7e05bdf3873cba78bbdfe7b2ed11a7245d9a415a1a973e9cde87b1ef2fc565e5

Analysis

max time kernel
53s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Size 13.1MB
Sample260709-ea8kasct6l
SHA256 7e05bdf3873cba78bbdfe7b2ed11a7245d9a415a1a973e9cde87b1ef2fc565e5
MD5 92e29596f60de7da9de3c735e83acc8a
SHA1 a85fe4559baed45833bfd5595cc6c1ba68eea073
SHA512 fd9186ae90fbdfa6ee5cd21c4dc82e8c865812d1d356efa718332e7a56c5c75a148e35fa2f56f4fa3b9b870ed13b4ad1530bdc075cef1c76db5320ac520e03cc
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eoNWyZ/K0ttYVAAT:zyZ/K0ttYZTEq0YyZ/K0ttYZT
TLSH
T17CD66B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Mail\wab.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{043573BF-0323-477D-8D0E-281F10488C51}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{3B714D65-CEA7-4284-924C-08DF8331ADB6}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4784	explorer.exe
Token: SeCreatePagefilePrivilege	4784	explorer.exe
Token: SeShutdownPrivilege	4784	explorer.exe
Token: SeCreatePagefilePrivilege	4784	explorer.exe
Token: SeShutdownPrivilege	4784	explorer.exe
Token: SeCreatePagefilePrivilege	4784	explorer.exe
Token: SeShutdownPrivilege	4784	explorer.exe
Token: SeCreatePagefilePrivilege	4784	explorer.exe
Token: SeShutdownPrivilege	4784	explorer.exe
Token: SeCreatePagefilePrivilege	4784	explorer.exe
Token: SeShutdownPrivilege	4784	explorer.exe
Token: SeCreatePagefilePrivilege	4784	explorer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5400	sihost.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4784	explorer.exe
4784	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
4736	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
6092	2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 4784	5400	sihost.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4736

C:\Users\Admin\AppData\Local\Temp\2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-09_92e29596f60de7da9de3c735e83acc8a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6092

