f44b3fcbd4da699730f43ff03bf2ae4d57c28fb5a1335737f30223bed6e2d9e4

Analysis

max time kernel
109s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Size 946KB
Sample260706-2ppgasc14z
SHA256 f44b3fcbd4da699730f43ff03bf2ae4d57c28fb5a1335737f30223bed6e2d9e4
MD5 0a4b9add19e63901386ef947b0a901ab
SHA1 417baae77a06df0daebe994069f0cdf73adee7ce
SHA512 2893d62a540d68ce424bc3fe2ab54cac8fffaeaf011ea4637167cd593cdb670da995d74461f9ed2d757d184ad782c686299c8a63b59612846ee4f4dc1a7b7779
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2N:J/sCv7iUIxc3EEg+QLb8NVPLH2N
TLSH
T13C25391366948F71D16F053059A94261DA3BFC295F2087DF16ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 40 IoCs

resource	yara_rule
behavioral2/memory/1780-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c60c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b316-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-231.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-256.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a72-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-771.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-938.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1066.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1303.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1503.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1534.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1553.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1554.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1555.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1556.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1594.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1595.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1596.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1780-1597-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1598.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2804-1653-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1666.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1709.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-2037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-2164.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-2166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-2179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-2204.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-2229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-2236.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
2804	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{A465AC7C-9A94-4346-B57A-E1C217DF6247}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{C163BDBB-DA6C-48EA-8D69-B583BF461453}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{670BC303-EB0D-46CA-992F-02952640D399}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5436	explorer.exe
5436	explorer.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe
Token: SeShutdownPrivilege	5436	explorer.exe
Token: SeCreatePagefilePrivilege	5436	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2676	sihost.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1780	2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
2804	patcher.exe
1108	StartMenuExperienceHost.exe
2740	SearchHost.exe
5436	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 5436	2676	sihost.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_0a4b9add19e63901386ef947b0a901ab_amadey_cobalt-strike_conti_darkgate_elex_hijackloader_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1780

