8129bc9e5a815d651510e7c131cc54354b3e9c4c4ff9415a34db0bc799ad8453

Analysis

max time kernel
118s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Size 3.2MB
Sample260709-kkn7asft5q
SHA256 8129bc9e5a815d651510e7c131cc54354b3e9c4c4ff9415a34db0bc799ad8453
MD5 4ce0ff891c71a6fbf9282251099238ae
SHA1 7fea763113230d1df996371c4626fb9cd1fae578
SHA512 ee3f89d386beb5f8d750a3a683cf76b69d56f5ac62682817a95f0cc7c294fa2130753efcf9f1b5f4d5dd44061f732f64bcf3bcebd51973f88ceba802cfa715e2
SSDEEP 49152:tYRw5x6M1HVO88hXl+JgjI45TMwwapIgT0QUOBh:Su5x6M1c/h1+HLapIDQUO7
TLSH
T166F53A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\WallpaperStyle = "2"	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Control Panel\Desktop\TileWallpaper = "2"	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{84934B6D-B49F-4441-B58E-AF3F94CC55ED}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{2510A5A1-CFA4-4A19-8234-21A67150A2A5}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe
Token: SeShutdownPrivilege	2612	explorer.exe
Token: SeCreatePagefilePrivilege	2612	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4828	sihost.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe
2612	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
5404	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1292	2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
2980	StartMenuExperienceHost.exe
5844	SearchHost.exe
2612	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2612	4828	sihost.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5404

C:\Users\Admin\AppData\Local\Temp\2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
C:\Users\Admin\AppData\Local\Temp/2026-07-09_4ce0ff891c71a6fbf9282251099238ae_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1292

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2612

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5844

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 3.7MB
SHA256 6f51c4430799368cefe83ed125f252649d9993b623b9221dad3b4871f8c13765
MD5 4b5213f7919c08efe55a4c368b9274dc
SHA1 14038a48583a5b5e3859e27ec00bcc3300526929
SHA512 2c7a2bd07991259208b2c097e211d231c41008a5e64c21bbf117ac35f968bdc58b26293b32348794dfe42184de28414d3fab72e93c7dee8a21786472ad3e5ebb
SSDEEP 49152:tYRw5x6M1HVO88hXl+JgjI45TMwwapIgT0QUOBvPji0Aj:Su5x6M1c/h1+HLapIDQUO9jo
TLSH
T1B1063926B1E14166C1AA8031CF869735D7F13C598BF087D7A246B7D82F336D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 7.0MB
SHA256 c73d26df4541e934c8e29c0b4280141056a954564e63df2fc459f7dc8d42e64d
MD5 427e4368589db9bc4127e7d61b2a9737
SHA1 44ab03cc89ba5d48ba8719f9f848a48b74fec420
SHA512 5afbbdf2b5fd519224a332428a54234adf19b405a8aadbb46877bacf30d3e8d895a79753f0c5dbd9795550c948588dc8ca32dcb5b37e70ba78ebb564293e6f97
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOa/h1+:Jw/h1+HcIDQUOFw/h1+HcIDQUOa/h1+
TLSH
T1A0764B22B1E14066C1AA8031CF869735D7F13C698BF187D7A246B7D92F335D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 6.4MB
SHA256 26a8cfb613b8d7b13601591fcf1219f62ac860dbfca0fbe3bf3fb7b070375337
MD5 4193a0acc27a40de4de5c15f4b75af5d
SHA1 f5a4ca3d3db6c6f0187ccb3576418f1032d3b431
SHA512 ecb4e6b5ed79c70d5cf4ca4872c9804d5dcc1290419f8ff63d213cb0399d1cad7bb4a52f1d0481dbc96f8d96e6793e59bf38ce29e2b72f8a22cd9702b02e8a93
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUO:Jw/h1+HcIDQUOFw/h1+HcIDQUO
TLSH
T1F5664A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 6.6MB
SHA256 0df6a0dbbdd43887a934df7a5b23e0e5dc1143acd90e0ce6d6aa676e49e1ac29
MD5 c0f7363b285e6aeb98cbf74a88594770
SHA1 8e2a5836c71c63265334962c861e6d24be009a08
SHA512 46f4dfd2c5f87e60414ae517c86cd06d3dfd55f6e70eb7f44e0b4d9f4fa6e1bdd88c276430f9294baa16d95d180fedb0956d193ca98da4bc26a605051e71732a
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOL:Jw/h1+HcIDQUOFw/h1+HcIDQUOL
TLSH
T1B6663926B1E140A6C1999031CF469735D7E17C698BF183E7B246B3D92F335C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 6.4MB
SHA256 919de4f664453e8ca9aa2e5471455501d7dfefe6b834b8276b0fe97636fd7a54
MD5 e56f498b8b07bb6b6c04587a7c0f13f1
SHA1 fb2fa78c9c2af08f5c8231503873a7f9e56e0244
SHA512 6210a45ae48ab923ff17646532187c63c4fdd93b3c28e076225165c7e84bec212d9e9c403e1c96f5afab1b944261f7a7b845bf9d972195c9f1012c62aec2c7a0
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUO8b:Jw/h1+HcIDQUOFw/h1+HcIDQUO8b
TLSH
T1EB66392271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 10.5MB
SHA256 33489fb1cf20fa1112d1e84d80b038b519d6c851d90be41ff44339a1f8950bd0
MD5 bb3460140fdd65a686a518e09675fce6
SHA1 9c43cd729d18ceba8018425f6fde4436984d1844
SHA512 987244c8f83dfb26fe653b0aabfba3c1c965b515b98c9203444618e2439fcbb716d800629b2e125b02d3281c09e94d9a8381352867b0457a2005d99efafa0fc1
SSDEEP 196608:Jw/h1+HcIDQUOFw/h1+HcIDQUOqvyEYc/b3w8O:goQUO8oQUOqvyEYKbi
TLSH
T16BB65A2276E140B5D1AA9030CF668631E7B27C564FF0879B6241F6DA2F335D07E3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 6.7MB
SHA256 5a3481d5a11fd20adc997b3954758efab246b7cd21e64294010589ba1b3fc88c
MD5 41c665fb2cc464cc4088d28024cbd45d
SHA1 f7e54601751e52b71efb3bdbe65605c18289d569
SHA512 3d5eb744ea9bb9420ef8e0b126fcaf0721a0d53d85692780d9e1f79f2534e06a81e7f1c6045b2889d44a2f0d3f56c5aea20ef1959e3240c966711c917989ac29
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOa:Jw/h1+HcIDQUOFw/h1+HcIDQUOa
TLSH
T11F664A22B1E140A6C19A9031CF469735D7E17C698FF183E7B245B7D92F325C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 8.5MB
SHA256 7c52a28d64c9022405c30b3380d68f570af580148a8c98c1c560cd35046f0b1a
MD5 ed1b1733815d10a5469c4b601b1c746b
SHA1 2f193fcdaf19447b291fe02e3f4eea83d5ecd51f
SHA512 6f833b4f9ba51e4da4ac990fcb3d56e50ad4d146693166e7cdc49546eaf38142c1e9f817d8525d39ddd4726a1aa8ffa77f68ffcccf5f2afc9e3fe4c1c84db2db
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOHoq2Vjnm:Jw/h1+HcIDQUOFw/h1+HcIDQUOHGn
TLSH
T166964A2671E140A5C1A9C035CF568636E3F17C698BF087EB6205B7D92F336D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 6.5MB
SHA256 516a248a94a544e01393e456dcd56339edd5c82956271e6b041e5eedbd40d786
MD5 99247231a908639f88036171ab02a640
SHA1 913fd0b3e6d1a11f44f160dbc1a4c07effe07cd1
SHA512 549a71abfc7993fb3cce80a72037185ec6d720624cf7b731412e51c698004586e46cbb5a729f7975e65e4511985c68e562811ef3fd186620105d763eb220aeb0
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOc:Jw/h1+HcIDQUOFw/h1+HcIDQUOc
TLSH
T155663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindRestore.exe

