5d011c9e5b5d81a00cc2625ec43feebbb36b3c796028fb59074f21e838804c11

Analysis

max time kernel
87s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
Size 918KB
Sample260709-r6bawsct7m
SHA256 5d011c9e5b5d81a00cc2625ec43feebbb36b3c796028fb59074f21e838804c11
MD5 646a53f2b9c430c148dd3b3b9867b8cc
SHA1 59f2ca842d21598b1b7bf520e1268e6f706fa782
SHA512 07a1508db260b879500e3107328d6d624e15a329c4e935282fe89c7d5ec1e9dea42b3744cb669ef5ac81b7383101581023abd38d0b83233f4aaf22e3db4cb83a
SSDEEP 12288:4/FLKnBNUbTYfUk92+CzNDS5lSZ7NrapUrE9+aYFLq3nG7H1u:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1u
TLSH
T141155C27BBB468E1F1BB89745AB18650EB72BC710F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
1548	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{36E02E28-4299-40D1-A54D-9248B7B913F4}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{6BAF7F66-9083-44E2-86DA-874086357636}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1148	explorer.exe
1148	explorer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe
Token: SeShutdownPrivilege	1148	explorer.exe
Token: SeCreatePagefilePrivilege	1148	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3156	sihost.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe
1148	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3796	2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
1548	patcher.exe
1716	StartMenuExperienceHost.exe
3744	SearchHost.exe
1148	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1148	3156	sihost.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_646a53f2b9c430c148dd3b3b9867b8cc_cobalt-strike_conti_elex_glassworm_hijackloader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3796

