a84630ff03c08494e9bb07a86d2a7154ca09bc1166771aa5c9379067682a0b1f

Analysis

max time kernel
138s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Size 8.1MB
Sample260707-2b647ae17w
SHA256 a84630ff03c08494e9bb07a86d2a7154ca09bc1166771aa5c9379067682a0b1f
MD5 f03621ce29453923666af33f7760bd9f
SHA1 8823a75171534875591c164c077acbb13ca3c066
SHA512 60d9a3e590ee3d6488466a93421b16f1a67236f501d8bcb798e3db312b36f2ab0cd7c3e14cbbd965e2af630704e5a62f8959a7bed5012568d8acaba0c76df270
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapI9:JtcIkGn+oKjcI9
TLSH
T16F866C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1581435544-3586420778-2104125077-1000\{E8664ED1-3E03-4B17-B73F-146707C1B70C}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1581435544-3586420778-2104125077-1000\{6DA799F7-FB31-4E37-B56A-7ABAF03C6DAE}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe
Token: SeShutdownPrivilege	5764	explorer.exe
Token: SeCreatePagefilePrivilege	5764	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5924	sihost.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe
5764	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2608	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4952	2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
4612	StartMenuExperienceHost.exe
3436	SearchHost.exe
5764	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 5764	5924	sihost.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2608

C:\Users\Admin\AppData\Local\Temp\2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-07_f03621ce29453923666af33f7760bd9f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5764

