13066c4de338f22018fa4f22efb61f41a556546930009895c45702354d775ef2

Analysis

max time kernel
114s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
Size 853KB
Sample260629-lp5khsas21
SHA256 13066c4de338f22018fa4f22efb61f41a556546930009895c45702354d775ef2
MD5 1749349077a3b4609046f0d585a4157c
SHA1 f13bfb0b3e356e03cee0bd0b7b18f164b136fdea
SHA512 a86ddf20f307cf44839574b6dcad098d001736d68c8320bedaff32cd8d1001f06b55a2e79f2a93a3bb86497116b17769a716b07250ac043c21dd45987540461d
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvC:NN4xIiuhM84pO5+t0pOdRvvC
TLSH
T1B3059D21FAE0C075C27B09725AF5C7319979FD710B61468FE3A8A26D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
3844	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{9F835964-85DC-4B59-B27E-1F2E0A56A725}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{1749DB92-11D9-4C2E-AD62-97FD91483D4D}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5288	explorer.exe
5288	explorer.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe
Token: SeShutdownPrivilege	5288	explorer.exe
Token: SeCreatePagefilePrivilege	5288	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5468	sihost.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe
5288	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1476	2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
3844	patcher.exe
4372	StartMenuExperienceHost.exe
4852	SearchHost.exe
5288	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5468 wrote to memory of 5288	5468	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_1749349077a3b4609046f0d585a4157c_cobalt-strike_darkgate_elex_glassworm_hijackloader_redli.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1476