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4784

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1368

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 13.1MB
SHA256 d164a83392d97e10d52e827f30413f0d9bbd5164185ae6f405be2363a329ee9f
MD5 64e17de86949563c0a290456b8cdf2d5
SHA1 5cd535fc5f86e44a5873e864a32fb246c3d809d0
SHA512 f024ecd1e4c7e5bdd5abc1b47928db6d723c7a4bcd3925994f81047ea87d589642300f736f914883f6c9269c8cb12c812c128170679eb8b4d01dd2504f886657
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eoNWyZ/K0ttYVAAT:zyZ/K0ttYZTEq0YyZ/K0ttYZT
TLSH
T111D66B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 13.4MB
SHA256 f0bd44de3dab13a5503dab762b067ff12ecb5f0c2264a69dd97663cff8f41aaf
MD5 a9f2cfaa0408c1cd36575bed5e620fff
SHA1 b5d25dd6686078a138cb27cbc6e9c00f2c0541d8
SHA512 1c4423faada4703a383094ef113c99e003c17871b900b70044e131cd26fbb744c0181ce53934f4825436f0cc8c3312014e29d47e1968b38ce92cb7a0ef457901
SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0eoNWyZ/K0ttYVAATY:zyZ/K0ttYZTEq0YyZ/K0ttYZTY
TLSH
T1A5E66B03F2A941E9E06AD178CF668231DB327C594BF1A5EF225076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 26.3MB
SHA256 1fe6efa92a669f309a479443a983864f3585ccd93a4447976c8d72cf8e5b85e1
MD5 e4f148af7f4c2c98efa957b7db81c303
SHA1 1d9846f7a70da91a05aa34ab920ba26ab1d76f23
SHA512 a7e690dc06aeec338f04c316ad66af1fb3717a1450bb980b3f10b9c53ebd8a0e5cd3a4bb5adae7dc8e29a6001f64357087f158d16a951fd965970d34864116d9
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTh:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREI
TLSH
T16D576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 30.3MB
SHA256 8e73a3e1ba18e4ea78a17eb3645bc884350e9a8e29afd5c3579a7a9672b8c257
MD5 11b956eec2643ac07d1f443b1f5a72a2
SHA1 b50db51c04ae65a63f14425065ebf56ea2e4e561
SHA512 f7edbb3cfc9e47933e71d4f8e2faee5ad37f702ac54160b17325fa00a5dfeeffbf4ba05290a46ff6247ae513f7b823acd1143ffdb39037217613316427c7f2a8
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT3A:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRER
TLSH
T1F7676C03F6A840E9E06AD174CE668631EB727C594BF1A5DF2240B6D52F33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 26.6MB
SHA256 ecbb5de40bdf172b5ec417ff1e1d7329e8578339e07e9c78efa1bf8c20bf4071
MD5 77076f246284b5cc349f18a2758b8b2e
SHA1 1d327653f94f0451d4606c24ae9ba885dbe82cbd
SHA512 70412076777b80c23384007de4a77f6b79f3eb7a77019f000ef8f014542cb8c9e173c2fc2ab9ec7d653004fcfc4c41070dbcf5cb808eada36aa9cd26307697f0
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT1:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREk
TLSH
T1E6576B03F2A541E9E0AAD178CE668631DB327C594BF1A5EF324076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 28.4MB
SHA256 de2565d46e819d352e9f063438e0bb279acd05602cc19d548c51f5ecc5e71f65
MD5 f08109c764b167cf7d32f608c8fe82fd
SHA1 1c88df0d3da5996864b2a5a2aee0a8d797af65cf
SHA512 ee7bf5e4dfc045e3f291a5397060356dea854253adb5c2b4dede82a6afaaf967e3a7c011024e51bf1d546e476560a4c23a7377b058ad26c67507f3999f7f59d3
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTX:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREk
TLSH
T11B576C03F2A441E9E0AAD174CF668631EB327C594BF1A5EF225076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 32.3MB
SHA256 0ca43d230fe9abfa6ad243c2115736cb7537ce688f77d5248a91117f7bbbdb6b
MD5 b06081592876be3c58332f78687d30c1
SHA1 835612dbe95d653939571b8b3e587abc1b170c14
SHA512 092b8964bd672eeea841c63817bb0e1a4d18e5c63c6a762b7f36aeeecb1512ca88524e7034aeb396b3984b26b7015f84d8987b7fd6e1653a848afd5900a300d0
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT5Fz:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREC
TLSH
T1F4776C03F2A541E9E06AD174CF269631DB327C4A4BF1A5EF229076D52E73AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 27.9MB
SHA256 68247935f3621addf1c232ac8f4482b888286f4a0ca7411b89b6e1cd15e12196
MD5 3bd6f0ebf4c5f4446b3e768adb2f8e8c
SHA1 d4ead7d81064800bf0ed3c3fff9ac349749d5cf7
SHA512 cfee6a1605370d76e6d2f21264be86310bf42882b6fe08437d925162ca0d617f6f445edf520ed2ab84d2624056663c8df04d0e07fdc90fc539f8698285bfcbb6
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTR/:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREA
TLSH
