58436815eca8984b75f93edf9598071c39c43067b6b85ad151191be96d18ec22

Analysis

max time kernel
92s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Size 9.3MB
Sample260707-qagmcsav5v
SHA256 58436815eca8984b75f93edf9598071c39c43067b6b85ad151191be96d18ec22
MD5 9622af7032fa03167ccefcf0486e6de5
SHA1 2598d8eaadb85410f84016d14a3b63709d57caf7
SHA512 7f5899f306b0c42f47f518d8603f2f91762768a07a418c500c5ea783ebf59762dd2e3d0830f0c278aa2954da771302b2470878c54c6e9c06802573bc6c877e70
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTY0oAaldmdmnp7jo1ezSC6v2XMH:JSWyZ/K0ttYVAAT1Kmd09oi
TLSH
T12EA67D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{89748898-C198-4EA5-8BCC-EAA8F0F900DC}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{5508D875-9CCF-44A2-BA59-7192A90894D7}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe
Token: SeShutdownPrivilege	3140	explorer.exe
Token: SeCreatePagefilePrivilege	3140	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2912	sihost.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe
3140	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5760	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2284	2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
4056	StartMenuExperienceHost.exe
3140	explorer.exe
4300	SearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3140	2912	sihost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5760

C:\Users\Admin\AppData\Local\Temp\2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-07_9622af7032fa03167ccefcf0486e6de5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3140