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2804

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5436

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 f44b3fcbd4da699730f43ff03bf2ae4d57c28fb5a1335737f30223bed6e2d9e4
MD5 0a4b9add19e63901386ef947b0a901ab
SHA1 417baae77a06df0daebe994069f0cdf73adee7ce
SHA512 2893d62a540d68ce424bc3fe2ab54cac8fffaeaf011ea4637167cd593cdb670da995d74461f9ed2d757d184ad782c686299c8a63b59612846ee4f4dc1a7b7779
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2N:J/sCv7iUIxc3EEg+QLb8NVPLH2N
TLSH
T13C25391366948F71D16F053059A94261DA3BFC295F2087DF16ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 8d5ead543a42aca44a28bc00e6c1cc3090bdf542ce699869b5f10243a8e3397b
MD5 de445e81038a668f31863ef21424c416
SHA1 c58b30a676bd89e1c83cb519c013d3be855f0b32
SHA512 84732168b92a51d9d9fe4a23aa81ec467742139a417886011c9f6dc1d3b3139b896fef86640bb78570f0a9740cedf79f875a6f8657f919250a5d4442d82e16a1
SSDEEP 24576:J/sCv7iUIxc3EEg+QLb8NVPLH2Z0Le5ji0hmxNrM:NG3n+C8NV8Pji0Aj
TLSH
T107655B17B6A48B71D07B8074C5E59656EA337C150F3087CB12A9AF283E327E1A939737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 970KB
SHA256 d856359955487130e3de77b678eca5de4f344ed2e81793efe8d21cd3aecaf271
MD5 34e04b641354c6bbc045acbc3ba13750
SHA1 551cb5b454e5794f03c6f46691b6f154cfdfacbf
SHA512 d5cf365548d082bf2176516fca006bbec912ef3959f6f1fbc9e5e07512420a26fa148d614be50c5cb6f1f398ec71ae10d6ecbe882d3300cfd571a188fe778116
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2K6:J/sCv7iUIxc3EEg+QLb8NVPLH2K6
TLSH
T1DB253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 970KB
SHA256 112956435d83988ae16435635c8f8ad09cabd1fbb5a800323600d2ff61268266
MD5 4f89d41c7f990e48a1450a494cf6a8e6
SHA1 ff00cad69b3170ed4dbf312c4b21b3b05aa1df80
SHA512 ef8e006aedd8a21796a46038ba100fd6c167777f323eeb145c99ca48c82736a89fcd0bddaef4c54dcf28b4810eb4b04ae624bf94c46f45001711ee46dc400fc9
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2yo:J/sCv7iUIxc3EEg+QLb8NVPLH2yo
TLSH
T1C6253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 970KB
SHA256 17967c01e0dab7b0f2cb8637da7e27adda7565729361fa6aa9cdff06ac4579ee
MD5 1d455eaf75203fbef4485d291c8f31b7
SHA1 d9c6c1ce2f2a0f9e7231549b7ab273f01a889b00
SHA512 9260c3b19497a1f92036d403192195f634250b552249721561d354f375610160ff06715a9d3c2b8917f33e27110623213d8b81270282c45c1e43feb11f63b727
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2mu:J/sCv7iUIxc3EEg+QLb8NVPLH2mu
TLSH
T1F0253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 970KB
SHA256 9c9b6181dbf7e0b21cfd2d32d81783de588732372291e6db0ad5e213e9404515
MD5 8e93c31c29ff598bca404eb22004ac6f
SHA1 fc0d3619a9d1cb90e573d88ab551f34cfe4b5aaa
SHA512 4b3bfa102a6ae0e87c491274a321d7df087866d71cfb00222a3de19d5ecc9cb6fc484c5ac67a623b0854adf4681f3176a2a521cde98e08407aa3df52758b3db2
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2a9:J/sCv7iUIxc3EEg+QLb8NVPLH2a9
TLSH
T1BD253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 970KB
SHA256 d7f53fd566efd9b7d4cf7299ffeceba05edcade266d3ee718e6436a581551a42
MD5 0b706d85d3fb5a20976a657c9ae78752
SHA1 30ff26902e674cd1e4f32957a7df1166ed0a9040
SHA512 ce3d3e9588bd3606bdf167bc8c3033a4b5ddcb0fdb22faa2d87bd091750f4aa80e5ee151ee201dbb2973ca9c7665d0d94ff150a1bf5557cd342608712b48d48c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2ac:J/sCv7iUIxc3EEg+QLb8NVPLH2ac
TLSH
T113253A1366944F71D56F053059A94261DA3BFC295F2087DF22ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 970KB
SHA256 8cd0b95da249af1e2b221b90a6e911dc46990c74a0cb9fcd60c1bd09b8872c78