Path C:\Program Files\FindRestore.exe
Size 6.7MB
SHA256 38b9f18fb9abde2bcca16a5bd95f2105d58e70ba8160e91d69d0a13f57ba9659
MD5 9ffef421d7ea5df5809149f208cdb790
SHA1 2d3225137e64ea507c8f9103e7e8b5ac8eab8565
SHA512 72dabcc7c23afc36e866a98297ea5a7c06835592da4a13efed5639a74bd6dd67969b9285efb1f0d62012bdce4957db9679d6c97785a1a2978546c9bde8bf750f
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOzTTxZB:Jw/h1+HcIDQUOFw/h1+HcIDQUOjF
TLSH
T14A664A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 12.4MB
SHA256 fb001d6ea6174b175bbcec0e19a2c74ff61114af792c556c2b91891d2f116f19
MD5 1834508ca4a155ea3178825cefe047a9
SHA1 713230af6071c53de8db834eb856676a716cb6ec
SHA512 9289dbb58da42492de0375c5dd01ebb598c3ec1a5f2ae94f94f2fe9c2ea1d12f08e1ac9366228ae5ea1d1a020d37b9867818f9f6a6ba1a27fcf3f419e1d2002e
SSDEEP 196608:Jw/h1+HcIDQUOFw/h1+HcIDQUOmQyiKaUX+PNo:goQUO8oQUOmQsas+PS
TLSH
T14BD66B23B2E100A9D09AD470CF69973197B17C5A8BF083EF228576D51F729D07B39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 8.1MB
SHA256 7be09b81f1f7acd1e658a06a592f2b82490593d7aeae099b5992609a826940e2
MD5 48796a01b078c8c8d0cb1d843eebb677
SHA1 ca861f74b81908c2f14c74c82b3b3691038b872f
SHA512 be8f2e1a9daedb134fa35bbbc6df2707ccf0d900f447dc92fca6ffa47939a8a6c8979f28346940419c5eb13482138d09cebb42e62b3f0d028237244522f9bd78
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOGthHRc/Q:Jw/h1+HcIDQUOFw/h1+HcIDQUOGthHf
TLSH
T149863922B1E200A6C1999031CF469735D7E17C698FF1C3EBA245B3D92F725D07A3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 9.8MB
SHA256 a3abd39c31bd8f339aaacff52fae395eb956b7d3a45a59fea98ed929635e6dd0
MD5 b798076f01d5796038330dc462a61266
SHA1 963a4f2d78a31b1629068888bb4ccac129f92db3
SHA512 fa65815dde1a55c82a164f13ea6974ac90bd0b64d53b444e6cdda5c05e409265eb4dcc41e48baeb438bf47860a8e2695253550f51656442c28f5478d9fc39a3f
SSDEEP 196608:Jw/h1+HcIDQUOFw/h1+HcIDQUOELIHuWhs:goQUO8oQUOE+6
TLSH
T133A65A23B1E100A9D059D035CF469232E7A17C5A8BF193EB6241B7D52F73AD07B3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 8.6MB
SHA256 10127156348cdadc1db21beee196998440d2feb8e6ff6bc3094093437467d741
MD5 f53626218eb8a75ace9e7fb5666afd34
SHA1 c328f5f981af00fb3df0a465ea4b68ef236f5257
SHA512 220fc475b7280dce31894a292c5e7909e1db69ae17a609aabf0f7f9e2230fd893379f560cf7de769af3c8f43a073c3aa840af49121dfe42b6e2ea11844f67e3a
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOvu6Jm0xd2d3:Jw/h1+HcIDQUOFw/h1+HcIDQUOG6Jm0G
TLSH
T1EE965B22B1E100A5D199D031CF469732E7E17C698BF097EB6241B3D92F736D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 8.0MB
SHA256 64a317002bcdaa8488842cd95aeea4114b3643b85bc896918e049d1e550b6103
MD5 9d155cf5de752243bb197bbcb9c6c5cb
SHA1 2e7dc4cee430d9c4bd181d870bf634f4bdfe4295
SHA512 a2009eb50bbc34d848d341703bf7e34f9368a50eaa4678b9e30f765f3fa19f86242f8418ba2850c8d7100bff9a84e6bddc43d997eaa1b7964506d7dfc0d0664d
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOBmifP5R7:Jw/h1+HcIDQUOFw/h1+HcIDQUOxfPf
TLSH
T18E865A22B1E100A5C199D031CF469735E7E17C698BF087EB6241B7D92F736D07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 8.2MB
SHA256 ccb5462d6d341dd9bc9900892327eb39d784b5a3ef8907044e3b7977f064d50d
MD5 1092768c324c7a3f66e6bec45784f5a3
SHA1 34ed893d768549b9920d566d49609f8cefe8e99d
SHA512 7c0e8f3b2ed73dde4cae1ead6d2ce5ac29935813471494f29ecee19cc1b7d34e087ce05b2f292c1dcfe9f8606b3e558fc6b4c18f27e5ea3e8429c3ca1496e8dc
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOy5dKCi616:Jw/h1+HcIDQUOFw/h1+HcIDQUO4dKC16
TLSH
T19A864B22B1E100A5D1AAD031CF569735D7E27C698BF083EB6241B3D91F736D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 9.4MB
SHA256 6fe6ac1389cd3a803b2966e3695fb2e877a2ac3835d717e8c324d671413f36be
MD5 e862db238ff248e47e59a5021efd84be