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 19.1MB
SHA256 15aa032745d386b1d89acff1867202ac20f27d0b265b107c9e46d7c87cd0f304
MD5 84ecb75792fe0cc412a0b2f7795a5299
SHA1 a1f080594530ea211b2e91d7f5ecc6d3af8c9c70
SHA512 779e3285428a097237b6a13fcc6e473245492eabb4928713b5828fe890593242d77877ce6f599c6204e571026ee73ae8bd756c9353d8e4d304fda3af55949663
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oilo:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTv
TLSH
T1AD177D13F1A441A9E0A6D174CEA69631EB327C494BF195EF3240B7D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 19.5MB
SHA256 dcb7d4fc11d931f80fc400f35158bda8ddc2b7be921481f93f6334a81413eb55
MD5 3b269c44f44d8fb8b4c4b9d0de6b1581
SHA1 0a6f8acdaf590a130998dc4dd9b32c1309be85f6
SHA512 b1fce373a2fcba19f56a55748237358e7d7f6de91cb1048e2658fdfd2e7b7a6f04cdc68be2e7781c8cb8fffa0c0b608b913bca24b064e6965bca1d2be81725b8
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi5:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT
TLSH
T180277D13F1A841A5E0A6D174CEA69735EB327C494BF195EF2240B7D82E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 19.3MB
SHA256 f70ff1046f1164419519c89f99d210e440073d67aea63320a45ac693f024c41c
MD5 05f39e2640a7ef72083c086eea9be687
SHA1 210c6f029d35b55fef1b2c0713a768d33f7dba9d
SHA512 5dd470366ee216ac5602e1b3c63f34ed73346111ee76216fc740aacde838f6bf00bd3112b8353235b8006ee868913a79662d1d0b17e7d8aae7b4259ba3655a4d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiu/h1+:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT
TLSH
T1C2177D13F1A841A9E0A6D174CEA69631EB327C494BF195DF3240B7D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 18.6MB
SHA256 b0ccb6956cf23a6f051e98134460f5075714fc1d56aec7efaaba52522019f1b7
MD5 26f6054393a5fddb6bceb9b2e02fdb21
SHA1 87b50b6b61e3c81bb1d6049204f67cccb5cb0983
SHA512 62925ee279e89119c496cfca16170ee613f9770c9ea39e5704161da08b483d708fed46377a1b63862d2960ba75ba0673855d82ed98b57e3f48f07733b644ced5
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT
TLSH
T1A9177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 18.9MB
SHA256 1d021290323840624a01f32fadd9bc6922e3a6ef4380d8859fa77ca63a8f4810
MD5 e6fa282a7119357bc8d614603781750e
SHA1 16afd7ce6d5834121e935a407749b1b50491c86e
SHA512 93a2637f9fafb8e37c57afc54618be9d27ab04881743b56d7ab028bb326da4ee73105ef8c0b742f043cac0f29f989e66aae13a2cb53f14b396ca728451aab924
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oin:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTk
TLSH
T1CE176C13F1A841A9D0AAD174CE669631EB327C494BF195EF3240B7D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 18.6MB
SHA256 9f09fd0853b9d4780cff95b1b20db0fdc284991f089b88dd662849747c5a6124
MD5 2f21b5e3d8ce490f761f47282a3f967f
SHA1 308275c758298008718451164f16c7ae76e9e9dd
SHA512 eed2583cd9bc5e9b3bb18d1a6a6b377a1362c1dc972e4a28dfa1a3947679d84d72b876ef02aa199a3c4da762380bd2f08d2347d4d64c5c504c8cc30372e7d8c7
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiAb:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTt
TLSH
T15C177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 22.7MB
SHA256 f2b0eb0b5e520c90bd5e7e9034525358f01ad4a039e1c7abf9260e2384fa65c7
MD5 032a42b5c82e348b09d4f803b35cf818
SHA1 f8288997c811216d3ce46e5e3389f8f6aede73a9
SHA512 ba344b03dabaf2122bf687206246ec413c354b56c0ecab47a07d4a24cd4d1dedbc76985c78d056e73dc8c36fdaeefd2ddf104656d784b771a515ada4e6b651af
SSDEEP 393216:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTbvyEYKbi:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT7A
TLSH
T1EF377D13F6A841E5E0A6D074CE669631EB327C494BF1A5DF2240B6D92F33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 18.9MB
SHA256 44887694489fe1de961b9fb450aaa553ae54580dfc5eee0c87a08381a640bcb7
MD5 ffa71bf17e1680a51e9ea93a0b815c51
SHA1 4361b16f7e573b7391aa74b21a915c736711388a
SHA512 3374b50c319298456fccd7ac415bc5f03dd1b1bb2984e7b03ad2cef56025ea63674f5aaad696bd1e787645e1c94762159023b0e3463f0c8d49f487db33dcd484
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiu:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTp
TLSH
T165176C13F1A441A9E0AAD174CE669631EB327C494BF195EF3240B7D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 42.1MB
