ffb6cbf581d837219f64fab6a3319b7348b5b5d2c8ab931741a38dc0eb3d7f06

Analysis

max time kernel
111s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Size 13.6MB
Sample260706-y51byshs2k
SHA256 ffb6cbf581d837219f64fab6a3319b7348b5b5d2c8ab931741a38dc0eb3d7f06
MD5 ad38fd5c0f3b5552b5dbd8cb851808ed
SHA1 9d4dbc08057ed8f5774d52c4ea1e09a5fd95d39d
SHA512 a584df54b748a67eebd39a08d05236db12562dece462324f1960f568593a6a9e639ec357c5148ffc726f3de334133c4992dd083081cdf3597ae2eb673980fc10
SSDEEP 98304:nu5x6M1WoDDklJ6qCu5x6M1WoDDklb+YPppCpU2hBJ6qCu5x6M1WoDDklb+YPppr:Qi8kLri8kb2Vhfri8kb2Vhij
TLSH
T158E69F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe

Checks SCSI registry key(s) 3 TTPs 46 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{059238E0-616B-458B-AF4E-D6D2BC1B55ED}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{B088FA96-65B0-4979-8448-92C68BC53FDD}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe
Token: SeShutdownPrivilege	5924	explorer.exe
Token: SeCreatePagefilePrivilege	5924	explorer.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
3008	sihost.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe
5924	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
892	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
4332	2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
6112	StartMenuExperienceHost.exe
3276	SearchHost.exe
5924	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 5924	3008	sihost.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:892

C:\Users\Admin\AppData\Local\Temp\2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-06_ad38fd5c0f3b5552b5dbd8cb851808ed_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4332