T1A2576B13F2A501E9E0AAD174CF668231EB727C594BF1A5EF224076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 29.7MB
SHA256 1c326a848ea7d3c89d3ebc934ae0557f4d95612c7d7d33f8166907b7ee0b7179
MD5 507a604d348a0ce7168cc6991128e090
SHA1 4c2f9540a665d0adab673a743658376a5fc408fe
SHA512 6d7f8e057af98276f275793647e8a8ca0e6524129cfbd678ca339ed22292fd555d77bdc75cfb491cd6d2f3252c8e3e98a04f4c0daf18d0d2a6a30d981ee740da
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT06:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREI
TLSH
T1A0677C03F2A941E9E05AD178CF668231EB327C5A4BF1A5DF224076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 28.5MB
SHA256 4e9f9a349ca5b1621ca90942597712f4fafc205fa4b4169870d819ebffb9d8ea
MD5 f2247e16f2444d6cd82626d6d2c72fa2
SHA1 23d087193bd8abf4f32a0ba3807b173948d6c397
SHA512 f9af78349144371d7d63d8fcba3da8b830a11681ff69daae199c01ebe01a3eba59c92c568626381c4596473fe0df8642365ead1920f54055fd36e2942d5b13e2
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTH0G:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREE
TLSH
T194677C03F2A541E9E06AD178CF668231EB327C594BF1A5EF224076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 27.9MB
SHA256 217fda1d2d322983fb1df8aff05e7f9b62d630f41acd0a78dd866027bf532f2c
MD5 57dc678f77d286fbcd574f5784389094
SHA1 d61a10116cb31821ab1b6ba07798b879899161c7
SHA512 ac250c17868b24d6554870af1bbb844c75f032c4309f4d04e96aa948d72ec1a70741284794b8accff294b8a7d924b0fc896239df99b82aade789e09094b1b2bf
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTyf:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREr
TLSH
T1AF576C03F2A941E9E06AD174CF668231EB327C594BF1A5EF224076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 28.1MB
SHA256 dbe362d9e35fd37d01e860ed6db8658a7113afa952926b15d930e95e095aea3e
MD5 7fe448fbc6c588a81c0091c22277aa00
SHA1 2e6dffc7db0720854c252baea1448a9c06edcce2
SHA512 6a06a22de6d9470a00cc6727581a8cd9bfcc6f83f90dc355db1b473bb4536a1b6a3b964364afeefd1e615e153d715c182f73375a02ed59765481b60c066c696d
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZToCg:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREX
TLSH
T17D576C03F2A941E9E0AAD174CF668231DB327C594BF1A5EF224076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 29.3MB
SHA256 b53ccb3dba3d490e7170e3f4ae8ca0d623e7e59c1e7408db471865a53466e161
MD5 717bf27465aa46ae41b65b8cc5331c4f
SHA1 23cc6765431edd1daa6187c11e1745f64de92353
SHA512 e086d85b0e8ff42266ad81ae6d874f8f3fbb6f493aad0cea1b696a54ae2bd92bb5116f97c4ac2f8caae34376d731a2561ecd1ed6190c3493108df0989a9bd27c
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTsO:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREW
TLSH
T13E677C03F2A941E9E06AD174CF668231EB327C594BF1A5EF224076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 27.6MB
SHA256 5b28c3f66be6e0b846b18b29edf6c4449bfde3526062a266ee99e6c312eb8ff4
MD5 21f0e0fcc40b7785299db98a321d721d
SHA1 5e52028f24b039fe1fa6002b75f0d3705ef8db35
SHA512 3bedd58d90088953b9398a67b14584b335874f89842836637f05b1aeebfa149a15f1abb19c2014f2759916f7f7cff561cc26e971dba055807a71e89b86157c48
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTa0:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREc
TLSH
T183576C03F2A941E9E06AD174CF668231EB327C594BF1A5EF224076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 26.3MB
SHA256 ca5968fc6efc34573f5c85a23721112945c0338e6869577eaa1b0ef7e11d20aa
MD5 4181187c4ebab2aff5eba01eaf78f85b
SHA1 743ad4db7073327a26e61fa68080e3973fe7c829
SHA512 fb875368c24d996b91cb85ddb77a986b31686c80a798acc66371c04ad6470eebe549d1e3f6b8a2708d8fdd58d77ef74ead4a43ab5bfc35b36f32540c9d77e195
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTN:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREo
TLSH
T139576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 26.3MB
SHA256 0bbb2ea7e72e18f7e0b6e71202614b3acf3c026e71652b0618b4dda96bd6c029
MD5 00ed6c795fc8580513864c87a0fb9304
SHA1 fda4fd01090a32f38d7f1dba12592c07f6a3474c
SHA512 01f00c691b1cae14f17eb39469a8c0cccf357ffc8ea83c23487c3f4619850b9f878ec0c06762c19df5336ee56e97231c718f3779bc7503d3d6c20ff990b96c6d
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTZ:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREg
TLSH
T17F576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 26.3MB