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3844

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5288

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4852

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 13066c4de338f22018fa4f22efb61f41a556546930009895c45702354d775ef2
MD5 1749349077a3b4609046f0d585a4157c
SHA1 f13bfb0b3e356e03cee0bd0b7b18f164b136fdea
SHA512 a86ddf20f307cf44839574b6dcad098d001736d68c8320bedaff32cd8d1001f06b55a2e79f2a93a3bb86497116b17769a716b07250ac043c21dd45987540461d
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvC:NN4xIiuhM84pO5+t0pOdRvvC
TLSH
T1B3059D21FAE0C075C27B09725AF5C7319979FD710B61468FE3A8A26D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 700063fb702daf61e6693ecc44f4821daca2f822404a8122ecd885370cf654fb
MD5 bbf66d900a09f24949886080842bf467
SHA1 9d3bb9b59e7bffd950c165440f8023fae2b90237
SHA512 cc3d082355786b685bd707fd858f68ae5bc6e485570539c21f67fb4fdf045172cf9d29f84e5c7ae2ba2652d7e207e3a64b1eaaf336be67b1febc73ded2224fd7
SSDEEP 24576:NN4xIiuhM84pO5+t0pOdRvvC0Le5ji0hmxNrM:1hM84p1eODiPji0Aj
TLSH
T1BD657D21FAB48231D077C475C9E2976AE97178510B308ACB9399D76C2E337E1973A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 b72b6dc1d4cedce73a26e570f5a0fa743510e74fda55ba7f756f7bbcb4a4a1a1
MD5 67744bbe93f8f9ba6ee82b528b1b438f
SHA1 1a27d2d6cae8b6e8791f248172e2ad61765a0e62
SHA512 b1459e9bf7e082d31a98e49ebf6d378a45d3f7ed733881c13d6cd5d708d3d45555050b7fa005a561a42242a29a62825a41a508dc8430497eb0e702518ffacc38
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvMa:NN4xIiuhM84pO5+t0pOdRvvMa
TLSH
T13E159E21FAE0C075D27B09715AF5C7319979FC610B61868FE3A8A26D0E317D0633AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 901KB
SHA256 5178cb4a7bcbb4ad55b640cd7f3c9900d45a782e2d5d3e8d36a68af8883a351a
MD5 23bddcfe38599634367915d261a27a01
SHA1 8af139ee03534f70949fa42301c3adf90ac1625c
SHA512 3d208aa5bf751b0fd44f290d778d103e61c3d1b007682e1b47cd989b1aff0fc00bd684641bdb852aefa30dbda831171c1bc7ce6836b3d8f72bc8098f4498f93d
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvnb:NN4xIiuhM84pO5+t0pOdRvvnb
TLSH
T1FB15AE21FAE0C076D27B09715AF5C7315979FD610B60868FE3A8A26D0E327D06336B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 877KB
SHA256 137d0a087e0ae85fc2790dbff69b0e064dc2dd015babf82c7d5c791b133d2640
MD5 41ca1b0f2e358f47d8d4db9ce6bc7bc0
SHA1 b0b371fb6a37dd04911932864384b7da855e0f31
SHA512 f96a09c21cc1c526e0c99dbe48e1b8bfc467859bdfea65e680570a542d0b47790d1a45434048061996f46bb252e8a53b369c956bff1d139a270183fc1c01ff29
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvGZ:NN4xIiuhM84pO5+t0pOdRvvGZ
TLSH
T1FE15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 877KB
SHA256 07130aed7b8fbbd80790802e423a35a5b1c7c9b93ecf829599ad4d3e6368619c
MD5 439cc8ce85fb0f97029094a779dfca57
SHA1 d9d8410c7df0aff521083c4dc2f30708c1652f4c
SHA512 c774de3ab68bef090b4282f4ecd0c1ebed1ea492f7c88893222ade0ba7017569f45c5845b30ed6b18b80e99ebef7ad4d28d7e27c762f4af1469784c55e297353
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvx1:NN4xIiuhM84pO5+t0pOdRvvx1
TLSH
T13215AE21FAE0C075C27B09715AF5C7319979FD610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 3a8f64c019ce6a1913b5d361db7b24b2a03e69b9847ac20f6c86f5a57360c432
MD5 efdd772ff50a06620e359957e58db2a7
SHA1 dd6a95756213dc83194a6eec47f2fda86671f942
SHA512 d36fdd8a698e149ff628436347c4910fa2db8b6a99a5f58f24733ffcba901f99df079db5d33375fa973f306bf4b4c755b01394627981a3f3127e507e92ba268e
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvl6:NN4xIiuhM84pO5+t0pOdRvvl6
TLSH
T1C415AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 3cf6ba08bf7ea190466871cc84875c90428fd7fec397fb22a76b5e127f665bec
MD5 217b880b02e110df5ed5fa993281f83b
SHA1 f9ae2c676c8412e6cf71a9fa862c5942f329590f
SHA512 513846a7cc23f5c02aff0369cbccb41d545802de79881955a21ea706297c180a38d31d8c9cb5bdba84f0ecdf922192e4917cfaf768858cabcd052ce44e91cd9d
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv7N:NN4xIiuhM84pO5+t0pOdRvv7N
TLSH
T19F15AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 3c0c5d6f9e319759c801c1f4705165bf2fb4215014804cc513529b58252837d2
MD5 19c2010b85ce6cb1ee3362578cb25770
SHA1 6b4a211e81d6d4c06fc880c3811d322bc79d3754
SHA512 82b1dd9f7fed3b1c62cc00e8312fdcac852e3eefd67adfbe4dd6b371b8d363b6442152da1020e6b355d81a35bc9d5158b2b8a8d46727773d31d9c434b04d7d20
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvZf:NN4xIiuhM84pO5+t0pOdRvvZf
TLSH
T15D15AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 16eb0987db0f7411c253ff936e1091ce88adf499a845be714a5e924dac4d7221
MD5 fc9ce1e2c38f7daf636cebb2c219c88c
SHA1 c48a6ce59068c2969a7bb454cc3a79729dba5cab