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3436

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 8.1MB
SHA256 3f44eb4124e4f5b7aefbe467856db0c5976cd1edadd1766f92a87271e420eab3
MD5 58e5acde29fd05d2925ef88bdb069c65
SHA1 de1b2584bebe83e289f1115ec43a10f214012e4b
SHA512 3e3d172b91f19c6c84ea179ee30bd5da5e13a35b6a203ba1a2ce2cf47394dfa08ce1fa79a9fa02169310c45a8ed827491bce8498257ff0c52a2b1f011220f57d
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapI:JtcIkGn+oKjcI
TLSH
T168866C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 8.3MB
SHA256 8d79daa471aa285433450157c829ca457ed288638d44d978ffe2e23465ba01be
MD5 aa6d99a19e47047be4107a734aee8428
SHA1 2cb984c1a2e2d5dec814f5af5d73ff270f48c557
SHA512 15a1c918188356b740c198592e57782305b9b5cb703cc5d3938e6ed4f06f0b30f46c4c652ca9f30beaac58fffe6d76d0af72c2da3f83864d3ca4ffb91130d96c
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIh:JtcIkGn+oKjcIh
TLSH
T195966B2672E540E5C199C134CF468631E3E17C698FF193EBA255B2C92F33AD07E3A616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 16.2MB
SHA256 669487bc36ce1c24089711b9d2a477d962b2f05e14bb25650a12ad5224fd8c02
MD5 e19f643027ec84680117833453526566
SHA1 ab7a1aad517d974766afc02a2789662092a172f3
SHA512 acaebdd257fc5f502ddcaf80b0f451bdb1e3bd69c95c523039ccf6a51c490fafc30684ef9a241edacd178631ad7c0fe87d6c6a1d614bc2dcb8f7074ad1548e07
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL0:JtcIkGn+oKjcITtcIkGn+oKjcIGb
TLSH
T138076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 20.2MB
SHA256 85b761815f2be1fe2329a53ee79203d74b7a2eb76c6ad95fee981a8deef8011c
MD5 619d3bbda76392cd1efb08758d5e59a1
SHA1 ea97d3ab6dc948b9d83015227f08570ab02f9383
SHA512 ec4c372778f5bf84387b7231adfbe317ceeb35785caf9a98fdb83daf476e5ebb3a80a8b3064b235c3adcabfdde63578ff5238558108d2fd84c30d81a7c93a335
SSDEEP 196608:JtcIkGn+oKjcITtcIkGn+oKjcIQvyEYc/b3w8O:I5G+oZB5G+oZXvyEYKbi
TLSH
T1D327492276E540A5C1AAC134CF568632E3B17C294FF197EB6151B2CA2F33AD07E39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 8.1MB
SHA256 a84630ff03c08494e9bb07a86d2a7154ca09bc1166771aa5c9379067682a0b1f
MD5 f03621ce29453923666af33f7760bd9f
SHA1 8823a75171534875591c164c077acbb13ca3c066
SHA512 60d9a3e590ee3d6488466a93421b16f1a67236f501d8bcb798e3db312b36f2ab0cd7c3e14cbbd965e2af630704e5a62f8959a7bed5012568d8acaba0c76df270
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapI9:JtcIkGn+oKjcI9
TLSH
T16F866C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 22.2MB
SHA256 f4f50a9fe0f65911e1485d80a184887f0cdc73c5d8bb4cf55be3ccfa3bd679b7
MD5 251449cfead5fc18dfc5c9e54d3c3054
SHA1 19e072fc4911b866fb580c29ad1494d49f11da92
SHA512 68d8b73626192b052e0f201b27ad59c06b15688fbea0121b6cd003479b208691648db963f8914b55c833ab8458299d8bde896e68e262c935f614449b5396efb7
SSDEEP 196608:JtcIkGn+oKjcITtcIkGn+oKjcIIQyiKaUX+PNo:I5G+oZB5G+oZJQsas+PS
TLSH
T137376B23B2E540A8D19AC574CF568232E7A17C698FF093EF615472D92E33AD07B39712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 18.4MB
SHA256 17d438b41446426e8f3b2b75d83e7cca1de6dbc814c1b7b10a84ee859b8f6b2b
MD5 90b380e7cfe2a5d104b870a55ddc14e1
SHA1 cb49c5823efa9d8e76b635409a94071dc74b1f5f
SHA512 8f37df7ae6480af44aba8aba945cce202856eb7a758545a6dbd80ceafa51a168eca52406b327c858b7cf03eb3163718893d170d2bf943243b39e816d014f4e06
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLY:JtcIkGn+oKjcITtcIkGn+oKjcI86Jm0G
TLSH
T1C7175B22B1E540E5C199C134CF468632E7E17C698FF193EB6255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 9.7MB
SHA256 37c1f63177a8790dc18d80941cb1a6ef73aae887899f22ca01c9e25a6476f439
MD5 059812cbba28855dc9ca2e5ee9c2e755
SHA1 8e737862f8b75dfe141cd35a98d5612d15aa2180
SHA512 68a398ede56cfc6057a0830d27334b2454f41f27b56f7dd67daa6b2a46a8934c018057b8ff8979b80d6159bdd6aaf3fdc8e04656873f7eb8f868fcf11d979311
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIfmifP5R7:JtcIkGn+oKjcIjfPf
TLSH
T18BA65B22B1E540E5C199C134CF468632E7A17C698FF193EB6255B2C92F33AD07B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 18.0MB