SHA256 024f23e9dfa70ec56144583f1b9b0d0023a14cf88bd0f97a158dec153d6d9e88
MD5 5aeecb04d4eff4cd0a878045aa3bab1e
SHA1 a25f6ec47509cfd8ca350e894941cf00c808636e
SHA512 f138c20e7c957d7947d738784ca04ed29467d816f76f5033986fb1090e5f04530f17d3d23da02af466d08e7d631f9d3a136ad358bdefd49965cec48385f9f742
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTC:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRET
TLSH
T169576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 26.3MB
SHA256 0c645ab1f33ece901002ae03f455bdc494cfad89fb69138aa21910cf749ffc0d
MD5 feb79b26918f8dd5b080cbb70d55e748
SHA1 530788b2f05cfb53b9a5f65de11e142b15313c52
SHA512 4e83eeeaf19b9727d91ad6d8ca4228cd0719ae4772cd8ff084f2d802edc8ee34c19e42ec1240067f70c599b77fbc706df0d5f2cec8d8236619f586729a491aaa
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT/:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREK
TLSH
T1AB576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 26.3MB
SHA256 9331d3bd91eecbdb96ce9416bf44606a75497a4bec12739575c5345e56f4f496
MD5 fa9e750ea7da50951a79af2e057e8b78
SHA1 0623e4c8f2a999aa18e215ab97209d6693ba640c
SHA512 e1b336856923ab8cd47b239857fd9339557165c2bfd37999c1bba6279ea2e6bcc1243b50635e32e20e0896ef5eb3f2642629656f642ff49bcaae55295402bb53
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT6:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREH
TLSH
T13D576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 26.3MB
SHA256 9148f9b1465ad78d73cc44e9c4066fe3cbbf50fe2f629287e5d734693e374cdd
MD5 97089dd95b1711e7da1e13eab55b46dc
SHA1 2c86b39b3dfcba384365853bb27b4fd2117c09d7
SHA512 5fa57fe9319087c85314f3865f92dcf07d3f65d1f74d4fe8371084e934aa34c557f1bbe690fb0b6ea52779f12e8bc8d6340b8a1b9ea372a54350d7ce4eeeac77
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTV:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREA
TLSH
T1BA576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 26.3MB
SHA256 f8687e3a573ec5fccc0a1540f413eea990c53119f6ccf66ab52990dfa011616a
MD5 48e026d3de2ad76066be1fd5d7137b47
SHA1 a7d32f5b499a2d9ae4ee32b501e8a2c1d8f4bcd5
SHA512 546dd3eb98b89b7d193103826a6d60f36e35f0c3648dc4c89d9d7966de855f1d6c738bf0502d5fb9aeb0ffb9e77e9198074e2574d9bd602cdd0e7a3913a206d7
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTi:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRE7
TLSH
T1B9576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 26.5MB
SHA256 4127b73f0e2021ab6e01b5474f8f448c4bdd958891bb39ca3f3a5a30e940a1be
MD5 826ddcbb3258c0b60b7d1de00a8232ee
SHA1 6021fe881ce655392872d738a71b0799654ff804
SHA512 eaaf90e341b30e93c9fba360aa77affc435ebd6544466da6a682f0d7c27236f43a6efa8c31fdd71ce9c8ed83143bd4041f3f59beeba08a5e4a0e538ab6ab851b
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT9m:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREt
TLSH
T145576B03F2A541E9E0AAD178CE668631DB327C594BF1A5EF324076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 26.3MB
SHA256 6aa5cc85056493f6f393b9d81d01564c12664af56eeea10ad27c079c8874242d
MD5 d829a0fbda2eadd6ac2fb090a2cd6197
SHA1 47b810553a97a8cefdc1d6903ee3b27063c24795
SHA512 c6185d0cf37f4662b751eed6b3573a4556b29eaabde9d9c0460436a3d75dad1c57ec5c19373617569fe38a6b1e170bfa7426adb998f9859baa4cf4e00df13912
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTL:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREm
TLSH
T1F2576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 26.3MB
SHA256 cc8fd5d175f41429e76a7fe95c51db4fd647fcce71edddc130d2c630edcafc0f
MD5 2497cc74a86efb69fae2ac936064811b
SHA1 9026f2f1ef491c05519ff5ca873e253b96567584
SHA512 faaf508fd641b99a3a048ed8d22fc6ca30c5b07ddd0a62cf1b55c95b5dc76533ab40162b31b3644fe9ccb6f92dd1bce48e28720563578ec8fff18b8f504b2c5a
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTP:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREa
TLSH
T1B4576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 26.4MB
SHA256 361841bf1caf65743e415f4d8f8796232deb8f54bf8353e9c75583b94036b97d
MD5 05b3e52e4b9c9bca2bb5017bdaf19507
SHA1 fcfd9b9db7c19ad3cc0cdf877b091afead250022
SHA512 e555e266d5a8c2fd11431a5cb3e622014649775a97e15649a95ca8156cd3b78fd65c93104fa18efacc3cdd14ed1687fb0d72723ae2a7118c2d2c00ab7b22b322