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5924

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3276

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 14.5MB
SHA256 ba898c19b9c74cfcea36e75fe01d48f9c3e147413c0729e410b190f294d7b81e
MD5 d1b137c2ab3c93f154845e2f1683c573
SHA1 9a6d0cc121fc749448f0b80b03bdb42fcec5d464
SHA512 d12fa0dd6f3d9a2f24b2eb17397b1d07b970e80f6dbd19b072e7363e6d005b5b5c0638426c44db002f6ae6250e123acb5998c6a29549a23c03f17e8ce239641f
SSDEEP 98304:nu5x6M1WoDDklJ6qCu5x6M1WoDDklb+YPppCpU2hBJ6qCu5x6M1WoDDklb+YPppk:Qi8kLri8kb2Vhfri8kb2VhiN
TLSH
T19CE69F03F6E441A9E06AC534D6669632EE72BC460720D7CF0690F65A2F73BD09B39727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 13.6MB
SHA256 c7bb27987fbf33aab9eee8c24faaaa709ff30e2aa96253ac1603e491a847d8de
MD5 defe70825a2a364d1106b16e74eb50f8
SHA1 9f480877745ea6a813c9a43f5667b5d42f4d4fdd
SHA512 4e58f8989d36fd63d0285bb3a9e51590dbd9221dec065d3ca8fdaf49d35e4e4a6f39d7378d84c1f237bca9c06440076a301983d682ee3e0bb60630b621bcbed9
SSDEEP 98304:nu5x6M1WoDDklJ6qCu5x6M1WoDDklb+YPppCpU2hBJ6qCu5x6M1WoDDklb+YPpp/:Qi8kLri8kb2Vhfri8kb2Vhi
TLSH
T1CFE69F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 27.2MB
SHA256 105a05066b5a43ab06801c5ab94052969ca491f09a3c3e8313e434ffe98ae34f
MD5 c1e2eab1320c1e46b17d4a2a29f99df1
SHA1 ba7a5d550daa7dfda8bd153ec3b6df8772fe264b
SHA512 d566719f0c455ff018f5891a31217cf4cbcaa7d1eddabdc7306dd62fcc1c395f395c1cb742eb83fa3e34d9d0711cab580e84dec388591aec1c802292b3b9341b
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhikb:IkLDkbedDkbeYkkLDkbedDkbeYm
TLSH
T1BF579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 31.3MB
SHA256 0a79763cf7f523641772be8f4c0b82ea0278bcb386a7827cac939239d6d21a76
MD5 207a29dfa8243e1eef29aedc9ed1421e
SHA1 8f6fa20de5e86a498a49d8ab40dd8068877814b8
SHA512 ee7c99c4a60b9d0637675c3f3993af54c45f3fe3fb90d72725fa6e1bf5150a0a19d6c712be8378beb3dc96954095cd6339d5b841cfc42de50fad5ce500d50b93
SSDEEP 393216:IkLDkbedDkbeYkkLDkbedDkbeYyvyEYKbi:IkLDkKdDkK/kLDkKdDkKRA
TLSH
T1EE778E03B7E540E9E06AC53496669632EA72BC460B21D7CF0690F65E2F73BC05E39727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 27.5MB
SHA256 42ebacd636926d944a30c10d7edcc18005188b7f3eaff0e9bc280450b99fc122
MD5 6179ce0ec5d8412117c40f5e09e9b1bd
SHA1 40dfb9e96b1594910c3852ccbd2de12d16044031
SHA512 2e6d0fb9cd99b12d5870f56b0f160e7e9df968f862b9b4a5295177102623fca7c35477379e4c6084c89c6db03024529f3a6e32a18f0ea74da64d41119daa917e
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhii:IkLDkbedDkbeYkkLDkbedDkbeYi
TLSH
T190579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 13.6MB
SHA256 ffb6cbf581d837219f64fab6a3319b7348b5b5d2c8ab931741a38dc0eb3d7f06
MD5 ad38fd5c0f3b5552b5dbd8cb851808ed
SHA1 9d4dbc08057ed8f5774d52c4ea1e09a5fd95d39d
SHA512 a584df54b748a67eebd39a08d05236db12562dece462324f1960f568593a6a9e639ec357c5148ffc726f3de334133c4992dd083081cdf3597ae2eb673980fc10
SSDEEP 98304:nu5x6M1WoDDklJ6qCu5x6M1WoDDklb+YPppCpU2hBJ6qCu5x6M1WoDDklb+YPppr:Qi8kLri8kb2Vhfri8kb2Vhij
TLSH
T158E69F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 33.2MB
SHA256 a8cd996113cc4ee816021502688e675360a4b9dfae6cfebc9a4292bec4b95611
MD5 4387856ae704db9c8373945fac5cf8d9
SHA1 81b11decef6540811846a04f89e33c733be09a76
SHA512 b40b27cbfb4a8c90bdf5453bf931570578d782846a173694d8a65406dd213381602b5ccec08bff8db7a58d426ddaaff6ac288ba2cde88292999580efbbdb66ae
SSDEEP 393216:IkLDkbedDkbeYkkLDkbedDkbeYuQsas+PS:IkLDkKdDkK/kLDkKdDkKPFz
TLSH
T1CA779E03F3E500A9E06EC534976A9632DA72BC464731D7DF1690B65A2E73BC06B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 28.9MB
SHA256 ce4a1e0794784a9f57a30ba0505f236d3e646a9acfcb03063b2d91c5fef4119d
MD5 a6bb8971a6fb5f3ceaa70f712cb2ba52
SHA1 61916da779c36ad18248ef3ae1f1fd3043bb6510
SHA512 2b10bdc6bc8929b4c3afa913a9053c288d01295d967325c93b4569e1c0723dd3c1214929fc19fd528fc9fb262ca679a1b891c1ddc378d8d46376d5746047187c
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiuthHf:IkLDkbedDkbeYkkLDkbedDkbeYe/
TLSH
T193679F03F6E500ADE06EC53497669632EAB2BC454B21D7CF0690B65A2F73BC05B39727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 30.6MB
SHA256 099d9bdc97d66a66785cb38a9591373ee6f0af426b79a5af03293e4f7baf4286
MD5 43bee91fc8ceab921b9bedf28d112ce2