SHA256 8e51709d8e40d807e0fc4a3f5ad4d7f618e8bff81bc66dd506d28aaf4b41ebf1
MD5 6751f5ff42e88ed2dcd2266b48445f29
SHA1 9e2aa8dfcaaf67fc296b7575014b0ece357928eb
SHA512 51c7fb5488a131a0d4bd4e954e63dc484336ce13580fcc5e3cb046257f58e3a25c66b3f5c99ee5cb04c7bf0c52bc3ea73c0dd1d49ae364f116be154e0f07bd8e
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLb:JtcIkGn+oKjcITtcIkGn+oKjcIGdKC16
TLSH
T174176B2272E540E5C199C134CF568632E7E17C298FF193EB6255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 19.2MB
SHA256 d63cebdc054eee32ee609fe6f096591b50a0b54ee5379549ccae69505d0384c8
MD5 3c0fb59705cfc4908077fd9799db2ac3
SHA1 10b4b331ecc66df3bf46ad0369c821e51757dbd8
SHA512 b9f0badb7ef091ace42ccc8da885d8e314d98969dec1ee9e5fd99a1f581a8237e2b48b2e266c33358c0bfc8409f840333b431e50e3b9674f11b4e978349b6cb7
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLa:JtcIkGn+oKjcITtcIkGn+oKjcI3jnDO
TLSH
T199175B22B1E540E5C199C134CF468632E7E17C698FF193EB6255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 17.6MB
SHA256 43e54ed2a1e1f6258a0fecceb292adb5f1d423bd43eeaf3ec5663daf7d6d2941
MD5 429d3df755e03c7361c23c48682b7edf
SHA1 620917208c3737f06667f9b3ddfa97889ee01fe0
SHA512 72ebaa48ae68f04bf3e3d03f16db97b1aedfd469fbdc2f686cc44c7a87ac6e386215211830c7eafa38ea6fcebbc64af4cf84d5b088f9235886ca3639ca2009d8
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLI:JtcIkGn+oKjcITtcIkGn+oKjcIh2iw3
TLSH
T1EC075B2272E540E5C199C134CF468632E7E17C698FF193EB6255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 16.2MB
SHA256 4a6de4946067b37cea447f783fd518df31cf9d0f01d931d23380a584e80bd519
MD5 86e6dc9eeb9a39568c46e793ea89302a
SHA1 e60c34e19faab35e0bed026408ecd3a5a62ef420
SHA512 2bde6261c79fea8e9492b57bb8b9e2d64114612f34872edbddd5611aa08abea37d8c9c128c5d66aedcfeba430e1817ce90d89ee7cd999cdc84b1d653a286758f
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLk:JtcIkGn+oKjcITtcIkGn+oKjcIY
TLSH
T175076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 16.2MB
SHA256 971633a999162d94934bdd1e2331d6f2abca7f98f3762ea31b764778a0e444cb
MD5 c265c10743be30e2282748fb5292624c
SHA1 7abbc0d8f1ec0516ff0ceb1f3d213bb9b437a0e6
SHA512 fe9a7731d30d16f1fcd0e2ef8438d1260a5b567f53bb47af20d63425fc3f52b7d54b23b2bdb1a54b15058e60c33678a237a91a822a34c42d57a82fb873215834
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLs:JtcIkGn+oKjcITtcIkGn+oKjcIw
TLSH
T137076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 16.2MB
SHA256 a0e871a408c047439e626661898045444c5c88f056ec6d439ce19821855004a5
MD5 28c08da5d94c337644e8516a3a4dc23e
SHA1 6b09ed6b77fd13afc51c816801dc98c592ee789d
SHA512 c4035ead924b8db3e99270e86448d54c6e017c2dcc962210ae14f8b2d33414554149467cbcd5d9a61827ee3dc3e6c2a610fefe47a20446e607d69f680b63a9c9
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL/:JtcIkGn+oKjcITtcIkGn+oKjcID
TLSH
T160076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 16.2MB
SHA256 9ba3725f4aa69f0b2c210fe91e1b57f4e1a001b6f66aaaa688bec4d383266e1b
MD5 d482b7fed1572576bdb9f264b29c6e0b
SHA1 186302d7e6ed804aeff70fbb30cc57ab5fdce23c
SHA512 ff6983c44ebdb5abe82f7e02631967056c8f6595bfdf5710cd54eec7af94862941d0913f59a9e5a98ec6817f4d70dd2e195a8f45cbe051bb423db94c5ba37d71
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLu:JtcIkGn+oKjcITtcIkGn+oKjcI6
TLSH
T11C076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 16.2MB
SHA256 6960f0210151b13c96c14c1bb3b565610bb9b4cf1005f68b1663c7d9215e3386
MD5 dd117a8d8840368e178a776d658cb656
SHA1 464a5e06bfa181d503f63473d61f61eeec799224
SHA512 d5979a9f2de95cb99d43f09d0d982fcb38ea70f69c11ed2a03ccda7761929ca5580a40bcb8d1f28b98014de8d02bcbcc7677460dde0cca7b360645c62bb3334a
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLr:JtcIkGn+oKjcITtcIkGn+oKjcIX
TLSH
T1D2076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 16.2MB
SHA256 ab5b3d44e0ebdb62c55dfe43deddd366beab6b261d2fcdd3d3c6928f64eb62e0
MD5 c976f95e7337d957f9c330f1aba426e4
SHA1 2bf9cd626385c1f860534e3df6d8a7ecdcd90cc9
SHA512 d63363a6876f28f2ee1661b7e765b7de32c948e90bde7bad7f7819600cdf1edffe6fda64b758c2853d088429ed8950f428e96a69922d6a48e523bdf4e0462192