SHA1 dabbb3cee6d9f149fd0cec771b4305c0a6fce63b
SHA512 a274a4e9313937299c705fac4ecb1ce4a07d83858ad021c995e15cdc4a62a5ec62e798d30640d0c871fc1a1ad88abbb41220664db42870d18ddcd44f1eb8053d
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOgm7vj1BDlZG:Jw/h1+HcIDQUOFw/h1+HcIDQUONjnDO
TLSH
T18CA66B22B1E100A5C099D031CF469732E7E27C598BF197EB6241B7D92F736D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 7.8MB
SHA256 15c863bbd1d7d3f3340c3fd0ed0519f072f624b43423af0132718e9d707d90f5
MD5 7fcc8ff4f8ab53287fc31db38cb13fb6
SHA1 bb423b50f7c6aa94accf2482cb3c2ebbdafc771e
SHA512 1a9801cd0998d2e0332fadc9819f271b6efee83ef6f7235c060a215c1281313bff47e15040a9322920a0e1be6678ae7eb31d8313867520704488fcce04cab235
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOLX2iwphX:Jw/h1+HcIDQUOFw/h1+HcIDQUOj2iw3
TLSH
T12F865A22B1E100A5C199D031CF469735D7E27C698BF187EB6241B7D92F336D07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 6.4MB
SHA256 4140f8af546a73054059d10ae1d59ad7aa77670d13244ea4694a37a908c77e8b
MD5 5ca5310a352830f6748f1df96d736ffe
SHA1 2c6665dc5d35982488de7593444d05aec8ff32bb
SHA512 3803c907fbc5f8ff6683b127e82b0154e70884f29e7aa4a3459e54aee6281b4a173b2df61fc17d7be6fdfefc2032709fecaf30d92e056e7cf4144262e6d5f5c9
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOa:Jw/h1+HcIDQUOFw/h1+HcIDQUOa
TLSH
T190663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 6.4MB
SHA256 ff54b90f2195c9f2f78972ded18e9c62e9b7730123e52e2f7259dac49534efe5
MD5 782ec66db5ae2a5812d8b1dfc51f1685
SHA1 35040aacbeaec261f347f22120e6dc9566bb63c7
SHA512 d9e83ddd3449f6155a86bf8dc3239b3f970abc6ac5f129fcca4eb0e63dc76f45c3048f2c7b51e9c16f6d378d1dce78def013b640f5852124b56403c815198414
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOW:Jw/h1+HcIDQUOFw/h1+HcIDQUOW
TLSH
T1F6663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 6.4MB
SHA256 8f4ab1aba3f6b59cb335c803cae1380113e6a8ddb89b7524365714d929328841
MD5 3272bca5efcfa298cc6d8e8ae365520a
SHA1 7f8c7b42332ab31c0ab044a1a6b02692bd826aa1
SHA512 90e75b412e8583be29c4e6d981fae20a9104b627940b1306f1bc096ad31de402b6da7a67e52e6c62336509cb840ac5bb07ad94efc370f6b26602dacbda6e75ed
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOh:Jw/h1+HcIDQUOFw/h1+HcIDQUOh
TLSH
T121663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 6.4MB
SHA256 6c63a88593222393a912d541ef50a5e240d1b5cdf1b3eaba325bdaaa1fccc362
MD5 932de0ccdda5c00fb3fb3d6473e0e34c
SHA1 a60f022713d30d6d27c286f084c31fee35d28148
SHA512 35df205179db605d62fbe02adf0044be5b3798491180373b5092bbc6ac697d449fa7700c5341df86c75678b477fb32cabce299188aba35e908bfa636f702a291
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUO0:Jw/h1+HcIDQUOFw/h1+HcIDQUO0
TLSH
T19B663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 6.4MB
SHA256 9df5ccb4c2600e04e89c609dbb9eab31675793fe0111d7d0dbb664224d6e85f1
MD5 2db045358f3393c8a8dd5905a3a91a62
SHA1 b8b9b0427b32e8541437fde06c95a07db5d16e3a
SHA512 6f9e34c25b0e1340ef7cc5e23444a49670d0fd59b0631f5af07bb934a533d3092fb230033dd1617ff3f6f3844bd4cbf35560bd4d363c131d5174b18cf5088f00
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOx:Jw/h1+HcIDQUOFw/h1+HcIDQUOx
TLSH
T1E3663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 6.4MB
SHA256 08175f5534656f12687687e66b173cc3b4de24c3775615a5fcd7f1543fc2b272
MD5 8f0f34c3820e61c2badd44430925c649
SHA1 0b7757e013507def7d5b364f7c040ec9ea4f7fec
SHA512 a39460a8c07c37a068cb13fd9ef7a074c960589c894f7147f871829e0693614d5ac54fe2355bac088ba785df57f409067299fe30c3b4000565b33d3be2dddb1a
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUO+:Jw/h1+HcIDQUOFw/h1+HcIDQUO+
TLSH
T1C2663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 6.4MB
SHA256 f84b0ddcb6eb2ae880fb8a0b691b62f616312044d8e39ce36b7068aebb062a50
MD5 70a36a0158ec5430c5bbf93d10b6780b