MD5 dbd7aa1be3b6b91036bdee84b742afd1
SHA1 4c13e7008adca3808ab586b39d7d4d66b34cd858
SHA512 5c907cc0368377ff97774a1a98d701cf578f694fba10f91b2542f7ddc1aae2337e5733707bc19e722e97ef376b07f9bdcea3a00117894d6ca92ded73321b4975
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2Tp:J/sCv7iUIxc3EEg+QLb8NVPLH2Tp
TLSH
T144253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 970KB
SHA256 14ed0d31482d4e2a08b7d18c43f3476b9cd0c1d53b2f443909922ee90b477b4b
MD5 1311adc5d81812b21000d76584a5083f
SHA1 7557a98a1870968686e6f155520c97935c2db455
SHA512 bda04408cb29efba1b6ae1497853337cbaf27d6f51b96adf5b102e599d135e7c73c801e20294652cf3a3e5356d432fd84d19879d58283aa969c236829aa8143a
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH200a:J/sCv7iUIxc3EEg+QLb8NVPLH20N
TLSH
T17C253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 970KB
SHA256 f05e22d5d49304ca3b5ec2d46de60a85bfd817fd50dacab21563a66a495d9dcc
MD5 a7fac6ca9ba162bdafb5035a7a47a5b9
SHA1 003ecc723c8a088b5b8226c0978bdc9b7b9bec64
SHA512 5d4b361c718bb4dbf63659be5f6384d51baf74266b2c581be59b5cb18f22aef10229b9d4949102b1827d3e7393f5250d72047ba6ba0b499331ee40c74ba4a82c
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2cF:J/sCv7iUIxc3EEg+QLb8NVPLH2cF
TLSH
T10C253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 970KB
SHA256 b01f8d4620e404fb52537b4b9c1b8c83b7a8f9eb94b7674cd888781f1a91e179
MD5 2ea372ccd08c9c0c89fa07ede7ce31fc
SHA1 003ce5bd90f366fd68d238553d52f57afb4eff3f
SHA512 df8a7edafe709a057568cbd56e4b062e7823693bc7dd9c24ddb53cd57776947e1d0cfdf95f1c36ff2d44a9e391d9c6b0a32c119a4ffb8f9cf25653f0917c93ad
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2JC:J/sCv7iUIxc3EEg+QLb8NVPLH2JC
TLSH
T1FB253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 970KB
SHA256 6db3c473e116514b367e724dde316832987787522928af9aa3a78d501e8be8cf
MD5 64e3aff4b4bc9fabee78d56ff251079c
SHA1 c08cc35d59f63eae4bdc29e654c84f5a520e41d7
SHA512 5a26512ef34071bbda9f3296b6d31c50792a49a3bcfb2f456e070496b2692e8e99db89f21fda1094ddaf21aa793c1bce28719b8a4953da5e8fd8bd9c952e5e1f
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2qw:J/sCv7iUIxc3EEg+QLb8NVPLH2qw
TLSH
T183253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 970KB
SHA256 22825da2e7beff8148cf9260afa52281fb2e7b83d676a7b746971252e22a27a4
MD5 dda3e59deebb0de43e2cce386f84be8b
SHA1 73bc04ee7d9f082c00b4f1087d0f075befa56725
SHA512 655fbbd59e8d48cccc52bed2cda8171d9c7aa12c08f6d41fbb19a6589d8ca4132a68b9dda2990d0efe6b237d22db6aa06c6b6161b4a5107622c18f4bb71a31bd
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2xT:J/sCv7iUIxc3EEg+QLb8NVPLH2xT
TLSH
T1C5253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 970KB
SHA256 07935c4af27795786252fbc7a5bd2bd3dfa4ebd0d43f372a7da136c12b2663ba
MD5 8d0027b3be9878bf46c40e3e8148295c
SHA1 55bdd2a0a56926ce3e69ded4262705b8a25a6c62
SHA512 f110d2a000e355b564efebb525a89a8273b09ce88270c425d329039e350340fe3a56ae3b5b968960aca8d29216cc38e81dfe8ef09b6506e7e194ff3473be6900
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2fu:J/sCv7iUIxc3EEg+QLb8NVPLH2fu
TLSH
T1CF253A1366944F71D56F053059A94261DA3BFC295F2087DF22ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 970KB
SHA256 10417270f333cda93580d80bba48ce76523be410e11629ac3e8d4a8f2ae8bb87
MD5 7f1eb2172f620ccfd7323b30c4d092dd
SHA1 b61fff044c0733567dadeb2737cf39cbe0aac13f
SHA512 c0990aa7f91498d63d4deb7bb59971085e1cbbfc8397c0e2588fb19adf5e1fb8ed80dc7ec7de1a1989aa638432a86910d098ccbf452771cbd3844061be19b2b2
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2Db:J/sCv7iUIxc3EEg+QLb8NVPLH2Db
TLSH
T106253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 970KB
