e2993795eba1f2efa225a34c62e62f695ead4ed4a3f7fb83c877f0e605899d85

Analysis

max time kernel
104s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Size 7.0MB
Sample260708-tvaakact4j
SHA256 e2993795eba1f2efa225a34c62e62f695ead4ed4a3f7fb83c877f0e605899d85
MD5 fabfb7d213a3b8fda7673c4c625c48e7
SHA1 2697e5db52689543efcae3f44100fd17c41402e8
SHA512 ee79e3e781cac231c893e3720a7b593eca9ff79a5b39852e8ba67e822bbcd7861a90cabab598c7fa37c0bbf5a36166f503c2cf0cbd45bb82bdd4fee312844019
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTPezSC6v2XMHG/h1+o:JSWyZ/K0ttYVAATUL/h1+o
TLSH
T1D4767D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File created	C:\Program Files\Windows Mail\wab.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{4D11E487-142F-4ADF-8664-F4A55205B4F0}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{F3E46E18-A314-4298-B374-74C3A7907B0E}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe
Token: SeShutdownPrivilege	3308	explorer.exe
Token: SeCreatePagefilePrivilege	3308	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3040	sihost.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe
3308	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
3292	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1556	2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
2468	StartMenuExperienceHost.exe
3308	explorer.exe
4648	SearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3308	3040	sihost.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3292

C:\Users\Admin\AppData\Local\Temp\2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-08_fabfb7d213a3b8fda7673c4c625c48e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1556

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3308

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 7.6MB
SHA256 37e9ccf52aabf1e65452a5b4b190a2db99bc162167f316b863553c137fce38f3
MD5 b08818a50329ba35def654e0bea4d7fa
SHA1 3ada7e17c84804d696c74168724f98444d6accd3
SHA512 83eb04d513e03e1623b579cf7e0c0b549d8ec1eb8dcbab0737cbe869bbee99b5237268142ae7d935b57d0476ce276a6bb9de45281caf4590af3b2542594c041b
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTPezSC6v2XMHG/h1++jo:JSWyZ/K0ttYVAATUL/h1+4o
TLSH
T178866D13F5A842A5E0B6D175CAA29735EB327C454BB095CF2241B3D82E37AD0BB39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 8.0MB
SHA256 e350924d53944f3ddd926d2bf882794e54b1b0119740d3c1faf4735395586149
MD5 421209b137173d173650f3ac0e7d86c3
SHA1 7fc83d271c9cb17b39ebc880433996533fbd2ca4
SHA512 bd4501b973c25999b47b108a269eed753de5ad57d213c74a4544e18cb0b3108326c8de0327c4460884387aca159b72b74e049c94a02be88bcd0e99f6fcf11ba9
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTPezSC6v2XMHG/h1+DezSC6v2XMH:JSWyZ/K0ttYVAATUL/h1+Q
TLSH
T195866C13F5B842A6D0B6D175CAA29735EB323C464BB095CF1241B3982E37AD0BB39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 14.7MB
SHA256 1888b6e9b806ef6e87afcb2340f291a445c686c4a335d0dde428184c9a0d7eaa
MD5 b03e9f4527affabf01aba8b0564c2eef
SHA1 34fc28736824d4a8e857cffe32a12ba179164744
SHA512 6e4e6b65d7299b76683e8c2aa16fa99d5f48c5680cb73fe26483262a0cf5daad20d65b5021017f41f5095ea4d403d77ee205e0b0f6a16f45db2093d7b12ba00f
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+z/h1+:zyZ/K0ttYZToyZ/K0ttYZT
TLSH
T119F67D13F5A842A5E0B6D175CAA29735EB327C454BB195CF2240B3D82E37AD0BB39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14.1MB
SHA256 7713f624aa4a9574fbae0f4eb36e82869204f9a8841fae1ecdbc97447b257cf6
MD5 96b1dc1f7ecfd71ffd4d60574bfce002
SHA1 180af1eeb377135cfd3894e11775a4d99d1e25ea
SHA512 b6a9d3ae80caac7209c4fd6497df564855aec78c8c5baac09802fcbb2016d68da040f9b3ede52350647cc1e4d78e0368ff3fea061b0f8ec45b7526990948fba7
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+:zyZ/K0ttYZToyZ/K0ttYZT