SHA512 1ba2549bea25fa6b14679414b9c266862fe5848dabcbb60e3e7dc83fe6e88a995255f931a047ab3bce9e8d5dc2312c6cccedea01e09dff659a987599f8b5b5ce
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvbo:NN4xIiuhM84pO5+t0pOdRvvbo
TLSH
T17A15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 d104bacef9ddca33176cadf7270f997ba61c1e2f12cf8a0e33a1795256b07230
MD5 ea0f87307c59c1f02bfd5ad146f3aa7c
SHA1 02c225c518a30599c7f86957cc9abe5455cbe804
SHA512 4e36f0b42d6505b3db8f9a2c8b4718d6f6611deddfff79428e473b38dcfb717399e6518cd73a4b599401db32f452d10b1da50954568fb8d005c1ca29ee420257
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvPu:NN4xIiuhM84pO5+t0pOdRvvPu
TLSH
T14F15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 ebee138201ea36e00920b2a96d218ec23013d185a901e0a1c5dbbd7187990924
MD5 e6817a41a8cf28616cd09af43fd4c27e
SHA1 bca8b1dcb44a4dc850e396b3cae7dfd2471ea566
SHA512 9dc5cd8dc0b32c91ad06bf1bd9b592f1637072c800078584c8471681d8e7131397d49acec93c9c58bcfc6ed161a6cc968b11c81d3379d370a84c11515da56fb4
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvd9:NN4xIiuhM84pO5+t0pOdRvvd9
TLSH
T12715AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 7cfcad009f6bbb61319ffd1848d1b6e01992a5fea6961160f36790a91b2e1269
MD5 f34fceed7d427864ccaf96ff8fe9e192
SHA1 0aa862c94fa65ba59fade38b0b2f27d8f5538107
SHA512 004e8b7b1e6d48bc0605f8b9636e393ff5e4199072b5350b3c703a71a1b00a80d40f34441db3865f7fab6d4858944a8493793c863b4e8a8cf5fdd4c2cc231d9e
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv5c:NN4xIiuhM84pO5+t0pOdRvv5c
TLSH
T19315AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 a1ce9c9bf00c00f8ff18f6bbf80b96ffbd76fad8f3db245720d3dd377311ad8d
MD5 3db91fe7e2d5b6145751c9424cbb4c9e
SHA1 f8b2a8c4b2bd3e953967511bd5c7ebf8303eda37
SHA512 e8438fff277453f10c3ca227dfeac974e57bd18a865b2fabe9120ec5f39be3dcd8f7aaf5d7b5def79c74b4a7ceed96ef8b537ccc095f94f1c3ceef04f719d040
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvyp:NN4xIiuhM84pO5+t0pOdRvvyp
TLSH
T11F15AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 556c072bdd906b850a84e3f2f627090b3ae7d9bf2f1b962dee884ee074773db0
MD5 6ca8f0f4a91c99093d9d195a7754d616
SHA1 a9ff717f7d90ad65c300f1494af30007976c956e
SHA512 49a693f0abda8643920414c6b12636672994cca25f7d9dae8f9613fa3d7749380c096ca0d8c240295d1574c9938f8f3e9153464e1411f5706c51718da32abd3b
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvF0a:NN4xIiuhM84pO5+t0pOdRvvFN
TLSH
T17D15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 ed9fbbdd3df2d49a298b51a323586234f6cb3864c676ddf9ea0dabeda3ae4fe8
MD5 190904d3743cdb59d4a9aa2d7a3bc8a5
SHA1 8f8f39c8ecf79b5483eef01af00000768d2e99a7
SHA512 63edc6705e9516ecde045637697e5fb2ad7218aa6969266bff567f6e00239739d211b329da817c030c622dde1ac9f544eb83115d7ce4be08081fe5a1961dcf01
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvXF:NN4xIiuhM84pO5+t0pOdRvvXF
TLSH
T18C15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 b159d7b9b99465386ee213a10e35bf10d052f23e94a7a86a61c4963cbd59125d
MD5 1012a01d04b5bd90dc583903ac96de73
SHA1 da96bd1966cacb83e2d5890a6718d561ee47ddca
SHA512 57d0c1893d9b072d46fcd935623330aea9f53d6793ffd39aca57c074760ea489d87ce41cbab77b94e225d9aae37795fa1e22bea4d9582e8d3b6e430ee5db96bd
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvoC:NN4xIiuhM84pO5+t0pOdRvvoC
TLSH
T1CF15AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 7e84d55576db237685f8e5021769638cc6bc36cccd78b2311d7cd8780ab9ee95
MD5 994416622b4a540346f95356a02f2d2c
SHA1 a7555192284ce7c58415cf41255edfedb6fc2022
SHA512 9a3ab1d239ee2af5c8ed26b4d99d684f8d64e50614ee4cc750e1e97ea049877e71c1038f912a692b3f24495197f39d52fc2b0f27dbe78e60f0c9927b77fa9ba5
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv7w:NN4xIiuhM84pO5+t0pOdRvv7w
TLSH
T1D415AE21FAE0C075D27B09715AF5C7319979FC610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 9181fe5c38c5d61f54dac123075c937ad1d283d6667a648c943a1a72d6a74453
MD5 15745dc655236be6557b5ba61f940f2d
SHA1 b4c1d2e571763da216967e84c62a42dcf97b16d0
SHA512 93788903c61fd29bf6e52030ae9692dd13f7ace6e0453b1686748017b7f8cface48bdc932ce375674d9b003c0dab034607444af4e39dfee21cd169ba45cd5101
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvCT:NN4xIiuhM84pO5+t0pOdRvvCT
TLSH
T15615AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 f17257960da1801f36e25ebfe41580f94ae4524f9b992287d7741498775704af
MD5 a51e143919b72ffdb68239f05fe9cc09
SHA1 3c86b56898b17efab421857720d086a6d6910081
SHA512 aa80e10be13e3c719f88a3061a83c5bbbcaff1ac057ea686452ebaabf3dea14151799640c3109f86a5492e2206701a44ed2d8e19a174eea9beaa6f6aa3d2ba8c