SHA256 5c39cd8bb67e6d7b1a7f31cc3b4ba93c1aadb3d1d4c03068f731270f312e8f88
MD5 4ca191437a79c1d5aa34c140dc5718a4
SHA1 8383ae113bcc9f351898400b346e05238baa97fc
SHA512 acad8d7b551bca92a05de688994272faf187bb223071d2fe63fd7c92da5acb0bebc025354801a82b69a1a9b7fdf9a1f360580e4cdf888f2ddce0181cb290a79f
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2Xf:J/sCv7iUIxc3EEg+QLb8NVPLH2Xf
TLSH
T1AB253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 970KB
SHA256 6953ad1220c2dd8bb6b446b09fab6723d62e2db092eb3fb54f44c394f3c75d95
MD5 029bd468b9ca9acea7f871bb3163eb7f
SHA1 848b72c0fe9c787f1d18db6b3213313a9303fb35
SHA512 5b37118d604e02670bb0fda3bf6541ce26d8af52186a9874b917495ac48e6faaedbfcd174cebb74d7afc54170a0fdc9e49cdaccdeb376917b99c3219226f1cc9
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2gK:J/sCv7iUIxc3EEg+QLb8NVPLH2gK
TLSH
T122253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 970KB
SHA256 8b49d3c83618d6847906912f831d2c82e62f1c85671113099f164f85cf374c47
MD5 b1c9149c7897d8d732fc8d0aa1680068
SHA1 f9989b514905c75e52b7bd11f804dc5e810482f2
SHA512 d934ab02d2b31826a131deda5e8aca37944c4f5d044517c14ada19f258d285cb27a96553c2f3823f10bc48c21bb49a116bfd45e913e205a82e2c53779ba85dfd
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2dk:J/sCv7iUIxc3EEg+QLb8NVPLH2dk
TLSH
T16C253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 970KB
SHA256 f06f28445656a204e72ee76bd16ca3b7b9523a79a07e2146a4f651ddbd640da3
MD5 0a209a8c635a2224c86674711b71cbb0
SHA1 79e86c6ce7eb03d3b69a5139a8da48045d29665f
SHA512 053dec6171adde7625431cffc0cbdecebe97988de673ad5322fde353a83f28b40a1b5b29c4832b8056dc14a0c175f35132af368aef7cf55dfce94bccddbaf17f
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2C0:J/sCv7iUIxc3EEg+QLb8NVPLH2C0
TLSH
T1B3253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 970KB
SHA256 6668889cb716c24818c654bfec9c6018ed97de9f11731f623969a93e4860d255
MD5 1dafebc0cac2a8c7d8968a28932a82b6
SHA1 8649446798dd2b9e52f7d9497991d46dbcd4c608
SHA512 b3f6f409244f5e3af276e62ba0bcc9b5da6a7ce84491a85ff2ed80b9758bfda8919905b1097f6ea8862fbeb5ece0ff3d1277d0f6d0bf1614ff8051964f8312fe
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2R70:J/sCv7iUIxc3EEg+QLb8NVPLH2Rg
TLSH
T18E253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 970KB
SHA256 f1f55e5577ead33bc4eb7de6cf8a557a8becb7c38098a83fc9b77f273efb40e1
MD5 9d410e1aa4c24cb598b44dc1ac8d1dd8
SHA1 5cd8eacfaf93f79bd0d95db056ba9996ec58a809
SHA512 943dcc5c61d9c5f773dd5ef07ca51b52db0bde15f2af5b1231a802aa3fecd65ee29bdda8f90634e746e2b028fd475def59dd5d30ecea928574713c21fc3fa0b0
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH24r:J/sCv7iUIxc3EEg+QLb8NVPLH24r
TLSH
T16C253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 970KB
SHA256 e569c1a70ab8e2a6f1b0ef87b90ee5e20524a4dbefdc925c1e64cfad3ba57fcf
MD5 694f35447fe3c5e4725fedb14a41ab61
SHA1 240399978d98e24b5055e7bab3cd9ac5ea0bfffc
SHA512 ac27fb8115d7247cbe2ab8c5cab4aab733bc38574ac7a415f67c185a322ada670e68b01f38baba460c5b761d717d6673e1279eebcf211ba7fe8381d77c32e252
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2Wn:J/sCv7iUIxc3EEg+QLb8NVPLH2Wn
TLSH
T1F5253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 970KB
SHA256 a391f51351393477742fe3b7346ba2fc1ec9adf0dd94359e412f0dd0cb07d66a
MD5 437970567601f54436eb91a01df0016e
SHA1 ddb9363861b1633d7156cf87914db51b1575d9f7
SHA512 2dfec7a826060530c8c276396fd5099d073a7a33252890e7200dcd70cc9be0c5962bfda91cee687286c9b6b76901da6d39305a7ce76641452f66ecd82a2a5c50
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH28x:J/sCv7iUIxc3EEg+QLb8NVPLH28x