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1148

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3744

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 918KB
SHA256 5d011c9e5b5d81a00cc2625ec43feebbb36b3c796028fb59074f21e838804c11
MD5 646a53f2b9c430c148dd3b3b9867b8cc
SHA1 59f2ca842d21598b1b7bf520e1268e6f706fa782
SHA512 07a1508db260b879500e3107328d6d624e15a329c4e935282fe89c7d5ec1e9dea42b3744cb669ef5ac81b7383101581023abd38d0b83233f4aaf22e3db4cb83a
SSDEEP 12288:4/FLKnBNUbTYfUk92+CzNDS5lSZ7NrapUrE9+aYFLq3nG7H1u:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1u
TLSH
T141155C27BBB468E1F1BB89745AB18650EB72BC710F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0f563e2ece26d1a4e5d024deaaa036ea5e6a6ce4ae314fcee33bd840542feee9
MD5 8a69014c098c9a597e5f9646b1796a35
SHA1 56336d2f7a465525733040069efa947cb770b3d9
SHA512 13040b80dea4e2b7e04dd71d7e8e1840cd3ab4d5ecf86fecd91d065fd756218e16c45b72fd7036ccef7621c37bc3b8b1f08755a4d730044ee3644f384bd1fe7c
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1e0Le5ji0hmxNrM:iFuLfUpzNDS5lSZUpmEZfPji0Aj
TLSH
T1DC654926FAB88AA1E077C478C9E29655EB7278610B30C7CF5251D32D5E33AD18E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 933KB
SHA256 b63bdf8ceb77c3eb870718eb3982f2a6bfefbf4223edde7420065c530c687ee8
MD5 cb1d4a4d8461ca61b2e5585ec8875dab
SHA1 3c47162f1c11e23ff4f57fbb3183e6fca1951cba
SHA512 a129210475d5c279142a8918d841fd914e38ee2cd3c2de72875df9033a21cb08de4fedf797b70bc03cd3e15360a32592551e56bcd3d6aeb9a07d7402a6c8f7b7
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Ya:iFuLfUpzNDS5lSZUpmEZ
TLSH
T17C156D27BBB468E1F1BB89745AB18650EB72BC710F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 966KB
SHA256 6ce5b9ca12763ca2b69d7f0f144e6af5e119e1179e664ab1729695d02221f289
MD5 6ccd0d1e9b4487b2ccedfe0385c6ddf8
SHA1 298f5352dea89c9d2e1df279d3bd711c43d47a27
SHA512 9a8077b95f2c0bc8777a93d8fe5675ed73a453cdf16aa8a3429b2084ddf91e3692cc156d653a524cfbaace1e662810893975ca246165a243e47cb1637ce85928
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Tb:iFuLfUpzNDS5lSZUpmEZCb
TLSH
T16B255C17BBB868D1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 942KB
SHA256 5679efa43d3f2845b462580df5a8bf17750c3b6b89a218dd594796c24b129a18
MD5 4254afc4dcc88b35ac635b752a68136b
SHA1 4e0f4a0c18e46acbfe41fa61e964182ee3750e6b
SHA512 ed0987ad894f2f479adb5760ead9be8716b13d686c3e6b514c667e010c7421e52c6316aa23b1ce935477c58bd36d59d09292c8eac0bcd0d3852a6f2a4044b6fc
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1x6:iFuLfUpzNDS5lSZUpmEZn
TLSH
T12A256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 942KB
SHA256 121b76b7515472792ca2926fcd3672849025d28cfc45aa9e79cf06a5b43351c8
MD5 4b1cb267affd9a2777ab51f996393e72
SHA1 7988498b395e7eca1652ebc2a345b356c93af90a
SHA512 7040a17ef139ed0b6bbdb2502c823d005d9407b8a0a89c674e0c866402b5afdbb30a874749611ce239bb8b775d621b885b9a28160f383cc2626d8b2fa08bd780
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1vN:iFuLfUpzNDS5lSZUpmEZ6
TLSH
T145256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 942KB
SHA256 d66b912acfd8f79e9c8907e0fa96cdad9c43faeaa8f0fa6773739e364040d474
MD5 871212e2c096ca28e5ffad5c87174bb3
SHA1 9f4b53969664af38e9f3813701b62966ab3c52dd