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLU:JtcIkGn+oKjcITtcIkGn+oKjcIQ
TLSH
T16F076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 16.2MB
SHA256 942ae99c03cb6658b86402d834b6abd4e6256a48b9eabeaee3ca1bb2d8a6ed1d
MD5 735c134a5672c1b067c52a86e517a47b
SHA1 6ca4a3fb3fc6dc9e988abda8e3f5d85191fd423a
SHA512 ff9c11b9c553224fbfe223e585524c28a3ddb49353db483eea3492f16150da429cd272e1194c300252cdcc163525144a1df297518496bf74c696bc536ccaa6f4
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLP:JtcIkGn+oKjcITtcIkGn+oKjcIr
TLSH
T1EE076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 16.4MB
SHA256 cd1c4328ef54d8aeabf673242c7cbdf7205b7853a030c7260e14e55c4b41b1c6
MD5 c73111c417dc6d08a7e8cb5dcf93c977
SHA1 a8b5da154532e9b1783043cdff89c48d01739189
SHA512 097e10bf59ef29eb394052cf452a802d40d8621d1ffdf60dd9e3b55da570bb7c967494e4e4b67cca79c05aa4f21ef67d2e8d667f9f9b4fe62b7b907ef308bbc6
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL5:JtcIkGn+oKjcITtcIkGn+oKjcIafu
TLSH
T11C076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 16.2MB
SHA256 cda259c2c264a72d9a9b0a3968879708ab9c38d7f5075957b0df54c28a208cea
MD5 64df1ad6fd523133e9cc59a2645ea901
SHA1 9e4141285ec45e4a767cf5283914c46433f2c046
SHA512 cfd5464f1f5753f0b338c6feebfee425d19c4f1f8f9ef7ee73f1f77d5dffb781cce06cccb2dac3cf93e5c62f23f2b693d6dbed17f516f78a19e0e712dbe87121
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLy:JtcIkGn+oKjcITtcIkGn+oKjcIW
TLSH
T1ED076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 16.2MB
SHA256 af79808eb7e3f30b92ce24f51c3ee1084dbd12ac20e906401b60af5b58b7e159
MD5 78f921ad276ab701203eafd2014fe576
SHA1 d474ca8c3c3bddecac50a2fa4801f43311f7ef0c
SHA512 fb8de217622fdb2a48f1a18e9aeb8512df185cdeb642788d6d7dd79a684fb220d24f4dea898946ca41aa855961dc7123939efa15db18f18a41aee1cd0b6933ec
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLO:JtcIkGn+oKjcITtcIkGn+oKjcIq
TLSH
T16A076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 16.3MB
SHA256 016354326008f1eaa14eed5005611170122b75ae9594d6293210db4c173ca448
MD5 6a029cdfa848d8ad8ff593f1bab9d631
SHA1 90b4eb26ef7516a191589df163f44060b403d03f
SHA512 10d77acffbd28503142cebc995050c6cea3ec4586d0e68a3a79fe1105cceba8175cbca38435524c6c94f792f23f3e05d348bca1e868b2fbda611990c61ce05ce
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLa:JtcIkGn+oKjcITtcIkGn+oKjcINs
TLSH
T146076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 16.2MB
SHA256 73590a4f862e2d028e811382d106d565e323378244db09e29b10dba10a2703fa
MD5 d5c95b9c2898ec4908d832f5bbce5ae2
SHA1 fb457be46c4d19b363e46aafa44d7c5af3bfe548
SHA512 c2abee1409cd2277f89524be8d6ae5e5d66753ca370879dbb9f3e8cfd158af975e74ebe634b03de73c7bc01c1fdd614b56219f315855e1b963d2335c6aa2b37f
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLv:JtcIkGn+oKjcITtcIkGn+oKjcIz
TLSH
T129076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 16.2MB
SHA256 7d56e3cd5974091845cbac9ecbe5c6aa47d7c981ed95b38af29d94ff3806827f
MD5 b36a403011e923db2c0adbfc6764a533
SHA1 bb2ebe345a2e63c32e0adce17469797c2ad47bf6
SHA512 badd11238f9b08079541d317aff46e11f9c6c9618d58c8595a6e81f796df9935e8901ac9240b64dab7322e2d34b14e38e1a0a792c3ae1fd79b1c850f7caa4cfd
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLh:JtcIkGn+oKjcITtcIkGn+oKjcIl
TLSH
T118076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 16.3MB
SHA256 dde946d0d90896a81cf61a17c06a45e2f772fa81536c6d88158e941a552e7b3a
MD5 8aede9e266dc8c204414d7aaba02dd15
SHA1 76736209ba0845f755bfaa374836e715d98ac7b3
SHA512 5e96b014e14b5d27f33a28d0106aa02c88511c7e69d622cde8f8fbf9cf6e45457a73daff756fb373f076ca530d98bb340da422e7915c462387bea7c0bafda35f
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLC:JtcIkGn+oKjcITtcIkGn+oKjcIcT
TLSH
T1C1076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 16.4MB
SHA256 6c009d2b1151a5d7c23d5b36660e2dd1114ebee51a353bf67f07077d22db48e3
MD5 838a3736166720229f139df345c9d423
SHA1 ae3c95d8868a07a7dc7af1fa20a56e90af0172f2
