f88988cef3e8657849879fca09dcf3557a22859ce814e557798e7007ba5b8a0e

Analysis

max time kernel
90s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 789KB
Sample260701-sdapbsgw8r
SHA256 f88988cef3e8657849879fca09dcf3557a22859ce814e557798e7007ba5b8a0e
MD5 b03e46bc3eca8ec66d7237d9be35ed2d
SHA1 9bc8570742712002138292014999f54599ec6a10
SHA512 dbb1445bbd1da1acc97ae92a0a4c1e8c1be0dfcef0ad440d65998817c7d15b3e81c40a867bce0b8cf66232eab8a0bb10d0baafed4bcba278f2c426a097c31105
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L88:yIifqFueIifqFuhCLfUQHzy8
TLSH
T1C0058E27BAA5A8F5C17BC57449E28321E771B8310721D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware discovery persistence spyware

Malware Config

Signatures

Detects executables packed with ASPack 48 IoCs

resource	yara_rule
behavioral2/memory/1172-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c52a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b4-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c92-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000189f8-198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a04-205.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a68-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019855-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-595.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a65-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1076.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1156.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1308.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1540.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1547.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1566.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1567.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1569.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1172-1570-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1571.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4492-1572-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1573.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1598.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1612.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1614.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1615.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1695.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1714.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-2013.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-2170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-2183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-2196.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-2210.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
4492	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{B5B76E5C-9825-457F-9A06-0DCB758FF509}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{AB2E4D7B-019C-42B2-9283-9D09BD568016}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3280	explorer.exe
3280	explorer.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe
Token: SeShutdownPrivilege	3280	explorer.exe
Token: SeCreatePagefilePrivilege	3280	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3504	sihost.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe
3280	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1172	2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
4492	patcher.exe
4480	StartMenuExperienceHost.exe
4440	SearchHost.exe
3280	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 3280	3504	sihost.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_b03e46bc3eca8ec66d7237d9be35ed2d_cobalt-strike_conti_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1172