SHA256 934451585c1afeb22119f594a9a722043e8650bae5316418d18639600a67ceca
MD5 03ad3056081ff2bd6b958a20c774bc60
SHA1 166d59dbb270fb237a7ed72ed08abc6de290759c
SHA512 c4a5d58337af4c1b2c09ef49d91a97b8f60318da31fce17c874b6976d17cba9fd81952432914432c53e95e08b402e8de0cf449130477d6fe755b21b13a10f9db
SSDEEP 786432:zyZ/K0ttYZTEqThE8c23pV2XIc23pV2X+T:uZ/K0ttYREqThEh2ZV2XV2ZV2XG
TLSH
T1D1A75A52B6E843E2E3A6D534C9B28272EB717C0E1B3192BB1175F25E1F376D06D29321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 20.7MB
SHA256 cd03e7cb0aedbcaee786dc39fb6407c59ca44db077c13c1f9160c40651ff400c
MD5 4612f07894311f2f7bddc518cff82c3b
SHA1 19cd9baaf5de2c748fa616c0bffba6077eaa1b5d
SHA512 4ace9f491d0df8d80d948705a8dde39b98a4a173b663d211d52d659a7b29d364c154dc158ca0356fc9a355eec30d90de1d311d94229f850e0195e9bc1623deab
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi7Gn:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTMG
TLSH
T105277D13F1A841E9D0A6D174CE669632EB327C494BF195EF2240B7D92E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 18.7MB
SHA256 1abe6facd24bf23617398d18b6da61159920f55cffc89401e159491c0290089f
MD5 b3ac798af74e3196065ce2e68c71a4b0
SHA1 f2603c0645fd5042ae69198a02b0f3f82be539ba
SHA512 af585c7c327838f119051917c55d5403be6e245e089c703b31cb4bc5762563bc363ffc5bc826e61c428b9563505acec38226e91b600f0145d3e1c196aa586e84
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiI:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT/
TLSH
T1B9177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 20.3MB
SHA256 64e0aebbead34039f9f7cd236bb2f01f4bcec83873aec06cbcce9b2f6d23700a
MD5 9817061eec6728babbb4e3e952cec3a5
SHA1 5e62f559cf86d5b100854ed55f588629ffdec7a1
SHA512 96c07773e5717a6f944acfa45e94ec0298c881b579c93a513c24beee96796285433acad594393c2804d2484ba3d8d40632b096f3c75dd5cef5cad18aac4d06ca
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiythHf:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTV/
TLSH
T1D6277C13F1A441A9D0AAD174CF669231EB727C494BF1A6EF2240B7D42E33AD07B39725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 20.9MB
SHA256 8e32891c0da4ff74c529af01e4d823ceb052896fd097bf8bf36c3c7404f161a4
MD5 cf467567f7fa494a1946c6d01d833407
SHA1 e5e937ad48a75d55c08228f399874ccf9d0620dd
SHA512 5b1297950954b687a0a025c11a73ca247a2728ae1eb579018e5c5c2767a3d6960ec5f073f86fdd8e70b5e504549e167006f042add27a98dada88f850434bcf50
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oii6Jm0G:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTRl0G
TLSH
T1BF277D13F1A841E9D06AD174CE669632EB327C494BF1A5EF2240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 20.4MB
SHA256 93c26f22c577b41893b99c4397adcaba36e907bf9bd62cd7ac29c2b0860aa8d2
MD5 604a6dac2c98c6cf211ea651e3ba3e2c
SHA1 9cdd266af6fc6eb8b33fa650a50723b1cff53875
SHA512 f1db8384574d6c057c79b4fe78d6fb5f30431394703e4e4f55fd52050e0a8e0ffb1cb23fe9720a900fbd91aa1291afb6ddfb73ce9223b481b4cbbce6d4d72032
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi8dKC16:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTEC16
TLSH
T13C277D13F1A841E9E0AAD174CE669631EB327C494BF1A5DF2240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 21.7MB
SHA256 9069c31c3598a3180c92d231085512aaa8d9e2e1ff80b7f10d503b0d7b8e5816
MD5 17eda0b920f6def0629e6ee7baf36fa0
SHA1 326b6a44139767c3dd39bdf579ee8ce4751ab6f3
SHA512 4c0f55a8bc520d4d3f5c1e2975969d15f311c709be9ab6a9be2af5dd5426c3ff4d60beb121a954d5c6ebd1542f07f7ba8fae84eea8866f045c990970ee52e48f
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiRjnDO:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTYO
TLSH
T1FA378D13F1A841E9D06AD174CE669232EB327C494BF1A5EF2240B7D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 20.0MB
SHA256 3842569a5a0394bf57277ec1ee084deffcb7b0b14f06c41a014647002d85449f
MD5 947c909041ba7ecbf39fe91ab7af2ff6
SHA1 eb705d372fad9fa8a9e73af68bed8cdde162c9a8
SHA512 132607f51f53b6748f9cd0a0499e04a02f01610ca46d6d3201e05d7fd42e22af8b573844a73a4091ebd8ac9b2ea2c7c8d0e99f443c2cbfdaa41e6167be930ce0
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi32iw3:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTG0
TLSH
T1FE277D13F1A841E9D0AAD174CE669631EB327C494BF1A5EF2240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeStart.asp