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvSu:NN4xIiuhM84pO5+t0pOdRvvSu
TLSH
T19315AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 92d96396e5b231236aac353f83023a94579c3a16a4ae93f1534f2f09151b0d3f
MD5 07db1f701d654b1a4283e697ccccc243
SHA1 1e738c4986fd5804f4723b10dcaa6d02b740998b
SHA512 2f397fcde3bfe54d06c1dd1e94099702540bcfd9186cb8e3e1e88de0bf6adc3864a73e3d770d8d952c1a5807f617f72967335153e51da2be05ed55215d75ad3a
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvMb:NN4xIiuhM84pO5+t0pOdRvvMb
TLSH
T1EA15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 83a096cf8860c64a72e6cba728d7fe942eb8180b207f10823f1203f10b740eb4
MD5 d7364a2ff058cb7873deb2059e2c6e05
SHA1 b48fd0930a45b0469c0e3b0d7cfedb9742373d7d
SHA512 69b574d6eae25d7d0eb0e6624f002542caa88029009b2df3fe4d15ffd61407f944495f804155e0a2793753a911d772e94d3b994e0ebc831fae1f4f19d7615019
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvyf:NN4xIiuhM84pO5+t0pOdRvvyf
TLSH
T14515AE21FAE0C075C27B09715AF5C7319979FD610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 eb35f14cb17e6bee262eb97a35a0b7d998fbedd17f38d4d2a0e203664e546fe7
MD5 8f8f5b194dfd5e11f5377bb1c31b6d92
SHA1 82b7c5e8cce801defb8abf614dbcf276b56a2fdb
SHA512 0e9789804d805a3156df4a40cb0748d63bcb934405d243e1a9aebff51915e6fdf3d05aeeb16c7a074b8e7f24ec6dd453f02a257b9ac198231352f81474ba3d16
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvfK:NN4xIiuhM84pO5+t0pOdRvvfK
TLSH
T10D15AE21FAE0C075C27B08725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 b7dc462c165215d0ef915a064ca8dba99799401aafc8a730d463604977f1ab79
MD5 b429ed14705dfd2c712967182a07d25d
SHA1 24211e2db8865021fd1ad0f019dc852dc069a44b
SHA512 dc48ba1fa94ac9ebec7ca3e572890c6bba32497060e551e8ff2d3b63b0b16e91a74d0e9a2e75460ae8390c921541790b067a1dffb24bf47fb1ce803f09c82eaa
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv4k:NN4xIiuhM84pO5+t0pOdRvv4k
TLSH
T10815AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 1b3e45add216c9d055a09be8fd41606e52a4b1dacf7d87efd3be186092843360
MD5 89c60c6bbc05b488bb0a1a3740cba62b
SHA1 6734177de676f4378e1e8d886b486d53154f50eb
SHA512 8ed2bc44a702618e344479fe91dc0ae90b04c461da5d211a5120a25a82c2faf3d6069e73b307870f69906bf86295311b270a582088f4f4a24fa93f8a0df62a0b
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv50:NN4xIiuhM84pO5+t0pOdRvv50
TLSH
T1F615AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 7404021defdaca421f95a88351e086b1032ef5974610e771b3c7e926e8860a44
MD5 e3223bcbc1b119ecc5c87572303fef6a
SHA1 1f79d22af07821eb796a2196f9812d24cc32dca1
SHA512 5c1bac08edb285f99c6ab7fce3c9dc1a4f196613cb070f2e987ef16c8d8f01ede1398e16cbd47642a2318c9d09deebd698bfc9d16fdec3afd9b792479f2c5e1a
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvs70:NN4xIiuhM84pO5+t0pOdRvvsg
TLSH
T13215AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 00bd75d337a49dd50d1aef899831102bb360fe88020fb0183fd56e0985b059ef
MD5 6e55a0192175d2f10b1fb728bfc96ac1
SHA1 1b879927d0ca6ea2c81de1e81d9ec8e547c3813b
SHA512 0082459736988b4a33d6c17dee7ab08e6c56d9f806e3045e5788501165c9527822a8ff33c44d2986a09700fc6497faa5c62e0c9e63c851f05349ddc3cdb49ecb
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvJr:NN4xIiuhM84pO5+t0pOdRvvJr
TLSH
T17115AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 f8e6c1fd6203d1bb46de0389a973abc65a2e2cc9a361ea0c89ea4950d87f0822
MD5 f7a55cf250d40d6c9c3d675cc9693828
SHA1 53777f975e4a690e739e769e2cfb6724c5780509
SHA512 bb63d3457bb853ca032f27432f309d116dbdea9573895a65c54a5765e6f10dfc7ccdce30909c9459fab1032896f5d745ad7e903ad42c857df7d0d58e33eb3428
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvrn:NN4xIiuhM84pO5+t0pOdRvvrn
TLSH
T13D15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 73cee18c2c49ce0ae0322d5eebd8ccd59d0b88bd5da0c8cbdc0ba3e75bc04cd7
MD5 e39d5d37c31aa4376894aee4e28c6f15
SHA1 ff9a3d7820040b1ac465a3a60a453a64d177efb3
SHA512 8b385701c27cf5a67e6f895a1fa6d744d95f3b9dd3dfc211ca08ebdbc20ecffa95f589b5dd9be6ef38921001159584e49ead23098d1d569493090effc5cff71d
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv3x:NN4xIiuhM84pO5+t0pOdRvv3x
TLSH
T1AA15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 0b1f5d0eb89738985efb9beee1712af77eef93cd8af694e47b90fda72c83a804
MD5 ac8f0621ed19822132d8568c9bd1e30e
SHA1 8c030f606719371397a432d60d4ad1925984141c
SHA512 c7b6e272f71ce40ba493e2c7d39d42669455e9788c26c02a864c76687b731898d8223e5b5b2fd5a2748e6493e7d1e3e1102534646c58a88df53ee50bc5509301
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvtA:NN4xIiuhM84pO5+t0pOdRvvtA
TLSH
T1FC15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 67530fef64b58e97ad68a47d9d39824389d619833576ad1f9f47fa0db46b1d22