TLSH
T102E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 14.3MB
SHA256 60914f59c3e8f31c856400680d5ebdbc6a681a6975732041e739d0f3d0476e62
MD5 4ce76b58ac3f10cfc42ff66905e3d8c8
SHA1 c93e9b4dfee9b64a6c7e7cb67b90e9fbc2b1bd65
SHA512 053e0dabe38530c0ac2117cf66780790a08b1119d8dec0f522bc6cc3171acbf2e44a259b9d3500e37e0205210dcf5fa352e63313f7c7b0ffc8a8b365623ce311
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+s:zyZ/K0ttYZToyZ/K0ttYZTK
TLSH
T11DE67D13F5B841A5E0BAD174CAA29731EB327C454BB195DF2240B3D82E37AD0BB39725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 14.1MB
SHA256 7844607b5790911303fbcf2e9c6096616b5d32027700152f200e3ed662db782e
MD5 fe5c0f4f1660248f2813e5411a1d4b83
SHA1 f8c3d2866f097dc3096a5dae5330c49d57f9b4b7
SHA512 a53116172dd2beb4e341fd4a9bfc4378d70f566e505a3a250d74e123cb392d53f1790609db226b6400f0ebfdd4136f00bf8098659c1a6899727ae702b9480a21
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+pb:zyZ/K0ttYZToyZ/K0ttYZTX
TLSH
T10AE67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 18.2MB
SHA256 097e44985f9dc5c9700b1a5859df72b2bd05b9944f2318b3d8c5d1d767872c78
MD5 113c50666c3a41a458b27111ac9a6673
SHA1 d17f46c4de4a642db640bc3cea7eec33db2da7ce
SHA512 45568539dc166fe49ab837ff6ff36efdd3f50fea65e0496a5d3ab2ef4cb2e5d04331ad7b62f254f6ef62a00c723c9da1fc75091e0d2cbabcfc8a7c16498b97b2
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+jvyEYc/b3w8O:zyZ/K0ttYZToyZ/K0ttYZTJvyEYKbi
TLSH
T11E177C13F6E881E5E0B6D174CA769631EB327C464BB196CF1240E7992F33AD06E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 14.4MB
SHA256 264771a0beedf57b13d392474274b78a764754c76469583928926a2d909bbbb9
MD5 4e7bbaa5e9a1d883f52a328015395f89
SHA1 f0af210db7afea4212245b3d3146595094643301
SHA512 78676f10d0c7ea9acecc82f11e83a3dd73e2aea0264e94620852cb4cba4ada99bbb73ae9be05ef36c4a5ce635db62ab742ae12b56d86ba35a3b3b95d0bd5bdab
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+x:zyZ/K0ttYZToyZ/K0ttYZTT
TLSH
T196E67D13F5B841A5E0BAD174CAA69731EB327C454BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 37.5MB
SHA256 1e566ca94d98893490f2fd8468f6a57a03392c18da5fd0f2e6f89601c7a2d506
MD5 0e1e67eeed8fe06b6202a28b06371416
SHA1 eec72a6c9566641878201661209f4079cb020623
SHA512 41055f584f834d20881eea3a7c728cf15ffc90c67bcd8f17bd12c1e6c83bcaf97e176c4cb246cd1bceccfec7a22b0a1ca1245973d198e3797876e5dd7ba40498
SSDEEP 786432:zyZ/K0ttYZToyZ/K0ttYZTXE8c23pV2X+T:uZ/K0ttYRDZ/K0ttYRXEh2ZV2XG
TLSH
T1C3875B52B6E843E2E3A6D134C9B18272EB717C0E5B7192BB1135F25E1E376D06E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 16.2MB
SHA256 b13c398a5a7ccf3e83da9be688285241fb466545ad14879a3a005ec3ab8419f1
MD5 8b7b522a6c4572f5828a58a40942146a
SHA1 567396913797f09357c04267d2b224ae0f9d3d23
SHA512 c0de9c0bf58e0456a5e4a8f714dbf39615bf64eb598408635924a8c056858c094d837619d7b84e5b4e749fed25f818c623d2d609397f76d1077c821b0b64157a
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+EGn:zyZ/K0ttYZToyZ/K0ttYZT6G
TLSH
T160077E13F5B881A5D0B6D174CAA29731EB327C454BB196DF2241B7D82E33AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 14.2MB
SHA256 6f773bd7ea41726f5aaf4879b1b1421850e614594dfd7c01cd6ba5a3bcfd7f6c
MD5 1cdd5b9e9a3e9aa17fe3a59f742373ab
SHA1 9dd71500692f51e20f3fd8cce0cfcf68bdb9ff1d
SHA512 f7acbe904e929dabd85b940e0c4f7c3754e81a01467a71fb0406cdd4dc963a173dc7b47c34e6270618aa8c68e6400a9646297641b00bd551f6bcb920a8238d01
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+n:zyZ/K0ttYZToyZ/K0ttYZTF
TLSH
T1B6E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 20.1MB
SHA256 4d45740c9ab7889117faf01b15841b8553a2acfacd61ce6ce21e07df8523cf35
MD5 dee7dc966251b8d2c8fd2070e00ab2ac
SHA1 abdb120d44a1b914d74b3e5e46459a9108d68637
SHA512 1cc767ca691b1ccf75ae465feb8ea7681433c8ba3e3d5d1b56daf5fd68553f1f11af64d179e3e9ab1402873b644a07f3cf91ad83ed082e60d624bd4f531fb6a4