SHA1 231da4672df7663482be8d27dc76998a86828034
SHA512 c190581d1145b3d8ad22767a61941aefd23ff65bb858202427fc0ae0bfb04100c5f8bb4575844805fd2af2dd1be0ddbda196c39b24abc68fee109b94c1d4a0aa
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi80kLri8kb2Vhfri8kb2Vhi8LIHuWhs:IkLDkbedDkbeY80kLDkbedDkbeY8+6
TLSH
T1A1679E03F6D500E9E06EC53497669632EA72BC460B21E7DF0690B65A2F73BD05B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 29.4MB
SHA256 feae518fffc89f9b779a0d519c8f64b5fad907c1381eb722a96e01c614590cea
MD5 d7151bd0bfb12e9bdb250d88a4454b80
SHA1 f2229619ae2ebe67ff8c1cd4139ef668ada045d8
SHA512 9842f8e5f30b1b8eee14decee8ea68754ca81fe7f95e5e34d6e155baabffc9af32ae0593fc692e8d5a1615b6379e247becd8247eacaaeeeb8f6903d11cd3e95d
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiO6Jm0G:IkLDkbedDkbeYkkLDkbedDkbeYOl0G
TLSH
T1FE679F03F6D540E9E06AC53497669632EA72FC450B21E7CF0690B65A2F73BD09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 28.8MB
SHA256 ab66a8d5db28e703d260a989cad53c7f753ed4138dc07eca10974ac81ec69e15
MD5 355521130d3526148b802a46c6302b90
SHA1 abbd69b2260a8687589ac884d4a1bfeecdd8b753
SHA512 46e6b156136a6666fb2b7c04cba5f56f3bebf9d487ceb738a28df2022f4a7356dc4813f068236f48a3d414910776b0c0dc64326494dd8b336640ae74a38478aa
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi5fPf:IkLDkbedDkbeYkkLDkbedDkbeYBf
TLSH
T16B679F03F6D540ADE06AC53497669632EA72FC460B21E7CF1690B65A2F73BC05B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 29.0MB
SHA256 ec52dfa428a89665ac2c0e50ca490999adaa261f3cee1a15c318fbb67b833441
MD5 4dff3b6d1e97666f5f4d9017eb9fe9a9
SHA1 ba320aa4c75a216bb5393f47785488e6df91cf9b
SHA512 6c28ef13eac8d7932cb7a2a9ac33288177f4d3d85ba7437a6bedf4aa0bf2363b43bafa94a304f5b26531621c56291f9aea700c83e66c078c281041b2e5ca264f
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiwdKC16:IkLDkbedDkbeYkkLDkbedDkbeYHC16
TLSH
T1D5679F03F6E540ADE06AC53497669632EA72FC450B21E7CF1690B65A2F73BC05B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 30.2MB
SHA256 9b3b7507a69ed31b82a91e7d16964cc72e7a7b8e210ca8de3448a620adbf59c4
MD5 baaab9210c411b73c79f97ca7c614e58
SHA1 02117f4807f7301ebde4bca26f7fd2cab3cbb446
SHA512 0be8c0621289d3afde025b6497d640cf1e7b5914c3edd5cd7329cee9376c424c0a5e7a71948c4049a3dee97b1a18176a14bd16e42046ca2d491660767a1464d1
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi1jnDO:IkLDkbedDkbeYkkLDkbedDkbeYpO
TLSH
T1E6679E03F6D540E9E06AC53497669632EA72FC460B21E7CF1690B65A2F73BC05B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 28.6MB
SHA256 0a3491f8cdfd41106f51875563b354fd830d8351292fba9aa5fbc3c7a1b6b57e
MD5 83fd71ef5b4c4a33ec5106c77fcc2471
SHA1 da33f39dd70e9c9e371dd4c0836896bffd6daaa2
SHA512 5097dea4a87f648a9ce7df6647b05c3796bcd4d090c0ddc27d8090e717fcaac274128a92efd41738b89f9f1aa2aa855ee8163c61fe55d7ba9c1f321e51ce0de2
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhib2iw3:IkLDkbedDkbeYkkLDkbedDkbeY90
TLSH
T17D679F03F6D540ADE06AC53497669632EA72FC460721E7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 27.2MB
SHA256 cac8cb2ea2444e8e488f94b57b939d8dbccea175b8f4c896d05edd7e2b30907d
MD5 abb032176cbad029f8f36b2b450fc8a9
SHA1 65f49a1d26a761bd7028d598cee902987fbad953
SHA512 a76b458b7f6d767823ac301d590ff877f76bc672aa4293de400922c15121c1197d570b7af645e51f4480dcfeaf24dea1bb12141979d4bd15a107cbc83e00366f
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhii:IkLDkbedDkbeYkkLDkbedDkbeYi
TLSH
T11F579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 27.2MB
SHA256 4f5f97f19226118683e1dec0fcd222fb2ebcdff1c376b321ad74611d8f9e5b3a
MD5 1c83987a34ff6cb6440c4e728cd82b1a
SHA1 44342f3da796bda7cbae606afa13fa87755d24a9
SHA512 d79dbb02b01fb074542a76645a350ed920cfbb52b8e3fcef2b18cfba111a832965ed8df8c0b17de2de39a12965f69441433f4a38273eaba9f767ed109561aa8e
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi+:IkLDkbedDkbeYkkLDkbedDkbeY+
TLSH
T1F3579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 27.2MB
SHA256 05f40eae37508e790167f3ae2495b3562ad69a9d26eaa9a307c5272589a36256
MD5 cb16c6caed35f0e2917b6afdc1aa56eb
SHA1 ae624d22b033ff4d1ba90fb9027d286778b2f761
SHA512 e520365271f6e239c9ab90a521ccd83b0d2bd60d5b087dbc75b4ca54df54e68a9db3754be20380276e2b5f5285d5b31be7ac8a1ab4d26513e29358b8982ef4eb