SHA512 114cc4dee4d947408609ac3fe9806293afdcb535f4184ae668f60cfcb9dff907c09ff38fc2cb45c32d9a479f7da11f137f3fb72df553e68d9c2320d02edac709
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLO:JtcIkGn+oKjcITtcIkGn+oKjcIAtB
TLSH
T147076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 16.6MB
SHA256 3ce02bded8d63ed1c8093a0238229dc8d497ebb0d2d401f508c359b16b1a8492
MD5 e6898277dc38044b48714c191b789151
SHA1 53e40c63d9653dc8f7e9c11a2d30374ab9c0820d
SHA512 8334b6c9c737cdcdb3840dfebf64ac680f1da8ffcd4606cc8f8c7098a1bfc5037787f116d28ce991aac623f0e6fc7b1fbd5454b1bac880b3141eb70d9db925a1
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLt:JtcIkGn+oKjcITtcIkGn+oKjcIrq6
TLSH
T102076C2672E140E5C199C134CF568631E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 16.2MB
SHA256 7f17687091dcd1e86eedb6134f93d5183f43c5f22cd9e49d86bf32387c0caa09
MD5 0bac16fb7884943941f918362c079686
SHA1 419f93a6a02c1f18bc8f4477c5c351d599ce6517
SHA512 1d6c87a1281b5be57d5774665f947a3df7ff2c1ed76e4ac60150b30d556f30bb449426cb582d4aa64027253eaef55335b54388a48cfbbcdcea6bbc4c7a4ab693
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLc:JtcIkGn+oKjcITtcIkGn+oKjcIQ
TLSH
T12A076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 16.2MB
SHA256 95d4e3fe6dad1f377b3400b3696288d21eb27bad7c32049e4b443147c0f65aab
MD5 2bc043fe5e8e0d980efbde1c5ed9f82f
SHA1 1cd671bfbd1865c618a08864f77888ebf929e2a0
SHA512 4262e65207136360a99a41140a97f42a3e1d4ed14d7814515901815469f22d2958a15846403864008c447f828486431c25f4dcbde58b2233bb71a5b3cf1b7c76
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLV:JtcIkGn+oKjcITtcIkGn+oKjcIB
TLSH
T1FE076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 16.2MB
SHA256 ebdbbe34d570a9bc16c6e7f05edccd087612ab193c3e6f38bd62d38d9ab0dc96
MD5 35eb5b276278db48445fb4442b358a64
SHA1 d485425873c2961ed3ad7218dde0eee9326a78c7
SHA512 b0146342e4ef6332e447c5ef5fcc2918329fd19e5d12b9b137d63709ab07d0b6aefb4cc295182bdec31f79c0d3c86dab48bd97ea369c24c2677172d28e72d31c
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLb:JtcIkGn+oKjcITtcIkGn+oKjcI/
TLSH
T19E076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 16.2MB
SHA256 647753de21d15e748956c78b7f17088dc0300ec98e09f758a4cbe7a7bc9557f4
MD5 436ab66fbdd5a8e3c424d9f3db0d76dd
SHA1 0b9ff87a6f47d75cad4291e7e2695249c9da8e3e
SHA512 fb5703cb25b5e04823ed46bb1c6638a111502026f36a5b853b0a4735d0a2255d9837ab0e55f5144adb6a5991b23169e251263623b928c81c15d258b2aa955146
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLg:JtcIkGn+oKjcITtcIkGn+oKjcIU
TLSH
T102076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 16.2MB
SHA256 788fb23327303ad3aa57bac17df07904b053f0b1af610bfd76acb5e2e83dc87c
MD5 d65c00fd77c68feb4bd4af317cfb5fc7
SHA1 4c389105277008222da269ccb763359c681e98b6
SHA512 5c664e3b4e7c2735eabcfc606c075b4e008a97a55d7b8a528940123346699f497592e1594f834248ec18f9fbf636a6e20801b9565c6dbd8944a8f0030f272fb1
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLW:JtcIkGn+oKjcITtcIkGn+oKjcIC
TLSH
T111076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 16.2MB
SHA256 56c50b7653954a0ff923f4a6e9ea9d0f8c83249ea1f49c8e89c10d9ce0923448
MD5 530582a15a8f0e23853f517f9c83d461
SHA1 ca987865e9610b4ac24908cbe6839ed7ab15b7ea
SHA512 2f7c6012e145c5876c2a7a2d8507c3660d1144141c24442aab84454697b57e3fd60c62d2c2a001b79db66c8f0f5d468633e5a3fa4681887d1feaa000d401d931
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLS:JtcIkGn+oKjcITtcIkGn+oKjcIW
TLSH
T1C1076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 16.2MB
SHA256 a995919ef96744b0466165ea955536d9a4628a46406a87251c84839576060294
MD5 a71e6b6d2fabcd714ec082197a248bc3
SHA1 78074f357a3f98f9eae70b51379d114bc38af141
SHA512 b6a9d52b4e7ea18f8a64101970e782355373e0029a0a6378d18a419e979f4b0f71de5197670d2587b8207e6df6fcb2cf629a3b18741ba1f0ce9d4f4488f04766
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLn:JtcIkGn+oKjcITtcIkGn+oKjcID
TLSH
T182076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 16.2MB
SHA256 37f65dbffce550e5689fd1080d983bcc650305472f62658d638f1f61f2177c11