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4492

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3280

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4440

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 789KB
SHA256 f88988cef3e8657849879fca09dcf3557a22859ce814e557798e7007ba5b8a0e
MD5 b03e46bc3eca8ec66d7237d9be35ed2d
SHA1 9bc8570742712002138292014999f54599ec6a10
SHA512 dbb1445bbd1da1acc97ae92a0a4c1e8c1be0dfcef0ad440d65998817c7d15b3e81c40a867bce0b8cf66232eab8a0bb10d0baafed4bcba278f2c426a097c31105
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L88:yIifqFueIifqFuhCLfUQHzy8
TLSH
T1C0058E27BAA5A8F5C17BC57449E28321E771B8310721D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 8c1b3fc21965b9de829a18101dd95b3ab04dffdc851c991c29fccf0de0bb98ec
MD5 1e65f415bd0bcdf1cda4e3c5cbff73cc
SHA1 220b8b39a8d23093b4c2928fc0c6939daa26b5c4
SHA512 0b8795375c787f24e10bb62c755b5659d60e5e37794e770a9d8ec571dfa9c23cbf0a08f3d51ff8e259188832847a4ae4456e6293a8044fb75a6f61a0a215714d
SSDEEP 24576:yIifqFueIifqFuhCLfUQHzyE0Le5ji0hmxNrM:OqF7qFpLfUUPPji0Aj
TLSH
T17B554A26FAB486B5C077C078C5E29756EB7274510B309BCB8255C3296F23BE19E3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 804KB
SHA256 69df785dcd49b2656989e2e246849fff3b5971b9488afb2e0770be9ce77bc5df
MD5 98a39dde8ee3c656f0aaa91510ad8b48
SHA1 7cac785d12f1c5de26011b55b8f834eedc01cfc6
SHA512 0bee449e5b33d027fa5c8998cd2fc19def49d353f82b22eecd63ecf7bf4f1566705932e5ad8caf140c9f5d5b145e328ef108cac1147e6dcf8add8418f1b4d4b3
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8ua:yIifqFueIifqFuhCLfUQHzyua
TLSH
T164057E27BAA4A8F5C17B857449E28721E771B8310721D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 837KB
SHA256 5342a9496410110f85c45bf6e71de90f9f41725686192344ddf02638d31061b9
MD5 bc2f4ba761b408539506b1af359e6f12
SHA1 938e0baff4844185656cc6ad46d5b4d3f740690c
SHA512 e0b6b8db00514f5772671f39eae6287fba161ff865fe0556852efae568d432453c1435d568a77a2b421485f12848c3b4908c8907fad29ed193ebd4332ceb468d
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8tb:yIifqFueIifqFuhCLfUQHzytb
TLSH
T1C2057E27BAA468F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 813KB
SHA256 7c4e9ed7e8d72b65a2935160de53af4ce56ba2ec34151941e1f856e2c4181e22
MD5 8207b6f6b23f2e1095c33b14ac3b6946
SHA1 d31e0c0eb2475ee46f293c61aef1f91b6b1e044d
SHA512 747e79b9ca751a5dc346390666459f8fdd90e99855fbb6fa92a6bc136e5199b3dc9e516b8bd6d90889fd4e40369dd079c78d233d848cfdd9f7a883d955d234dd
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8wZ:yIifqFueIifqFuhCLfUQHzywZ
TLSH
T191058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 813KB
SHA256 2daa7c576d35f287170ecf53bba918370f8b9db14e40676bec49d126fb9e7786
MD5 30bc41beed7e0b4b02ac2d35c6b20827
SHA1 b944324ba24c7d3fa32e6f5cc6992fdfe3fe0904
SHA512 31e27e709805dec3c51ce88c38f31319e588838746bb659763cc58171a8305d2db8cb8537276365323aeafee15800e8b56ebce043efd1fc3d33915e67a7a5ab0
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8X1:yIifqFueIifqFuhCLfUQHzyX1
TLSH
T147058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 813KB
SHA256 ef81042daf9e14bb681cda7ec9e5412496af479c9e9cb60934bdf617014e8116
MD5 bb01ccd64945568137515ba0424c8705
SHA1 253c475938d42d898213cc7f7fb215127db6355d
SHA512 c96b3c4e600866afb6b6c676e92b628da2988b62c3b56381b5d15defbfbf764ac976568e6b0d30a5b682c8504cf4863995407c99a1a095bde0740c158ab151c6
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8P6:yIifqFueIifqFuhCLfUQHzyP6
TLSH
T1A4058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 813KB
SHA256 f15bde03f92b6bb42be85ff688f80e5a0b466e345c62ec33a1e69a4d67ce73ec