Path C:\Program Files\InvokeStart.asp
Size 19.1MB
SHA256 5d95c0e486dad1b2dd4c9592556eb0cff3dd4140c5c1e30f8963e80ddc13cc6a
MD5 39356803ae11ac5fe7c48c673be70091
SHA1 f9c55be1a3848d17aac048eb204d31bd9f1baf0c
SHA512 d1f26b21912196a1ddac7e49626d12b9922d2bdd9d206e6ab5dd07cd73b976a2b752587d9f6e5f10aec21a558fce1804629979307f9f59288895088d15bb306b
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oitx:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTg
TLSH
T109177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 18.6MB
SHA256 ef4bd0e1cd1300d23ec3f3b482d9c9c1db2a48b4f1f8c8a364683d3f42cf1aec
MD5 569aadc1d2fd83bc82b8b085a5213e5f
SHA1 68d25cf68e9de7e839258f1dbd98201160bcae6b
SHA512 62ea3663595625eefaaade53505f2368f51f644d34376ab60c570056ba63b0704d6d9aeea0929b410d25a23f897a151ce38b159796e1040413b2336b60ff9236
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oim:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTp
TLSH
T1FE177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 18.6MB
SHA256 12c09a5a48c4d9e10e39ce8b20ebe10b3ab4d8a16431033062bcc7b029a3cac5
MD5 d70750a8eaf18f0087ffcbae4087f0cd
SHA1 0ec946d5a4701e5008ba70e5bb085e715d8f931d
SHA512 819e807a73e03500b9426afa086d32cf00bda57b2967e3a8aa46f5bdd783eea76b2e0f68fb251b0608b537d7f92ac2cb22e0fe0fe1f2ddf26553701871c0ff0a
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oit:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTO
TLSH
T1E0177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 18.6MB
SHA256 4eb84535848122ccaf87a40c210722c8af7edf7190b888554d84c211ffceeda9
MD5 f3e2e88e3eedd5b62a7a95a696878b8a
SHA1 6b4d16fd63ad59daeca02daefdc526e6c947c64c
SHA512 791461e5cf817e6f11b2b5b32caf2a1e9bda49402a82c0eefdb561f8ff089a670d74cc9b1ce3bacc77630f1973b6a6d17c8414fc38271f482e8c7408c16ec395
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oio:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTD
TLSH
T144177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 18.6MB
SHA256 99a1507078ad9465b7888290894cf4ca3bc7eecddd9ef15b30052bd1bd5a1ab6
MD5 992a7f014b40b4aed4b25bd9882fc8ad
SHA1 8292ecfec9c929929f0f8e455e7e8e833d305802
SHA512 8cf6ac7a2e8e213e93ad62a416c9679e668888e5395371272cf74d31e47af132859f4151465bf080632655988de66de7418e55a45c38b699a4f48feaa6c3ce0f
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi1:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTe
TLSH
T189177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 18.6MB
SHA256 a7a826d37c1ed1ddc139dcc2af0e1726aa55b9618aedc1fea323514a1aca18a9
MD5 7b2c6903b7d9804475d57c629b735cb6
SHA1 029126a23a34b805eb34851a54c8f1c2bbc6ee3f
SHA512 1cb8dd60c0c35728da1609c5c2b593d2536abbe6dc1c2119409b87d6d8c8c726035d17407c359dceb9ca991834aacec23a158eab0e84a1f9e1b3254bad027d8d
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiS:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTZ
TLSH
T138177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 18.6MB
SHA256 74b4ceb9446d58a28158fe31edb756b1a2b9ee2587263723ade6f60ae88a4c95
MD5 d04e39bb8cf1058a58560598e49fde91
SHA1 c5dc61541e9165fd0e00ce1b7642c2579c5d59b1
SHA512 8ca65f32b828f1cac26378c9177b7cc88d9dcb1c794793920933549131eb2f3b74618fbb9ecfb49d0060976573cc7433b609042821553d0c8ac1bae992da169b
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi9:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTG
TLSH
T1D9177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 18.9MB
SHA256 69d52a02edc85df175b8d8ca8a9dfe74b64afdad34587d61b5de1f88fd9c5758
MD5 d5b94190075890d3f50a8a067cb0bdb7
SHA1 90c957c56f0ebb79508c09c5a669f4e2b62240c7
SHA512 762ba71fc5852d63b5ba6acb8383cadf9abb8bdab5ac8f16e042a1911657adffb9bce58504dc2e93ccab65a96029f395e3605c627156649bdbf7699af335484a
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiAfu:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTRm
TLSH
T14B176C13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 18.6MB
SHA256 60a3a93a2a0960e685502fd556d2fff31f6ea6c8bfa99b893862c52a919a929c
MD5 4458c67569973a50e7eb465af4714896
SHA1 375295a0e7ae043744c0e7e670cbaaa9a287e9d7
SHA512 e40c764188cda61bb980bea665cd655a4fe5bdee972be93c7014a92a532e6f83fe8a5e37505226e335e0c6c46f129ce330ad09326c5fec30e5882302300121c9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oic:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTX