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiZ:IkLDkbedDkbeYkkLDkbedDkbeYZ
TLSH
T1C5579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 27.2MB
SHA256 2d81e5c56c9cf68e92878f89cdbe7be2d379cbf23d25254332f4eec5eb303bda
MD5 fe341f7e5c23767eec903336794cc72d
SHA1 c082483b939fc9f4c0aa268b21865154ca4ee63b
SHA512 a5711c766e2f064d82838d88d8d6ed4aacd0017a06680dadbfe12052dccf9759b3a2fa5ec8a08b908e95a9047fa99bc30037fa0aa29e7b6426d2240400ce7bfe
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhis:IkLDkbedDkbeYkkLDkbedDkbeYs
TLSH
T1D0579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 27.2MB
SHA256 0e6eb828bde3a3bb9466be41570b92b4e73375ca1ad914331575aaf893bf93da
MD5 3285cdd6bc788232a2c24d53b5d361e7
SHA1 7bc43c58643c0c2ec1fe727bbb8b60ca37b98b64
SHA512 745a2937c49b37e47c28f8cfc597977f0e0c4baa4a542b704703f8ef9e9523152189c4eb1c8ccf5b25c32c30fd32969e2fde9986e836641e96b4b7f2d7d64d67
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiJ:IkLDkbedDkbeYkkLDkbedDkbeYJ
TLSH
T1CB579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 27.2MB
SHA256 ee1d18588b8aa77654c0aa7be3377fc94f61e4c0fde71756d489f8a17f80f1fd
MD5 0b50b3bcb93010057eda3e88d23bdcf6
SHA1 db9c5eed29a08dc885231e90acbc85d2e78cd0ef
SHA512 c1462f6446c5e82d1be791ebeb62269776a826d3de93df9627c23b72da76956c02bf466996676b1bd102f4820f4cee4defd8a51547cdecbf0a453284972461fa
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiW:IkLDkbedDkbeYkkLDkbedDkbeYW
TLSH
T116579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 27.2MB
SHA256 b05ac7bc7e16096b696bfa41f45415b9f7bbb76fa87aca5d65a490d227120415
MD5 d9feaf53d8e3030c0e3320da230ba009
SHA1 ce588223bfd7837b2f4fb95fe284986485f8cde8
SHA512 089206ae686a0fdabf4e36c8d762a833642719cf2dedba39789c8bd105a7890e11f89b020e1d5c0c40e3cf666823fa936655d3decfbb241b48c1eb42417b2864
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiB:IkLDkbedDkbeYkkLDkbedDkbeYB
TLSH
T1D7579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 27.4MB
SHA256 7f17b4c0b2691db6f225435a97ee1f6720c4be9ca2dab7d2b8963ca9a77c3680
MD5 7b1feca375b12e89e1dfcf1d4211424b
SHA1 e1532f3d76bee493f0c8e71739694aafb2afd15a
SHA512 3f941cc02b22e44452088873b671fd514c31fdff0ae8b946da34fbbffd470e9c1d87971ed013b3bf527fa50c6721d980ff68784b5ae6715f1c131dfac41a2e47
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhikfu:IkLDkbedDkbeYkkLDkbedDkbeYkm
TLSH
T141579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 27.2MB
SHA256 93d14028b9ec9843994a61fc24d025542bd06196293a966477ee7314e759d6e3
MD5 b95fb8a40e6b17514d34303932355f27
SHA1 d31b39c1219cbdc777f70a3cec872c5b17aaa41c
SHA512 9182023952cfc88692fdfe4286d74b23eb5d66b3c7014b0a4fe25eb006f6fc3627572870af519d66f2a8f8e39cdff281a455b88a6880137061f01c9309f06302
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiY:IkLDkbedDkbeYkkLDkbedDkbeYY
TLSH
T122579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 27.2MB
SHA256 8b7fbf5fd7b7af41373f371a53fa10178ba4597fbb08940ab5586d7ff2ae974a
MD5 73aa6a31e4fabf5661095e59bb3f143d
SHA1 f33045cb3dc5d6aeb1493e8c61ba7eb469c35869
SHA512 257555b762036991bc31230529a8ce3caa10a71b5ba46b6cc2f523fa4bbb126b190e6ba6c2ed049385af62280a133967aa45f24e5524eb6f81df48692aa306b8
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiQ:IkLDkbedDkbeYkkLDkbedDkbeYQ
TLSH
T196579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 27.3MB
SHA256 c4a9a9b8e4161b01e6df0e5872afff6ddef6fcd833784a3056710610e045f2b9
MD5 e51b5072bc0fa137eb8b0fac7a894951
SHA1 085da3fa95ecf54cb177603999d9c9514f8c389c
SHA512 94ee2656a24af8bde91689d079bdd3722f334752d13be97d35a18e0b36cbfb09e3b0a839576d8cc84746b7b8c5f07a81669482d1efda9a3476fa75c5430a97cc
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhifs:IkLDkbedDkbeYkkLDkbedDkbeYk
TLSH
T166579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 27.2MB
SHA256 91a2b27d6d231a89892502cb3f8a58ea528afc479a9305510ef9bf1260847cd7
MD5 3629464d76be08435485fb750ac4ac85
SHA1 246500ef9f8bc942cb2b02962a277c0473631e52
SHA512 638cf67cece6ea9ac6b3b206d64d1ca319b58df0a8dda32ea2bcd444ba08492f1c83da03f362ea7626ce41c02172c7e5d20fa6160f15ab120c0aaa5883d18d1a
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhid:IkLDkbedDkbeYkkLDkbedDkbeYd
TLSH
T1A7579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 27.2MB