MD5 38de2f7cf2282cfdd3335535c341671f
SHA1 9a3e1fd895b798c65a590f3dd9108149a519f76e
SHA512 133df39542f61373cebc563bc7297ca2f235a299b91e60f76fab1c53a16963dabee2dbcb5789b3535071d027b95c219feea5d88e95f4564198457a11296d136c
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8RN:yIifqFueIifqFuhCLfUQHzyRN
TLSH
T1B5058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 813KB
SHA256 a2a3cc2330d3ca3598aec792bf0eae44c41f7e5518f28407d8ab24120e6b5ad8
MD5 6c5f5170c8b0b28cf32fd3c190b8e434
SHA1 d32be08a758dbda87d12b73dcaaeab2bfe1bbe16
SHA512 473acc18741de724fa1322b07314a733501dc3ba90bfb2acdd48afac498423db338fb0741f7fca214c5b4899d2937d1995f2323242f5ff2a4c25182fc207787f
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Hf:yIifqFueIifqFuhCLfUQHzyHf
TLSH
T173058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 951KB
SHA256 34f347e28089d8770c326e6194fdfb248a17a5102f2017a0c5df32a19b75b045
MD5 929747ee19371b5f57865dd99b411685
SHA1 51492bf0ca699792ea04fa14f8c2347590d23c2c
SHA512 37b8aaaee5e5383d512b2d0661fe568fc96bf720e319ad5c3ed8d80a8b1fe622c03843cd758938f49883bfae6fb7327ad9080038f584bf8f2bb0131af9d5084a
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8jyPz5L87:yIifqFueIifqFuhCLfUQHzyOzy7
TLSH
T158257D27BBA568F5C17B857489E28721E771B831072097DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 813KB
SHA256 65ace4ad01f2acef786979f544e26b6bf9634688ee6cd1fb95880ceeeae660fe
MD5 d1230ebe90add843c608647bc7837bd3
SHA1 782da4a817de96a60729f70c70c846bdf335df31
SHA512 9530b8e4027c8e33810859509d12b494eef9b8043a9d9d2c8ddc4c9f5c4a9325cca7f3aa0384f39d111749ffdfaed3a0ca3a03c7ce7b7f1ed94ead4fd3ee2dfe
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Jo:yIifqFueIifqFuhCLfUQHzyJo
TLSH
T109058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 813KB
SHA256 c5b65a69e4adf30c7dbe193b819c08ee26220bd7bf228474129880180e355ca4
MD5 8d7d7c591c2c4150bc565a9d43df91ff
SHA1 651383def295ed8553da2d51320ad7a3e02ba69c
SHA512 a522db28108b7feb0decff11c2094a4cc2e148168f2ce37ca5991dc2d10fea5bdbe4e4767804299341dc54381a2adaf2979bb192c2b1b558aeebd94ffe134d8f
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L85u:yIifqFueIifqFuhCLfUQHzy5u
TLSH
T121058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 951KB
SHA256 70745d17d638131f88cc7d24e3b74a53b103f1d8f18b75f51ae15c0d2a0fcedf
MD5 fe02c0a21257c93953802ece1a200a9e
SHA1 8c2105ac052bab144f3804c1c926e4effd10f754
SHA512 6ee2f21aee36a779147222855e128f814d652349ee7c20148137ae5a84c002013050faf87a3ab80ac8211b1704d1511b46425dbfa768488c81c7042956aefbc2
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8WyPz5L88:yIifqFueIifqFuhCLfUQHzyrzy8
TLSH
T175257D27BAA568F5C17B857489E28721E771B8310720D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 813KB
SHA256 b1c883122c483c80d2ee4b1da7983ad9988d814a85fb28b31224aabd6f42c95f
MD5 792cab341996fa04f0bcf7fd038ffbd8
SHA1 ab6e3fb74e54714fe56c55ea2a23d4978a8d5503
SHA512 64a04186a68492026945385879c5924d31230147c3ce4308ce1558a899b57803da6e7694dfebc55cd6cc3f5da9474261bc94dbc298735d1c6aa09f66085ccf2b
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8f9:yIifqFueIifqFuhCLfUQHzyf9
TLSH
T1CC058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 813KB
SHA256 143952a30bf8a9900a7d671de986d2bddfc161de8de00f5b80d6c96eaa1f2e01
MD5 85ce912e83828ee129590a1a540b018c
SHA1 2f433b36594de08944b5b9e049aaa1d5fb045ad8
SHA512 21eb8df84acfc2bf93e9f7f544e1f4de9d304d97e497d786275467beb74af51cf4fd16f58c30df7ecbfe5da3a625c8888df5e6f43b0f288be9547f583a4b27c6
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L87c:yIifqFueIifqFuhCLfUQHzy7c
TLSH