TLSH
T1F8253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 970KB
SHA256 bda577e966f9ccab3868f8b2c1d8eab435d5cddc120980fe330af2bb8bf441ee
MD5 859cd4527ec33161c920b6aa95c5a471
SHA1 c365c619622e9a94636993f0b0d6c91977efe233
SHA512 049de929f50681397306bbf01e4fe0d34671a0aebbf87e2bbc5a853b141af56c729705f4dd02e94fe2441bf5362459a631bf0261b18e770623925331b055036d
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH22A:J/sCv7iUIxc3EEg+QLb8NVPLH22A
TLSH
T170253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 970KB
SHA256 8818bfd36733c7bfb3c21f61a6beeeb9340fc329c1463db7b444c6568b985af8
MD5 abc811fdcdc174d9fa0498089a69e7de
SHA1 59be8c5aff3635670c11f884593cc7e2a76dd3b7
SHA512 5fafd2aae2a6d7aed6291a1922f7a1a8fa95bb38d5bafc5416b1232dd419ff81a53a4907ba74fe9cac2ea906f7dfcfd04caeffe0a64e86595a33b6b2bddd1fee
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2v9Q:J/sCv7iUIxc3EEg+QLb8NVPLH2v9Q
TLSH
T1F1253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 970KB
SHA256 b0c378259556c5fe245f6b345c0a584b31f7c8b38339f01b4a7a03b70821c3a2
MD5 85aa534a757b4be5683c69312782d448
SHA1 e0f75ee406d7fcb5aaa5c48eb708de0bf4aa9dd4
SHA512 96782d937160e37b6cbd2fc4fdff8074e0df96a0803d81c3930b45dc36350d1959107cac54628fab3b6f284f3fe91cfe20faf1f9d671017da3ea34d680854133
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2G4:J/sCv7iUIxc3EEg+QLb8NVPLH2G4
TLSH
T1F9253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 970KB
SHA256 7b33f6ceaf41d09842332658be3a743990d6e0d186ba27ba92e9f36a3a75da79
MD5 78d0cde292cbf7a5938a07ed72b3fb41
SHA1 c67957ac0411f1099357f8402e501d8e7efd9a88
SHA512 f7911858235d5fd961a5db8a29e53fc76032c8b007916e29f8c7e0847fdc10f52096809057d6f5f3e42b582558e919f967b78b78b7d1b62739cff40d9b2ae9bf
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2Vu:J/sCv7iUIxc3EEg+QLb8NVPLH2Vu
TLSH
T173253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 970KB
SHA256 8eb49cc5f5070bb6fc39cd20644b20e21fba02feb283d3b5bd3a36d62a00c965
MD5 196461b6b225e4da286d34b446ba2bc3
SHA1 bb3326bebff0c519cc0f720cf8993646f83f23cf
SHA512 8dbeb37cd9118512f2c05fea6e7881fba8de57207edaa831dc34e549a22c79e41ecd6f3aed6143bd3ff95a0a75abc9257a60d3dc2f6adf48e8371f20a9afcdd0
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2Ij:J/sCv7iUIxc3EEg+QLb8NVPLH2Ij
TLSH
T19F253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 970KB
SHA256 780e3514d0437faa77f32445c7746cbac68ac570937643ca10a5ef9b7bbf0df5
MD5 215215a85da51cef62589af06690dc12
SHA1 602e67539f4a4bda29737ccd6d7a2e5feaa6db48
SHA512 90a33cbed8c6a4d3931cb51de76d6797ab1b533c4e3c05a5ebc587162159d9d334734791bfb6fd0da917cafd6562e5b6a975d732136b843ced37a9dd98e56373
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH25g:J/sCv7iUIxc3EEg+QLb8NVPLH25g
TLSH
T1EE253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 970KB
SHA256 db6ea70abe7b82e6e8cd2b0fb732c099dad7689ddaf6badc376ee8f5968380d1
MD5 58376c0de896ef80ee9be52bee4c52e0
SHA1 f5f3ec77ada5d86905b22086f18fa5013570398e
SHA512 bd28a301d217578ea62737d613422561f80c96c2b6d61299498561fcaf5a98400e8084faebdbfff250b303eba9ae8543c2b93989ea421dbed4df6a898d3206f4
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2gI:J/sCv7iUIxc3EEg+QLb8NVPLH2gI
TLSH
T158253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 970KB
SHA256 e16d997da55e082c3471e69bd65fd0c723b9b5c37d98b0b5336b2212d8449e11
MD5 b45050763a5b39a0a6f375385860dfd3
SHA1 ab3b04e64fddc9461bc6fd2b462f148000b1a774
SHA512 ae245fdf9d3a320354212d34968a91829fdf627092692a82d4cb621e3059415af3f217c4a5752cd4150580d3b94e5a5981b7a0ef8fe7215730c5201b8f44e35f