SHA1 280631eb50b2d292859d6186be95b04f2e8aa91b
SHA512 f54a3bccd3a5a5b701e91091a64b081ecf32591c0b9ab85d59c94cfb7f293598ebd2464cd9d1d5c6dfa4b75c18a3f308b1e004d3fa2d9edd47a066f8c183fc53
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOZ:Jw/h1+HcIDQUOFw/h1+HcIDQUOZ
TLSH
T1D8663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 6.6MB
SHA256 9c7987f07c34d0a2316a9274ea7a20ebd8d4b29f7b74395779791136e9dec50f
MD5 e0e2d01262eac54ca4e5ab616d43fa5a
SHA1 93a9b4111967e2e0442029ffa427f20756b9756a
SHA512 f72981e81738ab78df813d520caf6143b9fe6f852626df51d5d0a45bee795a1f9bc26e755e7233d019b83046a07f1228fd413c17d6cf7c63f0200f49401b2866
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOIzfu:Jw/h1+HcIDQUOFw/h1+HcIDQUOcfu
TLSH
T111663A2271E100A6C1999031CF469735D7E17C698BF183EBB246B7D92F735C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 6.4MB
SHA256 a13db04abd26be6b9f65291c68a0e57c6f64f7371d99d1663c7ed6311dc5b424
MD5 bb7bd91ddbc54e7a90c426f518860c36
SHA1 df5fc76a6531a7a7487a47ffcb7976020c9c07ab
SHA512 82e0204dc1a14054623b4b37a7a6c2a09c1a2d45f1d327cea3ab4d8f4526edc9ea42234c8a28d63fce38580908674117d892aa80d23c7c6045e452f72345ff0d
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOA:Jw/h1+HcIDQUOFw/h1+HcIDQUOA
TLSH
T127663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 6.4MB
SHA256 e2566421774f716d1165cdd072c996b69ad6f69cd0ca2c1f7ccd58daa0bba9b3
MD5 151b2b45d270fb8be30861b59c3817cc
SHA1 54eb97ab8c2f54798f2f50fbe95ce0c39c9a513d
SHA512 21d269fc69a49f2118ab18f70111c97eafa6da6916e00a782a86d0aae65ba1c11321cdf2c13be4710dcdcb6c98f1c658f7e66b3740ab9e1599020045fe8fd746
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOY:Jw/h1+HcIDQUOFw/h1+HcIDQUOY
TLSH
T137663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 6.5MB
SHA256 39a9586147eeeacc784f68f10d36fe5696d1d75ce0448fb8ae2fd0d087946bfb
MD5 9a7299ac4bdf9ecbc23f0d2654cd4164
SHA1 dd16d2c910cfadef2c504e59ba10ae8c85d095a5
SHA512 bae104dc7b96a8dccf5e6d00fd89032c065f638d08b3cda062c4b9ab955b4c3ca0a8467702e3fe241e7810b12ddaaf0e93e2c12dca4155c93a06dba3ff9bb2b3
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUO3s:Jw/h1+HcIDQUOFw/h1+HcIDQUO3s
TLSH
T1E8664A2271E100A6C1999031CF469735D7F27C698BF187E7B246B7D92F325C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 6.4MB
SHA256 6437a90f04dc189e25b621751359c557b37cbdc28666424818e3b8a647a04aaa
MD5 bf65d1fb5d803e02c5368179e75784e7
SHA1 203701a88ca79501921445544caefc27ff3fcecb
SHA512 eef71145a42cbc943b2088f4286170061403257f7320d74cee5b646c6f60c8ab38d0055fc1d34b2d414ed1618ee9e375c553b6586af1fd851ca12fb63750d41e
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOF:Jw/h1+HcIDQUOFw/h1+HcIDQUOF
TLSH
T18A663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 6.4MB
SHA256 3776110565d7f99f49b618f415f02ada7a374f166284b9bedb182e555f2ab03d
MD5 6570ca7ebdb319bf900402ac5b25e109
SHA1 97269415b036db8e57935f0afb9182aacbb53e7a
SHA512 750888f55fc647d5901f7bfa95bccb550944e1fa3cbd47b57483af7c32d2af386d9a89af44f6d09de73493b9e11565be13f639a33356129bd2764e7f0c3db05d
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOn:Jw/h1+HcIDQUOFw/h1+HcIDQUOn
TLSH
T12F663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 6.5MB
SHA256 368511a22e057faf54d32a9d06c2b70bd559d62646e95f6701a9f752f434acb8
MD5 1b468097c5eee6b0e7e6cb01a9a5817b
SHA1 ce8070bc9a4ab2035df0ec9aec842ef626d988ff
SHA512 3de6560601e9ea10eea2809a37b979a1c9d41b7ca70cd6c21c7326a172b7bdcaf8c4fa5a90a8fb711fd16d31eafd3d086578b3a1719460fefe870101309170bf
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOKT:Jw/h1+HcIDQUOFw/h1+HcIDQUOKT
TLSH
T13F664A2271E100A6C1999031CF469735D7F27C698BF187E7B246B7D92F325C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 6.6MB