T1D8058D27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 813KB
SHA256 394b17e522321727fc931892aa20cfd1a6e6883cc5fedd51bc072951c9df9753
MD5 28f5240c0f88e590df1c1aeede12001f
SHA1 c581016e1a90b079a769a2df1c6cd5a5b8716537
SHA512 6ef2e059fd2e3250b9a32f1ad23dcd7730b890bd298d352efa9e68842399fb2ca6a9b431f7847fb515a6348126f8d9c599cdb6f5afdffe604de8b9d6e9f4b382
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8kp:yIifqFueIifqFuhCLfUQHzykp
TLSH
T135058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 813KB
SHA256 96e10fdc908a0450138740e2a6307981874b51e017b036da54a4aa3093337f86
MD5 4f3ede6dc5f3e3d1fbc1711549dd86c8
SHA1 4b7e596405dbabb6937401b55b6ac19e2dd0fb35
SHA512 3864248ca8890807fddcd464a2af02d128e1c8d15b4f8191c699d8e6414fbcc02af9359a6ab1d5b8cd2466acedf2ffd3f035ebfbd502e5309b549bc271404576
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8r0a:yIifqFueIifqFuhCLfUQHzyrN
TLSH
T115058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 813KB
SHA256 712af8862c750c70952f811466a70809d26efc7ea342da77de062631274b40ce
MD5 e062fb12ba10d646f9049e714221d849
SHA1 970897d70377d06e799d9bb0b69a81b4249f2822
SHA512 571e396670a0a515dc86da036be6341c7f838ce6f1d3bd975b5ad54140f870be631a4440346062f50ffda83fc862b2c3b1b0e12f47d500298f9968f479029e08
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L85F:yIifqFueIifqFuhCLfUQHzy5F
TLSH
T100058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 813KB
SHA256 53a42363caa90c15600ab6899286eea77fc7905e457d8e8d6783ed6e4161be17
MD5 e78d35596fc5fec35462f03420e6a3d1
SHA1 4452f7a6cdf1ef6df28cd6f85c401f5982d2c021
SHA512 02d355c9c148bfcf84a89abbe488c9ee492479f46855104937f10543b181dda8980a81f4cb76bb8f23747cadf1c9fc1deffa3c7920a9e11a84b2413f3325bf99
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8SC:yIifqFueIifqFuhCLfUQHzySC
TLSH
T11E058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 813KB
SHA256 2d564ae655ea9ea2bf7051d6922e81c4a33a6e2009e36f57487b5f4e3459083a
MD5 5f1b380c1052d8e1351e7c90533f552b
SHA1 c160800a525f0c0ce443bff03b61b0968b934274
SHA512 4241f05434b63f99acb76c754fce9d71a572cfdfc12b57aa804b69a7e786207ea0b8325eb38566652c3f7468dab23e672946fe4c0a287f9ca4d6fe75cef66a67
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Nw:yIifqFueIifqFuhCLfUQHzyNw
TLSH
T192058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 813KB
SHA256 5205c4d30ff9249a3e21f9cffb95947380beac69f3473c83a243901ab79d04bc
MD5 633154ff53fffcb5d062bceea70661b2
SHA1 0c128a96355b615ce0ae264fa157c7d112f10f2f
SHA512 1e6d75923f235dc7f418789f0156619e45892f08a4a83d339d49fa6bf3ae9c50c66b52976a52b68b8c63629cf7c92dde6fde17d3b7e9ec5ea33454027d7fb3aa
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L88T:yIifqFueIifqFuhCLfUQHzy8T
TLSH
T15F058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 813KB
SHA256 353c6880d97501b1dd6b7eae52744702280487d7be4d4a750cd079d46d289a7b
MD5 ecc2d91d514e81016aa2128d949ccc0d
SHA1 19392914878b6f8669089c36c750bdfda997b3ac
SHA512 669fc161459e808993f5d7c742c0aa4cf3951a129c2270ccbce2f4568faeb35f2b21d4179b0afdd64577575712fa2e06afada2ec972351c3655dc379c6f9a976
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Qu:yIifqFueIifqFuhCLfUQHzyQu
TLSH
T1F1058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 813KB
SHA256 ea117f039a8567da614e0940d9871121287d4606242b242490cb52508a4e7614
MD5 b0d0e986d6c3da963a96b0a9d0fdfc9e
SHA1 3bd32c60a2fe3e0059864dd6af3b12827f86818c
SHA512 aa8ae400eed3f5513c301ee228c21e6bf0f32f55820e41ac95b5c76a3c97a937ae7ee3d50c1b79a9c5d3cff27429b64bcce2e02863859c9ba6e88ec7ca5a05c0
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8ub:yIifqFueIifqFuhCLfUQHzyub
TLSH