SHA512 73881ac456e934ed0b84aa1c53c8328febcd510009ef015482001fc480dc42101bab54e86c74fc89ca7d2afa1cbe5508d2980e660915fe3531215d7fdddb9d05
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Vf:iFuLfUpzNDS5lSZUpmEZ2
TLSH
T1F6256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 942KB
SHA256 9e0a921085136ecfe618e1ca3d5b9713617544432c82b2239e7b785de6137d95
MD5 1803a8527bc704c0ff65a49ed36bde34
SHA1 d1f0b9ab6540e04cf00ba75e21e6952b056260dd
SHA512 620af7ec4bd0a3b431a12864b9562d583b1b6ad4906a72c44278860e7aee4979ca86dfa46ff988cf71cfb0a100b71afcd860502275063aa0f712dcffd17f7ae4
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Xo:iFuLfUpzNDS5lSZUpmEZX
TLSH
T180256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 942KB
SHA256 7abb86906a14287c99bee80b8dd4ea3d3794f27d82b31b1e0aaf98e67d264bee
MD5 bae9cff81a65b65edebac4a3b3fb61dc
SHA1 3ec01915f391a505ff80f1b8f2ef5bc496ff9189
SHA512 b229530fa03378fd92cf413c4105ad2435b040789d752b04a979a094593ca1d6cb8d2ea6326ab18d1c3d31983d47a2619813d74d87c6dd7ac7aaf361cebed660
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1bu:iFuLfUpzNDS5lSZUpmEZZ
TLSH
T1F3256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 942KB
SHA256 91fa4ba70dd115eb93ace2b57885fee43ec6f9567bd46106027003e10d030636
MD5 284040a9d384ac8235d10f5fa142867d
SHA1 02e637fa4f59466cd938360fa79eae39fcf8ebc3
SHA512 3da3d130964342b561ffb7909552daaeb2377f7a24d9fcb8783c020017134cbb9eee5fcf2f0939849783fa8951275d20760bed3f78abecbdb545f23fadac90af
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1J9:iFuLfUpzNDS5lSZUpmEZU
TLSH
T117256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 942KB
SHA256 fe3b6f39fb2d05032dc96f77f34e656f5e0fb576ada7ca9a0990310a9374a959
MD5 b73fc18ded6b0b9ad03c9e38d1f4541a
SHA1 7f1f95f09b841ddd9488527e94402801ca99f785
SHA512 6e2ee8bf18f663d83a142e0bb05ad669d76918757b44e4bf90a89d720d453b6016df995f750c1e922290a8c679f499223b3abcbceb19b57d144e33680569f8b6
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1lc:iFuLfUpzNDS5lSZUpmEZ9
TLSH
T159256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 942KB
SHA256 11bbb48009fe45fc9236c9e31b940b03584029f18f9b50a299e73a269a37b604
MD5 bcf7cd22f5dfd2a203d0589a60214618
SHA1 ae33a513b5d8072a0b278f6c17b76ece393fd6e4
SHA512 3b1a8af802adb4a211290d0de5b6e45c31409f67fdb0bba00a0db698a0b06f048a777737bc2c31bde84552dc4971d9d96355ee8c788db1831d117492bf53e90d
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1ep:iFuLfUpzNDS5lSZUpmEZj
TLSH
T1BF256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 942KB
SHA256 d242f89b0f593dada984ee696fe0856efe7d30b5cee062293f70cc6048ed12bb
MD5 d596c9ed011d5541f4b264cd79030023
SHA1 987cc00abd88ac040deb413806a699cf05ea9010
SHA512 2a4364caa91a28665afe190b4993c170bfcd8584caa1b4914a74bb49b15e93a7c2d658f0cfd23ad938f603dff505b910a6f2ec78c475a7afd3ae2b9ae95d109c
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1RN:iFuLfUpzNDS5lSZUpmEZY
TLSH
T1CC256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 942KB
SHA256 b3614725f5d23f9c72ba05470e0116e8b0f7d7a57fbffc56bfc0744b15f8336b
MD5 10174c79bdcd6153c284297e8971adb4
SHA1 7c50798b496e217188b775e075ea0c5849ddc5d6
SHA512 a785ffc42e95e66b76c75d21f8f910a0e5f5f8a47ab6d4c3e8397c0dd35ef180eabbe9cd7d9ea9d31adce5b5717634c9dbd4d2b0732e8dd9e8056c5daf4d17ac