SHA256 845ebb8dea81aa8e20a97a1f8a4f9f2b767eded8d419dc43d9d94b32f97f74c4
MD5 e736485764f677aa0123a85aed8caebd
SHA1 76628b5f2a5d119e76e886efa3d4f3326aea0c2b
SHA512 86c092d0629e6bca014e7f7c79f189d28440bbf154c52b7fb31851d5b393f57abc545b70b1764841f08d66370d5b96dc71ac0b0d7ee732587dfde2a80befea96
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhiv:IkLDkbedDkbeYkkLDkbedDkbeYv
TLSH
T18E579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 27.3MB
SHA256 9b82df8b1f504b2d1a0eb64e778e0fbdf937e76002dceff7c58b76bdc0bc6968
MD5 1671de1faa51ccd22120cbd2af135036
SHA1 945418696128962abb77564d996ffe57a8a020e9
SHA512 9884e5da3b5cc4613279bf8a4622898eb20e6704381bc865c0a2e8bb432b3a1f67bc11ae9690a0f134cb26cbfa13b59c75d96e3d439422abba698191b75e5202
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiyT:IkLDkbedDkbeYkkLDkbedDkbeY0
TLSH
T10E579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 27.4MB
SHA256 c39e22f6bbdb5df9118385833a9e8bb0d4a8c7fd57ef12ecce36ffb216445a41
MD5 c26b39c042647243268e08b0f2319fe4
SHA1 4c22ef0343fc55af3461f4458cfac4ee0fefbc8c
SHA512 bb0525a2c71d844be2c8aa1e09d2daa00e45f6362961236f7773cd9376d959a1a7fb47ecaa0ddbd52a0d97612de63d0be5e126cdd8f9ade8292a497d5113226f
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiGtB:IkLDkbedDkbeYkkLDkbedDkbeYG7
TLSH
T174579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 27.6MB
SHA256 560317ceff072672712407e7109569b221725437b933816339da6084eb493d60
MD5 0ad2fdca20541558642c277c6145a0e6
SHA1 a26b854d0f2d24907a1c3530021944173b96527f
SHA512 0501e10ee94845114870381d822ce972a9bdd0ab4d494f2b294f70fb0ea4a3421859c451ae8590cf49a7febfb3bdca0f5e3c9eb6c1d3c10857995fe33d500769
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiRq6:IkLDkbedDkbeYkkLDkbedDkbeYRd
TLSH
T1AA579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 27.2MB
SHA256 85e4f12cbbadf5f3a05f6623e0714b300aaf8759f1861ee0ba0e9dd49a96b9cf
MD5 baae2bb5d320d1e537ff8be0bc72c627
SHA1 6b0c11207188bedf377d1688620922d765bda7a7
SHA512 9d8fc49ba5f9399316997d95275cf191ce8bdb135773d7cf66d745aee04f889058b056ad2796b5a2ba8e57f146d2682c054bcabcf7f03b8f53e6e0ee8cdc935c
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiO:IkLDkbedDkbeYkkLDkbedDkbeYO
TLSH
T1D5579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 27.2MB
SHA256 a009044cbab90a44728639c4b480d4cd547aaefb1a48a04cdb14d9bb1b91cadf
MD5 c7cce60ec111c2bce10f800134378bb5
SHA1 d4dcc0b0b40017bc798f9135a2a0bf3bec30c823
SHA512 05114971e6c286d9320175ff3da745aa1502b2fa566f95726dbd747613e6a706e70b46056c837dc30abccc55f27837f0acc73d11b96e86c7ca9a5628fe3a7908
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhij:IkLDkbedDkbeYkkLDkbedDkbeYj
TLSH
T13D579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 27.2MB
SHA256 94918082516ab3e1530faadeaf7298e1f464effe557aae13c671eded155b38fe
MD5 58835c175bf576dc50d337154e8567c2
SHA1 1ecbd894a0ef667d85e9988e4370d94ea792d9fe
SHA512 dd98429a53f06cb6e6c57dd4ee359ff57faa5ab3a891826c3df10deb8c0d130f8132ff3b744c444a88271c116b2b123f6d22531ea8ba8c2ac8e18c7aa9bd20bb
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhih:IkLDkbedDkbeYkkLDkbedDkbeYh
TLSH
T146579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 27.2MB
SHA256 75c1d49f7e6105e52371a1878b2f075b96c3c7517f86607864e9843f6a998ccb
MD5 fe0ae2352c0e140f8268806c7d12f1c4
SHA1 9388979fa41f9b52b48b24539868f464e7886922
SHA512 018b53bcd913eae79d922b88249e3b77074dd7bd105d45d76e55ffe7640055d85331464ddb4fac62096ea765cf7b774d46a91ef96f4f0d85c130cb4aa0146507
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi6:IkLDkbedDkbeYkkLDkbedDkbeY6
TLSH
T184579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 27.2MB
SHA256 b7154d3b6cae56e958b82a399292e45509f71c0e170d9b01271c4e10dd7bc3fa
MD5 100d5cf5b6a7161a8551ccdf930d9032
SHA1 ca8ce7e1435bfdd1fb5f32f6e1a20feb1558353d
SHA512 af6570be559699bc90fdff2b90e3955b2d4be971178cf866f58a965e3ca157f823a03f206dbbd79c3468093723695310ab3f7de1811bb00ad69e346b2f5ed527
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiA:IkLDkbedDkbeYkkLDkbedDkbeYA
TLSH
T12B579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 27.2MB
SHA256 ba82779d901c199a2bffce584f8aad4e5424a8eb27145bd371add6ee8364fd5c
MD5 ad6efcb41e705075f721605723b58196
SHA1 23af8225c96b901f8c9639615e7517563a1c7e03