T1EF058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 813KB
SHA256 01d0bb3b0f0ec2c206d038c333be15c67b621893526055238251e99850bef2b4
MD5 be2cbd987dd64819b90011857486616e
SHA1 28ede8c33d5386d5f4ddde7e3a8f87a74a0e6c2b
SHA512 a40697cc38467368c2ccd9d0a56f4a48611c3a294a7118aa4e0e6b6a5bc0ba25cd8432491103514e835764fd161a7836f72e42513e016b8e7b551a3c2cd1ba20
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Yf:yIifqFueIifqFuhCLfUQHzyYf
TLSH
T1CD058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 813KB
SHA256 9b48d6b47fd727ee39cf78ed82c812c8d9aa9feb381c3c3034bf6cdcdb30166f
MD5 80a6e2a685f870e3988767e5d9f2e521
SHA1 94f853aa505b057ca3aec2f6f245b80c0fde2644
SHA512 c33f931fdfaf7fc204392685b37a556856c04b0ff8c12cb4d2a465fd41f3122a50d216c882cd06a37c7b61b352723af98a6beb04fb5bd7bae155f158dd12d520
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8VK:yIifqFueIifqFuhCLfUQHzyVK
TLSH
T114058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 813KB
SHA256 df6a043e5b83ba5703959faf9da78a8d9ee2d6be6c128b249ffcd82335aa12b9
MD5 c314d11f5a9e59e4a8ff41af51230609
SHA1 3a2b6469d6138966775a3ca53bf0f92084fdbdd6
SHA512 75c0625892523e48d6f2983a74a68ad08b3912958b5d82fc89f93d9ca547dbf2185fe9240df1c7d2d1355b65609c6aeda4e08b1efac7aed46c7dc9fd059f99e2
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Wk:yIifqFueIifqFuhCLfUQHzyWk
TLSH
T174058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 813KB
SHA256 b149452ab78982479ef3de8f16a9b3a947fe5cec75eef54a080d966268fd6bf4
MD5 9a8df4934bd3bd149f4ab9ebc1a60e6f
SHA1 b59f7eb8b705b2a2285f79acbfe98b1abff314f4
SHA512 63c03d53e8afa3681accc1b2e705eb0b994b2614d18f93201913b60159543232334dda5973e8dfc776a4bc8336b26590366e152b6accccde87fbec5af9ea183e
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8z0:yIifqFueIifqFuhCLfUQHzyz0
TLSH
T145058D27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 813KB
SHA256 49cbd0b5962f70b13b3e59a284e96d9830213a8a3715a12c1bf9f12c9acda6dc
MD5 066dbe083c4b14c9dc712545d43ac31a
SHA1 da630ecccba61c8f024b84a97609f63bae93af6b
SHA512 c14e116c4155a03528ec243c3bd62a5b45006ee9cd05e874a69e92baf68a67105bf70925d8101b8aeabd3957ec5cd5cac6cc8dd2139447d0c65825ed7eae2638
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8C70:yIifqFueIifqFuhCLfUQHzyCg
TLSH
T1DA058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 813KB
SHA256 38b1ade7225ea67f3121f573caafe213cc5d1cde717282536b549d2413a088c6
MD5 3a892500ad7c17c2a26ea75d922fc7f1
SHA1 3119a38f8f3e308fd16bf43b16ceff0733e4846d
SHA512 1c7948e6815c156b475e06e771403c22a47757c56c570a4398f47e2b7b92accea81687a1324ac3cd5b2eeef00ae3697f00058dda5c5ac973c833e756b0855da5
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8jr:yIifqFueIifqFuhCLfUQHzyjr
TLSH
T175058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 813KB
SHA256 83db34b433be8854ddf2794bdeb60dcd6025d4dbc467420005ff9b33aea2c1f9
MD5 0e4fdc1efa4b32a7592ae2d44d62b5c0
SHA1 ebe0aab5d9b4d8dc6dcbf824d244bf73fad9becd
SHA512 2248cf1d651a39a662ed21c30fe56cfe4e887c353e188efd20e07d4274f9c38dd773801a9679cf564ac97ae0903a01310f6d69e096d4a422d47d9f43019e459d
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Fn:yIifqFueIifqFuhCLfUQHzyFn
TLSH
T147058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 813KB
SHA256 1aea293f1d68adea601bfe3792fa839685cd7d3272e06ec64262fcb5808a9a5a
MD5 85a2fb0d15e2c9cee18f7a173c42bb0f
SHA1 09be3c6b18b2692ccc1905f4e6f00ed7d64b4e2e
SHA512 c5547ba131317a4640bc226d68e9f3dd248ed724aca40ac2b761ec95b300e7dc24108ef0642fe12282c876c5296bb27115b82d14a8ca341ed54d9995e04c24c5
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8xx:yIifqFueIifqFuhCLfUQHzyxx