SHA256 680f0b06c1c6a1f1b7a219beed3ed8bf2508fc75a33dde793d8f2364fce94d0f
MD5 74d7d1f14944b38a2e0be7ff8bd881a3
SHA1 9ec973cf4b16971f390703a5b70a65af64c4eb61
SHA512 512a633667902fb716f36df4eb6005ae54d4cb60a7cf5e9ac13f297f12ead0ecc3b7cd12ad2ac7caddea27707dbe2596b5b8897d498627f3421985a78e54b63c
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOqLtB:Jw/h1+HcIDQUOFw/h1+HcIDQUOutB
TLSH
T12A663A2271E100A6C1999031CF469735D7E17C698BF183EBB246B7D92F735C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 6.8MB
SHA256 ae8c3c91108f840b9e719358a4c0a927516443c07f8cfbbf4e35c6bb63e07cf0
MD5 154c489b1a0e504e3cebdcbdc80ada4f
SHA1 9cc2245f2295ffd543c27153668078c837ec8a63
SHA512 70b1425c693665a24c6753b0dd0eef8f293c1fdae7d809871374b3f2ccb598cd6486a3176e88262480efe4b68dea9d0215f65814e8ebba69ffb7a2a62cfc44ba
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOICq6:Jw/h1+HcIDQUOFw/h1+HcIDQUOpq6
TLSH
T121764A2271E100A6D19A9031CF469735D7F17C698BF087EBB245B7D92F325C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 6.4MB
SHA256 982b0ce4fc54fbb83e7be054c686482b7c61edd9f004be442e9c3d0cf7edeed8
MD5 2a23f3914bf0a2a2d58c72d2d4f48dc4
SHA1 46d9b43ae953383932fdf9c86b888a798d0bb29d
SHA512 66acfd6ae7073ca09888d53ca45005f65aef686f3b37ccfebd4bf4f1b94fa5beb00fc3095bb6c562548aa9b9ccb2a4e55ba9b3fec1d808c4894eee1b96aebd0c
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOm:Jw/h1+HcIDQUOFw/h1+HcIDQUOm
TLSH
T175663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 6.4MB
SHA256 dedddaf4e1ec0dbe3d0a156c204bd25e6e735e8c5d4fea3564c70c8226b5d219
MD5 ba15c6df8eb28e4de29b26fd88198fbf
SHA1 4dfe68c172c68e008cee2958acec376912d56a54
SHA512 1acf289431423c6cc5a26721b3d2c17c31f6c6942753173bdd5c115b9c857f0e80fd00a153eb89f987fb52c060e653270ce7f56e9035ea085d76be674c57ec99
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOL:Jw/h1+HcIDQUOFw/h1+HcIDQUOL
TLSH
T18F663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 6.4MB
SHA256 72a615360f27ebcc47ce9c5a94f08d27304bf3c9890d5684d271c3271df4cd86
MD5 2789b950dfd67af4bf4894765509ac88
SHA1 cb92bc490413d5b00ac5fb877c55415eb0eef162
SHA512 2e273875c19cc40ce693d40db3c43312fb35426ad62f17d5e3f22a1c796af7850df8451772f3976ffa4a8ea582ac48e7046ebf95d1bfa3c1ecf113027cb4e2c4
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOp:Jw/h1+HcIDQUOFw/h1+HcIDQUOp
TLSH
T133663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 6.4MB
SHA256 93d10415d171cf0df83ec140521e540066c540c668bd22917065a0d3f43113a2
MD5 6e58c3390470f969d90c0e1719ece8a0
SHA1 716f36ac96d29ae85c49f92b1d904f8e3569ed43
SHA512 27aa4010a78c98fabe4feb3099e06a48771bab0c49ae46cf719e5b4c2d9d73224f33ba2db8423f489abd7b7769127f2d890b8d23bfdd9562943aae23edc8c822
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOy:Jw/h1+HcIDQUOFw/h1+HcIDQUOy
TLSH
T1F0663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 6.4MB
SHA256 96fdb531fb3e0013a87b2176a446492f450983d0332a841711799e8010f55a2a
MD5 9277fdc336ab3c025f1258906ab9f4bd
SHA1 6738bac714af0f37e181fcf3e27db94b2e634763
SHA512 bcc1dc42eefaf6b3465a92bc49447820de5c863078bc80f9aa4a7927daa7157e8d2a72d2c1c74f8f0ba69c9bf245c44f121150b0d271e01df33b8fc28d1ec354
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOY:Jw/h1+HcIDQUOFw/h1+HcIDQUOY
TLSH
T107663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 6.4MB
SHA256 074267c64591e8633a133f55c89b5c348f840e83983f7eca704b81093eb8a9b6
MD5 218b6917714d82b07ecb216dbef1ef18
SHA1 149a1f12e77f3d6ae6dd65f2a5f62a13ff8d8529
SHA512 215d3ac9d19b0808774fb122db01aff1faa4b134e4a28e1b19317edb6bfe395bde716a133aa07ff1ee76344250e90f06e72253f476dbc5d02500defb4a18ca8b
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOs:Jw/h1+HcIDQUOFw/h1+HcIDQUOs
TLSH
T1E9663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 6.4MB