SHA512 3949ac67144ad516c44e376e80eb790a2ead94eb14855dd85e38d0255e4b5e8f803a93ec3a30f25d45a919c82bffb8c0bac385468cb0e568fdffb60c0715539f
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiU:IkLDkbedDkbeYkkLDkbedDkbeYU
TLSH
T1F3579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 27.2MB
SHA256 79c7f2d0187c3aa1dca03ad2f7d2687d39a3521d0a68a87c8a5c596e6bc776cb
MD5 9124fbee0366b4f97b572311de969f15
SHA1 62103523df42ccb94abd57b97b5e564b51b7d1d4
SHA512 5c870a8c16f3f167a4727c11625123f0523d0897f870c6fa6e6e6e2ad0f9e7a40acfe8ad6f0c2347a07e318f83baeca5af8cd9211186be6a583c0f37632ac32e
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhip:IkLDkbedDkbeYkkLDkbedDkbeYp
TLSH
T184579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 27.2MB
SHA256 d121ec7ba18e9f368984f4cc5e978062c75be171546c73ff902447cb5251cdba
MD5 1c1b68dd5b164aa542af92a0ec4f494d
SHA1 9886d0031333c97a426946d80ff1158e86b06be9
SHA512 0d4e0ac74af4c9c5afb80174071d9b044ac1a7ce8f3689e03415f15a39f20f3325105d0b12a6fceb07d0605e11b691e8a2b0855c8d4b4aedb05da5d26696dfcc
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhid:IkLDkbedDkbeYkkLDkbedDkbeYd
TLSH
T1DF579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 27.2MB
SHA256 e5a8d3e2bd3a63894eb249e0026d99c19cdfbed1b17466c84562817fc5d8289f
MD5 69804b62f68a3601596e0fbcbaea001a
SHA1 6b6ab45d3284af9fe9abe759205137cc9bda7b6d
SHA512 290cec7618f4b1002877fbd66569c6ccae3b606f233b1b197592cef8e913f785eb3fa96dbccfc5889188296a5ef8999fda412375eb55cf38e9b7f7866b5fc398
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhii:IkLDkbedDkbeYkkLDkbedDkbeYi
TLSH
T135579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 27.2MB
SHA256 8250c405432e6b67e6ed669f1eff06219c198cc3085fadd91bd711fabfe9e236
MD5 58bac8268e88487d69cd85e602b295d7
SHA1 580056e40b99cfe65da4be4cde0bc93ba44b6852
SHA512 b420d55d47c15b4d6fd059b6c2ac3503fbbd010678f2205cc60170f43423ffb6e4f18e4a9244feb749de97f43dcbbfaf0134515c7b5a3bc18b8cc8e3ef08e265
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiT:IkLDkbedDkbeYkkLDkbedDkbeYT
TLSH
T10A579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 27.2MB
SHA256 1843eb0f7588b0485cd068357ffa379f9aa84343e8499c7822ba74d002c351d0
MD5 d1ac5bc26ca76831b45b3cd674bbfba2
SHA1 45c1441fb0ee0f7ae7a78a608a8dbffabd09d8bc
SHA512 27fdfd619eea77eb628df0c6bd78dbeefd5ed0061de33e067277c82e22b87f739ba10fd57e189633546ef51abe573086fd7e56f66ea82e3c8debe20234bb0a2d
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiL:IkLDkbedDkbeYkkLDkbedDkbeYL
TLSH
T132579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 27.2MB
SHA256 0ca8af45f1442a338d24ff273017660326ca51a71ecbf9864b2e533f2f6cb849
MD5 fce72dcdf0b2f9fe1e75df216f9f2b8c
SHA1 9e51edd1a682da1cedc5c2d29e2d6c01d5c09ce1
SHA512 cf6ec914cb4fa99aad718d09fdccdb734ec5cdfa82f1d208d1ae0343af680d1cbe0157286c504ca7042679e4fbdbf639ce4b3c93f3f328aed5884f860ea24c49
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi7:IkLDkbedDkbeYkkLDkbedDkbeY7
TLSH
T1EF579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 27.2MB
SHA256 f543bde83ccb1fba9b6a1c06044684a4866b46d295e94830fc76aafcbb7a3d0f
MD5 2148c83221f1a87b64261adf38d1bffd
SHA1 032c3046fdcc720492630d1a7b09044770e3108e
SHA512 3500e1208090f39d5cb9aa6014d9c707c69df93cc5db992dbb58ae9663cf6cfd3e272ef163e86675373a5627c441f09887ba3f666f104aa0f4b73a76d62e9283
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi2:IkLDkbedDkbeYkkLDkbedDkbeY2
TLSH
T1B9579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 27.2MB
SHA256 b11b24adf073fb2bacc94136392f44f596e850857d9ae8999f9ecdd2db1d17b8
MD5 4906b6ce1c35571e561fbed50d608260
SHA1 f8bdce2dfe9e652a4596c56a4ab5b6f426347777
SHA512 ed03e597013fe936e0162f6629bbd135ab7b29e69e305406ff99e3c182588d229e77329a89aa78734e7174f10ad869a3c4d85fa05430ca2fab12a3192b4cd8b9
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiL:IkLDkbedDkbeYkkLDkbedDkbeYL
TLSH
T1E1579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 27.2MB
SHA256 d7b33e621e98e3b6f72b1054e8f366efaeff00e585df525b232eb6373573a266
MD5 fbf1ca6832bf222baf00474f2af0741a
SHA1 c2d839bc181a788323e2f27462c8d7a70ccbfe45
SHA512 7078d529898abd5fb512e6cee1b890f9447176bbbdb72228a19ce2915463b93cbd5859c20c8743cecf2eeb57fb8156bc411edde998feadf4e82a9c54476049a9
