Analysis
- max time kernel
106s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 04:32
Behavioral task
behavioral1
Sample
2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe
- Size 909KB
- Sample260707-e6acdahy51
- SHA256 f8d804e6a36b4577f57894c585076ffe683b3e38b1e9049abbc47d20f8611b7e
- MD5 31ce2a42ee3485bef0b7348ca05b74fd
- SHA1 c5fc6d4a70c44e77aba014aa0707af1ddc063b32
- SHA512 ce1aefc7266b8a9f96513fb83a82a57f5dd0553b63cfce8300a1387cac463c5c8e75b7befcd0a986b89a946cc5826f2068fa3097f4324fc55db4b44674d570c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbu:A3k03kB56rE
- TLSH T1B0157B03E6850FA4D00FC1749A968662EA777C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/1480-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4c6-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b302-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1480-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5664-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b307-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8c-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001897f-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a59-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-235.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a5c-447.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-502.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a5b-582.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-675.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-791.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1120.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1554.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1573.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1574.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1577.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1579.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1618.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1620.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1708.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1751.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1850.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-2037.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-2105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-2106.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-2190.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-2204.dat INDICATOR_EXE_Packed_ASPack - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral2/files/0x000e00000001c4c6-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b302-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b307-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8c-60.dat aspack_v212_v242 behavioral2/files/0x000400000001897f-209.dat aspack_v212_v242 behavioral2/files/0x0004000000018a59-210.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-235.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-266.dat aspack_v212_v242 behavioral2/files/0x0006000000018a5c-447.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-502.dat aspack_v212_v242 behavioral2/files/0x0013000000018a5b-582.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-675.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-736.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-791.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-879.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1120.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1229.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1272.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1333.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1390.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1523.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1554.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1573.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1574.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1577.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1578.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1579.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1598.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1618.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1620.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1621.