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1zF:iFuLfUpzNDS5lSZUpmEZu
TLSH
T168256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 942KB
SHA256 f3a2407390840c64d7d96b33af6984a7b08b5dd5d50903ac41ef3afaa6e5592b
MD5 3c6861b07ca022f9951f998328eb63ab
SHA1 4ede3e0e2075ce432db1fb7a2fb2cb46d85108b7
SHA512 81c6894f84e1f5cce09901a76a705bf421272938ad88fde0fa7166f22c307611c1af89a0d98ecb8f4f42e96e1fc0dcdd24903597647a798bfe1897e80a9a2107
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1cC:iFuLfUpzNDS5lSZUpmEZK
TLSH
T10C256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 942KB
SHA256 23241b61646f1966e34ad221ee2244abdaa0dffac763498b406fa7d67a81d66d
MD5 3360e7ce30130ae57ec787d862985c6c
SHA1 9c81744885858f5d0193ac02ee3c8f30c26b4e5f
SHA512 ea5bfda4ab018f657a7a57bd8e180c648368485193883d3aa55c25d6500142ee39f56184f2eb82e63e43c40801cb230b5596bcbc94c7b0c6ec12345326f9a856
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H13w:iFuLfUpzNDS5lSZUpmEZf
TLSH
T15F256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 942KB
SHA256 07e8f32616b786da27200033ac47ef63faf42b4f8b3d47d1c1c74f860e9ebd0e
MD5 d81eda5c89efa940481aaf0c18cc8117
SHA1 76357ec99820bddb17144856e0376128300bfe40
SHA512 478107dc1198e7e6246cd884e6f1e2c46facece2dd21a06b22f14c7aaa6aec76196f70397ccc079a6193c202c5a295e0ca132d8183a863053a6530784d96a01d
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1mT:iFuLfUpzNDS5lSZUpmEZ7
TLSH
T112256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 942KB
SHA256 8f56959eb76be0ed269fd077d624d57945070f8dd6b47a9e296f76bb05c5dfe7
MD5 a30f8fa055113fe43a729cab38a4b499
SHA1 d84015edcfd0fe70e66f652da7a507aeaf023fc7
SHA512 d448af6c94b3b6621d411b8415aabbd547ba34b7d3790f8f8d26c975eb2be6d05fd71ade04b71bf762beabb680ac22d07af4794cb13fb2b01b930d49494c5a01
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1eu:iFuLfUpzNDS5lSZUpmEZ8
TLSH
T155256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 942KB
SHA256 e413bc3e5b1073a2ff15e5922be03aa9a8bc4745983e1c60ed54bb6517faac44
MD5 1266859bcd72f0c8b28ab623f075b715
SHA1 d0a3f8905c74b05634d1ae4c455e43b7ce3c3088
SHA512 528b0271510dc1c3ebb1dab68aed5885512ddaeca0dcc394b352cf82307a92f6bcffce8df29e44526c7130eeaddfd43085f56e1e0dfecbd6c97704b82d3f6596
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Yb:iFuLfUpzNDS5lSZUpmEZV
TLSH
T115256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 942KB
SHA256 7c442a40a72b68016229cf6e994c606ebee34c860e1c1eec87b39cfd224718c9
MD5 503dfaa8ac43a823d727267b874c2166
SHA1 8782c36bf40dd36d372de0de281e1530cf0eb750
SHA512 7ce2c18828abce2affa6e3531b2a57fb86d874968fcaa79600b02adc868bc3463b3833acf61c084c214d8932971f0464dad5b379cdcb223ac2eb99d060db238f
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Gf:iFuLfUpzNDS5lSZUpmEZV
TLSH
T1A2256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 942KB
SHA256 cde6f1bb3bba8e60aaccbf29cf641ee4439740b02248634bb808a7bc2be33ee9
MD5 01d6e04334ed001e71e570ae54404c76
SHA1 6fe2146982530ece2314d4c58a36ad372a77879a
SHA512 61007cb5b58e48a7678d043ab02288108f2bb808e8b17f3fc6d96f4f9dde884da6a3e98fe3c02799d44d78af8b8367b48c15c4abba8b9b7d12a50b3a988e3eb6
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1DK:iFuLfUpzNDS5lSZUpmEZN
TLSH
T199256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 942KB