MD5 166c569f0214ec2190cf7b87a34b7834
SHA1 e7c8fc5de5bda4e74e5220ff5ecca669a948f18a
SHA512 c833fcf4c7942b89783be4685a9a1f5fcd6081eb6f9703953ce92f7ab2538c1278a7da6ae9f12b26fe486ff24471de4498abc6f6673e08d194a9984c3ba36ba0
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLj:JtcIkGn+oKjcITtcIkGn+oKjcIP
TLSH
T19C076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 16.2MB
SHA256 9130127c3a8456f3214b850a3b0d3135381b44ab47bfd257848039f06c42008b
MD5 205f3b3c3e85f3ea05796f5332052270
SHA1 9f39f6cf656bf6fdcbf5917534125cb98dc45be8
SHA512 9ebb62f213f6d399ce1d370cbc1993f3348c57c02622a82e4882474a0660abf82c399fb77171a8ee611f0abe6045a6983a5ae132f2e3a968239c200de5a8552c
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLU:JtcIkGn+oKjcITtcIkGn+oKjcIg
TLSH
T11F076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 16.2MB
SHA256 db581d7a134ef85e85f799c963c505dbb472effad1b1d4bd50bd896fb501fd4d
MD5 728c013b3f6e772e3bc97a7a678004f0
SHA1 9e0923a63ea87823b66f89f0d12603bc0d9b962d
SHA512 d290d02e50b41a2651f9d6bba708e585fbce3f7be770f9f94eef8ed8054dc01faa37ebbb8a70f7a5ab9b0d0e42be03037ed2ad0bb0c750abd7ba325e39ff6034
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL9:JtcIkGn+oKjcITtcIkGn+oKjcIZ
TLSH
T1AD076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 16.2MB
SHA256 1f310367ac78a0a734a7ffb7955b4439e28ffddaa7117a7434b044c7f002d8ee
MD5 49aa5afe230265bc3a6fec5de36c92e8
SHA1 769cc4c340c35e00d21e87a8bb9b87694fca6aba
SHA512 fc6bc7e098a0cdd78823f66d60954a8ccdf044dd372d406fec0877f63485989150ecdac8265ce84bd211e6e74a8ecea629b1cc85abc50ec2c43350f76fb98ce7
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLt:JtcIkGn+oKjcITtcIkGn+oKjcIp
TLSH
T182076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 16.2MB
SHA256 c339425b767ab5a089c404c37a74113327a669edf82ec1e9f50996f1f7859e23
MD5 91952f2e6ad52284c35fb41f9c066715
SHA1 c145f6bda138c8b8e91185f3a0a6d3b0e6e3d7f6
SHA512 870dd78c9b49aa96072bb4fb62aac9a3e831be4601dbb3733e99b1402312d2d23e437a67dd3647dc0da45ef5c7773b695e2e1f7f7d7b303409b8e867fedee3a5
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLl:JtcIkGn+oKjcITtcIkGn+oKjcIB
TLSH
T14C076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 16.2MB
SHA256 948e269876baf6170dde5a9da17f0148ca264d4c7005880acdf4ab552c005358
MD5 aa47cfc268c24fdb93c23c1dfbdfedbc
SHA1 224b7bad92588f7a0a53b584e8ef09f554557e69
SHA512 5196600ab192cf021edd174f83a22c2d9f99791b35153eb5edd4a7bbab3ac292b7751942f353ad9b5fe48209e60d43d461d824cfbfb5f657f0ab5d83119a7094
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLM:JtcIkGn+oKjcITtcIkGn+oKjcIo
TLSH
T140076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 16.2MB
SHA256 b474f47c5b45dc49ec0269388da0740824c31d7dac38fd455fcca7802d73f5b5
MD5 9d1404b3c5bfe17361d01316be47b760
SHA1 07cb452a4ee8595bf0c8fa30a558ed048c345ee0
SHA512 497540e6101248d4d131ad8ea0e7aa4b4dafd8b2a6a9e3bb76a610a909d133e1a527ba1b07045af864d5e8e837c369225de231b23df225a901e7ec3bea86f86f
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLl:JtcIkGn+oKjcITtcIkGn+oKjcIB
TLSH
T192076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 16.2MB
SHA256 de3d564f3b64d8d0619b18ca195c01953a4dbfcae147a898181cc0da19bda9f8
MD5 04608efa4876c35acf868ceaf0ef21e8
SHA1 0f787718578ec3414a1b9b58abfe12136e883ef6
SHA512 43692aa494a697c5db85c08763bfb604fb02e1b391f4a5536c54a0de21ee87e63f55b06a376995fe694b24338387b8a1714cafeb235eb0270b080dd947aafcd9
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLE:JtcIkGn+oKjcITtcIkGn+oKjcIA
TLSH
T134076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 16.2MB
SHA256 87938900863155c2766be08014a981993d031a235f0090572e2a7e8f675b8e7d
MD5 c8333996ef7cc14cc64d6d1a6fa84327
SHA1 785f31dc9551f7bb98a2c2b45c6109287f5c5e13
SHA512 f9e109eada982d3d757f35f340ec53b9ec85a7f217385ffe0823471a67725b8b6b2d12ba1f6abf514653aae309c4404d1c3b212ca0bc254c78ee4b07ef3b6939
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLW:JtcIkGn+oKjcITtcIkGn+oKjcIK
TLSH
T192076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 16.2MB