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1622.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1623.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1708.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1751.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1850.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-2037.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-2105.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-2106.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-2190.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-2204.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5664 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{0D5ADA8C-76DE-42D8-BB12-51D05E841DDF} explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{6CDE0AA3-707B-44A3-8606-AD1A94A5B7A9} explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 720 explorer.exe 720 explorer.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe Token: SeShutdownPrivilege 720 explorer.exe Token: SeCreatePagefilePrivilege 720 explorer.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 828 sihost.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe 720 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1480 2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe 5664 patcher.exe 2944 StartMenuExperienceHost.exe 720 explorer.exe 5180 SearchHost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 828 wrote to memory of 720 828 sihost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_31ce2a42ee3485bef0b7348ca05b74fd_cobalt-strike_conti_elex_hijackloader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1480
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5664
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:720
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2944
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5180
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 909KB
- SHA256 f8d804e6a36b4577f57894c585076ffe683b3e38b1e9049abbc47d20f8611b7e
- MD5 31ce2a42ee3485bef0b7348ca05b74fd
- SHA1 c5fc6d4a70c44e77aba014aa0707af1ddc063b32
- SHA512 ce1aefc7266b8a9f96513fb83a82a57f5dd0553b63cfce8300a1387cac463c5c8e75b7befcd0a986b89a946cc5826f2068fa3097f4324fc55db4b44674d570c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbu:A3k03kB56rE
- TLSH T1B0157B03E6850FA4D00FC1749A968662EA777C465F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 b10f8a971bc72ef147143edd3d415bbf4394484798d8c59b2e98061c41f57b78
- MD5 d71540607111fcab3626d29139c9a80e
- SHA1 cad1d89260c99a466fb1e66c54d4af4156dc66ad
- SHA512 4678b3e3d71e8acdea7e0017eb426fd352c2067cf962f5ee19950e115b11a423ecbb2080fa11c57c89a7d536c46506787e0577f2eea3f8c688d652b5dbaccc4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbe0Le5ji0hmxNrM:A3k03kB56r8Pji0Aj
- TLSH T1E1655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 924KB
- SHA256 252ac1fd8899e213c8ad6c9a714bb94ffd10a56c9e20c060251efe5106b1972d
- MD5 c21947236e63b19a557b4789c9d3100e
- SHA1 b8bc6330725e071b26c236a876416a99336fbd96
- SHA512 d2e5c63c1e6a8df658b035f41922039968a336bd1ecafad5cbdf22643037a557d7deef38c15b2c76838e879324497e312d0f195837a4f7683dbf4a1cd0a06625
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbYa:A3k03kB56r
- TLSH T159157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 957KB
- SHA256 dcc963b6902003d0163e8551a805de6023bb5944adf767a9a40723fa8c98dbb5
- MD5 454df599cc4e6efe6b10633e7ee893ac
- SHA1 6a077a07cb7419909306e8d807031968525cbb00
- SHA512 7a648eb05462a42146546a1258d1a011e7c41fe0f5a9fffb9bb3c362cf0c73a3776d47dbaabb8954e3796b8f5626bafd2ec0e7e6fc5753e74fbd245efafaebce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbTb:A3k03kB56rFb
- TLSH T1D0257C03E6940FA5D00F81749A958662EA777C466F2093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 933KB
- SHA256 4ef2f456192e45e17976c43795ff08753bc78f2c708e2e1a84050bfda81404e9
- MD5 e80011d871804a7617f69c8596a6e54d
- SHA1 888c63a5b4ff1ec8b41842d8ce6709364b9246ce
- SHA512 900c8a9b421221efc07d7cee1f86c10256af2ff50aad303db4c77637682f63cb4ddd5d1477fec253e3a5a8079fb4cfd69ddcbbcb7a84341acbb93fa63b8ed36a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mb6Z:A3k03kB56rS
- TLSH T165157B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 933KB
- SHA256 58b4c2f076bf11c58ccaafa72d7ec42d487e2b87555927bcb231d096029111e4