SHA256 bf6e670f201424381282befb002201c8b5d9879f4fd184a8b65f0008291c57c0
MD5 d8365c0e04baa1375a551bbcf84606a3
SHA1 8bdc3179b3a352c4c71414dfa28e5f0522bb3256
SHA512 b3e7cddf0aa58bba58fdd805630b7040a5798d83068ea83f674b225c4eb8d0987fb4cc493da1d8f1dc9905d4dab9a5eeedee15446c4c91693f06405a8bbb8a38
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1kk:iFuLfUpzNDS5lSZUpmEZk
TLSH
T1B6256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 942KB
SHA256 c30e44321b201683ae370a53ba39a1efde00ea699a852672b398ce992da40bd5
MD5 d733b6e15417ca777990610e705ca04a
SHA1 9836f44d936eecff4cb4f2d7e47068edcdf5e038
SHA512 ecdd9701b9d1e0cae2acf49785c1849f183715ce085fe1b242bcad22d73b41b82b357730b3b2c6e5e4b667bc08b9422ae6ff36ade1ed0d1f06b2833d4893a432
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1t0:iFuLfUpzNDS5lSZUpmEZN
TLSH
T1F4256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 942KB
SHA256 dc3b5e5126683dcfad354bb5db8d11ac17950a404f434e5fd6199265b5bf32e2
MD5 cfea6de6abf159e97662138109e44971
SHA1 5d164dbfded8eaab25494ee24369d349a3f90d4b
SHA512 8361a80745a8dfa4c0cf341f22c2fd98bce2521370741de967dcf72363f01150524f0373d5a38624a7b195f810e384a5741c40c5e3a98016754686b1c5845465
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1wg:iFuLfUpzNDS5lSZUpmEZ8
TLSH
T1EA256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 942KB
SHA256 e3dbe77d09dc8068a8b72a32929a97d6f1fc0a8ed425be0496f1a692564f6765
MD5 e1b75d8b4637e2c8b10383515a19abc8
SHA1 a4b0015ed0bc83708b7c2a9465a14bb85f333c69
SHA512 5cc96b93246251e8bbef17e5f5c6273b1e84c6fbf2774af814312d7709f51cad2ef76051fa40e1b60c63ca27fa635ff6d4fd47ec9cffa2564aa34e34ce1662c5
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Fr:iFuLfUpzNDS5lSZUpmEZO
TLSH
T1F0256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 942KB
SHA256 f01d02d1f36ef7dd90b82dcf39a87c19cd16998db90f6e115ca8b767da0a6ddc
MD5 f0953d12edd8b9016dd75640b078376d
SHA1 e7b65ff4e3a76e1b498141f163c486e161478cfd
SHA512 be0ba2e70ff43b6d8f84bd7b2431a5f30e9d63529f8f1efb1c5cef65ad8b6507004b981a1830e7dd1730ff079a62ef931dd6dc0838fc6e7ba20c18e577313656
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Pn:iFuLfUpzNDS5lSZUpmEZ4
TLSH
T148256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 942KB
SHA256 e294785c052e3ecb378340fc65ad7fea129fea72e9be023a4abe1ab517bba037
MD5 c66660230592e4e0a2d84f1e0093ecf2
SHA1 f6a051df6420652b6ad2d8fad56ff0082b223371
SHA512 a6503d551f6c6511e21d26d9c8cd168c0c815ab35887f419ac33f00e29271d29dc3e8a1027701ce9bd27cfba3c04d08231f9371d239f368655eaeb9bdfdd84a2
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H17x:iFuLfUpzNDS5lSZUpmEZu
TLSH
T1D1256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 942KB
SHA256 2d929493a9ddc6cb77442377b86df49afa20dbe6e133929ef751aa8a3fe9f053
MD5 4008a8e74d0dd95fb908906d6071f7c8
SHA1 5b7c63c0043f2c58bcf91300f131f0465e97d329
SHA512 ca179e74e5e24a97d4dcd70888749d71c4e2309f47a79ad6436463e21fdbb5c46b397bde9207270cbb1e368bf2837ed0bbf47fd11f3ff9cb529b4336c1c0e70c
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1pA:iFuLfUpzNDS5lSZUpmEZl
TLSH
T13D256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 942KB
SHA256 91ba26670eefac53f6143e693b34b1598b818e7c83e9c3a44a51cb8c34eb0046
MD5 3435a65346236373c0b7f894a7cbbe5a