SHA256 1b6e9b2a98774d682801d0ed3d8b843aab6a2886ef6088eed99b0ec747dc4795
MD5 922edb7fa083e819f35ef13dd314be30
SHA1 cf217ee951971e79b3eb8a6f32db8479773d8034
SHA512 5fd7f987380fc59ae54e1aae90ebfcc4a60872ac78dc00f983ecc8ff5d7f76376518da00195fe8f1e6ea957a71084beef2e8d2ae4a9abea6bf5bd1932361c57d
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOh:Jw/h1+HcIDQUOFw/h1+HcIDQUOh
TLSH
T19C663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 6.4MB
SHA256 9e98569a67cb46a5933f25b8dcec855ea9fd9e548618d216f3528d49dcb5b76c
MD5 51c8059d80955144cba45d114f227fd7
SHA1 15eff3b9dad279a57edcaaeffadf6244f1abc16d
SHA512 d144d886ef50191d91a6c33359bd95e472a24ea514171eff5b636cfcc2f483fae2be0d6d2b6b6794024ea2d5fcc1f21736f3a44b699f6f8bacdfdbb2195a1e53
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOV:Jw/h1+HcIDQUOFw/h1+HcIDQUOV
TLSH
T151663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 6.4MB
SHA256 cb2453e44e9881019087d8c95b273be93b3450ac1de8849c3caeda89151391c1
MD5 c22e4c1bc4b8faa1ca3b0fa449a5b599
SHA1 ea60cc1f78704357768bdc8c6e79dadb77822ba0
SHA512 13bba0777dd4f395ae85f92d738a668d96dddc8248c4c48b8354f08c283e002037812561694cffbd62067d8bc8055be687425d567d5d0141f53dd0d72505fc56
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOK:Jw/h1+HcIDQUOFw/h1+HcIDQUOK
TLSH
T15A663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 6.4MB
SHA256 51e34f5840ce0b24e46ae23b2335cb3747c52f55eb865969cd9ffc0d709f47ad
MD5 cccb879b3068aa4b527eb5e342d43054
SHA1 fd7f4d63467a985167dba29d6e64afbdca416946
SHA512 5a3fdba54b0d0e7986d9d43b107cdfd1c4f7bc45dbcf4f4c302457bd8e7ca33744447c500b13a04f0512db0eca4da03cd8df97258a3fd00c9eb4adec3fcf64c2
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOr:Jw/h1+HcIDQUOFw/h1+HcIDQUOr
TLSH
T177663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 6.4MB
SHA256 c8ae5df1dc7ccc8958d5e128ed63bd2f2dccf1714c6d16bb751d81d4f70cd6fe
MD5 63b40ab038f1faafb25a0fcdbf6a2e06
SHA1 e84fc0bb6b5c24f3e12814e2ed83eb47f06fe946
SHA512 da6cc4987d1e1e7192a95b5544f707aa927e41e854d8d9ee96b2196b6e8ba3cef47d245a0908bb6aff1be12048ff269ebf9460e5b7cffc899e408e199da83017
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOz:Jw/h1+HcIDQUOFw/h1+HcIDQUOz
TLSH
T1FC663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 6.4MB
SHA256 6d0c7eeaa276d3925742ae0e3ee3ebeceabdc74f303e89ac3bca5803187ab3da
MD5 8377ed246abd8e0f2b38c3d3f364ac87
SHA1 baaebf87988457cc978318066f3cfe66768eb7b0
SHA512 7894d17faeb13728dfbdf6636bf97f306b5b8fb470146b399fa5f0331cf2be03a2eeff020690c61199412d5373d8cdfc3356c151c283dc2aa9996b4f2a6222cd
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOj:Jw/h1+HcIDQUOFw/h1+HcIDQUOj
TLSH
T1F2663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 6.4MB
SHA256 2334ff4538d107d417a19b9e6ef5dbfd0891365c0a8343d2f32f49cabed5c4a3
MD5 8311b3210893fb677e8ef23b7d16bb79
SHA1 29161421e05dd9e88ad8537d36578a2e7e041552
SHA512 4608d8d9a5f262899c0e82bbab15f6abb2215a18f136e9e7ab77305192f2766d455c24be230f4838f4be4d7db9b9fa17c65c4630b2ec2c1be6600e092db9d6a5
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOO:Jw/h1+HcIDQUOFw/h1+HcIDQUOO
TLSH
T158663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 6.4MB
SHA256 e2ff817fdcdbb06b12d0de97611d6878340a5783d4e2f1123e49fc78558c2e7b
MD5 7a8e7498bda2127e600d0e959b510ca9
SHA1 037342d2b950feb21ffd2727ba0a535e45925e09
SHA512 a9ea7d5bbacaa736d807bccafc1f5d74442b48929bfabd86144e0f0b617527f7f4bcff315815a024ad5398a1e575f66c6cf3e45935d269382618d023156282a7
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOT:Jw/h1+HcIDQUOFw/h1+HcIDQUOT
TLSH
T182663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 6.4MB
SHA256 74466aedb808cc076daf709b5e984a9f42c459f0726911b8db84c4670ab2b904
MD5 69fa2cd71d8eafd2e5b51ef87005148f
SHA1 2f236c24a012b0f71ea1edddadf5634669622047
