ccb0c897570618708b6f454a036637ae177ec468a22366c587f863772dc428b2

Analysis

max time kernel
92s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 940KB
Sample260702-sdzcpadx4k
SHA256 ccb0c897570618708b6f454a036637ae177ec468a22366c587f863772dc428b2
MD5 610c7de0f2d6c1c6b37f78ccc7e525b4
SHA1 70dfa272a19ce17101539809d9a9b54f52b2e807
SHA512 f181300d47f7f5c649a2f88111740f2bb82d50f14e8616e19afeaa6a39800ea69ab057e31645323d2e318169016aeb36c91b104b0360b812e5723c2b21a381f6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZc9:A3mnXoZjzyaTjtqCD5TvinrmFmcZc9
TLSH
T16E250406E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware aspackv2 discovery persistence spyware

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/5236-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4b1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5236-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6048-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e4-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a09-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a15-209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a4b-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-235.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-248.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-250.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-289.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-308.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-429.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-449.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-462.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-463.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-482.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-504.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-505.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-518.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-521.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-529.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-651.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-682.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-761.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-829.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1196.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1295.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1362.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4b1-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b7-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e4-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a09-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a15-209.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a4b-228.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-235.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-248.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-250.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-289.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-308.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-346.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-409.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-429.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-449.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-462.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-463.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-482.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-497.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-504.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-505.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-518.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-521.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-529.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-602.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-651.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-682.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-761.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-829.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1196.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1295.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1362.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6048	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{6253CA12-742D-4CA5-B050-EC86D6618E1E}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{4ADF1976-1922-49E2-8462-C2944848F893}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5692	explorer.exe
5692	explorer.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe
Token: SeShutdownPrivilege	5692	explorer.exe
Token: SeCreatePagefilePrivilege	5692	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
1128	sihost.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe
5692	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5236	2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
6048	patcher.exe
4724	StartMenuExperienceHost.exe
5692	explorer.exe
3432	SearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 5692	1128	sihost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_610c7de0f2d6c1c6b37f78ccc7e525b4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5236