MD5 b5d66169efcd10d34c7b71e92700c7ef
SHA1 285c0f3945b61d803ca9de0966294e3313b3a558
SHA512 0b5297a192fdcf9f5ccb33929c735add95c37ece2cf886187e4392638bb6a9742837176eedc9a55743cccab9c1e15141a1de727849856f907c22c1fda9f3a99d
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvm9Q:NN4xIiuhM84pO5+t0pOdRvvm9Q
TLSH
T1D415AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 34dab7a2262eeaa037dc481b1ffd3b6221c4f620aa35366819c5098ac428784f
MD5 721d52a0df00009d82043b5408772052
SHA1 176e181aca6b19c6e140e8710b4e649ed5925686
SHA512 c730646e2bc0edca184c0f692e23a963a2ea52d7988d6f58b9d4a5c8bd26ef1d2c8f221866590c9aea6bc09f80a86b2547063a8a91ddb1eac297f29179ac9898
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvD4:NN4xIiuhM84pO5+t0pOdRvvD4
TLSH
T18515AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 1d5516fa86a1210fbdef9b8f420b65117489a29bfe21e6ffc41fd99d5cfb00e6
MD5 eb5de59f140c4e3f363080b0bca1660a
SHA1 8bfd2848e3ccf025baff76efd017688f58ca8236
SHA512 ee5abdfebdaa92faccffc052d1d9a976350ec955df842afd526bf47a6b1791deab51f407e7443b975afc2557a5c4d9e09a8c59c80f1fa34f37d1b59a192fff58
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvqu:NN4xIiuhM84pO5+t0pOdRvvqu
TLSH
T10B15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 b25b494047a9062afdccf6804ccbc9baf38ca121709b0fdac3bb4ba17908b759
MD5 5203ea0ad581b67a09e5fc6927e32d3f
SHA1 b6a5e215a76c98304b851305850d62077677acd8
SHA512 2b7003fade069ef69b7702b221892a1ca5d998fdaa11ca4a2038156c0fd240e3029ca71082e2455768962c5b9801f760a9cf957d452f001f3287dd6bc8763d67
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv7j:NN4xIiuhM84pO5+t0pOdRvv7j
TLSH
T13315AE21FAE0C075D27B09715AF5C7319979FC610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 7420f313d4553a424f6fbe9f55e7a619fe9e8181952f544b358df55f519ace4c
MD5 83e445479680d0671ccbd2659e4a6274
SHA1 db9b71d54738732bd7a7b478b7d73b0f8bf754c8
SHA512 a4d89b67f10f9c42421da9e065e2cdddccd2ec938a33b492f3d7b1c9e9f11811ec49c8047679dd2c1ca3f39744a0dad469a28757ba66ea48e3dd01b3a91f18af
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvGg:NN4xIiuhM84pO5+t0pOdRvvGg
TLSH
T14D15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 24b2ca1e93574eafbec93c55096f74b2e2ea21efffd542a9d12372c2a9e59aa6
MD5 23ed85f7d1de453d504152a29d911cac
SHA1 e6d8f4ccce5495d48b921a706ea9be1d9c6b8727
SHA512 9e6a029e5c03c4d4a87492d68d8c3cf4992920db1eaff0a3deb56ace6cb3b25b5257586c78d5a51c27cee21f9899898ff03099cdbb561fb19816457bef6355ee
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvpI:NN4xIiuhM84pO5+t0pOdRvvpI
TLSH
T13C15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 fa17c93a9265b9d99e90af6e1e801a5601cd6cbb8b4d22abb1330792fe11834d
MD5 a45a8b3598681c4aa400765f03fdcd50
SHA1 6cf705f580c94118cce0699c35390dd885a1f45b
SHA512 23a99dc78657fd97910707e67397e0a992c568f9c06977a674f589bc6e2ef6ccef4c51526a44ef24498964e451687831731494d98b083efe470631784a385e9d
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvLo:NN4xIiuhM84pO5+t0pOdRvvLo
TLSH
T12915AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 392f695cd1b0397dd7e12c407c314377e9c98ad35426f1a07beee0c41a571b21
MD5 949ddedcc3b91d9c5b2a86406ec4fbea
SHA1 6cf1c90f543f519f0f09be118e18461ff411a8f6
SHA512 4ea0c97db9abf1273462e4920268fcf9c044313541791db6b3039151cfb3a3ef1ad12161ca242f8af3401fbbd7888dd69471615ebf8cde979af900b2aa918de7
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvw+:NN4xIiuhM84pO5+t0pOdRvvw+
TLSH
T15215AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 3318e61ad1f58679d9e2083da6f69baf0eb4dad2695eefa2077e5cba4b9bc058
MD5 daaf3b60e076d77b610466d5ea370bfc
SHA1 f837a49a4bca60616161ce0355b350b0bf5a8bbd
SHA512 672eff8a3abc94c593239f9e5d324333492dab2bd51f38a05a59a87d080e16b204db23fbea63442d404f20cf3ae6502b66e4ab14c362979b9e4cc2f8dec9d0be
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvIQ:NN4xIiuhM84pO5+t0pOdRvvIQ
TLSH
T12E15AE21FAE0C075D27B09715AF5C7319979FC610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 9b4bf565023245ee2bfd6e13c8c1d0a52a96ed4b72b0d1ce285f3df7515eea71
MD5 279b5862bf0c8a67eeee16a5dce2ef9f
SHA1 a0dd7f1057ddb80aca7ab6506edddc1de220d52e
SHA512 91dbef24c0b39cc6246fe329aa950398ebef4fcd5b448b35a764ee568cf7b4fffdf6035a49034891a8665b3da2c6fb0d37f13dbfa6dda2ba5789611ad42121a3
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvBX:NN4xIiuhM84pO5+t0pOdRvvBX
TLSH
T18115AE21FAE0C075D27B08725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 b0112af002ba567df8bd01b6d260739961601f4bafe8ada4a1ee06e086c6f72e
MD5 eef2a5ee76bb7f8f65e45c0a14aa62e9
SHA1 faac75aa5cc629b7c87eda6f0c9c8c99e1bd22f0