SHA512 d6a031abf7c539f460341172bac827d609bb25eb027f809459678e087deffd5bfbfebf1019a77fe0b97abc70c5f4185419671631dc2c3f57c6696e64c78685be
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOW:Jw/h1+HcIDQUOFw/h1+HcIDQUOW
TLSH
T114663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 6.4MB
SHA256 776018987286d539e26327a0781892c1cda2ff60db75a23ddccf540820c3cfdc
MD5 8e5fb329de40d1a6a506ec1e4027676c
SHA1 954895556f79bc52c970bd296e07db94c772667c
SHA512 d357ad4434166b9e75d5c8ea7a77a214395b6218d71f49b97e5276899b34a21e9cbea5cdb862eb42195592671a8806cd1431c590e7a587c9f2f58133419a8aa6
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOY:Jw/h1+HcIDQUOFw/h1+HcIDQUOY
TLSH
T1FD663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 6.4MB
SHA256 44f35d665ca4ab584cc968f5f5d08dc82d662442f864eced85ee86d9fe43a81e
MD5 84066faca9198257164c7a22351b7192
SHA1 d823d8852f0b70ce8eb9bfe08897fa89c8985ea5
SHA512 3c46b0677dbb9ac4134b6854c452e40097badc9a10b0d2ceb0de8f1331eb74ef6f10cca6061e1f57735bc34798f27c28ce27568c8c2d907194516d80f92519fb
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOa:Jw/h1+HcIDQUOFw/h1+HcIDQUOa
TLSH
T15D663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 6.4MB
SHA256 36172c522aeefd78ea9b5d9268507e41d34f00b1c8037f8468833890b1ae2f3f
MD5 12b592ec917f662a7dc8681bec308380
SHA1 47cad77e5375318d6740c7571c9a025b6d34a6ec
SHA512 f4fe8aee518397405c7ed7f4b0867751320c3092bb7f7c3c529331b4de818af940e6e80399b29aa63c0bcd7ebed042c95f18f1ff799e7216bf872f7d390d5e4d
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOY:Jw/h1+HcIDQUOFw/h1+HcIDQUOY
TLSH
T151663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 6.4MB
SHA256 84d94e7dbe8900ae775d24ed4660d201b20de25b16127e04464361d7b6faef52
MD5 3d394c403bc7c03fd1725e8539d3f893
SHA1 4c2e250ae9bf5322b9cdcc8f7ca1697a5b7bc62b
SHA512 34aaf0a0991f454c5c94c20878f807519f39c0e9e26346a244929eb652d45ea36f51ebc04b71e1c0425a7a655bec48e51857708e2b28a2a9a405321c2e461baf
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOb:Jw/h1+HcIDQUOFw/h1+HcIDQUOb
TLSH
T11F663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 6.4MB
SHA256 f75a85351fcfc45a478ba318f387a97e1805be108b0ff4779fdd55ab3c2b1c42
MD5 3c5830050bea56ccca0d8938569514be
SHA1 01b59f98229167907c5878e01b287997b71daaa7
SHA512 465461add6fd451b8494299754099853f6b336ff7d9552ec7ef58a2b8b9378be59fb7b822fe398530283a0e55c9c0b321a993670afbce49ba3d2c0290ae7b248
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUO2:Jw/h1+HcIDQUOFw/h1+HcIDQUO2
TLSH
T162663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 6.4MB
SHA256 981a4bf4bab77b54bd663715f4924b2b93099e700139be1c37f331073f5195e9
MD5 fb711b81cff5eb0d005e9975f281fd81
SHA1 64bc7e6484b61ac683a029ccc1c2e7a9c58b9d7e
SHA512 0ed73cdeac1ed444ff7d13bd7f35b74359f6a6c28a6719a0b99b71007edaabb7a01515088af0aa4ab57f8143cd5492a94f1f8a37aa503c3915b8fec610a3377c
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOl:Jw/h1+HcIDQUOFw/h1+HcIDQUOl
TLSH
T166663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 6.4MB
SHA256 316653125f125273d284b76ba90fabe922db40f5b2222bf00e0348724190b622
MD5 d1b9669e2dfbda927d2e16fca96133ee
SHA1 a2fbf9d67cbcd792abcd36578494cf79379c01f8
SHA512 432f5ea176cb8d8964e04cb783e8bbea2fe9057053d41ccbf139c88791dbaab8378886491fbd1625331890cd894158f521a25da62f43a8e70ae1b1f6b4251885
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOQ:Jw/h1+HcIDQUOFw/h1+HcIDQUOQ
TLSH
T118663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 6.4MB
SHA256 d58f27005e59953cd6b2bf6c75f9a9ee124e2bfe35d767e9f900c0a05000845e
MD5 fc445a9b2bf3034b3a3773cedf9b7773
SHA1 36c592d0c810b8db85ef4277076aada1894ef7e7
SHA512 5616cc853c64cab2ddbc1c9dd40107c3faec341972380a9f75200f00b02e910a74708b1c9bba4fca4801ee86fc6d82cd4ad6da1b01c4e18fbc816b02e8225f44