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT3:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREW
TLSH
T141576B03F2A541E9E0AAD178CE668631DB327C594BF1A5EF324076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 26.3MB
SHA256 1364e6b22414102ccce8992698d708b4c7442af06f7c567166a1a6f0e4504e7b
MD5 f3234a582653d62a0c07220520c6f6a0
SHA1 2a949f9862373b7e86b8381ffe46c83177216ec8
SHA512 4d57b21e69cfc4b5aebc9934aa1899819bc1d8b42a80bd77830f3f0ea8cce4610da6dd7bcb8bfef44771216870acb1312f048e198f30d09908cc5df049267838
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTG:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREj
TLSH
T15C576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 26.3MB
SHA256 0c905f8a6f93d0920484b1d3a19bd1468133afeada39d630a9d38936482804db
MD5 88b0e6cf5c667c3bab2e7ae1b007de00
SHA1 645d826f67fc8f80c6d545d52465107a69f29f0b
SHA512 fb9f68504c354452551efcc5434d301f8b0bd60d2826ad35bc589f6ff08474c177d2996daa13ead19cc461570ca692185d93e66e4ac55544ad4de8d1c9f3c3d2
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTQ:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRE1
TLSH
T1B9576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 26.4MB
SHA256 b965ea3ba57bb54ec8cedef16b219f86cecc69a61df993cac912d9b86a4305e8
MD5 735a3d275babe7196cd6debea1c6e70c
SHA1 745028380faf787f354aaa5927b6a3d2df0c50bc
SHA512 49ebdb0fb15d09a66ced1b54480ac13570acc5a0dff5be1743b771bb16cc89f34268b8cb15bac3a69cf44e2b8968ed3a5fb5ff01fae8495d63b8efb81602d95b
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTn:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREG
TLSH
T1CC576B03F2A541E9E0AAD178CE668631DB327C594BF1A5EF324076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 26.5MB
SHA256 421adbc81bb143e856e342573dc1809a86b94590f407acef55b30b7cc1335f73
MD5 387d95e31ad953e511656760c094a2af
SHA1 9ece864e4aeee07e12c61b3f0885c9f27a5b555d
SHA512 9977006eaa4b27ef745f73960e7752e042a727c8365cf31a8ed9fe65dd209cec6594b73dffb7ac3d00233f937a44b58b44c70e3029f7507086edc09fe7280efb
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTj7:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRE6
TLSH
T1D1576B03F2A541E9E0AAD178CE668631DB327C594BF1A5EF324076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 26.7MB
SHA256 49dcbadc719d6c999c4723972ce607bb86a6fa5ed7658c4a323e2977dfe30119
MD5 06d368fd6e640d299214414b1a69566b
SHA1 65a08ca31e61bc662ccc8d8a1531841f1a39e17b
SHA512 6b2a8e348c988897e5b06e12607c727fae4ac438e7286a43b3d75299df4dfa48653ec416220bb933f4277f52475934b8e107618611a6c0e6dd4d15c265302695
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTUd:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREh
TLSH
T118576B03F2A541E9E0AAD178CE668631DB327C594BF1A5EF324076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 26.3MB
SHA256 de4df28053b84c26847fdb605b25aa8e3ec6a08a5e2f79d0fcbf927626154a68
MD5 2fc0967ee62b8aafcb6cc19f442ec948
SHA1 9edf17ee3c2792e2bccae252a86a9e6cffb33451
SHA512 79c3c51e014d4d304f1e9155b5f9d5e76b545b89e4c04f5c063132ffaf21720a73ee2a550aa5fdbb0679ded12957de1e98ea4d9b5d439f55bd1069fb32b347dc
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTl:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREA
TLSH
T1C9576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 26.3MB
SHA256 de51564b6332a148a8aefc687de5cf284ed6593283c7eaf6298414d83e762a43
MD5 7b8864911bac654071f2489f3ecc5114
SHA1 7b1606f3141200dd6ee252499f576e4fb1f3c39a
SHA512 430f51226ec4b4a0739972e0e832289232bd9b502077fb588d568621df0ebd27cf18f08c5d59a4973e54b92759fda59c4e8888bdeaec13f250e0491c31d30afb
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTg:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREx
TLSH
T15A576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 26.3MB
SHA256 8d6f7319158999496fe1646662517a9eb9c96b8cfe7ff20fb6136780e2c45ce1
MD5 2367e4d9e4c3efdb9d1f8b035d995f7c
SHA1 b4640c9fd2da78a16dc4596ee984bf574adbe6aa
SHA512 9393bfe8cab6a36cc18b1909dc8449869ae9b948afa9418be8208a2f9a96bf2174bc8240032e875a52ca2499f7f59a4a9fb3fc3eb8f3ac9cf1b6876de7ed82a2
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT2:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREP
TLSH
T194576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 26.3MB
SHA256 967adf341ff504a0c6fa8169c95ed249bbc84b7721c2a3ef3ed0178d502dc837