SHA256 4d72c2ed25984e737cd8fb067cddea3e09906ad2b89672dbde565fd87cdc384f
MD5 a85bb8d5c825a6b19c75c520fee3a72c
SHA1 6096d09a4963e0646b9c680e2f84cdb9abbe990d
SHA512 758db1b0876acbba5106d605fd8a158d5edb81149fed3177f2465e877e94649cc83a978099b27cc9938c3e4bbc313986cc8ced06614e85c03275238acb8a490f
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLQ:JtcIkGn+oKjcITtcIkGn+oKjcIM
TLSH
T18D076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 16.2MB
SHA256 2c092e10d7625401e06b33b0bb121b8c5e46ce29e98a9fe896e756fe834853e9
MD5 50357171892cb67bec16d93e199cc970
SHA1 a150f74e8ac8f68c8340886a87cc591259a6220a
SHA512 23d3644da020acd864be5fd85d222666c302cdbe86c63b46afdc625c6c1fca07d699e5a3d40739d640a2f8ad87ab36fd7dad43399757e2733c741a4053486e6e
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL2:JtcIkGn+oKjcITtcIkGn+oKjcIa
TLSH
T127076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 16.2MB
SHA256 4d6c84c2872e1f931f84eb78d2330bf02327fed908efdf6a6006e9a7da955381
MD5 9ea1d73c57ecfb9104b80cd5818fedd7
SHA1 262e9440955763aba28d30a115c889046becd96d
SHA512 fffa889752c81f3bd6e2f75c3a260523ed73c7bd5c40109ab505d69bc37f714a2365665a092ac96bce72d884553e3b4df2e441cf21f775c094251afd4785e5a3
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLt:JtcIkGn+oKjcITtcIkGn+oKjcIZ
TLSH
T1E7076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 16.2MB
SHA256 2ad5bbb01c6500c0bef50313dfa3f123adfcb0e5e303129533c18dcf7aa3263c
MD5 8e16bc9296077c12a3da7f7de51753e6
SHA1 4a4b05faad5eb85194b6a911665f799cb536a082
SHA512 ffb998d532d9a6c7a710cfeaf85a90d9025012a7ad1001795f25df216d30a5c367d041cc17a7cb318b14979d65bb6a58a39bfeb3e7d2ef7c2d5faf8cf9d04550
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL8:JtcIkGn+oKjcITtcIkGn+oKjcIA
TLSH
T1BA076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 16.2MB
SHA256 a159609c9df23bfd88442217492a3a0d66d0db2114dad0c52943b1fe43cc1ae6
MD5 13856b3d03ef1f7de9565ddf5edbf767
SHA1 34fc2390359a97444c5c4353cb8d6901ec2b4f01
SHA512 068171ba79b20eb01de946053225b9993be3bcd15e5bb00d3d20a99c414029c16a79a156e13f58598c908248b4ffb59e668c318ebe2d3f42596fa11061026c0a
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLX:JtcIkGn+oKjcITtcIkGn+oKjcIb
TLSH
T18A076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 16.2MB
SHA256 9f8b35d30799e355706c4fff08ee8c1f79c144c493c6cd303a4c441c5edbe5f5
MD5 48169546d27bf8a424bf2bb49866f0df
SHA1 29f9a2a720d3901fba1adfe69aecd10309cb75ab
SHA512 8f3246e231e42fd55efbc50de1a7e135455db71d26e4fae49ed5655ca35c6343574688cd4714883c4e098d1c68e9d9769d15533a5afbd9ace83a980fbb5f984c
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLa:JtcIkGn+oKjcITtcIkGn+oKjcIO
TLSH
T1D2076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 16.2MB
SHA256 b9766f8c28fdfae7eaf80c1ba6102b472f9f39ec6ee9d31a6617a9db1d3e784b
MD5 9290eef4a553f1a73bdeb1c173308229
SHA1 c4607d5e20b11a96a87c7c26c7230c72582446f8
SHA512 d660d3f7457593c9d43f0a1cd1325802fe1d00050888229514b99d912b37fb133e3dea1904b34c1cfc9a7ae6d64090e54722eab51563b689bed6c18005cf6bd3
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL0:JtcIkGn+oKjcITtcIkGn+oKjcIg
TLSH
T1B2076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 16.2MB
SHA256 44983596ce507d4ef90c8ccb64a2915814fb734e439aefeb5d96772c61b028ff
MD5 fe0e600444bfa8d555896d6e8c5a60c7
SHA1 153ea27817a01ea1af091709af34d94745ea89a7
SHA512 d048f4f6944ae6d6c79edd98f938712d113402d59393a84974e354413bea40b27184a1d8627fe02b34a012bf62c16beff40f91669b0711f81a8d9603bee6e7ca
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL8:JtcIkGn+oKjcITtcIkGn+oKjcI4
TLSH
T126076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 16.2MB
SHA256 85d8992615e977b3efbb0e1930b262f65fda4c24d92b0cc5c74f1f33d6f8df89
MD5 f9d4a2721c30adf967b85d5ea7dde40a
SHA1 efd0017376729f5eac1540efaf28d89d053bc9ab
SHA512 2f20825469983314e048cac24991f37584c33096a67ba49e7450b45f710c2a306ef3eb0666eee67c06f3ba7794394e3f86e3c6bb2f16f3d69868b9257aa38fd2
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLV:JtcIkGn+oKjcITtcIkGn+oKjcIJ