- MD5 d9aea18c09d1c1365b394e753d8971f5
- SHA1 6882b6b662f7dd46becc2eb1f6e4dca574b9721c
- SHA512 b1af40773e31305e89a6bc31c4d8f0bd9cd470d715e8ecad6368cd33fb3a8b8c3f59b16870a9db3ce755cd1a5e64cfced047d9dc1eb923d465ef7fe0d84010df
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbF1:A3k03kB56rN
- TLSH T19E157B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 933KB
- SHA256 b8f8ad43ffa82bba86b8e768113cf210a7ddf2c15684a01f118a2c84a2b60cdd
- MD5 dd26cbcd3b75e2e3a0a2bf6700016a33
- SHA1 98467768bc0dc868456e977aec27ab071ed6faf3
- SHA512 4a7996cfe59d1134380928a12ff70e4a854f45c966d8890af85b2ab02471ee94fc97d9bdcd3355e5aa8344bf906b71f27fd8a7b94b55330ec1038351b2915a1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbx6:A3k03kB56rq
- TLSH T178157B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 933KB
- SHA256 d799945cb5d465fcf76afeb79c6461c667feed53dd3c16cfa10fd1f55a7ab625
- MD5 5cd8e66a2797eea74f60d3c41a9edc94
- SHA1 d4ac20b68ed52b87599ff34c5d249cb89a7e3ca3
- SHA512 ea99b7a5ef6ef3d6bd655dcc87e6cdd748a50ae3eebafca566933a6f9f43c67181916466904d80b8a104e49899558b17c51b64a5abace57a3366803d2b251421
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbvN:A3k03kB56rj
- TLSH T1E4157B03E6850FA4D00F81749A958662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 933KB
- SHA256 8586f251e3f96d6cbd8cb7a48d423d317202f86eb9ec9789f06375f2a1b061a1
- MD5 357866805a1daa380a5b08caf2ac7e1a
- SHA1 2cdad1578dde9e38f1ccc687b268746405ead1f5
- SHA512 9422be8181e092ae56f89d92c0f2dc620ee5c35ffd939779572fa9123f3dd28715ad0071e1ad537afa414478c51e351c660adac1a175bbd0155b430580050875
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbVf:A3k03kB56rn
- TLSH T13F157B03E6850FA5D00F81749A958662EA777C465F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 933KB
- SHA256 f791da00458971776ec78122c8e6163c0a6be659c1f86a89e4eeb8e04ca7e90a
- MD5 4efaf7b0e467b144003b8a25bed28fe6
- SHA1 5731ba074b3de8789f9289b852cf724d92796f34
- SHA512 4b28ef2a8e199f5fab47d3caf2792c3814d353c92558fcf185bb03b77dc2a95bc9b6aa5ef32307cb2250a38fe16c8367f342c9fb28ca5afc75361449f96e0e01
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbXo:A3k03kB56re
- TLSH T1D8157B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 933KB
- SHA256 66991c03573df422680a4a4d009f82097db66a51b4d25f7f12423aaf628ff529
- MD5 4e98273850e9d048f297047f775eb870
- SHA1 2d353ccaddb45b6c349b6b4c3fffd15fe04ca815
- SHA512 732173b626fe4842a990cddca5c532a46d730a52890dca73064223692a028d822ff52e321c1bcd7af1099b40a86b92a798a557bc9ea79139894e7d507d66ac3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbbu:A3k03kB56rY
- TLSH T1F4157B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 933KB
- SHA256 31a9dc6d0068951e7bcf5bf79eb27acda0bebb9c431cb5703d85f4bf3ce5abe1
- MD5 f84b83fb4b2124d77e8ccbf1d968b74b
- SHA1 6a3284adeb1874121d00dfaaf5dc2bbcdbc2b826
- SHA512 31471f13ef6df3be0680054de92904bee7884801046580ed9fb43da5b178b2de367e6038f5caa4d3bfb65ce570203f0efe74abcc784c17c8d9c524d1de6ba98e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbJ9:A3k03kB56rN
- TLSH T116157B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 933KB
- SHA256 c1efc7b82f74fbbd9c60a6d3aa1c1aaa7252009d4515c64853b7bd9f6e3fc18e
- MD5 e28ecc0056d1adafd86ac834f902586c
- SHA1 1519fc7e7895ac39bcaa25d9cddd20c65158cd7f
- SHA512 e606b01cb06e01813236b75ee09cc4c7f47f70f4e25e37fae0d948e34807a6cea3b5d5f7729b9d1c98fe1328293b008b2a568c660105b159d62c498a82a14900
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mblc:A3k03kB56r4
- TLSH T13C157B03E6850FA5D00F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 933KB
- SHA256 e80572bf127c1994f2afa8fcb59362093389ced07da34e20524ea8253450fbe4
- MD5 07106ad5560da5f7ef82a2eafd79539a
- SHA1 fa355c9945da2ad4fed2f2e18ef659acc55c9db5
- SHA512 326ae0ee22f4bb9f337790dc8dd02ffe768bafe7c99b016a1994181f2cc72b43880214a24ec686cfb2a24ea9b8334649bf9266e2b7b15caa757ebb2cdd9ec15b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbep:A3k03kB56ru
- TLSH T1E0157B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 933KB
- SHA256 2c24c4c4fd41fb291c49aaee0bd5eee277bd8eaac17e7f0bf193480623111922
- MD5 6c8bbc84c6461b7cf331258a8567cdcb
- SHA1 0faa3b08bb41a8964f2c3606add961779545ef9d
- SHA512 53fd19c74b640701996b261f8c6eba1077d81fc462842e5d01a82680a62acabec22a1859d237147e4bab55eac99ff7c2ead6749d318aedde819795371502be43