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+FQyiKaUX+PNo:zyZ/K0ttYZToyZ/K0ttYZTHQsas+PS
TLSH
T11A276C13F2A441A5E0AAD174CE769731EB327C4A4BB196DF224477E42E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 15.8MB
SHA256 cb5670aa57eae1dfb89884bd3530c4fb0525eae3d656b0c3ae1ee1741c0d642c
MD5 6465651bcec6df865d34dbf27e8dec48
SHA1 ac02de5f05b784fb61a7b6b3720d86567a46b4b2
SHA512 3fe8994ce542a421a460b751aa3034f56a5700991316322e400af52d5913a0ba3d3b1732418bd76ec30a03f9331059f1b12f36a03491737d8ec5edde297a21e2
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+hthHf:zyZ/K0ttYZToyZ/K0ttYZTD/
TLSH
T14AF67C13F1E441A5E0AAD175CBA29731EB727C564BB096DF2240B3D82E33AD07B39725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 17.5MB
SHA256 da4b28605162c5c7ec7672f101d558758bcab810a27b16da426380eb98140bb8
MD5 6614a39a5bc28d1363ece237e338bdfb
SHA1 9ec548614baec461297eb1ad9060fbf9010e9fde
SHA512 a7775cd8e14d1d6b59416468a5c4af0bb1669f439b445c788c3703aa46a87d102f402626db5f27707c36e5de05c95def1d589257a3eef316c2e97193afe40e71
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+JLIHuWhs:zyZ/K0ttYZToyZ/K0ttYZTn+6
TLSH
T10E077D13F5A841E5E06AD178CBA69732EB327C464BB196DF1240B3D42E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 16.3MB
SHA256 55fd8babc3dcb6365cddbbee24dc377b1a3f262efbda3d5d91fd57b4cb6b05f6
MD5 a5d8550b5b728a1c53b7d0280c90d228
SHA1 6c6cd8b267325891256469070f7f5147ad135e02
SHA512 17d7bf8edfb649e15b31f3eee2378764f18be7caefa5efd0d60c540597d1cd5c84fc2e7c0b9bf7a944ff39317a672a66e2b8bcc3e22b318b4b09f3419ef530ef
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+56Jm0G:zyZ/K0ttYZToyZ/K0ttYZTfl0G
TLSH
T144077D13F5E841E5E0AAD174CAA69732EB327C454BB195DF2240B3D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 15.7MB
SHA256 ed98a2aef0a9ec7921fd4264ae98c8c71237d9dd0dca43bcb692c1557fe8be6a
MD5 e159f28bda970fc03e7ad64c3336a808
SHA1 c04bdbddbca00e9fb1a31ff0ea835eebc5f33621
SHA512 c3ccb9fc896d4059489d19752b8f78d86d5ef09424b3b3f5127e94b245c11165d94a9ba5f727e05f1a536fc8bd6c1c3902252549643f3313c81091b1d9a58e89
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+afPf:zyZ/K0ttYZToyZ/K0ttYZT4f
TLSH
T103F67D13F5E841A5E0BAD174CAA69731EB327C464BB195DF2240B3D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 15.9MB
SHA256 4b12bf8458f15d2d67a74b3aa9a5d7d98369a0b4538944126c507e4c875a9ffc
MD5 b5005f7bebe17d2b870cbbef108286ea
SHA1 aef509f145512f5ee86020595372f2517fda61a7
SHA512 f40caa7709f9ba0082d2786c5cecada9ce54eaf577938f0eace85baeb3def1bdd6057f83fc610c69ad076711c37c95a80aaa1eaffcd857e8ae4e4330824367d3
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+3dKC16:zyZ/K0ttYZToyZ/K0ttYZTSC16
TLSH
T136F67D13F5E841A5E0BAD174CAA69731EB327C464BB195DF2240B3D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 17.1MB
SHA256 5cde44835d846fcff7ce1151a5b04c0aa8d415d4fc1833b8f1bb502feb74a838
MD5 a5e2e7b6141206f961e22686bbd634d2
SHA1 a9f8d3055c4e5ba97a710adb12ce054fe1473161
SHA512 654d7a235ea25116f697c2e9a10d5cbe3495cdf590034a5f172b9504e80244d2f67f426c246e7fd89d5ed5041efc95df77c3530383a1d3c2441dcfe4b559bb56
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+ajnDO:zyZ/K0ttYZToyZ/K0ttYZTGO
TLSH
T1DE078D13F1E841E5E0AAD174CAA69732EB327C454BB195DF2240B7D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 15.5MB
SHA256 95a351b63dca1c23d1ce474bd64f24489a0355c2248552aa3b793edc64e3ce21
MD5 5f072bb59181f6497b57b95a60491d7f
SHA1 dc1aabc9ac312f011f76acd05b79acf73e423e6a
SHA512 9516a5c4ac1932ccb5cb9ce0038158a2c3943796b2d7e20091d22ee881960d6638d1ab2d01560e37d3e7a861d5dd437649b684840d3df116845917834dd4c9dd
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+Q2iw3:zyZ/K0ttYZToyZ/K0ttYZTY0
TLSH