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6048

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5692

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4724

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 ccb0c897570618708b6f454a036637ae177ec468a22366c587f863772dc428b2
MD5 610c7de0f2d6c1c6b37f78ccc7e525b4
SHA1 70dfa272a19ce17101539809d9a9b54f52b2e807
SHA512 f181300d47f7f5c649a2f88111740f2bb82d50f14e8616e19afeaa6a39800ea69ab057e31645323d2e318169016aeb36c91b104b0360b812e5723c2b21a381f6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZc9:A3mnXoZjzyaTjtqCD5TvinrmFmcZc9
TLSH
T16E250406E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 4c8bd6ca3ed34ce48150c076ff16d68d8ceac198bc43b38fa2182bafae1142fc
MD5 b7e24ee276100b81302b5297f8b7f924
SHA1 60012525cd290fa1221dded7f1d60687e110f43a
SHA512 3e25c5561deea6a0eb6e82e2fa16c2e7931931517613e95dcb4f42683d3ac9f015a85bcd66b6fa3a80502b2d340c2ded85665bae19ba68b1af855a0f11d09ad4
SSDEEP 24576:A3mnXoZjzyaTjtqCD5TvinrmFmcZcJ0Le5ji0hmxNrM:A3kMn56rXPji0Aj
TLSH
T15C651716E6644BA5D02F8074C7925656FA733C425FA087CB03D4EA3D3F236D19ABA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 955KB
SHA256 db22853bac5a36c2b7fa17532e91f39cb28bc1bbd5f8dc1e6e5b9575d6a53610
MD5 272d689cd0b03785ce75f3fc185f5bf1
SHA1 d76b6a82910f1863caedfc6251566aa31412be2e
SHA512 0db6ea54f100815fa488023a65a71120ffdf61a3706f340a639fae25cc890f31fb2701bd515a95931b6f344ff33c8418ee8c32fc23e8f4edd62685e977e72765
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcba:A3mnXoZjzyaTjtqCD5TvinrmFmcZcba
TLSH
T1B6250506E6940AA9D11F8174CB914662F6737C125FE097CB13D4EE3D3F32680AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 964KB
SHA256 8699a5d26a0be95f68fa9a18aaefae5c9cbe7569144394c8c8d3d79ca0a74264
MD5 5a961f8c07db3e92b9ee59d6028f571a
SHA1 3b6e52592fe314735c4eb77499f3834b3b8bf0a8
SHA512 6419cf2bcbb264fcc0177dcf30ddef665446ac608629a0d18be2569e93658769c6d8708a756ad68f0f8448732fdc1aea8aa9183f77aabc4386a3f2460b625104
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcjZ:A3mnXoZjzyaTjtqCD5TvinrmFmcZcjZ
TLSH
T125250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 964KB
SHA256 ad9055c1371cd175002a6ab66a255c57a9c4e1c983c64a95f21ef8e48c9ad766
MD5 0c5f0eb9af09c8d56250b4f85f7a5996
SHA1 26bc27e7d8708eed115bb35545fe50911ca91507
SHA512 ba5ded9d35d6ef211c2c01005e5ad10472b4f23a5837394b64b04e4217621c52d5d8c932290394f9276eb96e85d851dd2bed3acda655fb9f82d560efc9cfe2e0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcY1:A3mnXoZjzyaTjtqCD5TvinrmFmcZcY1
TLSH
T1D0250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 964KB
SHA256 0738d4fd351340a1bbfefb469c20ece087c3978d79dbb6ecfa9c213e0fe341a9
MD5 6658ee1b1d624e95d7bc31eae918d82f
SHA1 9c77dc958c03a98c9b3706511308a6684802b218
SHA512 c271521e4ca4f4ddc131b9f61f11a4fded88f63aa2c7129ef2569662cd9f578cf990f2792d3004eaffcae09fc447b3d2f8b52328228ad916c9200757443e94eb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZc66:A3mnXoZjzyaTjtqCD5TvinrmFmcZc66
TLSH
T1FB250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 964KB
SHA256 7b130469d0a5d9599fc31d4f0c87216531b2bb6616af3302ef5403c690774360
MD5 115493fd985fec2e9ef038011d87887a
SHA1 9b0263f0947749dc083fbf5869c5fd5c42984b84
SHA512 c3573b739342a1ea992523724d66a61ee3796f48b6e9f02e8be1bff516f3ed9f8e5c2fa6d0a68cc2c9af1e3a6c3a99f55ef4ebd6561574c5d026c107aa7329ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcyN:A3mnXoZjzyaTjtqCD5TvinrmFmcZcyN