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi+:IkLDkbedDkbeYkkLDkbedDkbeY+
TLSH
T18C579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 27.2MB
SHA256 c3479d7b5e3a92b3748ad3ec7c5fa61b3de66de83e8011a9a3799e9e69fca3fd
MD5 97c7a4a9441e919a00eb652c5ea9c029
SHA1 121dba12ffec2cfff1c3c92aa2e5352c89f64f17
SHA512 c2afc34add64e0bd49a8383c8ddaf6caa6585597efbec58edbfa3de21162254d1056d1952462ff730dcde36cd4d40dd20c4bb53caa8c26f2c162e3048dac6d95
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiA:IkLDkbedDkbeYkkLDkbedDkbeYA
TLSH
T144579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 27.2MB
SHA256 a9303fbcbc8b49db8d3587d2d7b424b7bd933cd797efaea271848cbcb13eae1e
MD5 44920ca382df1aac7c3566e42b3cec2a
SHA1 dbec801544ec08ee857001e844e17ab69d1096b8
SHA512 6ca1b9fe1004284b08dcb553cba74ac68af46dc9b38c922e110d9fb0ef6c870d20c498acd08e920ad7286dda46c7c3ed087e29de58ba7765ce604b2a4f98eff4
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiS:IkLDkbedDkbeYkkLDkbedDkbeYS
TLSH
T168579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 27.2MB
SHA256 38bd0fab995600cb078c5955adb493323b866556095a9cc5c439266c7a6ca1dd
MD5 c76c394a899831398dfe247e96ac1fe8
SHA1 f46deb955091d7849246895350960bc10e212415
SHA512 8402e1b09da08848cbe4de12a60b13eb4178bbe494eb6dc60e33f87b59b3e35deec83ccd4e14ce15885f66f8b21055cff8b94320a45bd04867b157d5df631da8
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhig:IkLDkbedDkbeYkkLDkbedDkbeYg
TLSH
T1C4579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 27.2MB
SHA256 4e9f0e79c02537cee01fdc59da2b635461ef0ca4577f46cd8ae047cff09f552d
MD5 0bc1c9165925b413c548eb24153d6381
SHA1 8e5e455e7999d4de3249ece95e34282b47603ba9
SHA512 97d4abfb150ea88499708f6d668ae5920405d4d10e84b2cf6abdb56e925f5029b9b7defc40eb873a5e2199f061f640740cbb0ba3b3b878e441a8a8d9d01eb741
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiD:IkLDkbedDkbeYkkLDkbedDkbeYD
TLSH
T1DC579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 27.2MB
SHA256 2e2f77e326a5d9748f1f73451ee82c734b66fbc16534c8e0fad59b3f4967abd4
MD5 b53379df9c9ab070470223a6e2ae0828
SHA1 25c1795f00dfffec02a49d55cd935bcf7ea671e2
SHA512 c915955481c24d3112dc87bd9c082bb57c95071ec7c56875dc96b10c93c38baa97773274b69cac0002f7b171ae2b7dfa5c789270938e965f3e3a9d6507c768b7
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiO:IkLDkbedDkbeYkkLDkbedDkbeYO
TLSH
T11E579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 27.2MB
SHA256 0343733c80e92e68d70c8188d00340336b9876deeafc8d36f9a76241aa7c567c
MD5 c2e8adab95bc3129affdebc44c643504
SHA1 8e1e58a76e344afb2c1e1ff10f59071b4c90d3b8
SHA512 a6664569a677d50929dabb898ab89e2bd42d38553daa847bd98ac037e42691deecfb9ffe55c02629f61162ce0856e2534d0128a9f6404576a8074c4b33d6bb29
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhit:IkLDkbedDkbeYkkLDkbedDkbeYt
TLSH
T1E0579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 27.2MB
SHA256 25c504b9e9afa5a7cb4de3a4bbff7e01adefd1d69c09d62632ef01dc22eedb57
MD5 588be47493fba629173f6683a7c3cb24
SHA1 2a033796320f9beb4f4aa2d04a4283bc7b78635d
SHA512 99e5d47d0554f88d702a1a5437160198078b642bbfbb5a9dbf580223dfe16e70e9a0aed90084685a20671345af564d747d25aaa732e7299b987d0d526f749592
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiI:IkLDkbedDkbeYkkLDkbedDkbeYI
TLSH
T149579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 27.2MB
SHA256 a7138fc611752e84b61b0526c87d4aec6aef704ba748b6920e98aced760d4221
MD5 b6b29041b41c6dfd7b0392c523a57012
SHA1 965fc46313f8a8deefacddcf74c3185d08b75433
SHA512 58af8f37c31a7f687bb4ba670a30f54d3d4423bb2183a8c0465aa526f836295d2aa4f306c70126ee0682dc650c1e2897db218f24681e74b0c21377bb5fdcef6b
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiC:IkLDkbedDkbeYkkLDkbedDkbeYC
TLSH
T1F3579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 27.2MB
SHA256 737b27b7cd1127067915b0a59400690874f2cb4a7bc4b514e5d9bebd5a1fe06f
MD5 0f71fb3d0a6322c5c15a1625418ed0c6
SHA1 b221d6e040757ae12024c87c670b3ec14e29ef4b
SHA512 57d434280de202c1f8aaf67c8e2db55a26edcd75aae59bdbf689ec7c0f578c413a743ee4fcfd1c935805378ad9b1c4cdef00607e4c9ef6ac229dfb84f0285416
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiG:IkLDkbedDkbeYkkLDkbedDkbeYG
TLSH
T1A6579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 27.2MB