T1D9F68D13F5E841A5E0BAD174CAA69731EB327C464BB195DF2240B3D82E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 14.1MB
SHA256 73f1d084eefc21cd61f0769f29245dc44efe2d5d3f38b73e9064a022fd56256c
MD5 78c328415b4c896c6303bd8e46d8d545
SHA1 22747ec5378f67ba207e5c4c31853944a596c559
SHA512 c46b26140ce334b42e74bdafcd101d84aaef3f01bb1e85e548bc7599f6f120b77d80d3fe2b69fef0a3b695f566984cf0d7769df876347321ef9ce64ac777ff1f
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+R:zyZ/K0ttYZToyZ/K0ttYZT3
TLSH
T158E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 14.1MB
SHA256 ba4c8b6fe516ab7c17de98f30b312c09705e754f92d793a4e4f4de9c7b6b212b
MD5 0e3d8263b52a1302e4f6d6a0f9e33459
SHA1 a03298f62b90ea275c1d7d772217c1581d7088e6
SHA512 9884f30ad59000b8d5da4dc53990a8115b460b7775222f2b3dfabe585143840b44f70302b661f1764b35c1cf9d40887751cf8242d82a22485d35aa125d36279b
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+N:zyZ/K0ttYZToyZ/K0ttYZTf
TLSH
T109E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 14.1MB
SHA256 f8604c8ce272da50fdd9cc441d06af3e1a9bb93a47618449b5cb4e09ddb29b52
MD5 cbbbe721de5c41cf4184b62f92242c3d
SHA1 e42930f09307e6584b55c2fb950980d8295b6321
SHA512 c7744491b7f435d47a692fdfd35a55b66c6f905216317ff4974f89f14b9fb652694d7e744f552e510bbf1163df050927c7b9ae8d74e52fcb33262252b7f8cacd
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+m:zyZ/K0ttYZToyZ/K0ttYZTQ
TLSH
T119E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 14.1MB
SHA256 7e81ad353a95c913abe8b4863c9e06e81e9b4484e0a265b5dd1b2e1f7ea0d7c9
MD5 510b5eff40c6c4800f4e732b1703a207
SHA1 6160569b109e0dfd69e8477d4b23f2687d3ae258
SHA512 078ac386607ab2eca097a9fc32d7865747de0caa45339f497c6c681e0f1f3029538e2cd0d0e478d7e0bdcefaf7ea7db883685fb7d957464ca4a60469c2dcdb3c
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+7:zyZ/K0ttYZToyZ/K0ttYZTh
TLSH
T164E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 14.1MB
SHA256 375c67bae46116fb2fa07f39f6148cafb4040242105532262f9ae7032a8f51ab
MD5 0ed77b1c72c0efc92915ff443f4659fc
SHA1 17d31f2cf730e09af1d00dc0b85513745122d05e
SHA512 f6b7e72da1bdd56c74f05857aa213967fdc86668646acdd22c71d9400ed33fd5ed8d438c4ff37964c5592b291ae8bd8d1bfa20a4dcf81d571f8ac18073680c04
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+W:zyZ/K0ttYZToyZ/K0ttYZTE
TLSH
T1B6E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 14.1MB
SHA256 428e868e55f4b3695715abe50bb519ac2312fe698ed0a9e3dfa327b05c89b77b
MD5 2828176e4c508b20d87b099fcdec3037
SHA1 47ff50a951ca237cb3044d7ab3905f2b2872d55c
SHA512 53ffcc6e1334d44e3d3ed64684b02b0679de9618948138b0293bc06d5f425362b4ad168eba73c7ce561e2bd8b60e0f87506e658d3675216d321a04043c1dad57
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+x:zyZ/K0ttYZToyZ/K0ttYZTb
TLSH
T144E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 256KB
SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
MD5 af7f46b0157ae58d52e704d522cb25b7
SHA1 3a755ed5dcf12a989f1f5a82dcb425a7e5ab2303
SHA512 e1e68c322bf33e75a4344996aa0f0d7ba8889c164f0420de2ed2a9ad8c6c887ee64dd6913b70a7bb4495f3ef095738955eedf9900160bdf8071f51791939ba89
SSDEEP 1536:8ZHGPeg2Sv83fH+5MnNlP/2xbYqrDA0A3MZcWGbJl6JQ3zsHLeKfizF9fxv/UMVA:8Eee83fH0MnNlPubxrrCbJl6yLVKDX
TLSH
T1A84409E185C0A0F2FAD1A17060EC773965B9CED5B7004BCBAB67EF628E6E100531795E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 14.3MB
SHA256 d5c9416f2dbf763508c4b0a985e12e1a391a6e61f5dc938504ca7dcceb18c671
MD5 124c0c0773e53fb68435d77f82e5546c
SHA1 fee90721e086db3e35bce622d272b1169aacc39d
SHA512 b2736ac1dfffe673c1ddbeb1d822a0662ebe5e198fdfb2a864c3fb2039738d56838f2556a0d0e22224b3baea03c31d5b57ed9ac75e7c49440a91c894d4dd625e
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+Zfu:zyZ/K0ttYZToyZ/K0ttYZTnm
TLSH
T174E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 14.1MB