TLSH
T1BD250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 964KB
SHA256 f7f3e73ccc9f3c271920402cd5a0c41b2d55d03f6e703d3e33170f8306c304c9
MD5 e6631afd2c48f44da8788b74cacc4303
SHA1 b084eba71a272b96dfca0595b0b5f0017f9df76e
SHA512 f2ba4a5b1fa32482c2c5379027ffff4a664498ca6a8157dde96502b71e691e3b67f83d3105ffdc33d657d0a4ff9aa47537ca6eac214f4bf8c54c8973605a26f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcof:A3mnXoZjzyaTjtqCD5TvinrmFmcZcof
TLSH
T1E9250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 964KB
SHA256 e4ec7df9033f09c3607772ddd091be9020796c176853e78797fc097f79cecc60
MD5 d2c330b141e77ee317de8c9f822d83f0
SHA1 54ad7236bab3fa76c23c02e940e5662d4403166d
SHA512 8892c5414ccaac1c70ddf03d532fe5b75f6f8861664b53b3f248dbb830c402d3ed92548f3985be6650c31e7813990bbfaa4e883eb41b8ca446cebef3910e2250
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcCo:A3mnXoZjzyaTjtqCD5TvinrmFmcZcCo
TLSH
T155250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 964KB
SHA256 fe4e62f61a297cf5e11c9337621cd8bbbfc07c7f32aecd09794065b884651590
MD5 bee619196aeee4902879f575cb728cc8
SHA1 4032de501a5707d5bfc0ded21ba866c1a6ffaaf2
SHA512 bb3b037ba8f253c330ee444a0997e3692b14289eff5e6c0ccb48e3ce236e805880e0e7e7e9f6ed5995cf86629b58be26416c451d96eb636337186e74ffee682a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZc2u:A3mnXoZjzyaTjtqCD5TvinrmFmcZc2u
TLSH
T109250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 964KB
SHA256 05f91fe1fa7120d7f37222d4f2cacb527cc11bfa68a2cd2e283d72035b58a77c
MD5 c08361b9041bae34e58bcf77c763c4b0
SHA1 448a579e4ab1ac846b54069a4c4646bbbe2b7077
SHA512 618c6d372dd87b47988c9fb64d144f844388887ec59c2b7d5c275aefdd7e7b9d5f1244db9d6a0c4984d338b0e6b4941a6fe0972ee6ee8fb97d978bcb44a8cebe
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcq9:A3mnXoZjzyaTjtqCD5TvinrmFmcZcq9
TLSH
T13B250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 964KB
SHA256 93e67f43fcf33d18cf85ea7df51c7a34f82ef4758ecfcde9369a81c8f14bbd5a
MD5 296f41f99326785a6017e2a03834a114
SHA1 ed5b5124623a0098a848d52d01e3b4b485c02284
SHA512 e2966857ebdc7331e5f101e4dc7b6a59ddeb68f158de6fbb49c7c288037880d010e6d10e29c59dd1deb2d067a3e81b06c5bc6b3cb09edb1799ec6ccadd1dfa92
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcqc:A3mnXoZjzyaTjtqCD5TvinrmFmcZcqc
TLSH
T1F0250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 964KB
SHA256 0a4c987a7442350565ff8b5a9b42b7309e189ef63d7cecac04373a9107740ec7
MD5 932c13d63ce66246227ea28db1ff18ea
SHA1 571bf33991dc529efbcf9f08846bfe175983e294
SHA512 9df2fb0722c5a6498767c28ce333fb11f66833233c62a1b4761ff137ad82e0209bbef597911f10475e30a62598a372f5c6ab55195071cd5a1dff8d5d4f7056fd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcjp:A3mnXoZjzyaTjtqCD5TvinrmFmcZcjp
TLSH
T1D4250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 964KB
SHA256 41e1abb73a02cb1bcb3a12967325a1e8394206ede85c8c4544a09ca91b22eeb0
MD5 f724d45a3d67fc5e8a96d32c7dbedaba
SHA1 1613bad7fa10144279b678a1ff2f29c8d5f4a3ba
SHA512 94808972d123ce10066b326b347fcc8f49b6ce21e7258fa522c0f78761f8040653f88e42516242df0c56f3c0c99ce688382c39f0acd03fe07431d71be4db416b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcE0a:A3mnXoZjzyaTjtqCD5TvinrmFmcZcEN
TLSH
T1B7250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 964KB
SHA256 92db3ab903cb1859853a85f54f99256b31cdd0f23f00a896a3610588a28f175b
MD5 858c0670d724591b11e34bca19630dd5