TLSH
T1AD177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 18.6MB
SHA256 1c9f125b63bd6d96584edaa600364cc950e0768d149e74217c6735d6c248d774
MD5 1ad2ab1a7351f8f5011e2d4aa6b31c7d
SHA1 f4ecd0c4d6b8a683296a9895a85ceb1cd2d74c17
SHA512 456fbaeb16992b43ed398b6e191b0699080fc939a67550ef003306c5731daa2a51e2c5549ed0c002908c30dcdd342c12a42c1f117a3ad36f921d7e9fe6caabc0
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oic:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTT
TLSH
T145177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 18.8MB
SHA256 26e27663ae50fd4c067e8d2672131461f05132aee1d750e5661f9c49b15c1705
MD5 8204d49319caadf057dfc946b6d5a06c
SHA1 d6977dc6cc094f6e4ebb0572681c220bf6562e6b
SHA512 9ab55076958546dba69d868b054a336c3a5ae0d9e4e16b6db49be5af4946b6fa09c11ed4b2f536992968158315546794f4219c68c659bd657a91d2b67f86823a
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oizs:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTL
TLSH
T127176C13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 18.6MB
SHA256 f8576d4f3e012529fdd5c7473b41b761e67feb8881aae524b573a77d2a6cba73
MD5 ce486e0e04f07cc75efbb445e6aecf5c
SHA1 328199dd285f1413b61d091b96f9090b0b2dd09c
SHA512 6c9745d27a5f6de5be5376dd1865123340d2721b5cf57ecd85e631e83ee0fec16a0c0c311593a6c3c0812b1498f2106c64c9b99347e89da366b3069c3824c786
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiR:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTC
TLSH
T1BA177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 18.6MB
SHA256 428f0d1518726bccab97444d26d132c50adc27e55791daa7c80049453cfbcbb1
MD5 47cd9b932ca9b9c4522532e5c328674a
SHA1 0d0321284fd0991f7d25ff6a9522195b39500fc0
SHA512 5c78f7d53f359ab198295cbe3efb02f6743e45e95e5b4f8acf0f4e969983d1668821d5646dd1abdefb18e2e7c4d5dc84a9312feffec37cc06b711c6bdd87c1b9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiD:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTM
TLSH
T184177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 18.8MB
SHA256 d3e791cbcb9e171cd04042d013aeb550e5d4fcb603019f0976aceb9897030592
MD5 1ca2b1cdd3aea69022400529e55fa377
SHA1 6920dff5161c66c0c1d1963ea93d733e34fdc825
SHA512 c79d8f41f1fed884eb6cafaaf9a5a4c9668b06dc9c03738a22d612ef77eb640d27b8843877d32a6e908dfa4e0eff5ead346a8fb27f420b280c891cbde30b84d2
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oimT:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTj
TLSH
T148176C13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 18.9MB
SHA256 fad1d8503dac6525c90dda0cb7eca34bb719d2a98fa5d1ccf2c7cf01935b5885
MD5 04b62cd50adcf446167f2f161ff1e8bc
SHA1 b2841ffc6c1c211548feb88a898d7fdf2e4610e3
SHA512 03dd89652dd5655cf8397f4b5b484c92039e9584b3dbc1b938ba2304dd09e452b37a0ce771b97dbf3ecbbd0329cf7a0c929410e6dccecd8efdee155d0a4c1dfc
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiitB:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT37
TLSH
T10E176C13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 19.0MB
SHA256 6b5ba8789d19695aa76eecd209f5772f6fff2b07d0824afb64d5a6d2b8c1f220
MD5 bef1a8b862b7df758f465f66fe28b965
SHA1 c2e0ad9a30322024f1d6e6765a9309dbeee9650a
SHA512 3592c797cfa2a3bd46fff86003b748a7a8254b73e88fc402da4715438ec3ea32c742ce147278bf700c90f6f68d6cccc48e5bb19307f551198db96c94725f258a
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiFq6:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTQd
TLSH
T149176D13F1A441A9E0AAD174CE669631EB327C494BF195EF3240B7D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 18.6MB
SHA256 95478fcfa528ac436755a45ee6953f91872ac3a78947650751fffe806043e565
MD5 191ada218b78c77e1aaff93157f10259
SHA1 2b561f1af128fe8a5da509a6d253722663e583d0
SHA512 b4c89968e2b7ba0160eeb86f92f8b3987826b25d4a210a13db63615fcab0694afcf02a527eda2e629dfa005546a39b96025ce19b42e4b96fcbd059ef3bc4c78f
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oii:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTR
TLSH
T189177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 18.6MB
SHA256 778b0aaefd9b0d3fe53119769314c023c79e923be03e1753953aa07eafdb6432
MD5 8f00187d56275ba75ea206073b2c030d
SHA1 1f12f62222cb2e559b09632c93f2137beb14a354
SHA512 d8c578b63cb26232474a97edce72daf7322176aa144e70a07df5d22a4dba3571e9a7443e1eb71fc5056f57a0a24594137a64af8e5dec56c00cc5e44dbaf15f83