SHA256 af18ac9f77c0efd97f2382c11b262d4b72287ffcfd3d72b8b152f7b9ee265ab4
MD5 bd1d125e2405a3b27e3e9954a3061588
SHA1 f555a12c1ead9c3c03b7d2bc06e19e6e3332fd35
SHA512 0e9114d0fcaf3c657dfa5ec67b3429792cd54cfce72e3cc4deed80c1ff062335a703c6b22e8c985e0c67eb470bd07407771b7ac4de576852234be1bb01805594
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+P:zyZ/K0ttYZToyZ/K0ttYZTN
TLSH
T1A9E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 7.1MB
SHA256 50b10afe1d687aa3a9ad856394ff739914a1802b114f3d5a491b57e3e2e1e877
MD5 2d837a795a37e04b38daf525a65d45b9
SHA1 79b855ef42ca032bea8d7f801bd2e7c1607bc2a6
SHA512 ba1dace04cac161ae55faf63f95f262965529065a1f0a0cbcff8a79b2482e6ed6be12d663161dfa305de544b599b1ffec664d044517b448f77f6fb405f86fa5b
SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTPezSC6v2XMHG/h1+L:JSWyZ/K0ttYVAATUL/h1+L
TLSH
T19C767D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 14.1MB
SHA256 4600a4811ec5ce60916ef308545f1e51baf0ec16a77f3fa2198ce8e0c366776e
MD5 62bfa2cd7179de7214d39e2f05cebacc
SHA1 38ca8a92396b19815565ae797d0e6be9749f5a22
SHA512 410899cc633f52cbfd2378c30711495fdda95696924a6a522122d1d7dc5f2feb3d041019bdee1feeb7259dbefdc939605715948db47f1d1f8710a9bb7de753c9
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+a:zyZ/K0ttYZToyZ/K0ttYZTw
TLSH
T12DE67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 14.1MB
SHA256 f06724c6b74b0677f5d61036c54d5f8342693b827e58d6f0e9ef5ba64142781e
MD5 6d870c35032dd0522ca6d9ad80326943
SHA1 5310acc845ef8494da6fc83f619188e5d2a63d2f
SHA512 fcb971497981a27cacba4e3c04e2a052ea193e54249fdc49153239e07e85a82552a06e3d03ed79639c98e2a50b29016aa43ebc474e62150d212f44951a27f19f
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+0:zyZ/K0ttYZToyZ/K0ttYZTy
TLSH
T131E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 14.2MB
SHA256 58d805bdb329151e0553ced79925dcf5ddeabdedd6379a89c6da6d919038e56c
MD5 1555ac743537536df7604010851e8793
SHA1 15870b41ccf4ede48cb8247ed6f80290516bdca4
SHA512 1d2d08c98e94d0432b6a48c71fb7baf10e952d74ba7763c0e6baac14b577278c5f85fb1d46c72026271de30c305d490d7fe78a7b443c791f3af1a91324922cd6
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+/T:zyZ/K0ttYZToyZ/K0ttYZT1
TLSH
T14FE67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 14.3MB
SHA256 326794e8e0b05fb0eaa5cf9ed116377efe7bee5284542b99dab1aded97df756a
MD5 7b1f03cc376564b9f5ba4b013708e57b
SHA1 d23e38087fe805417cd89958889a25f4536fa102
SHA512 e377ffdf7cc81a45918481de62ccf223aece78227f561531e530771f92b43e85627f8b00a78b60e70037c042d66775630ade78be9f870714f3c840ebb0b7bad9
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+PtB:zyZ/K0ttYZToyZ/K0ttYZTp7
TLSH
T160E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 14.5MB
SHA256 8682aeca18e9b3564b88645d464063042b7a1ee35901939b4ec6fc8938a642a7
MD5 3fb0980fb3f3445de485ffa49175f56d
SHA1 cf0fcf84e5f8ae77e16e3b970b5fe1222aec880a
SHA512 42d12e2be0def5d7190d9e0c5219da179400529c9fc82eda70368e20b0b90fbf73f993186ce66f2d34d659132f8874936e8fa7a89a6756f088479d09d24d101d
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+Yq6:zyZ/K0ttYZToyZ/K0ttYZTqd
TLSH
T1EBE67D13F5E841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 14.1MB
SHA256 51c3d703bec3b8deee3d71302810a53e8784e1db10c13b8c39f666c244dbefcc
MD5 94e070111d7da91461106000baa73750
SHA1 3190a99759db1b290c158797e3f46a6140bbf09f
SHA512 b71a21ed15265e72d9424f2ed653cfe4ac9bb0492bd486e047ac46e0b379b21ca29ed8116bcfef36c6e641224ed65ad48c4ce8ae4d9176df8cc6bc44ad246533
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+Z:zyZ/K0ttYZToyZ/K0ttYZTz
TLSH
T152E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 14.1MB
SHA256 067368a7731ec93d49cf47f87efb61ead0c27defe1a984f3521866707708722a
MD5 3af7394888d9b477fc48ee6ad0471294
SHA1 11c06a3d955614f65583ffd629b49f47040e31c3