SHA1 b35000e376166f0f3c5915b8d5dd230cfe912d1a
SHA512 3eb96d78f49824304dfb65b51788a6ab130353c630058b8432a36f3726fedfca91d61e71589a9e2fe4e0702e343b0c6a80ae5229e521d796a93403a881c6d0e1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcsF:A3mnXoZjzyaTjtqCD5TvinrmFmcZcsF
TLSH
T110250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 964KB
SHA256 0cff6b14b5d21bb6f386021e0a601b3f6cb626bbb0abe5cad5f824a9a700f772
MD5 08e7455db007bd9dee75e9690c02ef52
SHA1 f36dd2558697e48138009dec1cf674b2e9aaa8d8
SHA512 10b11b8abcdcb9af123662a93e877b1208ad04e893bf64f5275187d088cec89b54d067234c0819acb105942c45beee535aac74deee86c65310a3694d900df5ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcZC:A3mnXoZjzyaTjtqCD5TvinrmFmcZcZC
TLSH
T1D2250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 964KB
SHA256 00006030e79a4fabbf9d27999cd9e76605b34c1822e16a9826013ac6f948a26e
MD5 8addca59c15edd1d3c86b57d93b39775
SHA1 a5d3b3fbae65607e8ba911dbee71c5a7fdb78bd7
SHA512 ca56ad3778a395b3e602774fc0ae96bd8d8ab3b41a5023d90318ed06ec275e5b56fe07a27a440d5a19b23f98e05e23e00db977b378caacf9711113462287bd0c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcaw:A3mnXoZjzyaTjtqCD5TvinrmFmcZcaw
TLSH
T11F250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 964KB
SHA256 ad5367c4ce9477961f35d2e02f2de226d9de4f958ea590f292c4bab4bac28351
MD5 c4280a6e1e0ae0340f8f49b258437d53
SHA1 f1f6cf4f9bfd5ed4583309cdb5fe1eaba340cc34
SHA512 09f35b7b7148057592349472becab55ca4ff737dc694c9cd36e1fe48adc303d89d8e32885c93e1c081fc9709597666ef3c9df06327ba1021e7e88c91ff5bca4e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZchT:A3mnXoZjzyaTjtqCD5TvinrmFmcZchT
TLSH
T199250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 964KB
SHA256 e510ca2529cca239da473faeffc8df5605893beb4eaaae98c29ca64a1df7691a
MD5 8aacb220f6013124ff0aa44965d66f70
SHA1 2622df05487292bf4809436aa3a4dd96ba572696
SHA512 63912222bae855d057be58453daa2248520bb23cc0000f6744790295e97cf21ce83996df9e1418541766905e85ffd7c1eac6a3cc9489e918236c42b2a462d437
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcPu:A3mnXoZjzyaTjtqCD5TvinrmFmcZcPu
TLSH
T1CA250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 964KB
SHA256 8e6e869864f7ac07967f8a719e9079c2c54f57cc8e4e1c7c2b6c3c2536829d98
MD5 bd869141f2a4c39777fb437f64269fb3
SHA1 ff2f8327a7b4fa7e78d1240b8cec1eb07a97079c
SHA512 ecd86078230e898f505453b7e7172621d7bc1390f3b5d4aa4a6a81130b7b41526e0bfd79795c20a428fccac5e2014fd575fbae337cb43409ff87a713e1f78312
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZczb:A3mnXoZjzyaTjtqCD5TvinrmFmcZczb
TLSH
T1BD250506E6940AA9D01F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 964KB
SHA256 ba35c4b3ad5f2dbb73dff012b7ec725e45292136383b225eadeca99160a72865
MD5 515ccaba510b75943e8dec78b87899c2
SHA1 bf3bb7a4b00016f03fd4e8f984fcf897a557dcf3
SHA512 bc8e466b8f7a6e7a1c7a7380e9d645097f887025d7ef5ada31d7d3284d1541d5f78de40019418024884c6979e8e981db7edab5a08bf6ed3bfb5577e8fe6dbb4d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcHf:A3mnXoZjzyaTjtqCD5TvinrmFmcZcHf
TLSH
T150250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 964KB
SHA256 07b184f3453cd52b5544bb680e5b1bf80e9285c2388539918ce7ec64ec3f6f8d
MD5 65adeb16c16bfb30d202dfae004ecd60
SHA1 1f8ec67db3f43bd7412ef504bed410a6114a6152
SHA512 4dd18ff12aa77972f22dd532351ba3aa88304ebde028923393ceb1d7b7bdede374e0705b5661b4eb99f50a52f5861ba0d91d86fa3cfdffdcbe2ce0e1a93e3594