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOK:Jw/h1+HcIDQUOFw/h1+HcIDQUOK
TLSH
T16A663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 6.4MB
SHA256 1937b299334d15247d6313daf637a455b5a7f36cc6c32beca9debd423a620f59
MD5 5e91615df661a561559ae10122e6cbaa
SHA1 83ff02483b492f225c18b0112c17d4dc5ed85190
SHA512 0a29cb4c1763db54c67c1a38641e49a30e49372c423cd557ae0d47d0b738f3d6f5d2d36f0a147fddd91252747ba6bb2b45f6df4f4041bba3968c7b1eab869564
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOe:Jw/h1+HcIDQUOFw/h1+HcIDQUOe
TLSH
T105663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 6.4MB
SHA256 8b6406f65dea8a4224f94b59d00095cc50aed301e2fb655ee33068f0871deb3f
MD5 c138922016c093678caa70c86cf6642c
SHA1 df331343a9dca406ee596684ddf7477ffb72791a
SHA512 40beb9971e7c228c12b93c3ea75b7984f4a533d0acaaf4d75a6db49112e81c35accf95a1699541e487044e090b969b519cf82a5ce3e9db221310240ee4b72134
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUO3:Jw/h1+HcIDQUOFw/h1+HcIDQUO3
TLSH
T1C3663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 6.5MB
SHA256 8d1d8d7fca1686aad5241da9cded0533d984d516bce7a0bfcf417ece0253f98b
MD5 d56358af4894edf1aa96282d8ea39890
SHA1 d85b8b6a28831448aa0bc942ee1e381a10e0cdfb
SHA512 bb8cf2da84b7008326b12f9fe0d05241b11710a10b4387d55d194f65ab5d7dc839f9d1fec5d1cf98e43f832cfc4860f1f1ca3d209cd7ce3a24f34c49347cef3b
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUO+:Jw/h1+HcIDQUOFw/h1+HcIDQUO+
TLSH
T1D4663A22B1E10065C1999031CF469735E7E27C698BF183E7B245F7E92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 6.4MB
SHA256 54dc1dc0e236a5f2493e4e01c21d70b9cb41a93f10fd47e09193bf6cdf65867c
MD5 0d9c42086c2e2a9a752f8a3ce7506026
SHA1 b39d509da85cfee1c1b094fa00061f1582d26628
SHA512 49e1f7cd554cfeca2ab1b2da4c35c39d369a0e37c818f6452f51e323d845541909cefa2547c58aaaed344f1d4636d24fee9f8b50c05b09772d0ec31f570a2d2f
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOm:Jw/h1+HcIDQUOFw/h1+HcIDQUOm
TLSH
T1F6663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 6.4MB
SHA256 bd5e68c65dff968a5bba79fb0e6d4534b833dc37370ea1afe2a8c5b5da1f7681
MD5 a8302bebe515407a96e58f8fcf9d704d
SHA1 581a99c0ffc418dabe171c8d7b9d28d1296888e4
SHA512 be557d49f6618d225548ef6b60c574a0651731177a5266cc2a9d9088e9a61472637942f44c4ca5d51b246cbc34172c7c7d1c0a5ab04b3948a8342d7891ca55dd
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOWj:Jw/h1+HcIDQUOFw/h1+HcIDQUOWj
TLSH
T153663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 6.4MB
SHA256 79b1b33c8e786398254fd56e86bfae377a3aa3b7175aca42b1694ac29d36211a
MD5 7963a90b5ab09a4a0d9784c1736d3413
SHA1 a683d9d2a13bf82028a5182d9d9addcad8a7c316
SHA512 cb77220722d80855b13b991289e613b6fc811141a81cc1ce21443e6466b637242cb4f82abe6a9dc5c34b3ee289659400b9625f500954d3fb906fe03de992473c
SSDEEP 98304:Su5x6M1c/h1+HLapIDQUOOu5x6M1c/h1+HLapIDQUOMD:Jw/h1+HcIDQUOFw/h1+HcIDQUOMD
TLSH
T121663A2271E100A6C1999031CF469735D7E27C698FF183E7B246B7D92F725C07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1292-106-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5404-12-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5404-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5844-497-0x000001CB039F0000-0x000001CB03A10000-memory.dmp

Download

memory/5844-483-0x000001CB03BA0000-0x000001CB03CA0000-memory.dmp

Download

memory/5844-482-0x000001CB035B0000-0x000001CB035D0000-memory.dmp

Download

memory/5844-465-0x000001CB18E60000-0x000001CB18F60000-memory.dmp

Download

memory/5844-464-0x000001CB18E60000-0x000001CB18F60000-memory.dmp

Download

memory/5844-511-0x000001CB03E90000-0x000001CB03EB0000-memory.dmp

Download

memory/5844-463-0x000001CB18E60000-0x000001CB18F60000-memory.dmp

Download