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbRN:A3k03kB56rB
- TLSH T1CA157B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 933KB
- SHA256 cb08871bb0c9abecfe856c36cd37f38bd199d93e2cfc0b640ab03745cdf78af0
- MD5 2a452f73613e0038b7cf5367811a3e6d
- SHA1 c4a3bedc932deee8fb660166a1dcb51f6a7cda68
- SHA512 07dd7fbd629a65141b460559b8537a2dc68db8c080c1bbe0b76f1400efa6faf40c3e3313f4bff9bf9ec73c6cf3d9d12f68b6ce615654f2dd0a5210f5f40a75d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbzF:A3k03kB56rT
- TLSH T149157B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 933KB
- SHA256 a2e257f711844ef5bd75523f13e20ec28cacacc6f120493a07704365baad0cde
- MD5 8c1e473f4618c745bf42056a9b69b5fc
- SHA1 9d434942e5b68c906547f3cf600aedd51e283d60
- SHA512 0b5c5c598aaa1611fe597e491c3196a0abbce31b85e1618648ba35dc4745bb636138fff77fb499b48f17c6371973fc966f0c0009dc1cf1bc3db3993b652e1836
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbcC:A3k03kB56rP
- TLSH T198157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 933KB
- SHA256 8c6a0ba9840432e67a737fea15485fc9150f1c0f866735397cf700f7be9b14af
- MD5 5e8d8b3a3be7b00a8d45a1b986ca261d
- SHA1 2dc8b6fdb0c91335c7c025b85a3c5856d854d4bc
- SHA512 2c9cf8d641270820c15e12100976ece6ccec32335818117fbc62df179584376bcbd25703e5285c225cafcbb653e686e3109e1e244e1df6b010e5f7480fd82d21
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mb3w:A3k03kB56rq
- TLSH T1F4157B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 933KB
- SHA256 94c9edc7d94178be9a1066e6b2c78e299acec5e549dd97a8634ba8bf76132f05
- MD5 02f88ee0d4af6b95e974580e41cba1c9
- SHA1 b01b5f3061c80ee189e2441a50b8836314119e69
- SHA512 748464ad595324a8273932e65f9a771d52927ae5e77129f9e19ccc3ec41acbe66a5345611431666f5d2cd388313ee8f2eaca5f92bf4f0cb4ab945742aab6e271
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbmT:A3k03kB56ra
- TLSH T1B5157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 933KB
- SHA256 16ea0e2212d80e5edfe27357ae4030facca98dfbe1bcdae3a050f12030216d2a
- MD5 dc168fd23d9eec8d047810c10beb7d20
- SHA1 feeee4d0b08a3de6fe0ff73a50f4a487c17e12b8
- SHA512 e4194782a87f4cdb6de27254fbe7a881884d954bf780cc41df420a0e65ba45d8dea4c208ce1570b4e757e796f07d8ae2fe2c4023e04ec7cf9a4a1f7b0d4ed893
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbeu:A3k03kB56rV
- TLSH T192157B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 933KB
- SHA256 a5a114cc2421602ef98a38dc6687a9f7eba583e23b646b0507479c5bacfd8552
- MD5 08b9af68e900da7cab349ba14eb054b5
- SHA1 9ceedceaee8787bb0984198928cf9f59f371899b
- SHA512 b8a4a5f4d84365c7c49ed07bb5a902ccc78384018322736eaea90d27aaacabab4250957f1a965b4438fd59b1ad648f750f479944f74e2512c1b8f2de18b66710
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbYb:A3k03kB56r0
- TLSH T19E157B03E6850FA9D00FC1749A954662EA777C465F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 933KB
- SHA256 41181440441b5749b49a8810b67ebd74a5fa0144bdb03418b33b1485aa6a45b6
- MD5 651f8df1069661f03afcbee9db31169f
- SHA1 e2d34bb863418b0227ab52d2fca67e0764b8a838
- SHA512 32b7469a67436c84b979cdcd775345f72145dd13300966352edfc08de352ba0f0aeb5a9a408759e16b32ba970be632e249356d26211b94d6cb965574f7e66a02
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbGf:A3k03kB56rE
- TLSH T1D0157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 933KB
- SHA256 123e80e2a77b658a7708c0369bb53050d1301bcbd19b9890070123824718f9f5
- MD5 e91548a800daea4a672b631f797209aa
- SHA1 19626d31ac0f00e0729ef1afe3f74a058548a4fe
- SHA512 0169ec9e4c24be38fdd75b7275c578ca45f6108c3ac526f3de256e8dac3ba8491cafd440ecf7e10ea62f3e27638a60aa16f4bb7b09bbda86faa5c21a81a9c168
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbDK:A3k03kB56r0
- TLSH T119157B03E6850FA4D00FC1749A958662EA777C465F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 933KB
- SHA256 253468828d28bef4a22f7558310b5c077edb836b20987bccf3122121681084f4
- MD5 c71b22821119edabc5662f48c8545134
- SHA1 af7759f94d84e6a96cdec1275601b278f6888517
- SHA512 c887a91afacfa664361c98041a6e43b087be04193feb99475e7a480af5bbe1ba4fffb1ecff99b5335fa842f3005fdd7212b65c4019d1af248e0d8153539434ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbkk:A3k03kB56rN
- TLSH T13F157B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 933KB
- SHA256 228c25bb822f7762497d6d07d3be5321153fd4bca5d4be4965f69112198ca520
- MD5 a16df66187613ba779768bf04169afd4