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcwK:A3mnXoZjzyaTjtqCD5TvinrmFmcZcwK
TLSH
T1A8250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 964KB
SHA256 1d4dc9ca57fa2cdf41e7beb551c3610cd3e3161e27f626439c7a8b69ddaab57d
MD5 93c0a2bd51b1b790b6b776e11d264b4e
SHA1 0c35a5f7a430ed147e0d1fbf993f869ac7e870bc
SHA512 74ecbeb3246feead0c88dc9be4f928f38172e76194a30b19020d19a39474f7771caa1f17f57535574a1e2f52d7c91c2265c080e78644a2597dd1565abf3fa20c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZctk:A3mnXoZjzyaTjtqCD5TvinrmFmcZctk
TLSH
T1D9250506E6940AA9D01F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 964KB
SHA256 df47d05cfc792cc17cffa9cf82432013a898890bc8cd950bae3b273e1a4f164f
MD5 b6d5985834e64167039a24595ccb275c
SHA1 4ac1f410294ada6e765f230d3fd85b412daf3101
SHA512 d28d19c95a3c0e9bd4796a18846ea0879fc596ed86384697643067aefb19ff38ee4eb0dfbce3157ecbb12af61979c26686d3c20dd5771349598138a8402b8b8c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcy0:A3mnXoZjzyaTjtqCD5TvinrmFmcZcy0
TLSH
T173250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 964KB
SHA256 e39854fe1f89cf9bf58b6051cb0aee7e6613d0621ef6fc4cc7047887ccd2f416
MD5 14a6f94da7e5b9a03d8abbceaeabccbf
SHA1 a733dd45f0ced7bfbcf7ca7555253da1ceb691a5
SHA512 ba68113b5988f70dd574f3e07755f688732b3afd9a6efb345e9951497188b8cb1c3626bc3859cf2635873225d66a040767f3ba28e5060cc45c40c839795a60a2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcB70:A3mnXoZjzyaTjtqCD5TvinrmFmcZcBg
TLSH
T110250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 964KB
SHA256 402b7d866dd0281f12ac955fd25a99a5c5756371a95055c87c7715278a2f32c6
MD5 aaf701d63d9da2c4d4ffc4f215f8530c
SHA1 666cc3bb2f05d117477732a8d991933ab824bbc6
SHA512 e71bfae6f7ed6452b5f972c4da42d8e1bdfe4e1bf4ca52a57c705d3fb0ac5c1e159fe27a4341bf4ddd5e5f9030409e0f3ff485c8bdc22ef5e1a22627b73e6a55
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcor:A3mnXoZjzyaTjtqCD5TvinrmFmcZcor
TLSH
T128250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 964KB
SHA256 620845630eb1866995e28f2fc28a89e4d7d89e15b749174164b8cba34da21489
MD5 000d973455ee5735e71021266d4f18b0
SHA1 460b8e762b9d322ffa0b9989b6bcf5eea6b09e27
SHA512 698005a7707e0f637a33fbbc162201dcc23d74e43e4c75d7c5ace5965ff2115bbaf3d01a00c3f8f2791560f9e6515fd2d07f98f1a55849ffe089d81c64cbd9ed
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcGn:A3mnXoZjzyaTjtqCD5TvinrmFmcZcGn
TLSH
T1B8250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 964KB
SHA256 1078b217b03c426b4ac23314bc77dfbc17721193fed6ffe6cd6cd568cbd1653c
MD5 83ab48200052499eae87e19f66a01255
SHA1 156093e1dbbba0954d257ddf4737d6ab15f8d817
SHA512 1cf95408e182d38cc317571670dfc4d2997a99d35d9e786fbffb07b5afb8f9b1f9dc61d04f5be13652968b5a59a6e3f45ec5953156951ada73e461c80a3c1a2c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcMx:A3mnXoZjzyaTjtqCD5TvinrmFmcZcMx
TLSH
T1E7250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 964KB
SHA256 da6ba61cf3975d22e97a2f928fc824b82b8d66c92a8aa32db8775332376c1d78
MD5 c57384e3a7fa65b3787e756853ba8c7a
SHA1 c66bf5b0ee07b7427a83bf107fee4959de8bd323
SHA512 6bc7c1c4566d8f397e818979b81c79d29f82421255607dcde6f56375402d6057bb2d44e2aa9eadc3f052fdd7afd000ccdb04e53f8f277af95f4251e5ae4917a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcGA:A3mnXoZjzyaTjtqCD5TvinrmFmcZcGA
TLSH
T157250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 964KB
SHA256 4a3ef1cf1894fbd41089a1903843184f765c2e1df07a579e251a7cfbca7625ef