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiP:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTk
TLSH
T1EC177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 18.6MB
SHA256 26e1cffda90f1eb2ab5334c78b55e2080b7db7e3c82d44bd7b434e1b4737d791
MD5 1d7bb4cd5cbea155aa50646b368c0d3b
SHA1 e92dc0bf8d3b2ff24ca7284ed49df6c21ceb2b1f
SHA512 31cb94d4a67a816fefcaa77f2970e18530d69e9e923f0914b81f90bea33f6107277b11be8135e9111f2200d0e1bfbd77230aeac0407fb562796eb229ecbe3691
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiF:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTy
TLSH
T12F177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 18.6MB
SHA256 c13e3b255ffd0c76879a7943e3f866014fe508dc9e7eea8275ce764662f334b7
MD5 a631ef248c1264737bc54d23755a66fd
SHA1 f15105d17f581cec8ace0e96a0ab5373441170b4
SHA512 8a6194de06d1a8c8952ccdcf0e50f16fbbac294034bb5796dcbd8f2d508a808f7ff3c47c68464726fdb370ffd67b462c99b79526e01b75f3aaf0809dfdd427a8
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi+:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT1
TLSH
T1A5177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 18.6MB
SHA256 6f894c6ff734fc5e6f9b1543f518d169328cc5192a49ccca22641331999b5bf3
MD5 525bf28f86f348725ec0120ef911a62e
SHA1 8e58b46443d277348436045e2894e01d37d93b56
SHA512 ffae30e55605e3986caebdb80169205d0238b1c4d27e7e0794534f7ffe36f64d85dc41a55b02865dbe6f2155c00e2b7f94f2395c4044d2d5701734cd999676e9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi8:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT/
TLSH
T1FA177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 18.6MB
SHA256 2b79cffd54588cfcf75c178495a42b2fe006a6dadd6aecf0e3e498f609c10754
MD5 31773d0e983391feff633d3010d02a2b
SHA1 ecc50eccf3c3d5b3e06a1cfd952f661f06733a8c
SHA512 193e6993e4e1e5559fe8d2838fa56fcbdd14c78ce486e65a6bfed2a4b10ba95b14d4ad0b0b8a10cef9738ac4f55b0f6424330087ce3f54f787d8d9ed9eba1806
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiI:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTz
TLSH
T13C177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 18.6MB
SHA256 3df6ed07f746a072535d297cbf38091e01dd38769896551dc3aff8c9008530b9
MD5 3e78040ba12f6fbc0b27bc26840e968d
SHA1 e2a2896892930e85d48f9c6103621b3040337679
SHA512 2fd0e6f7901be784a2d5eb885a0cd7db854f29c1375865a7519d4833c9d7e9966c97105dddc20ec2ac5381cb6891e7ea3e3f5a8cc15cd7d27c5eada55997e4fa
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oil:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT2
TLSH
T19F177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 18.6MB
SHA256 b77612bab30a2dd11aa870cf19f3df6f9e7b83534be1eeca3ff7e4aba9eeeb08
MD5 56820d421206ffb4adcae955495f2295
SHA1 276a3a985dd98bf27844b5a5806c6701c75f39f7
SHA512 96b79cdf98c78a14a951c0a384bffa7514b6160b1627bcd24a10330dce10d8c5e13b7adf43c4bf3faa904c7f97d0354b86d3252741a83a2ed5de6cdc255d6722
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiZ:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT2
TLSH
T1E1177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 18.6MB
SHA256 69a933943faf76a1ffc9666376b9d66e6ce4cb2cabac072f1e7cfff2f29882bd
MD5 07b39f50f19ac278349ca161d64ac6e8
SHA1 dbfb64263cf4668dd73ab42bae757aa51e774d7e
SHA512 a486cfbf599efb4f607b824b5be32933ff5cf105fb6c04931c30f43d2f03799652816b7979dc30e2ba7ab7c27850bfe51a59d94c0f9de29245367d3b54e9c1c2
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oie:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTR
TLSH
T1AE177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 18.6MB
SHA256 80ebd7235ac0e021f41e5e488a7943a4dbf9f63c37edacd230bf66203eb9aa49
MD5 5c62160a87b8e910e2e979ccb66ede04
SHA1 c14e0b8e56a6dd07d2b55e7f990d268d43a81f67
SHA512 b669942b858233980299cab303556b5f1388dfa8b9eeaaf4fc6d66b1975967a50dddd8216ad0010e89885a3d023f483b6520ad7b2ef8c248d96fdf4709849370
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oif:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTw
TLSH
T160177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 18.6MB
SHA256 b5773dd0e30f5da48743195f366365662927ea4897ed0bf104d7b4a8a635c908
MD5 f644578b8057dc0dda76c44d71572e3c
SHA1 ab789fd099cde48074ce62d65dee9819b8fb7f7f
SHA512 7dd747bcd9e4163e569932e48b6c5934b2b0627d7e87f2969fe4c25a3ec76e6107a0d64b72b934e1c9bb84318a060ec7633f5fdfcd5373bf3b10b82250cea1af