TLSH
T115058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 813KB
SHA256 f626ff375cfdfadb4c6469c4d1ded6041527b9ac0b007806362f3e321e030965
MD5 29d0e5011c28526f2262d5902a8af738
SHA1 dff950b0ef823f64dca3430deecf3833bb5262a1
SHA512 edddf3717e8c042bb266e96b6eb4cb46383a58691ee4f802cf8ea9c048b1970972949b6521ef6c604d1e6b146bb0b9ab4ded8833e4eb240c4c8d2783634d2f39
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8fA:yIifqFueIifqFuhCLfUQHzyfA
TLSH
T110058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 813KB
SHA256 b68bda26d930e2b7ec55f77e35bdcfb29adde8c6037a124254de7192243b1917
MD5 12673935309d5feeafc144ed3fce6123
SHA1 6203930d1ec02bfcbcce7807af06f165afee1988
SHA512 1c4af9b54c93205f6c75d8b6ce9a078f15ed6ea2c65422fb2f0916f232a1f1813948b0cd53217eef5c6d80a03bd516d1133b194bc1c71574d27a620a097dc33a
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8w9Q:yIifqFueIifqFuhCLfUQHzyw9Q
TLSH
T191058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 813KB
SHA256 85afd4777bb9aca713071842506e828feeb710e97b426e2548609def28ff4352
MD5 1cf52403ececb3a7085a76d08af27ef3
SHA1 f17b6a83cd0ceea264777a70f07dedfa8c75c2ee
SHA512 9d090d0e0325412b09675badf152f8d2c31f2253c1118833ccd80bd2ec2457facc87154e2c3e5fe3d419747b1a54d4033757b3752250de0aae616d89fce7f610
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8R4:yIifqFueIifqFuhCLfUQHzyR4
TLSH
T17D058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 813KB
SHA256 dc61ad5341ba4152659cdf89273517870cf3f43f2e67690c400fd5df2cb20055
MD5 894ffb178567ffeee18fb14f47205e09
SHA1 55a8af9a680457443b211fd38be1e581fe015d95
SHA512 071dbf9e9273000b4a76b5137287457b434f24b466d79e063ad92f0fe42e1c22f8d3ae2ef49ca9229d21a7e1bb91b19ab53a7f6fef21214a736fdfb3965ab147
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Uu:yIifqFueIifqFuhCLfUQHzyUu
TLSH
T179058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 813KB
SHA256 bad37e78a13d753fdd42d343ce64e20056e63fd36d356921ace8716e7c981565
MD5 58aca036f7a995f5964fe7b530fd3247
SHA1 bb20f9bf902f413687e166b7ca22bb12659499e8
SHA512 6bdb6e78402829ce33e915574ad209627c0d7db9e0c875c90f1e687e14f5907cf457ddda74942f9b2b4f02c6c6424bae17868dd399aed7ad6be9b92addb1ca87
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8lj:yIifqFueIifqFuhCLfUQHzylj
TLSH
T1D4058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 813KB
SHA256 9b568fb7d871062e862747d4fa20347757a60668367963f29c6258e2e0bcd0ea
MD5 00a12d4da8010e5fedc175fed2d3a60a
SHA1 43cf10f2d94bdc077ac601908156694ca0058ecc
SHA512 d3851cc98fbf0f2f7fa4259942cfb85a1c55d0cfba3547a29ece4321b8a8be91298572efd7ad8fb8a0a0e510a5dd1f59a04911e39d235ea93d7b3be2449be413
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8sg:yIifqFueIifqFuhCLfUQHzysg
TLSH
T107058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 813KB
SHA256 d91d3523078cf2b2b5d10d3377ad6a26914c51c177ce5b8963917f6dabd58b7d
MD5 f89c79e057699b65113c6d29d7c80336
SHA1 689f4128a0342296dc31cbfa92f260a5e24791ce
SHA512 676efad133be3f19b4121b0942143750af1ecab93b78445dbd54d52f64b8dea1488366aae81f004405c5b26dcb7456a95045585ca022d409a28b41a98e19726d
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8zI:yIifqFueIifqFuhCLfUQHzyzI
TLSH
T167058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 813KB
SHA256 5bbfc1a73b7647776411e1ac5f96b5673fcdd44f7f2a5acea5f0f0bde18841d8
MD5 28fc5439a6aa48ece75bf0e8a21c1f5e
SHA1 25741727184803e3a3479d7c9699a1319b4231ac
SHA512 854458a4ec82f8e551ebec1a5729de79d5f7224ab265ca49a7836b19ac449244cb4e0c65c81135d2d4c6038ce317af9894302006e2239f00fb110849b833f935
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8Jo:yIifqFueIifqFuhCLfUQHzyJo