MD5 f4a6da002b3a4772fe23ba9b7c2aa94c
SHA1 0f3ec4b41638b407aca9e144852a9c36120c875c
SHA512 0df9f8d93944bf04f3d06a259b14093b95e5e17e01dc8542e1040538524e377f613bda76dc5e9a8435af117aa7aef0a918ae9505f8113ddbb74627c56316cec7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcf9Q:A3mnXoZjzyaTjtqCD5TvinrmFmcZcf9Q
TLSH
T1A1250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 964KB
SHA256 8e5f85bb1a3b26040b071251aaf7ed50b3421788099ee68db135d42d84652f82
MD5 b8252acbdb857196b881a182ed537e49
SHA1 d42f74ceee4c670194a52c379398adb4ca262b63
SHA512 26d619f9329cd8411fb4f1d61ad4d239a85e7e4e2a02cd719052c70e6670f55e531d5181cbb2c61bcdf4d3c6a0c1aced44c0da5f9482c78501b0e2e5f2c43b7b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcW4:A3mnXoZjzyaTjtqCD5TvinrmFmcZcW4
TLSH
T1E6250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 964KB
SHA256 b4737de3286113322202dc85c75cff3de03004d1ef1fc418cef4d59dae894850
MD5 f6d4c507ae8143885d9ff99635360908
SHA1 4d120d88671f0b00033efe61d338fb15de4e2e24
SHA512 1df4291a194eed261702aceff35e7360661e169146e061319ec7199615cc5275c2f6c2b6156fb6ecc23b6ff26d1e5dff1d8d9b02af659f007c8bea41ba7be9d4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcFu:A3mnXoZjzyaTjtqCD5TvinrmFmcZcFu
TLSH
T17E250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 964KB
SHA256 9d4db25be77e312c67fa09a7b9bfac0eadbe2bb068170d4f8d6634b8071b5cbe
MD5 27c839963bdee2bd3ccd4bf62e68a1e5
SHA1 7759a1d760ce1575bf15065abb134feb8392d514
SHA512 ce61bd0f3d673b52ed9fbc498d0bb8dcf33cd660494778cf5aa244a6791924098aec97449000659dc998dd9e31784443a58da443a6cbc16b9e3a73585f89a43a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcYj:A3mnXoZjzyaTjtqCD5TvinrmFmcZcYj
TLSH
T174250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 964KB
SHA256 a260f2be6163a0e5d018161c84d805702fac2a822432bbae4dfd5dbf6bed2002
MD5 3ae6d01906ded59a842cc5780c3edb36
SHA1 3b4afc743f24a5053cb4426fed0a4c9ec6c0dd8b
SHA512 3af668760120ebfda52caca12f3f2cae45a5116faaf7cac7d1e0eadc0f43a72beff29ec3f6a0edf81c4f8d0335ffcab7e4a1b6bf2a4e2ef796b221f4c9513dde
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcpg:A3mnXoZjzyaTjtqCD5TvinrmFmcZcpg
TLSH
T14F250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 964KB
SHA256 05a785a4c778b78fb34dbebeb283717bb5696ca20b23cb4eceb6f487f523170e
MD5 548d9c0b0c702796cd5811d0179b31ae
SHA1 e048a41a9f3818eb6db9294e0ff856fbb174cd97
SHA512 199ddb5b3cda7ff1788f2928110bd0e4bc07f731a4d1084f6fecf21290237ddbe34aa32947219763754a659ca14782b058abe4b56794272a418111142bc093d4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcwI:A3mnXoZjzyaTjtqCD5TvinrmFmcZcwI
TLSH
T1AA250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 964KB
SHA256 a7ad54f71b7a074a74c45f7bce0c7021a5310c4e52d7bb198fce51c5afe08051
MD5 ab198152928bf14ccdab0f6535a26654
SHA1 3160f3b3a18af68c86be105dee846fc43e29030a
SHA512 39fca5b9dd751e640e4254bf64d000d72b57af725699b53a16fc49368624923092c78f998cdeed8074561304d4eab92cd7157ad11f2e6aebd188edad6281c41c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcyo:A3mnXoZjzyaTjtqCD5TvinrmFmcZcyo
TLSH
T177250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 964KB
SHA256 a22a86925d7710399b238338430d4d59892efe04b2b706ae5d1c29a02aab8ed6
MD5 cc0f345ec7618e59ddf2f1a0f591a116
SHA1 70e5981faf5158cbec21b3b99e361accea5d00cc
SHA512 e5f5fae084d9b98c61075d7f521be9b3160eb4bd64781bd55a6da4c92781831dee80f4fb03b43637feec06cb56c7bcd257b778be27d697fa756962eec444a9ea