SHA1 2381f485be6b778b6032876410b3bdf3cb0a06ee
SHA512 c01d8476e51d641d4da467b13340b2809d643c64e02316561eea28319450ad8080c369d9b5ba23a778c52c36822be8356be15c0bd5e8442cd48096a02fa061a6
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1i9Q:iFuLfUpzNDS5lSZUpmEZE
TLSH
T19A256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 942KB
SHA256 c0f108925e229faf00ffe577327c0520b94676ac9e6805c14c08a5795aa44b18
MD5 d48a626aa7cb686855f0b45cb2582bf2
SHA1 d973dfcdae4c52f664d2dd71e356e2a5dbc9a40b
SHA512 f61763ea5dfff3b06572d9bc464edbbbb9db90fcb82bad57a7af356bc36363db21838fa74b3dc61e154fd4141ac7245f3acd1240c2b61e47800b42ac2fff916c
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1H4:iFuLfUpzNDS5lSZUpmEZv
TLSH
T12E256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 942KB
SHA256 2545d29114d384ae6eaa32404e7ea5596bb1426eeb104edb70bbe106ff685025
MD5 0809b75e548ea55ddb22ec75fc68f8eb
SHA1 5347cee8d6ea5b93a8b67d1514f465aee33cec76
SHA512 a105bf5684d0d118b00cf1bcedfa1e8d130e0e8db732c3d01676bfb7c1d97ea1542a796a4f343d7adb4ff01832b876b38e700345ce9ce821cdfa02de54b5abab
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1mu:iFuLfUpzNDS5lSZUpmEZi
TLSH
T1C3256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 942KB
SHA256 68964cefdf553bad761bc93be291943f3e651ec3a32a43ee365105eb6552dca8
MD5 f2b4045ddc1a3a1535b17a27275c612c
SHA1 1d40d904478c793faf7d9ce02cdac180b17ad96f
SHA512 d397fff1c048318ca8169f662860aea0522b4b477f718eba223c815913a12e3594305457198b2191c9df9d579f97574531f645fd0a407148267b7236f585148d
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Xj:iFuLfUpzNDS5lSZUpmEZ8
TLSH
T1A7256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 942KB
SHA256 750c39f19158310ee60297616df5f379af96c055b27a8af6a5f7d266df7cbd53
MD5 1ab8dc754816aeb08eff1513ca9dcd55
SHA1 78ca50ea25eeb0f53d8b17079c5062ad418d26d8
SHA512 712b57b4c3f932904decc29d839933b1e171dfd8843af9b082fd102d3df48a8580f7ba6f2c5e0f9293053cc56d6ed20504367ca703644df629d8971712b93922
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1Cg:iFuLfUpzNDS5lSZUpmEZ0
TLSH
T175256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 942KB
SHA256 0ef892c473f3cc5c3f2b596a670b5a3f3ae0308e18fad8ff10b14edbcac76e08
MD5 c205552fc1076dee1a83d4fc1b277f5a
SHA1 590a33ac4ad48638c085ee01d455428723eee2ca
SHA512 33463e16428fb6b61d811cf5fee14c8e3eab7683458394890277cf6bfa17d26e0adb737a9ac55ce7f387b385476018172860c987beeaab24cdfa0c21133790c7
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H19I:iFuLfUpzNDS5lSZUpmEZ9
TLSH
T17C256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 942KB
SHA256 65b111972ecfcea260380d0286b2766610bbae51949cdd4116cc3fb299399404
MD5 05814c8595f87227b1932de1d1c548ec
SHA1 c5c16784865e33585bb9f449bcf946b250ac7982
SHA512 1cbb1ad7319b70ae885a77d334fcc25847a63ae498e6bec59a43786499784114bba80171ff8b5a85e8fb475d5fb399f87fb5b496f4f6780555fda9cd9d96e1a2
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1vo:iFuLfUpzNDS5lSZUpmEZb
TLSH
T139256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 942KB
SHA256 92e9aa90df7642d19c70d501a1dac05f2c44b76f31813f8dc17fe496d56c5dee
MD5 b410f4fd0dae71c48e13727cc4d9fbaa
SHA1 19fd8e28d5197321f95e2d3683ad6cc87204102b
