD5 dd2b3b4c2c1b023e5b6066ef6494f219
SHA1 081e0e6c71c5df94eb5c7deda16a3617b53e555a
SHA512 665d607a50910075553b286ad6cfcfd5fb6e82df0fd61a1688743faa1075fc6f9dcc349705b682cd15007d5e7682d96e41cbdd760dd7b886ef7df6a62477c4dd
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vl:zyZ/K0ttYZTEqoyZ/K0ttYZTEqD
TLSH
T16E077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 17.4MB
SHA256 baf0e39641060cede1138410b043d800c7bebb00f88fffad778ebb3c6e3610d3
MD5 e754af9f774d2af4bf2e17b283a5d32a
SHA1 dac827743c1708b085319948589c1c5cf7b031b0
SHA512 03741b16bac398e9b773ce94bf2424180cdb85eb8a526632a6893631cd4c6875d88c9f846326bd09a523ac1d46dde85e174707ad0087b0d3e8c4432323d2029a
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vM:zyZ/K0ttYZTEqoyZ/K0ttYZTEqK
TLSH
T1E3077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 17.4MB
SHA256 efdc5e2514e882962c89eb98fadebaefb94e2a1c761ad15c2c6f9f67fc63cebe
MD5 d29b1efe5cecfbc3b2139dde67462b94
SHA1 abe72cd74030f6112989bd0b41ef5c65ed1fa3ba
SHA512 c0fd33133cec7ec446d8974bc019a5b66e3698a4408fcbe87c970280073ae740cc9e7d3ef11968c6d683902e5e496f51ae029935700813e6b4fb6b392e991313
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vO:zyZ/K0ttYZTEqoyZ/K0ttYZTEqY
TLSH
T113077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 17.4MB
SHA256 3a39ca4386160638c951522978ff120e8cd1c2a925521155cc1ade2229cfa403
MD5 9d81a3b1fdbf1804a03f7c431080c657
SHA1 ea3f19244c645f821efc9e6ddcc9f50368f02377
SHA512 231e4ba58be1e3898a18ad8d3442980649f7194619d709d95569c05f15929fafa24782a6531583d4600022fcbab4c9bdcc7ae2ba22198b5a0d89eb32d50ab30e
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vb:zyZ/K0ttYZTEqoyZ/K0ttYZTEql
TLSH
T1B0077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 17.4MB
SHA256 8098427a88e10f63b02701bc5bf7f09a3f16bbbf0c383a88847ed56959f244ee
MD5 79a5e9e5722876403d9de4f754ef1f13
SHA1 0d4e6f66ba2cd2bdfe8e8beb162028c396a1d3e9
SHA512 2f647cbea79aa9bd4ca6ed8ab131301f2ac21d4d8ce5fe5f5045a0b9b59ab9f3209cab2d1327721087e43bfdbe53e416dae96d2bdfae9559dbf9a2aa6aa9c8cd
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vf:zyZ/K0ttYZTEqoyZ/K0ttYZTEqt
TLSH
T138077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 17.5MB
SHA256 082eb0aae3ea583933dfce6aa2f7458a83c25bb2d06be873ef3b8da7e4f1cb1a
MD5 59c3c3eddb241865290abc90a16ddeb4
SHA1 c9583dbd7c1d61563ba323aa991b66d80049cfd6
SHA512 f2af68edb32595d233ac81457aa064428a4ac5ab34b0171d7e3efd09fbd99b71d5cad1680bddb1b9c1f0638dc9a267befb17337b05d6bc12e71e552fecc72317
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vh:zyZ/K0ttYZTEqoyZ/K0ttYZTEqb
TLSH
T11A076C03F1A540E9E06AD174CE669631EB327C4947F1A5EF3280B6E52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 17.4MB
SHA256 c08cf24a584d4780c9b7ed45ccda10f04b52de88cd3e6fd33a58337e6206074c
MD5 0b1215cdbf5e83dae29c96617ef63505
SHA1 e46f564808674ef9abf95581116ffdcdd32e4d69
SHA512 3a65fe89ca7d7ffb073233c7e78c48b92a080bc57990ae3690487a9cbab67c529c7c1bcbb93719151838a08b6e582c3440fb61a46678cce5388379c776cc0a62
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vd:zyZ/K0ttYZTEqoyZ/K0ttYZTEqH
TLSH
T1E5077D03F2A540E9E06AD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 17.4MB
SHA256 9cbdccf2ba441522229cf6cfbc3839b0934be75426ec92d07fb11ef34bb12c38
MD5 7456242e3504d30fca747c0118fb38e5
SHA1 f3184fa2481a7a2833f97c09fec5ecb84adf0df1
SHA512 fb1d6cd367c1ca602f382727ef2c1f5350705f5f2a3a01463ce7f199095ace0ceb3daeeaa5cfdda922f5ab373a12ff8ee0a53c4bc8c79249431973f6f05d8f64
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0x/h1+vYSWyZ/K0ttYVAAT1Kmd0x/h1+vtD:zyZ/K0ttYZTEqoyZ/K0ttYZTEq/D
TLSH
T10B077C03F1A540E9E0AAD174CE669631EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1132-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/1132-4-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3808-463-0x000001B803780000-0x000001B803880000-memory.dmp

Download

memory/3808-493-0x000001B806CC0000-0x000001B806CE0000-memory.dmp

Download

memory/3808-507-0x000001B8191C0000-0x000001B8191E0000-memory.dmp

Download

memory/3808-485-0x000001B806E50000-0x000001B806F50000-memory.dmp

Download

memory/3808-462-0x000001B803780000-0x000001B803880000-memory.dmp

Download

memory/3808-461-0x000001B803780000-0x000001B803880000-memory.dmp

Download

memory/3808-483-0x000001B806BC0000-0x000001B806BE0000-memory.dmp

Download

memory/5932-19-0x0000000000400000-0x00000000004E4000-memory.dmp

Download