SHA512 a2b1ee5bc7ff4d0c7e447f8c15cefdd31f940e9a3a48858e124b1e6fe0a5602c4bf8db0624251580d50eca4f8d5c20dc964a5920c40e1edea7f783d80bfb06b4
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+c:zyZ/K0ttYZToyZ/K0ttYZTa
TLSH
T143E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 14.1MB
SHA256 a18a563581e3316cdc526f436d328bd4ff0a0052f843d4cb3797348e0e5e8b99
MD5 c64291f3cdd65528050d42fc5abfd155
SHA1 15e37a1a49f5634e700d68b50395563cb52f45e6
SHA512 2c1fde023479d6a0e1a6a64fe3fdfb7c9fc361eb068d9aa080b2f3ea923cb27e6857aba17f64f085580d0a71372248599c31be99d2677fdd6c565316f7a2827f
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+q:zyZ/K0ttYZToyZ/K0ttYZTA
TLSH
T1E5E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 14.1MB
SHA256 7f0039bf78f18fc4d3b4d7aabe82ded6fbfe6ef880e16aa668985ef8bab66fe1
MD5 b8a18c841f162bbc5911610ad1dd97aa
SHA1 967758a6d9c14364d4203d051516e5acaf1d7739
SHA512 57befe8bc49717bf12a197995490c484894bbcdb4d4d750e2a27dd7365dc63af0dbf28ba2dd92c0bc28f04f8b842ec3eef975bb6bc603642e7460208ec7af1ca
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+d:zyZ/K0ttYZToyZ/K0ttYZT/
TLSH
T19DE67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 14.1MB
SHA256 76c82a7925dd417eed7f7bfa016c28fa3da75d84417c47d0201dc602d41890cc
MD5 ce3659ef0edbeb6234e86d1fce2148b3
SHA1 86c87193ea3a549373a5607bf1ea5b9b5419d8ee
SHA512 2ab778589f5cada3d4378224885e1df7ec20512554686a8d96fcf113f94b54d2107b6bf724a832e7d18d1ba981447a9fb67478482ccc832096bab3f80dd060db
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+H:zyZ/K0ttYZToyZ/K0ttYZTZ
TLSH
T1E5E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 128KB
SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
MD5 a26921a2be71501221e21df53cef9cd3
SHA1 f58e1fd814a722e7fdcbd77df79336fe2f60519a
SHA512 e9a5eaa327fa536a571cae56fbadab067bcd3db12b607ad340ddf414ba73deed772c7da529acc9952b51473dd0ff62d3653212042b44d84c55d5bc4fe39087f7
SSDEEP 768:PKLnZ+GdNGPezMrItSQGT6dK1kK5oI/8Zvd:8ZHGPeg2Sv83fr
TLSH
T1F6D335F549C0E09AF5E0D171A0D8B33825AACDE1BB5047DBBE17AF628EAE5400397C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 14.1MB
SHA256 bc4e85601835237abeaaa2d271275053ea6bf3b7f868200be33ee7ffdab11721
MD5 5bb0c099a1a807fc9938fb46362dfa49
SHA1 55858b98f289b959bf137a3981be850b31b15b23
SHA512 df36b433f11227f9d2a6b9a017877bca810e9cabe7ca510f241b25bb1363533b0e21bf0965d074eb3cd9aa691701da75166c5b43b47bdfcf93769ac1e66263d1
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+e:zyZ/K0ttYZToyZ/K0ttYZTA
TLSH
T1ADE67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 14.1MB
SHA256 cc72a6423aa170810bb2d3ded4e4ec213c25ca98abc2edb53575553f74f9b22a
MD5 180c924223df19079ec75a96a85246f4
SHA1 81df3052d06bee3d4724fd10d918e7517b036809
SHA512 4d83b35c4f4dd559e4932ef5c1f174950fa1a6a54d554e5dd8de1c89d7ada9e7cd42fea671723f88399c254373954e12689444edb0bd64140b85d3e08acd341a
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+J:zyZ/K0ttYZToyZ/K0ttYZT/
TLSH
T196E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 14.1MB
SHA256 4d44786c674ca2e48f8ecd997d033984fb5cb02dc0aa2e0a7729746bae6017a7
MD5 66adc8d30547233a89f436aba8825803
SHA1 4ea4dc82ea88f939614e5b0af1b81031521dd088
SHA512 34e6773e8afa63e39e65e757cab4bc1f39e7b863cb69b7c9d78d5dc1c4dbfa212c95de1e565c02c31e6a301d573145aa3e74d5253f93040dc1f89c46f2672e46
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+4:zyZ/K0ttYZToyZ/K0ttYZTm
TLSH
T168E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 14.1MB
SHA256 3c6c6e56c9b9f9387574d1d0db78d92dbeb44a08533ce00d19aa8d9fd7ee5944
MD5 192ac398dc9c3054e7bbfbb26ced9950
SHA1 fa40391c7907b743fcdc9ddab3e08ac90bbab949
SHA512 9c3181581008b22bcfffb39cb05b1b31223b40052b5ff2e9cc8ea4abb8d20220a33f64cd0426b9d4274d570189855a127e294f7190929c89f2c34d22593a7ae1