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiX:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTg
TLSH
T184177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 18.6MB
SHA256 cff3232dcb587cdd68ffa6406b42c35459cfd5199ef7cbbed2df46cce8498e35
MD5 c476d1f436a5acafec0f8a87cd534074
SHA1 3ab737c36426d84db68fe59a4ec6dea423f8b13a
SHA512 00b81a222b600a68eba5428df0fe3f8880cbe557871424f38ac5672421ff23cdec77a3a73c4816cab4bec0b989b3f09fdd22d6816ba04bb716cce3f4dd208b11
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiX:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTA
TLSH
T185177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 18.6MB
SHA256 d7fab8c706d331ef20dffe4b18b6a04c6d868ba1bb28abb990d80e817f3ce8aa
MD5 e24341d7e5017b6fa3877d29c03883ba
SHA1 1200cc31b55be65dc31df6d5b737f5252a2c0ac5
SHA512 8cdff0bce7e3e7b9415f4e567fc2e327068718bdb54d9514530ee22f8c55937ec542525451da6476a381bb02f39e51f5e6b2a2a6ba7ec76c655ce8daf963dd53
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiy:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTp
TLSH
T162177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 18.6MB
SHA256 33b2aab4121f9c87910d36140b04055c63835525f75bc959caa757c23f6f05cc
MD5 3c4786cff8090dfd3d74f908b96b5ed9
SHA1 46fb4da895f6fd477b6719c9f859dc024e5d9da6
SHA512 3afa2f54fc0d0b2486593f2977d6e4f3507f93aecd5ff73e9ce86f584d569fb100361007c17510feb0835086198753b25704092069ef60b9ffff2e7874929246
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi3:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTc
TLSH
T17B177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 18.6MB
SHA256 422c1b1def92f7d4bab6e3b324c9e9250a5e1ce58a53ead5c202327341a76623
MD5 4a499d66374159826e3530b2ca6d36f6
SHA1 489f8115fbe96a7bd89fe43d230a7b171c83f1fd
SHA512 f9d73ef35df320e84d98ca3a3a418105615dc3e9ec19d8db1d54ff39116b1dbf663d99718b4170d0750afe307b9f250545ba58fddb60dedcbb3728c1cff30cd3
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiK:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTh
TLSH
T144177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 18.6MB
SHA256 780516839bcfe6a1a0f60fd3272a45ccb497bf2699644f52483f710c4ad6cd9e
MD5 79b0d984429abde3fd19d199b436c4f0
SHA1 412fab70bfe9c240726c642925233680c78cea93
SHA512 7eba4eede6289664adb2e6e3eb23c61bae9e93641b3e32410e6fc48f9305a449e521820003ce5c0ed34d14f8daf07b38ae45db7c9e06cdaca9bdc9a2d2590110
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiU:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTL
TLSH
T11D177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 18.6MB
SHA256 8e4a464240993c01a4c359d94c613010cfcda9c63e215f91ccd06f35c3a64ec6
MD5 1829edb650a1a6d5c67f20da70346c9a
SHA1 f2dda8d5e845433c81075c92ec9084aec9d30d00
SHA512 6a8326b60ca31ba21d7637cc046fd5ba429f842df0073a5285c4d0c115ce3c1c348557a537a7ef9f3b1fe5bdcbbaa74b6968e52fd9398d006b45b25ad4956843
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiO:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT9
TLSH
T149177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 18.6MB
SHA256 65f948e1c239ae2ecd85378ea547227e6a7a658ca62b9470952cd3a2337c8120
MD5 7cba508fe0545821a385e2c3e7f1bf90
SHA1 dfd7292d9b10233c593ffdb2086d97c35bfeb812
SHA512 ef138b3748ed0be64875d7cf9b9837493621bcc8bb64d52d4d30edbb8e1b93cc7af958d3bdf0c88570730ec089c748dc1bb28fa5e9389729b3e0cd731ccba581
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiU:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTD
TLSH
T1EE177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 18.6MB
SHA256 49ebc0cf901f7893346d6290906be4908b52e1374f2464db357615ca9f5f7dfe
MD5 31735b35fc101fca58c9d8ef0caf7273
SHA1 0262a0fec3a5911a463fd2487fb8ac492302ea22
SHA512 7182e7a36430e3cff6fe1e4f460489f5faea15d220dd9f84a2250352c64a012ee95683a37487563396344d534a8f7c95ee852a76314786f4e296d2e5a9a141c9
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi/:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTc
TLSH
T1F7177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 18.6MB
SHA256 22b300dde6ffbcf3f1fb06bad8d7d7adfbf4f1aeece9b4da7888308be367a959
MD5 a80abdf53e1389c40f117b9fcd18f123
SHA1 2b786fb40c6a05abc8a774ff03f3d50505ee0e27
SHA512 cb5533113047f66d1fea0290e3b04d5401427136b8314a5f08fab79d0b32adc30f26f29b8fab2ba5e95337c5190887b8621c5316a27b7ddf29fc7945d5c2307a