MD5 1931f53fe0c5907a5c47499ffaa822bd
SHA1 3300e24a2dd14e9124ead16980e68785765ab11d
SHA512 417c53d0a6d3a514dbba40c44b0ff04d3d3178a223fa800501b1e697b65a6bc006c588c4229a526db49e540df769401ac7056e8883797523ceb2c129eadf0a30
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT5:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREE
TLSH
T1DC576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 26.3MB
SHA256 766b520eededecec32569c9c646845b73e11bb85a760e3628788290c5ccf5757
MD5 5b71a30ba0e26dd53b436cff12836124
SHA1 04ebd06222cace4971bc15ea49c6d067f8d3573e
SHA512 6e078fa2deeb089070fd0fe4767ff471ee169f1ae4d9cdface1cf2fccf66a0eda909f7c1598e0e1c05eff30b3c2bf73c76f6aa5c95a958a3fb5dcb16f90e3bf0
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTr:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREy
TLSH
T173576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 26.3MB
SHA256 633b227cad8fdfbf8ce523294e0064c58bb4cc9211098971a8a49c20fdac5c75
MD5 bbe7f28c49e05fd72a5ab3730ae79ce2
SHA1 e678948c934f1b417f47ccbc442299c5168ddea4
SHA512 bb6c66f5f1f47f8fcef06f7b80253eb16372404af55a1d89984612ce4e45fa993fa0448b1b95efe6dadc1ec18a2fd49f7551a27f52e055800099f2593e2ea94e
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTH:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREG
TLSH
T1A8576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 26.3MB
SHA256 4aaf37512db07243ac71b9da1ea0d753e75050e1b0fdfc13970db6da274c8991
MD5 05659636d85f9045d774a9b28869d278
SHA1 1cabb421d20042ef694424a2d858e5053fa0f969
SHA512 a2a36fb1dd876c32e9f08bc36c851311363d301c94ea60347bcaa7573026c629b446bde5658c1c80d1569c4d49ae9e13ba24d179083e15a28d8441183015e2a9
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTi:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREz
TLSH
T109576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 26.3MB
SHA256 7912423db070f1a7818b4e38fb01f6fbfe976639b9b8f84b325fb5254cafd0e0
MD5 1da394c415110f53fe561aa8de199afa
SHA1 fe874809eef4851b266371d2f23f373269bc9f79
SHA512 a0ca0de116d9c5e01fd0cb5af7ae5c07a7506475db94ca94e4840e32ed80e78d20cb9768145728b080e644e828747e8142a85c35eedcd44ae0cf5e4ab5282fc2
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTS:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRE/
TLSH
T1CF576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 26.3MB
SHA256 aca25f3868dda258275fff79777b089488557f1c29160f386a2f70002a49ecaf
MD5 db4d84528d716cfc191b4347047d4059
SHA1 c9d2292805b5b7c3e7c058c35cc6ccb2da96248e
SHA512 a4636d5d086babce4bb1505928c8a0e508d107782eb8c418e57fb2483a710196c53bf4d8c11a07e8f560721c01317f635f4938b99a32251d456fd78aedae3ddd
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTd:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREQ
TLSH
T1BB576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 26.3MB
SHA256 48f6e84d5e18d9713094e2447eac3be1b30cb0fcdb663445483165948d4a07bf
MD5 635e32ee9c91828c8cd339137334db2c
SHA1 27bcebfc44bb97363f584a9c4a3d52d5513d0291
SHA512 2a254580c52fa74c2285405119a8ea6baa20aa62b92224a2d487c20db0c6c282910844303f1b149699f222391e3c1bafb29ee582457f37482cb0245c954fd9f4
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTs:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREJ
TLSH
T10B576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 26.3MB
SHA256 807c4a2aca5f18eaeb79d1d8da8f5681515b157770c9fdea1b7eedb48e4665e9
MD5 4bc403fec67368520831658bd311c2eb
SHA1 f3260e262cc903afe0a5fbb068b78f746bd377dd
SHA512 d3002b935a62d69a8f4a9dddc13bfc0abde3dbed132ce5cf51e11a28516a3bdadf5e5420c7d1a65eb9250c572b72f002dd45a28014bd0e4c1c7508b11cb6bc12
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTs:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREZ
TLSH
T12B576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 26.3MB
SHA256 e470c9318b9274a854f5ff8d233e7dc5f03a2a7399c56aa12a9aa4a616aa0a2a
MD5 76cf6d0fba0adbabc176e1fcc6e9445a
SHA1 884fc8e6a699157cc37396172392119dcc200a0e
SHA512 1065e1362d72303620d6c2c0c6132ac0ad3490308af05aa9a82d6de0937270895445c8e4e520e29ab9667c0dc89c5d59691e1c8d65bbcaac8ce64abd2ec7d34b
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTc:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREx
TLSH