SHA512 fcfd6b66f90cea68cc0c74bd85596df19baf2531510cef43b0b68907e7f0f34cd8ca8920698d8a316d3846675ad4be0b0b405c6359d785242de599e91f1bd5d4
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv7L:NN4xIiuhM84pO5+t0pOdRvv7L
TLSH
T1C615AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 ec2316e57e84f747f9d62b62534692f4fed67918e57d96a47ec12b195f9a69c6
MD5 87ad63b3be810f043d77ef1db98c2aa0
SHA1 3a34450f90eadc33914ca4ea03905d69bc5fabda
SHA512 f1101c71496a1e3c9de397e1a671d0245488e80c48145ab6b1f51064f4b3b8d6e0cb002531a58822c677271791b51f3f3fa768f0e5b045587e1dacda95bae24a
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvBFC:NN4xIiuhM84pO5+t0pOdRvvBM
TLSH
T1DB15AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 6e64a80b062f821926a7daf49cd441e6af2cc5bbb94e89e80befcff2e863a5a4
MD5 6e9ee87c56b7532caba1f36edd9554c0
SHA1 26fe72010c0879c5358f489f30d4a5acc1c1640a
SHA512 12adc703a3b515280596deeb8e683940d95e972741f7dc08a0755065e5b3cdf6cf0ebdac5b904733731f3ecb9e7aeeac9909c7477fcf2ab1c4fa6049c337a8ee
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvqh:NN4xIiuhM84pO5+t0pOdRvvqh
TLSH
T12715AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
Size 877KB
SHA256 fd899e6ad8857fdedbeaccd53ffbde1cc64a5de544c775c2961bd6e5b7c20bd7
MD5 287372ff69ad635d15d357be116f8b0a
SHA1 d2d18a30119e273fa6cdd3b0763714e4b6909905
SHA512 7c6cee5180dd21583eaec5edc7ea2af11e526d8a05a95c1b9f5a2deb0508ae55f463ce07bf4767ae35d4fa42dedba38d2212a82770f5465d99cef87317c89d20
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvcY:NN4xIiuhM84pO5+t0pOdRvvcY
TLSH
T1B815AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
Size 877KB
SHA256 96419a209902ae8ee6a3f43a54ddcb55b559d35265b29c6c1685c9dfcc8178d2
MD5 0a2d02a736a3ad8d057ca8a2dc2f2b81
SHA1 0cf8f61f091d49f90069f78910a47f7ac9e62b35
SHA512 cc295a005147de55b4f3ba1c8f00e9cd74b12fe35ac5c13b023dd25b341d7ca5472421bd6b71f79cdc45e3bba0fd0a0e6dc3f4f66107eab765eb0960b9d403eb
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvoQ:NN4xIiuhM84pO5+t0pOdRvvoQ
TLSH
T17315AE21FAE0C075C27B09715AF5C7319979FD610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
Size 877KB
SHA256 61d21c8c655b2d209b6bbd7673cb7afb268e471ebaf55c3a6e13c8396124a482
MD5 9e57fb4d35de9d543438278bfac437d4
SHA1 b2996feb478b7bfd86fc52284690f80c88e589f9
SHA512 8850321d697dafc0f9647449aab65ede2d5e95ab405c5b01737ed0832edfa4e7d12f89f6a135c09c14527cf1e222e984a601a9a99fe6ed64c7c697cf66dafab0
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvut:NN4xIiuhM84pO5+t0pOdRvvut
TLSH
T1A015AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jre-1.8\bin\klist.exe
Size 877KB
SHA256 a0bd9d4c241b1afd37a18872bd1bac238c38a3807321d4e26ad175aaaf27686d
MD5 fb66ec0608f3b6e7603b0bb413692eec
SHA1 aba8a152946ba4f6f153a54efa03c093590429f5
SHA512 c8951630617d0abf085e563a3d02a017b4511b796051df701b151fe4cd417a1c3d974010e9d2cbe04a359380093f2393d61ae854c856f8995f05abefefb18ad4
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvLQ:NN4xIiuhM84pO5+t0pOdRvvLQ
TLSH
T13C15AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
Size 877KB
SHA256 369e1b24c9931c80fbddfd8ad05cb48d1f36e25da3a30095d16aa3b325151c3a
MD5 400b372c1a87ae48e577a3edb7450954
SHA1 59e7983b3054d1f0fc88953a10cfc0acd2417c86
SHA512 777f3e89c1d1aa66f5a1d73d1f0dee9f5053b513c9b9a1e0682283c1be3bc3ecfe526d391032a943af5dc5be05404a1c620f493bcde4268ee3e9541fe603644f
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvoV:NN4xIiuhM84pO5+t0pOdRvvoV
TLSH
T15015AE21FAE0C075D27B09715AF5C7319979FC610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
Size 877KB
SHA256 3f987b1877e3d6d09280117de5377fdf4923da6fcbc90b495c32ab9dbee2bff6
MD5 88d6e737404d874bbf8a8b0e649074e1
SHA1 21db9c55db064949fee458d6b624fdbf61eec8eb
SHA512 49b5ab23d6a8d713d1210df3eb855eaf5a2005a078eef28318c675e3b100e75bd726543f747d3ddb730874242302bfdd7b5d9f5eca16d3feabd3ff131e445e00
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv99O:NN4xIiuhM84pO5+t0pOdRvv99O
TLSH
T17815AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
Size 877KB
SHA256 a3943cf7d4090f3ee80ebbc4174cf434777b6789961d8d831aa9b5d6ce6a68de
MD5 e536151fde20f0a5336e1d988c4dc8a5
SHA1 c194ea7ba09e81efe0944f52ca5e3abe7f865e51
SHA512 b0325f683407e6e3ea236869f672f13ecdc0141a512bf1fa541d7ef1aa047fe62989eec7381a355e4a62188a30a1c07241cef8e0a6341c72a9c87d1da23588fc
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvy5/:NN4xIiuhM84pO5+t0pOdRvvy5/
TLSH
T11F15AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
Size 877KB
SHA256 4f7f8341ff85eb46e4417a99b4541e7917a6cb8239e03f6e4b9ce95e3ab037b4
MD5 64b1c21e9b0d4b59dd4bb18dacf38aae
SHA1 5858a52dd2363e79173fd6f20969441a45dda214