SHA256 b2b73fd2cf773e7d38d4e3c7b171c2531aeca9590462bd8846c2d5c0175e3ac9
MD5 baf971c1910a9ac9c14ef4b570f286e5
SHA1 0982c1bb8ad838cdc04f90dfb0fc2aff168c7d57
SHA512 7dc13374b2d05b92f4cd78a8f58ad2aafa1c2f0be397a9a5e775076cc1cf36e789093370479fb068eed7ec55ff8c339c9e315e737625e475d28a20aefd32e535
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiP:IkLDkbedDkbeYkkLDkbedDkbeYP
TLSH
T1C9579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 27.2MB
SHA256 7320be5d8f978be0cb82cf1d68d7c2b390df9d5a9629b08d63498eb55fddd11e
MD5 12095b83a67f0dfed8b21d782cf3e9ac
SHA1 683e9b5920b2a34f9e311b2084dbdf097925bf25
SHA512 83cee5ff445ea69b9fcb51004157eea62def8edd691158c0fc7f9acf8609ceaaf9db65e146c77773796f387845c261af86ca2554f52547ef14b91af731c08f68
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi5:IkLDkbedDkbeYkkLDkbedDkbeY5
TLSH
T12F579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 27.2MB
SHA256 b730979c38e85f2fc2367b6e5c004021226c8f83805c6bb68cbe8a3993d3161b
MD5 6f09f21eb7f5a1971e4dd4880cb483c0
SHA1 09977714fcb4ce294fca3c04f370ae5a6895ffbf
SHA512 afa62a3835923ed67965a8d4f4ee7dbd90e53dae82f91f7a6c3725db340e24a101ba3bc73308200ec70650c631a7e7aae8f1b51381c1e5608c58bf4b55ef2902
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi8:IkLDkbedDkbeYkkLDkbedDkbeY8
TLSH
T1CF579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 27.2MB
SHA256 4b1d3576bd171888667532e6a17b9f490ab6cd887156954be8f271cde4692da6
MD5 aa7e2b29011f3b79befb61ba5155adca
SHA1 b944a2d6744b96a72c17b20e84c34b33bbdbf638
SHA512 695ddafd96a86c6a40054d5ca3d40d48cf17e1892bbffb79e823d6ccd9472f871952b77b919baf7857aefceb41cc2335f6422c8260250e07dfde0115923c0eb1
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiU:IkLDkbedDkbeYkkLDkbedDkbeYU
TLSH
T17A579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 27.2MB
SHA256 bb09473e8d3355c982bc7cc684bde7dd12446b8df62adee5638c6ce715b6a112
MD5 b29ae786af5b9dee4c86c7d803cae6a8
SHA1 678e29e8f9448a590b1acfe091d9d03209cbfbcd
SHA512 54637d0f1dda74f1dc0dac663b74d6da5653ff24a34c70a7a823442bb2c1297d5c9eaedf522330c97c2d72ed2da38e7568a324baa960c2bdee9bbfadcf525f45
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiU:IkLDkbedDkbeYkkLDkbedDkbeYU
TLSH
T19C579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 27.4MB
SHA256 017038b1d490959aef2b525553e6e63544451e8fe57bc42eeb9b5e9e43f91734
MD5 540b8628f451e2ba08805196224be3ee
SHA1 737566a8e90a68a12ad620e46ebf8a49d4ea5560
SHA512 00ebf09fd38214cd74c5cd5616106230f005e30c382174a560ec8e9ba610ff19f0049a733432dcb9b4649f7c391a3eae666f5c644672c36bab40209e32891fef
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhi2:IkLDkbedDkbeYkkLDkbedDkbeY2
TLSH
T131579E03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 27.3MB
SHA256 6ac7fa42f8c1efd782479bec45dbec20c7bedc3bda50938883ffef5dc02e3cb6
MD5 c708efa3aa204105f7f65f9b9d774b4d
SHA1 d97751e880c50336b4cef56ec5f8879a5b6eac36
SHA512 7dc887cbdc200954e6eba114f0a5177622b6fcdd019eaaf82ee6493e41b163dc4d8b6939a9fce368d23caab17154aa7bb0a700677fe3ea94fab27a3dbe3666f5
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2VhiW:IkLDkbedDkbeYkkLDkbedDkbeYW
TLSH
T111579E03F6E540A9E06AC53497669632EA72BC460721D7CF16D0F65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 27.2MB
SHA256 6bc0f6fda2de9d99f5e1ab57916539a5d351b50c2c7c0437a5b29e591bf2d4e0
MD5 fd228a8fbb7cb479961011fb4a9d4f33
SHA1 debe7981c3f02c5e2ad24fc6e369dbdd3679064c
SHA512 700323f392bb3d4aa162e1cedd686d0b34f7eb598c444c7df5097662b83e162c79eda8295033a3ff037504aa0e234f7e59db5358cbf5c4bc1f6ae0b838ce58d5
SSDEEP 196608:Qi8kLri8kb2Vhfri8kb2Vhi8i8kLri8kb2Vhfri8kb2Vhiej:IkLDkbedDkbeYkkLDkbedDkbeYej
TLSH
T1BF579F03F6E540ADE06AC53497669632EA72FC460721D7CF1690B65A2F73BC09B39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3276-501-0x0000027EDA900000-0x0000027EDA920000-memory.dmp

Download

memory/3276-462-0x0000027ECA140000-0x0000027ECA160000-memory.dmp

Download

memory/3276-487-0x0000027ECA380000-0x0000027ECA3A0000-memory.dmp

Download

memory/3276-464-0x0000027EDA560000-0x0000027EDA660000-memory.dmp

Download

memory/3276-456-0x00000276C4640000-0x00000276C4740000-memory.dmp

Download

memory/6112-621-0x0000023413B10000-0x00000234141A1000-memory.dmp

Download