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+4:zyZ/K0ttYZToyZ/K0ttYZT2
TLSH
T113E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 14.1MB
SHA256 30815be1edc6840e47c6a93fd02a0d823d4d263bdbee9b3cfd7f5f8c3897db8d
MD5 a5ca8a21a2bf852553f64292fce95810
SHA1 81d02477008aaba1dad54475f8710fe0cb12bc8d
SHA512 31d2810073cf42aba68ab8c057f03b0a0f5441de9b77d09d80287d9e91c1347a4857026a3d33b6f89e5d300af4a17c74500bd411cfa5193e81f4e353846c69b2
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+4:zyZ/K0ttYZToyZ/K0ttYZTW
TLSH
T10BE67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 14.1MB
SHA256 35578180fd5a8a56a1ce027fdfc5590065da3d79e54941178e1eea60060cd009
MD5 07173342eb7c96f9fbe8ac4fe8d12297
SHA1 8203596d79ef8a2a97f499e6b4835b5d96cae2ed
SHA512 98238f981b03d550ae4bc962769adac28551e85f4ad3c1b5ab46b493b8acc55119724427de2081b929fc30a02ef5ced9f0495d60750bed0759c71f05c8607e6c
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+R:zyZ/K0ttYZToyZ/K0ttYZTL
TLSH
T1E1E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 14.1MB
SHA256 ea0a259bbf87851be74b71c1bae7b62c79fbbbadb2b299d1725ba13f0158fc66
MD5 5e9355f2cddc34f7e7d392418839502f
SHA1 87834c714504bf13c477ff126e2646127dd1e889
SHA512 5567e8a7cb728c7e19ec31e6d7cee1ae5e5faaf30136da6b451d16c27adc3951e9e3ef5b760c367f3594a3c11b572b71cfb135acdaa023da44de4871646f44bf
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+U:zyZ/K0ttYZToyZ/K0ttYZTa
TLSH
T168E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 14.1MB
SHA256 d95fb155cc43f130cd047090a2d0ffd798b7b46fa3e45cf06d1a06904f3bc5fa
MD5 00ff712cd53fb54c419639b887a4b457
SHA1 84e094664cc4790114972d16da75de18c4912979
SHA512 fce7fb734c9f594496fff88096988ef5bc8a75bd7efa93c61b00be8628172d857ae44a4496b460936c892bce7544d1ed791f8fac83adf2bc016b8c46df76e464
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+p:zyZ/K0ttYZToyZ/K0ttYZTj
TLSH
T15DE67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 14.1MB
SHA256 cc3cf0ee4d4ffca644a964a273c384a527901a54553a157759dd3df32b8b53cf
MD5 ec1d289f2cb7e19ecdc9dff4212b5948
SHA1 25920d99d8e65b7325cc4bee99f1af8768cadb08
SHA512 a62736fe7e69a98435b6b1870aed07213cec7fc9254e125dabcdeedbff2eb2acb12ea268fbdb8ce17faecc462541feb959b08236b9cc4d0c4333d7c4b4023d9d
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+T:zyZ/K0ttYZToyZ/K0ttYZT1
TLSH
T1C4E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 14.1MB
SHA256 160095c0543d604ba2c16d38154321a4347e4bc6013868867d2f783c0b1cd0b5
MD5 746e8cbc3747a4254a8139d803cbdc39
SHA1 a895c3adad685c95cd62775b7040350379a3e8af
SHA512 8722da92c867f7ced53d05f2c9804afbd932a1c97032ddca858e37b993db55992c66bf9f2ad92a48d870d5d405c67c73b3736a6a719d90f79596cffe9265d307
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+V:zyZ/K0ttYZToyZ/K0ttYZTn
TLSH
T133E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 14.1MB
SHA256 375c7f23a53daa0a0ba04f089e5bc420307af8b9b81358af981d804181057a05
MD5 5bca4854725db4652b8a8780728a2e16
SHA1 ec793d0d71dc52d4f934c943732cb3eaee320e6d
SHA512 c281527201723979a866bf75abb94dfbf8e0965a5c32832c5d08931b4cc74c6469c521749cd57c6af38007167643138a2aca8b6dd1588b73a703681484d919f4
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+r:zyZ/K0ttYZToyZ/K0ttYZT9
TLSH
T138E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 14.1MB
SHA256 50869e90571e93bd1b34e692c82a6018e563680e4e69aa54bd42a02e6ed64c41
MD5 d2829252e3bd052e2d2a16c8639a4aff
SHA1 d1b252eb0eaee578d4492d980cfd87dae6baafef
SHA512 0bc3003f294a8891bf9bc005de6a241464dac19a3793b7d74274eae7e583921116f6a26d5c6323e96e5edb8bc7302d1d22b6672b88a7a643508030f4953401c9
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+K:zyZ/K0ttYZToyZ/K0ttYZTA
TLSH
T16BE67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 14.1MB
SHA256 26e53f3fa6c6a199a89cd7e302cdf05d6e96af96b9a11ab060a72c980f16ccb5