TLSH
T1CD058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 813KB
SHA256 302ddcf2e80b78e5714fdec9627725ca9051b80f5600f252bd8a5c2d3840c5f3
MD5 fcf6b3487d48cb2fbd060bfba4cf1410
SHA1 67fbb7a1249636ae802c6ab253bb63f5e5a2efd9
SHA512 c6d352e4caa4c99b652c50eaa7ab8ebb93f561e4b1f9a7f791c30c0384420fb7e94e0768f62fe0bb95b58ca4da148053a76bdc546165ceadd014c30beb05e867
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L86+:yIifqFueIifqFuhCLfUQHzy6+
TLSH
T1F5058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 813KB
SHA256 6b0ffa96716a34641eb97ff2c2600dcc7d890e71e09286c64e2e361dacd192dc
MD5 7da7405149f3788ac11973589de02767
SHA1 1c04532ab91a838ba987236b917ef5b045199d04
SHA512 28d18d1fb9e47f36507751da6ba919c5e7a570eccff6f082eb8de8e9abc12d66095cf2991b9b30a1eed62710daa2c593444f36d78579137518edcf88fff32438
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L86Q:yIifqFueIifqFuhCLfUQHzy6Q
TLSH
T1B0058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 813KB
SHA256 492b2c8157d51260aa3dedfa860afe19a3b0ca049aa24cd50ea4ad3fd3a6fe7e
MD5 17a1061f015687fe218c4339ec2d0459
SHA1 d852c54c5812df3ed0085d90ee4efdf3e1bf1082
SHA512 250749b0a45ade6004f4833ba5698c7685718b300594a6b457c91d29b7a192309d3869a5eb0576135736a30c46f6024efc7e27fec753a1f099cee7aaff081d9f
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8LX:yIifqFueIifqFuhCLfUQHzyLX
TLSH
T19D058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 813KB
SHA256 7c85f5e4a25121f263d04f59e55a5ff68923ea0a9d4efab78677603309502049
MD5 2b3f7fc74f74971183f06fb8ff9fac5c
SHA1 a4ac4b69993352e8f7bcc2ec277b2dab07a1d863
SHA512 6536f0b2410cb8931efae2d50ed12119d4171ffe7364c0847ba5606ff120fd1a89c126f34ecc1096130b11343ea0d73c6bccb22a52325e214f9193ea39dd31a9
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8ZL:yIifqFueIifqFuhCLfUQHzyZL
TLSH
T117058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 813KB
SHA256 e710311b937817e94ccc6550ea4efb96c4d8aee03329d8dd2dbade29bf47d104
MD5 0d1202f3716e8ed8f5d0ff9dc3d732c1
SHA1 106e537f56d015c8b03a6c5b8e93014fc1fc6fdf
SHA512 4884159094ca70a502a9dbec971b230b0185f2adf01b771ead83473677d9be7f33152d58fd9a284860c170ae769e25804ab181b0bbee25e49546bdbcb63bf44f
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8HFC:yIifqFueIifqFuhCLfUQHzyHM
TLSH
T1BD058E27BAA568F5C17B857449E28321E771B8310B21D7DF9364C32A5F23BD05E3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 813KB
SHA256 969db59d645f857ea6591b16f57564e445370796dd726feb620508f0ef24e9be
MD5 359975c3ef3e35a40f255e8943c9fdac
SHA1 7a15f248dbb1da179fe5b4347a97fe85db7b1652
SHA512 58dec60438f8fab290dce6e94742b7058b7c8fdcd142845ad110d1e7e72723e791be76f0a24deeb5ae5a136cda0891ab961ae1be3bcf76a3facfb30ae9576c0d
SSDEEP 12288:cHV5KV5izrqFkbOV5KV5izrqFkbhCnBNUbTYfUQayPz5L8wh:yIifqFueIifqFuhCLfUQHzywh
TLSH
T1BE058E27BAA568F5C17BC57449E28321E771B8310B21D7DF9364C32A5F23BD05E3AA24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1172-1570-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1172-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4440-762-0x0000021A801E0000-0x0000021A802E0000-memory.dmp

Download

memory/4440-820-0x0000021A946D0000-0x0000021A946F0000-memory.dmp

Download

memory/4440-787-0x0000021A82E90000-0x0000021A82F90000-memory.dmp

Download

memory/4440-786-0x0000021A82930000-0x0000021A82950000-memory.dmp

Download

memory/4440-806-0x0000021A82C90000-0x0000021A82CB0000-memory.dmp

Download

memory/4480-1107-0x00000253F1110000-0x00000253F120F000-memory.dmp

Download

memory/4492-1572-0x0000000000400000-0x000000000040D000-memory.dmp

Download