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiS:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTd
TLSH
T174177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 18.6MB
SHA256 35ce4fb74cf3e2780e4724fa26ea14d6bfb703d33cf571908665c1c04724d404
MD5 edf531495a40aa3a0eff35eb92988405
SHA1 139caf6fc07cb4be0479f14e60897ddc486d3480
SHA512 5a8f804a88fd74de0cb42f170fdacb6629681d49d646adc3dc06e6e7185bddfdf10de782acfa2ca1e6554c8b27016b034605767b6fef9355b9bfd9a0e86580ec
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oih:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTC
TLSH
T1E1177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 18.6MB
SHA256 98600bd7a1bb5f08eb27c2177358f509da19613f5c3066e40044be2906cc24f3
MD5 0eba538762ff4d7bc64969625f032f58
SHA1 97c43dcc2af5819d7ec41fc1152f3f1c997e8cef
SHA512 b2f99fcc0d03e814910147ac8642fd5679ddd01a89a64b207dcf43fbfd030056039aa55a29c6f7bf579114f858d8522e495d05e1fa5642c07b09e6127970a046
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oi8:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTz
TLSH
T176177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 18.6MB
SHA256 9e20e3c77ad69d3d27fd877f6fd8f7bc01cae070b324c0bae2a5f0b5434567e3
MD5 7a2d096049e0d476fadc0672a3f3a0e9
SHA1 9abc1b06062250c5fe344b294bc92f3a7acb9e14
SHA512 9dc02355d054c786fd982a3db7e418d9b0995e31f4f3d1cfb2b8ca92f155e454bfd203eae23b950163dbe5b97e307d6d4d68511e52ec600f6ad06b7d4bfe30c0
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oie:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqT9
TLSH
T123177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 18.7MB
SHA256 5a57a80b654e3b720b1da12892d8cb7f49dc661723b596b57fda29d9458e17d9
MD5 f5c4faa5b929fbe7ffa78b4258a35486
SHA1 f96c225c1bebadb981754c3b024811fb01055123
SHA512 4afa8c41c1ddcf1bf8001e73605dd47f98bc92b79beab9d9abb72a855363d4367397e4f356b38b4fea275af31aa9103e1196423682ec3391122bafa7da907448
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oia:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTF
TLSH
T119176D13F1A441A9D0AAD174CE669631EB327C494BF195EF3240B7E82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 18.7MB
SHA256 5bd1d7e28e54035cb9b6d6dc7748b64ec0ddf72b4d223a175fd9622cdb4544c8
MD5 0c441c6000533c3a8fa85207558188cc
SHA1 3705428e93e73d764cfca792ec15bb561799643b
SHA512 2eaaac583cb80d12a4a1ea3b0ada19d4d43f79f324fc89ae7af652642584bafae8b15d24c0c89cd9f709f467a173f2d4cc30bd63e929d52750e4fb6510a8f86a
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oia:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTp
TLSH
T138177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 18.7MB
SHA256 f376bc588751c213a71ffd6fe897a0e4c6d63751867813df59a6e9a8def27621
MD5 87b0c0b02d994b264e7744b916b41080
SHA1 9e924d87bdf644942789f81bd9718b94ce8b3272
SHA512 c151472f6ff2739952bdbd772dad0c4e80857cdbb8deb2e1f94dd638695f36b01af959909c08d0a3020c3fbf297f09c9a9292b4dbc7e87e42bab5b9e8beb140b
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiSj:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTDj
TLSH
T13D177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 18.7MB
SHA256 796e470c875b5366cf3ff49f4d760468535387655dadfc48283d230ddf9e82ec
MD5 a7727362b84d28710815ee835cdd88e6
SHA1 69047b76673b88c51ccb114128708cfa0533c54e
SHA512 0f5c98d840d0d841ddf9f907d6978d14981baddf097c34797568c27066d637a7823775da8b2d8582e17df65290e74f9171dcb02c2b99e2cfd4d084fdf93f86dd
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd09oi5SWyZ/K0ttYVAAT1Kmd09oiQD:zyZ/K0ttYZTEqTWyZ/K0ttYZTEqTJD
TLSH
T188177D13F1A841A9E0AAD174CE669631EB327C494BF195EF3240B7D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2284-29-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3140-420-0x000000000E4D0000-0x000000000E63C000-memory.dmp

Download

memory/4300-453-0x000001ED83F50000-0x000001ED84050000-memory.dmp

Download

memory/4300-452-0x000001ED83A50000-0x000001ED83A70000-memory.dmp

Download

memory/4300-481-0x000001ED83A30000-0x000001ED83A50000-memory.dmp

Download

memory/4300-480-0x000001ED844E0000-0x000001ED84500000-memory.dmp

Download

memory/4300-495-0x000001ED84480000-0x000001ED844A0000-memory.dmp

Download

memory/5760-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5760-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download