MD5 5661bd5b571da9e0d21ce2b69ed270c6
SHA1 7c7a2e5d732d86e70d42400b4e4633a2180b1c25
SHA512 4806b44f03a0fc3343571a6452dd470a0c312524a52d62bd32a167e8d0d9b95bb23d8a451b85e647ac9999b88e693e442435e609c202f0c8e81787d237a10e0b
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+L:zyZ/K0ttYZToyZ/K0ttYZTh
TLSH
T159E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 14.1MB
SHA256 d0eceaac336ab5bb72c6fb6efa72b45eecaa0933fce5142ec8db2b0a92a16a92
MD5 b6324dbd60c60b457a830e460c9a9607
SHA1 6bf25db6652ab21f8e15a5ee9a7c5079976fc038
SHA512 30a3dad2aa69a246e02e2761f8982f656b0e2dd2d0ea9136a7a9d2f5a97343e31548eb29ca6d26f1652a2661569851c55c135745e63512d42704ad284d929e7b
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+V:zyZ/K0ttYZToyZ/K0ttYZTL
TLSH
T1A8E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 14.1MB
SHA256 9731919ae38ab96df8b7004d9128516e26fedc1c4f0a77c689c30d3779a2da5e
MD5 ae346b4c345bacbeb83b926234abb4f1
SHA1 f3de7d356b9c34c20477d7bde7c8b96d792da07c
SHA512 3e0fef12e46aac742e0af8de0d08e250dcca364613cc665fce7740a89d70d44abf16e197f6be67af991dab4019a3bc2ba7d8ab7a98e275c8c1c2113bb59bea92
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+J:zyZ/K0ttYZToyZ/K0ttYZTD
TLSH
T104E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 14.2MB
SHA256 a7d35ec6fe662885268504e847d5d283eacafe6905d67a40c692e3b1c7a6e1b8
MD5 d7580b5e239ed32bc48e4b2102c08031
SHA1 8ae4cabf95b4a6c00acb7624c9907b65089fca14
SHA512 5a06384ea5ed4e6f20ffe19496cf2381ad6c49f560f3fe8f614a71c19d2e5e37b26862aa89d156ee899641d10632121212211b89f2a65936437bd5587115ef79
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+d:zyZ/K0ttYZToyZ/K0ttYZTb
TLSH
T1D7E67D13F5A841A5E0BAD174CAA69731EB327C454BB195DF2240B3E82F37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 14.1MB
SHA256 b42a9b109e539592861648b390368d1a15e5dadb11a653efe3e7b612bd91157f
MD5 4baaaaa94314b71d65a1661397d33c1c
SHA1 4bf1fa3aefc0dd85414d949edda487b634bc6e5c
SHA512 bfacae04fbe436b79ade425bd17465e086f8cd1c1fb6c6fafa60dcd8a6eb9a615b963022f23226d63ce38a4f6c4d3ac2bf5ddaad1c9344a14c7816ce98e5caa5
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+x:zyZ/K0ttYZToyZ/K0ttYZTH
TLSH
T181E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 14.1MB
SHA256 bddf2180ee3663cbab6cd3e4afd5a0d30b08ba3472e29f879be8426dbc2fd353
MD5 f0863c2ae09141fac98c06fb5dabbdbe
SHA1 9d41cadcb07b0460dfe6ec0de09cee3619d642a8
SHA512 21b77ed7fc4722c12bc92ca29e264049f2714fed944711f3433565851544689869548e601f26fe068d80ba4ecbb5f8e80a9d7d476ed1c8285d975d786dfa8536
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+Lj:zyZ/K0ttYZToyZ/K0ttYZTdj
TLSH
T1B5E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 14.1MB
SHA256 b92cc31217132d17c225be85ef7052b4c09861cf9d04bb2120fa39f62ea1961d
MD5 0dba04e241b8ef1255e7a6b38dc0c962
SHA1 c648d3fec82f626e61449d67e6d87e4551c1ac26
SHA512 1e8417940a41da461db5707d6730abdf3442d3ae4fd89158e503964e73ebb2cda66f59bc5aa2c2aa0e1e6b3835995e4054b4a3f04e539bd7885a518df2521d4d
SSDEEP 196608:JSWyZ/K0ttYVAATUL/h1+sSWyZ/K0ttYVAATUL/h1+hD:zyZ/K0ttYZToyZ/K0ttYZT/D
TLSH
T183E67D13F5B841A5E0B6D174CAA69731EB327C464BB195DF2240B3D82E37AD0BB39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1556-67-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3292-40-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3292-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4648-235-0x0000023C801E0000-0x0000023C802E0000-memory.dmp

Download

memory/4648-304-0x0000023C822E0000-0x0000023C82300000-memory.dmp

Download

memory/4648-284-0x0000023C81B00000-0x0000023C81B20000-memory.dmp

Download

memory/4648-283-0x0000023C81F90000-0x0000023C82090000-memory.dmp

Download

memory/4648-282-0x0000023C81930000-0x0000023C81950000-memory.dmp

Download