TLSH
T186076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 16.2MB
SHA256 a8fd708c58bdc141ad1876fb7fea7c56410ed60564f1fca7782a9f22d90db674
MD5 9c75f4099f8cf449d23be52f30c90606
SHA1 336ebc917873bfd5a6459dccbd138f5e052c2494
SHA512 7a28652359bc292e91ed2a0191a287e9ace292ab9e3f47446349fd0dbb5fe021f46ada9d3b0f02fbf120de84f2a82dae7b5e2520c9da974a529de9f7f397b78d
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLD:JtcIkGn+oKjcITtcIkGn+oKjcI3
TLSH
T1F3076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 16.2MB
SHA256 e681f5de6229828a1a06e6daa471d760400a3ffc36fe719758ca234cbdf7a955
MD5 c29256b91784a7200339ceeaf1f4533b
SHA1 61e3d7a4a42a9be2a684a21ed1f3775c25e95f2e
SHA512 42f919503109f032cc7022ab2ce3fe01b27a5a04fa6a78daddd6b254bed1f82727af80bdbfd8c48dcd4e42ac97d259e1e3cba12a2929cf1f16d0084b370cfb50
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLG:JtcIkGn+oKjcITtcIkGn+oKjcIC
TLSH
T19C076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 16.2MB
SHA256 5fd64c46b521e731f115d0e21974a4656591d36d0f49003e942cb028d282ee61
MD5 6094ff1a11f142e5ddf92e576e6cc2ed
SHA1 bd0572cbcab0ddbef30b35f4a51cf9f02d9c0b6a
SHA512 584f937f11c6b54ac5f4d2fb353c637a99c527f3d7bfebeb70a05d8ca2b3a72aeec66c298dced359d4bd16d34b3eef27a878347439d1fbeec4f517c234c58c0d
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLC:JtcIkGn+oKjcITtcIkGn+oKjcI2
TLSH
T133076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 16.3MB
SHA256 7c8d379adbac99c8f0ff95cda58c66f59c3db1503ff6ecfe15dc49282bbf554f
MD5 2dd3868ca5d1e6a207b4cbe480e8a770
SHA1 c5175c1c26dd8e41ff4ffef93e595a0012e722c2
SHA512 dd5490983774373ac2c6cc7968df3496828ded9f2ad352c6dc3fe00844a177881a594e5f05ee0024afbb147137da4f801ff123a6245e2815008c6074c3c00512
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLA:JtcIkGn+oKjcITtcIkGn+oKjcIE
TLSH
T124075B26B1E140A5C19DC134CF568631E3E27C698FF193EBA155B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 16.2MB
SHA256 56deb1fb4f0af5a627a68c8f0aa68d84ccac687daf3afe40fe56e688df1de97e
MD5 608b737fe5bcca6536e585705607a087
SHA1 8dac371cbbb866f5795c80cb5e1808d669752c5b
SHA512 16f1aa8dd0cfa1633db64916b5e75cc1361941a05f80ac022c2b730aae4d7b1460474d9091b92fbdd398ce065ec2ee7a29242f0e78cb97e047817dd2be82fec5
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdLI:JtcIkGn+oKjcITtcIkGn+oKjcIU
TLSH
T1B4076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 16.2MB
SHA256 ffc3f958c922750579bd187594d58615cabb9cf1e1723d66d084dd64147e158b
MD5 33514d6bd77e2f469999017fc3836e45
SHA1 d01fed12271a46513e7335e52e6c42c604ff6894
SHA512 31a8dae40af76f45261ebb17e4d5389599b35cf7156bab644ff8f4e813ea5ede413e64df3d511e3c33f12ba2732d159c42f3ce40f3148a50d94a87a0a21bd480
SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm3GgHIKgMdLapIAu5x6M1pLapIkoq2Vjnm3GgHIKgMdL+:JtcIkGn+oKjcITtcIkGn+oKjcIwj
TLSH
T135076C2671E140E5C199C134CF568632E3E17C698FF193EBA255B2C92F33AD07A3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 566eb119c9afe073f7b438d28c5ddf3377a5173343fa2b757d044a73094dfb6c
MD5 4865aa6770a6848d8aaa9c2624fcc1d0
SHA1 79c9f4dcc0b29e34fdb089e25b3021e2204dc496
SHA512 2935c7968cb00b52ffed0c2fdd46c105676cdeb8b77b6533d7b6e88b4f9c3284ae2efc94bcc31f37e53430dcd6300a821ccfddf64fbb2e7078fd59b16ae55053
TLSH
T187F09ED7C7959769E413023CCC9515C17531F590B98321338041AF1C2D36720AE434F8
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2608-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2608-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3436-507-0x0000017E1A0D0000-0x0000017E1A0F0000-memory.dmp

Download

memory/3436-463-0x0000017E04550000-0x0000017E04650000-memory.dmp

Download

memory/3436-493-0x0000017E09C30000-0x0000017E09C50000-memory.dmp

Download

memory/3436-478-0x0000017E19DC0000-0x0000017E19EC0000-memory.dmp

Download

memory/3436-477-0x0000017E097F0000-0x0000017E09810000-memory.dmp

Download

memory/4612-631-0x00000211723C0000-0x000002117267C000-memory.dmp

Download

memory/4952-9-0x0000000000400000-0x00000000004E4000-memory.dmp

Download