SHA512 3faf0a4a3a811485ae87f73a1d31a12a999bd9f0402b89b80ed0f516abaee0508079e4c3ec6cd19df3dc4578ee0c34369bb4c679861928ccaba04002452e4d35
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H10+:iFuLfUpzNDS5lSZUpmEZ+
TLSH
T1D6256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 942KB
SHA256 a050fbaf73e88316d4377ae027a07c1d03652a3dcbd9b114a138fcc1eeb754fd
MD5 557f73af207a5f881a9024944ce79e4f
SHA1 ced2c93a6b05f175f1717e5990e12a864d41d129
SHA512 d1801efa1d36a7f3d889c61bb0e938e200feb57cb837394ba68c32f4038c5b603881a869586bc0475488c51207b90a7e4eb700a41b453b181f916698f4849683
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H18Q:iFuLfUpzNDS5lSZUpmEZq
TLSH
T149256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 942KB
SHA256 7fb6b54a633f56ec57a2ea7ade439ea2d79d304574b431a0795d569343c9e414
MD5 808976c2886e25704deccea9d348394c
SHA1 34018d1611ff2eeed6272fd3c07f9a69ffedf02f
SHA512 8eb3444d1e213e06da700b95a1fd8b3ce4b1fc4eb960aaa0506f6b5c2938b11cfdd576d1abfd6134f74d7b448b8dadff844b2b9778d3d23381f8839f4fed4292
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1lX:iFuLfUpzNDS5lSZUpmEZ6
TLSH
T19F256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 942KB
SHA256 6e954c2fc0839668dcb9d8485f020dc93ba5b5d5efd7687deaf6084b6c089036
MD5 823c9e19af326dce880bcf16bf36b78e
SHA1 dc4091d9849cdcc080c2b6fca81d14d0ffb7ac20
SHA512 66dfebe11481566beb22266c149e13397571d66aa8b726b5ab5922500f3469a43e6314e265e39b3bf277e7fea8730255db979ee17af6c69e8205248eeb0ec9df
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1HL:iFuLfUpzNDS5lSZUpmEZU
TLSH
T13D256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 942KB
SHA256 62679adaf594180622452344b69e4717d2a5914bf25841c3c1989c91922c2926
MD5 0aa93aba08f8aac3b076c7017408f24f
SHA1 033e2ec90b5a4887a4de46bff2dac16d7d65b83e
SHA512 64c7c699dd26cbe07a185eab2689275686bc210ceb776cee394783925f1baa6f2410f3d7f7d6889152e447560facb992ed792c55ae52196c23242fdb955589e6
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H19M:iFuLfUpzNDS5lSZUpmEZ1
TLSH
T1EA256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 942KB
SHA256 b44c06b2715f768960a5f05bee2ffc06ab029dd6e497741c2bfaed9b18a31ae9
MD5 ad2ff2880236ead4d280bd8bce8e8138
SHA1 6073152272b43878683502f76c61f82fae15aec0
SHA512 b6181bc8b10d0ce52df57367b63dfda42af855852bfb188f44ad29aae6bdf0da2372b208109cbad21b233beff3e731f0db8a234d14c2378e4152dc3625663a2d
SSDEEP 24576:4/FLKLfUkFCzNDS5lSZpapUrEZ3G7H1uh:iFuLfUpzNDS5lSZUpmEZP
TLSH
T1B6256C27BBB468E1F1BB89745AB18610EB72BC711F21D38F9160E21E4E33AD05E35725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1148-966-0x000000000A780000-0x000000000A90E000-memory.dmp

Download

memory/1548-11-0x00000000005C0000-0x00000000005D0000-memory.dmp

Download

memory/3744-611-0x000001EF01AB0000-0x000001EF01AD0000-memory.dmp

Download

memory/3744-549-0x000001EF001E0000-0x000001EF002E0000-memory.dmp

Download

memory/3744-625-0x000001EF04270000-0x000001EF04290000-memory.dmp

Download

memory/3744-587-0x000001EF01930000-0x000001EF01950000-memory.dmp

Download

memory/3744-591-0x000001EF01E00000-0x000001EF01F00000-memory.dmp

Download

memory/3796-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3796-1-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/3796-18-0x0000000002180000-0x0000000002183000-memory.dmp

Download