SHA512 aec3ba3cdcd034dade40e96a9bddf6415f359cd1d53c511e21fd4f94552236949910156290452248a3b9a256e2b60e30cd83342d838cc2a0eb4aa0dd699cd4d7
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vv4T:NN4xIiuhM84pO5+t0pOdRvv4T
TLSH
T1B115AE21FAE0C075D27B09725AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
Size 877KB
SHA256 c879f0b4621586770f5f64eb88080bb447f62fb7979bbda2f1bbb1eaac5a3789
MD5 90490abbcb73a06bbe380c9e239928b9
SHA1 0f82b686ab6e2735604d1a080c152a8a9bffd90d
SHA512 3ef3325d686c1afe839f2664eeaddea6f365aa54e7df47867cf1c0b2bf250d6b2c29811583873eafa67827aad1471642e4f0b0a93f2061161f37217f0cfec5a6
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvKs:NN4xIiuhM84pO5+t0pOdRvvKs
TLSH
T1C115AE21FAE0C075D27B09715AF5C7319979FC610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 b3e64c8c7cb34acce38c6c378f2c9e8f3f040644e3a1f269bf6ea8fc2dda3dcd
MD5 00a4e96c3e7b2b3c929a3cc4dfec49bc
SHA1 1d9d56cbfbe42a36772d9f29222cac4889392f03
SHA512 32243c8424c1ac7e23dc61981c4ef5c8b7a4953f34cb717ea2170c936ad77fbc7adc82da8eb1da03d586d696b7ccf3fd21d33c2f08a93785d3a7fff8606346cc
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvBC:NN4xIiuhM84pO5+t0pOdRvvBC
TLSH
T19215AE21FAE0C075D27B09715AF5C7319979FC610B61868FF3A8926D0E317D0633AB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
Size 877KB
SHA256 fd82958343d7c84e3c88e50548a9a877e27ef5c29cb81f05d79f8f98e713d9bc
MD5 330fa041132004f6e56cda28dbc99383
SHA1 91438f8ebebf223dc87a1517c11b8565d2df2afc
SHA512 daeed88d76a486c6ad20cadd9e8f3195b165aaead95cf8f1c48d5546a244a3e491b3bbfcecde0fe087a8a67ef5b125d294b9786c05db9b7b1e3779495ab49b58
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvFI:NN4xIiuhM84pO5+t0pOdRvvFI
TLSH
T1FB15AE21FAE0C075D27B09715AF5C7319979FC610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
Size 951KB
SHA256 8be26fd6bf594d09fd42a53c26351f1592686fe7165b2622e892c7aefb4a7425
MD5 52f87e7d3f9ca41f68030b6aec1644ad
SHA1 dd3cdd061b93a754a0c6bb0ec3b5b9f5597a02d6
SHA512 475cc7e3e7844f80ae98fc605972e48640df3f7dac4b41d8ac8867246e221ad02f751f6c3b4dbba1f498bf99c2e3183ca51d2b65a7685e76377653e389982828
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvBQYfgHaps:NN4xIiuhM84pO5+t0pOdRvvRf2aps
TLSH
T1DA25AE21FAE0C075D27B4D755AF4C7319939FC210B618A8FE3A8925D0E317D0A73AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
Size 877KB
SHA256 85fbf0a771e4a32a5716a3902b6c66650f08429e97944441c57aee54615e776a
MD5 785cf5633fb3b22669c219c061287356
SHA1 8fbf39d7e2b9d3197221e5312c7bcdc8b3e4a4db
SHA512 01ccdfc83e46045acc492d2012c5fb73cb39b64acff7d8fb12650f270dc96d2ae55d234aa9bb20e5eff5a1fec60e4b648425ccd1093098e20ee834f4a28b375c
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvOv:NN4xIiuhM84pO5+t0pOdRvvOv
TLSH
T1E415AE21FAE0C075C27B09725AF5C7319979FD610B61868FF3A8926D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCANPST.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE
Size 968KB
SHA256 6494677b0b23a9227728c6858cbbee12ffea68d53e421e17406325c33ef3d149
MD5 e5b4924e8b5a08669a162d2cdf5d11a8
SHA1 3f04d8e03bb8fd6ffd2c296a3e8b43514a250555
SHA512 23f7e13c43cdbb78566e7f2e524055f2bc52d6e296a22ddd532435f85ed4b67f1f78a549621fd3f60cf5a5edae4c52dd97200ce649930284f99a9594d4739d94
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvxFRx36wKse:NN4xIiuhM84pO5+t0pOdRvvxFn6wK3
TLSH
T1E525AE21FAA0C0B5C67B49715AF5C7319979FC210B604B8FE3A8D26D0E317D06B36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelperBgt.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
Size 886KB
SHA256 10243fb19004fd02b8f2f6f8178c737473ee1a4f4f81fc8519074a50b2439907
MD5 7e017dbb604bf217b057ac1b58279c23
SHA1 093980807516c3d3484433443111ad9cf66a03dc
SHA512 5ea22a07333dada044dd9512c0f0a5654dc90d393874434dd0db061ba234e29310700285e9d10020377a8bdda924e10c643752a3bf9bf3a957e7e8b6b70107d8
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvv1:NN4xIiuhM84pO5+t0pOdRvvv1
TLSH
T10215AE21FAE0C076D27B08715AF5C7319939FD610B61469FE3A8E26D0E317D06336B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETLANG.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
Size 929KB
SHA256 4383d6769ca1fa270f909e8d393f30f85e48d932d9ec206c7fa3798b9724f022
MD5 62f41687e3a9ea2404656811ae6129b5
SHA1 6dbe8883b7aa51de5593bfea3bc6cfe2a8d455fa
SHA512 f4f4f860024e8f1f76570376ed955a13433327a869cc23442ec4cb4d37c59ed0f1e26e5f8861201c46237fbde61b1aa16f72355241e4547c83af7d90c3cdf7f4
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvsKHkUl:NN4xIiuhM84pO5+t0pOdRvvzkUl
TLSH
T13C159D21BAA0C0B5C67B08715AF5DB315939FC610B60968FB3ACF26D0E317D06736B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wordconv.exe

Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
Size 897KB
SHA256 c26579f22db22afc16be2b0f536f459d680d06e15d2abe2bd694e18b62306fb3
MD5 862f96619fdca881664de576e92e90e1
SHA1 bbf8b538482b12488ba0ee82a1cdd7b6492b16fe
SHA512 0ac2919c0c48f1a2a7e67de8d32491d99828e7c4c6e42ff87a6ffc8000a7473923bb1f3cbede43133f071006b46a398d309d372e7b53f4b867c488a302177f77
SSDEEP 12288:NIK4Uvp2woV5KV5izX6hM2GAu1mt0LDwrepmy+5+JL0dLo1d1W8vvLwZi:NN4xIiuhM84pO5+t0pOdRvvLwE
TLSH
T16415AE21FAE0C076D67B08715AF5C7319979FD610B60468FE3A8E26D0E317D0633AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1476-1-0x00000000005C0000-0x00000000005C3000-memory.dmp

Download

memory/1476-24-0x00000000005C0000-0x00000000005C3000-memory.dmp

Download

memory/1476-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3844-11-0x0000000002040000-0x0000000002050000-memory.dmp

Download

memory/4372-1124-0x000001D788000000-0x000001D7882BC000-memory.dmp

Download

memory/4852-925-0x0000025008BA0000-0x0000025008BC0000-memory.dmp

Download

memory/4852-918-0x0000025008E40000-0x0000025008F40000-memory.dmp

Download

memory/4852-948-0x000002501A230000-0x000002501A250000-memory.dmp

Download

memory/4852-917-0x0000025008A40000-0x0000025008A60000-memory.dmp

Download

memory/4852-910-0x00000250051F0000-0x00000250052F0000-memory.dmp

Download