T179576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 26.3MB
SHA256 403fb055694fc51ce1815f45f3d9364e85d76160d4a8db44cc89b973248acb79
MD5 a433ab5be677ca710a7f0671e208e61d
SHA1 497e45a0955399db676b810b07acec93ed4a43b0
SHA512 8eece88ad9e5bfd1251e638d7ab7996e8fd52c7019286bad248ffe19e66958188b8916889be6c7744b88cf9ad99fc547a5ad6900a69fb33e3658ec1aa17b7b1e
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTl:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREY
TLSH
T1BF576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 26.3MB
SHA256 91ff2e381e950d5168f599a9f16bedf6710bf6b1394a7cdac76e4190fc2c805a
MD5 6879c6dd599b4f4542875c97ad61175e
SHA1 17d310ca4e3236d6bfc45fe117e825933657a5a2
SHA512 7ade63e18f8c4d6dcd3a29710c877ea760767058205060d474827f4a2e86954bcd6eb083352c8dbb7ad6bc000bb763d2b0c34189518339551b1430a8a5f3b962
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTY:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRER
TLSH
T1DE576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 26.3MB
SHA256 ceb96ba71bfd4fcbb1a6543fcdd90c750cfa7eabe93671c507fc4b7887836676
MD5 378b9b710bed30ba9957e78e6c189c2b
SHA1 6fc8a1e1d527b2b57db68d5a62e6fb6e3beacf7e
SHA512 7ac12d011b559f38e8c190b651046ddc2ed6d9b7d530660380b888d5c476cfc1a47fcbf8cc6094d76746941f321c35e9adb0eca7f1124ccb69bce129c66b0099
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT9:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREw
TLSH
T146576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 26.3MB
SHA256 b74268f41d80b50111df0c469bf6c5539e1158aa98ce7dd72455c8b9aad329d1
MD5 a4a0bdc039304865ec0e912413832686
SHA1 3d1059f478f13afaf5ddbd32b86345858832633e
SHA512 2b2f185b63f10b5d41263c87413acac0465fd5d09cf812eedd135efe3c9d533d2122d10e62804912844499be32c2ac1c128f53bc989430bb05a601e4537a8b5d
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT/:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRE6
TLSH
T1AD576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 26.3MB
SHA256 d3d71a50a984afb1b2e02555bbe039136689a16ee2fc18f08a05fba880ed268c
MD5 296f662ebec05eb3db949568620169ca
SHA1 0e24c0f9989ecdd3c49c2bf2f2eb4df8b771bb4b
SHA512 5aacf6eaa7ab476ee7c9ed3d2e66fc9bead26954126a9f9100d7256f68caa65beedbdb6bd1f4adaabd1de19df7e679d671119df377f4e71064429a094a894529
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT5:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREc
TLSH
T195576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 26.3MB
SHA256 313e36d90740561ab096bddb23089d12f7b8a7d59b733d97896a4d68cd7730b8
MD5 a35d2331613d2708bc947eb8fae8fb3b
SHA1 07a071676383cb4130581d68705bb264325d7f51
SHA512 9027875ee75f78525ac11067d437c082ba5a0f2b631f3cedee2e393cc678e5e430eaa87105b4b60075f018ec1d16c815cbcf8e5283ad3969209b2ac671d1504a
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTX:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREK
TLSH
T17B576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 26.3MB
SHA256 40af85f2d983ef5726c90a4e2d4cb516fa8e4c94a0c4c35d7692f246348ca4a5
MD5 b86731a592d2ac95ab081d8779e06823
SHA1 f8ef196ca12f71f144b7f7d2888c4fc10a7083ba
SHA512 4e76798be8d6ec000820fa9903f417a64be1e332446e2817fbed8432d87ade0d242e23cefd24cc8e7967128b6cac19971f2dba6698dcbf8096bb1eb16e9f8e0c
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTY:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREJ
TLSH
T125576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 26.3MB
SHA256 f32c660317c83eb93b545240830ecd691213024f049598e518291a79ccb97a70
MD5 6904cbe9215411c97776f946c8f2fa4e
SHA1 bb951965224fd37c99d27195b802f989bc54ad36
SHA512 efc346ecc1abac5db6f71d4669b7616d03ba195ca3c6880332661edb6b86b32f6e8ddc8c8180985df185c38c1a03aa6a519ad968650cdaeb3fbf4823af0463c6
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTB:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREQ
TLSH
T1F2576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 26.3MB
SHA256 f9e477837e6d5692c5a610770e41dd816a5a985cefeaf09af11782d4e17a4609
MD5 a280928aae808dadc0dc66fc2bd8c7cb
SHA1 f8cb1d8911c7bd47acc7b9b4f8ab56eca1fee352
SHA512 ba20113c36eba21c8e7aab2ede73705f3b92347aff0c16f4ce78e1631c25b30f08b66930dc1862f750b04af2d8d3c71a07d9ed96b245963669cf786436bfbd8c