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcp+:A3mnXoZjzyaTjtqCD5TvinrmFmcZcp+
TLSH
T1E0250506E6940AA9D01F8174CB924662F6737C125FE093CB13D4EE3D3F326906EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 964KB
SHA256 38e9885ad54789681e296acd0ab283b2890844be21b180c2c128dcb22d6b3436
MD5 41fac13f8462528189bb66044037818d
SHA1 56dc0bd61a3b6cf9bd186a7f843c074a27a17c48
SHA512 7a1ed9c4e64662d59887921850b88e567d4d1f9c91ba6e1c874ed07de0a6a16d23397d0e6090cc786b8b06abc2a8355496327c7f52a40ef92e6414fc9ae351b0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcXQ:A3mnXoZjzyaTjtqCD5TvinrmFmcZcXQ
TLSH
T1D6250506E6940AA9D01F8174CB924662F6777C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 964KB
SHA256 9f44029c358e5e535b334a3fc1e66ccd85cfd3f726c0cae4a55c3f65619f75c1
MD5 d2b49ec23acad9df75aae5228925ff25
SHA1 7b8075558b3cb08c140e630a38a939448d1106b5
SHA512 c2dd54d3ccfd252076a3bec57c7b3f5db60936b38961b8c023e1a1187c13ac2a2d690166c4da8980f3b55f44363fc840d7955b0b3c36e97228f2d3ba929f75d5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcsX:A3mnXoZjzyaTjtqCD5TvinrmFmcZcsX
TLSH
T18F250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 964KB
SHA256 3764663e6932f5e8fbf7a083edad9a012817a84d11da2c6ba58bac5b55a90e03
MD5 d9b7e1f8876bb0c3d5263e238ea15478
SHA1 ba9f538a044e94dd56eda6f97f3b2fa0ca7f4ae8
SHA512 abb0eef874d55d63ac955c4dfc997f9e3cdc3d3d713703c416db49499d617931c3eddc4680ea37c04aa4f6080e301a23d304eea23c972b55f7ee15db80ef7deb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcKL:A3mnXoZjzyaTjtqCD5TvinrmFmcZcKL
TLSH
T159250506E6940AA9D01F8174CB924662F6737C125FE097CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 964KB
SHA256 90704449c116c05736b671fb8ee1566b99881425c29fcb48e6dba487b104a0c7
MD5 0c820a6343098fa7afb3dee59e642b7c
SHA1 05760837a2187d0117c41bcf52a407fa71b049ba
SHA512 17eb7c03a75f3a51ad3fa6a139417e1a1015a54a7be719631383d6e96bf0c1b316b1ce0c5eee5ad07a684b4bce27f86625a33eafbdcf0422301be6c56e97f787
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZcuFC:A3mnXoZjzyaTjtqCD5TvinrmFmcZcuM
TLSH
T1E8250506E6940AA9D11F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 964KB
SHA256 bd1eb01de9c3f69f7afec0b15b5e059c5bf0f91b428222fd02922f333738ab70
MD5 2c26132f071e0679f49182be096b530f
SHA1 9c431568bd08aa0abf2cea94bd2c0feaa93401bd
SHA512 89187673db8557234ce9cb6c9265af4dc2bf8f6c8dbb2ed1be804e7e4320f3866117f79c248c3ad110273f49d34d13094fa5eacd4037e8e8c86694a079b55f1e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfeXsf36CD3JeU7vinrmF0XcZc3h:A3mnXoZjzyaTjtqCD5TvinrmFmcZc3h
TLSH
T144250506E6940AA9D01F8174CB924662F6737C125FE093CB13D4EE3D3F326806EEA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3432-991-0x0000021E81D60000-0x0000021E81E60000-memory.dmp

Download

memory/3432-977-0x0000021E801E0000-0x0000021E802E0000-memory.dmp

Download

memory/3432-989-0x0000021E81900000-0x0000021E81920000-memory.dmp

Download

memory/3432-979-0x0000021E801E0000-0x0000021E802E0000-memory.dmp

Download

memory/3432-978-0x0000021E801E0000-0x0000021E802E0000-memory.dmp

Download

memory/3432-1023-0x0000021E941E0000-0x0000021E94200000-memory.dmp

Download

memory/3432-1000-0x0000021E81B60000-0x0000021E81B80000-memory.dmp

Download

memory/5236-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5236-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6048-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download