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2io:J/sCv7iUIxc3EEg+QLb8NVPLH2io
TLSH
T110253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 970KB
SHA256 4fdd4e0987c438aedcf936ba8e89d7a90b9a7ccef60371944f561c6f6ef8fee2
MD5 71f2cbe12f063f301eaa538cd8f50e59
SHA1 a70d1a832766152a33ed72ea67deff8420b36ff6
SHA512 fae3d94afd46f96a134be7460737b863f7806822c7ba60f4864677ed67be1ab163de02403b162cece936dcea7c2537faa251c899f06e3968ced9b909e89e10c6
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2Z+:J/sCv7iUIxc3EEg+QLb8NVPLH2Z+
TLSH
T177253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 970KB
SHA256 501a7039b5f1acb411ffeab2081f18cac167d5fa8d59db6de4b2a028c1549e52
MD5 dec36d483ced0a1a562c2ea34ab37d5e
SHA1 85516410be9ce7683b7c40e4fdbce90f79d61f89
SHA512 5c7b958bdcb77086589ddfbb12ca0056a3aecb00bdd26e5abf08014e1517161cbe4fac491b7757c83d6a54e18350e1a445a49a95078fe35dbf4ce1f46a1dfd61
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2HQ:J/sCv7iUIxc3EEg+QLb8NVPLH2HQ
TLSH
T1DB253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 970KB
SHA256 1d6f07e5223005f67a397f972a2d0b94c09b5562574b1e606152bf50ac5b6e78
MD5 19437ac3848180b09fdbc5e802290aba
SHA1 0743bbd2a00a2633aa63945e649e829f6aabd6d8
SHA512 ffbf188146ea35f83125061e571ed4783e9b20d1a5659c32c32d67bb1a0d1c973fdc4d38445621747e7430d097da0b30feb460bbbf9d55b585a4bf79bfbe32b1
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2cX:J/sCv7iUIxc3EEg+QLb8NVPLH2cX
TLSH
T1C9253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 970KB
SHA256 06f89979542a437be2649907859a7105f28731b38467d522b5fac639f5ada67b
MD5 d9b0b2314a3f4f4c387673aeefede597
SHA1 475ea9c746ae20058a2bcbceb467ef5472b9cb65
SHA512 98836e5c408536fb0c28f21e78e06b6f79d5f17b16e1cec872a5f9d19ba49bf8cdfe7c13d771cb5ea338c950fc3f4bfc3e7d2c4adcaa54035eb35509cdda7067
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2aL:J/sCv7iUIxc3EEg+QLb8NVPLH2aL
TLSH
T11D253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 970KB
SHA256 3dd1bd1ab372f41fb1bac128ed9b7a5242eade0bfd8de037f1defdbcede150c4
MD5 0b27388cf81f7f2653b1230d54121fd1
SHA1 a4e0effe2c504c275f6591b3ac4b0d25486d299b
SHA512 4ff88fe2afd7777631181872f7af7861d6bda8fd198bc440129f024777dea069bad1412c636e8d9c1d7d6f88be8ed45665084af88601f5763b965d1845385e0e
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2+FC:J/sCv7iUIxc3EEg+QLb8NVPLH2+M
TLSH
T1FD253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 970KB
SHA256 95dbe5703b1bc3ef83738e751d19bbab23363fa431a03b51b835467b1e0a54f6
MD5 1b41256674734af0f822eff2e3d1f9eb
SHA1 7ba05136db24abdb71e60b167ca232b015821d6d
SHA512 b7c5f142f111f8661f9a5c991280cc17290e70d89059d39c199837f5237d106885ad7be19d389ce1f8b76578ea13a74ce80517e64dc8641e1e448363f1d864cc
SSDEEP 12288:cPE/72wcCvRR58LUeDuUlIKxc3c76uz3sBO+XThuL5dtMdNVBT0mLH2nh:J/sCv7iUIxc3EEg+QLb8NVPLH2nh
TLSH
T1EB253A1366944F71D56F053059A94261DA3BFC295F2083DF26ACAF287E317E07938B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1780-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1780-1597-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2740-666-0x0000017483D30000-0x0000017483D50000-memory.dmp

Download

memory/2740-653-0x0000017483A30000-0x0000017483A50000-memory.dmp

Download

memory/2740-655-0x0000017493EE0000-0x0000017493FE0000-memory.dmp

Download

memory/2740-685-0x00000174941F0000-0x0000017494210000-memory.dmp

Download

memory/2740-641-0x00000174801E0000-0x00000174802E0000-memory.dmp

Download

memory/2804-1653-0x0000000000400000-0x000000000040D000-memory.dmp

Download