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTm:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREL
TLSH
T1EE576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 26.3MB
SHA256 82fbc571a014f9998386d9c07e1ff8bb1afbe349a97ee373f578da19372a3758
MD5 a8dc99b8f25db6e33067bc1a18873023
SHA1 5441a7d47ea2601a361634de01df20d9e3127d2b
SHA512 6441cafc2a076e0a825dc9af83f54c228fad763aed9ead101d3a3de978bfc3b34ac1a75b580a9ade141f9cbe16c09572dcf9b4bf302df407372fb3280d37139e
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT3:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRE+
TLSH
T141576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 26.3MB
SHA256 2f2e9e1bff9453a3f2a44392b3a9fdc75393ac8ba0981ed22a232a043ab904a2
MD5 e556b8aa68e09d5e35715606ec0a33af
SHA1 e392ecf6419e94eba77b5d947d396c3fd8393f37
SHA512 93220c7b055bd68b0a5b30a1c7128b867e8afc8ac42251561bd25be38a9602cf686b8640b2231ee58656938aa469e5e5fa787b1301a645e8763231a7d23b5673
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT5:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREw
TLSH
T18B576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 26.3MB
SHA256 fd782e403d9f756a662054c7dba0f5fb8a95954721832188d4f9f5a0968cb46e
MD5 edce94844e5be1bb6214518f1093a50b
SHA1 e7f3d3492b2e88b1d274e530fc580ac391045aab
SHA512 bf67f612f446cf1f2532ac340911b0a8f63bede22904e8237e755d15fefd02d4b7d12fed59d7a5ef0e28fba230bec4848f7097f30352310e9456e7d905bbdef8
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTN:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREI
TLSH
T179576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 26.3MB
SHA256 c4e8e5866e6cb492d82aca27927a04d81f62c0e66dd72d2364b96b9a87702c77
MD5 1f0eb734b057732489347971af92f7f5
SHA1 319f4651f149dc6d186a95fa855920368500581e
SHA512 3343c85e11acfa87db83047705bb27a60f599b162bf809d6a22ffe5d9a132d0bdb762524749073c7c8b6cd4feebb920b3293b58d4a617199ac3a2a7d01c57000
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTE:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRE5
TLSH
T1DD576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 26.3MB
SHA256 2866142c231f9d4a09af481e5d8030e6e4fbc815c90f633acd5413b3b735dedd
MD5 b2256a88231b625c57eb1622e1e2eb59
SHA1 6f193240dc6d8df7b2ea82edf478a89ffb4f3e23
SHA512 b8f559352e606dc2d737d2d04dcbb799c75c0a12dd183992c454e4324a9483b6d9210cc790aaceac7a61afef9ee6271b5b3cb711e49b0185094133d5c05648a4
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT2:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREn
TLSH
T184576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 26.3MB
SHA256 92be9b3da504f72a643ade2e17d79c7068b40871654ba22f703ccedf58792720
MD5 f53918333dc489aa0acc8a5ef1c35b05
SHA1 1ae814fcf24c0d51fd56747e06087eccc286c5e4
SHA512 39e98705dc1b09909303475e016a8b236f9a0f5f40d05e606f0e2f6b894fc1b0dae33487fad95258bb90694b03a50f54c12b026a79fa17a1e42085546d3eacb4
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZTj:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYRES
TLSH
T106576B03F2A541E9E0AAD178CE668231DB327C594BF1A5EF324076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 26.4MB
SHA256 64a3dab2e170492d9932f53345b32ea8df70f8a223e1773373d65ece15103e86
MD5 c8eacca0dc94814bb97d77de21b9fc7b
SHA1 72ed7d5430bab117e9ce632af7268301de3bc1c1
SHA512 368b070465f6b5b347a357a5ff8859196c188d1224d780870926941b5ec4d5c3c55936a5b11e48b2266f57f6a1fa252763a795346a6a37b12d2dca8b6297788e
SSDEEP 786432:zyZ/K0ttYZTEq0YyZ/K0ttYZTayZ/K0ttYZTEq0YyZ/K0ttYZT5:uZ/K0ttYREq0zZ/K0ttYRRZ/K0ttYREU
TLSH
T12F575B03F2A541E9E0AAD174CF668631EB327C594BF1A5EF224076D52E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1368-462-0x0000027B80180000-0x0000027B80280000-memory.dmp

Download

memory/1368-472-0x0000027B83CA0000-0x0000027B83CC0000-memory.dmp

Download

memory/1368-497-0x0000027B83D60000-0x0000027B83D80000-memory.dmp

Download

memory/1368-511-0x0000027B95300000-0x0000027B95320000-memory.dmp

Download

memory/1368-473-0x0000027B83E60000-0x0000027B83F60000-memory.dmp

Download

memory/4736-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4736-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/4784-600-0x000000000E820000-0x000000000E9EA000-memory.dmp

Download

memory/6092-5-0x0000000000400000-0x00000000004E4000-memory.dmp

Download