- SHA1 05682d68de4c9bc29acbda1f3bd154a36a55f134
- SHA512 cff62680ab3fd4586c5f3739d2ffdfab0cd0cd0c39853dc3dce9a8ccdfcd342e92581982925e89d0974a51ad83c17e09b73f6676c8a477f0b4a9a0ebe2537c55
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbt0:A3k03kB56rw
- TLSH T1C8157B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 933KB
- SHA256 b1b430ab73daaf8dde27095ba35cacd939f607752a1f72035fae69fe095837c2
- MD5 8c6dc6ca5d1678d0e4fbfee2f1859967
- SHA1 1d8926c097a1bb2eb5b053c46b11b3d3be837809
- SHA512 604958eb4a4dadd2a4c1bcc51bbc91e4ab2d1dfbd87e0a6a84534d03c9a751d58b987cb717671fee0204dbdc882361e290c271075badd94fe8988fcab71be62b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbwg:A3k03kB56rF
- TLSH T124157B03E6850FA5D00F81749A954662EA777C425F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 933KB
- SHA256 0e0325b72a5ac44650ccbd3e6f61c40f4aa0dde719734e3542eed742d5197bab
- MD5 aa304af1318b5c86eba52ff786d7c96a
- SHA1 a7316c42002635b82ce6aece02296b71f49c5efd
- SHA512 5df597945504c55b239b31f052b237e7f187580628acbd28afe2d52918f34fe70c193e3ec7aec86499f6a93eca9d0e797f12b3287c427924a64d05fd4a9081d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbFr:A3k03kB56rH
- TLSH T1FE157B03E6850FA5D00F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 933KB
- SHA256 7cca1e0276f0d2f9e727d9412e6b0b1dea920f9ba0c13b6edab408dc28dab6aa
- MD5 46d143b3166484e21570d2dcb5b4f419
- SHA1 85ac043609567f4de297cdf51b33bc6c90a0d91c
- SHA512 8e122dc119222621ec6b89426a5365d03bc7a8895e04ab749afb74fe001c31d200be689a829a0698486aaa86d100e721809dccda510583fd4676a9ccf4fe7df5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbPn:A3k03kB56rx
- TLSH T123157B03E6850FA5D00F81749A964662EA777C065F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 933KB
- SHA256 269d36a1fae6155dfe615135a389063e297ae29f4ef6befd6bf2d41275424578
- MD5 52994698eea74d1e802f49b1d991a1e0
- SHA1 b9027e9c878c0ebac806e6c1b34c0cc3b2f11ee0
- SHA512 b48c5a43099cc9b73e7f5cfd5d0ab2a55aa68a7b5f353b0a6d37c1b18c7ea3585cd788823cd40b1ae6b4e46e59f6ce33fab40d7d29972f88dd386507d41a4053
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mb7x:A3k03kB56r/
- TLSH T1E1157B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 933KB
- SHA256 32949dde8f49994daa8f74d37454ab2b201a03e8062f6052d5b1da3d2e71bb07
- MD5 d0564d04d28bc4cf72c5bd807f04a6d3
- SHA1 7207b42aa7e3c1a5d558a3389779fcd802900106
- SHA512 69b5592fa41d287e362ef943ab5633f83246167d8b3827cd7d4494453424597226159f258a908bf41d36947a02f1ef71d070d10d5677240329f49aac999383bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbpA:A3k03kB56rA
- TLSH T182157B03E6850FA5D00FC1749A964662EA777C465F2093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 933KB
- SHA256 994151e0721fd4b788ebd95331e435e60000f17b007ce18808918c24278f6cd5
- MD5 cfefd0dbd31c71beb30ebd3c07602d3d
- SHA1 74b62cd34261be25942ce3369b7d2b274e6b02a6
- SHA512 cea9cfefb2f7077b1f90ce2aa4dcba8fa4862c46ae9fe2667e74148aada5ac1c702804c10915d0b5ded8998a329ed021fe6d0609c10e39b6163cc6af734bb0ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbi9Q:A3k03kB56r5
- TLSH T15C157B03E6850FA5D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 933KB
- SHA256 ee07f9f47fc3b2c3ccd950a6ae283423700ef597d5e49bbeaf191fc2adf49263
- MD5 1a630279bd8e33dcce2ea8e76e4e054f
- SHA1 0281423a2694d99bc9237af03570b3a21f3fe020
- SHA512 dae726315b6075514f97fd788caf54bc6e99e4b187d434f23b36a8aff2cb4eb22f231ae8bd1613224a79ade52627b5d026b6e515f71f27ea5075fb8323eb80e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbH4:A3k03kB56ru
- TLSH T1DF157B03E6850FA5D00F81749A958662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 933KB
- SHA256 630ba95b09fd4618db18e3181946350b6fedde8b66413b1d2cecf4db515e09b9
- MD5 1566a8731091fbb44d554d05241fc404
- SHA1 37ea778a52953c000be1a92fe57d1ff3fe646668
- SHA512 87cf4c7efa80c2a7e9c735e41d38b047c32faf4f4ca466493f914e5cd3b12c7ccba7c7a4951d0819d3b2452cbe7915d66a35b9b15f99cc62e65c341ce2229811
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbmu:A3k03kB56rP
- TLSH T184157B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 933KB
- SHA256 247ce218afdfa186161ec53f0847304e24d3242f27263de4c13c5cc2824c9bb9
- MD5 0cbc5df6b4448aea7efef41377d5c7a7
- SHA1 7a9a75cd9ff39ec9bad119e921ff0ff5c5472d1e
- SHA512 b700d6eb47e6cdef719b13be45b82f0c1ee887610776c9c8d4c76b8f4bd19e62da71bb6aa5c75f5c4a0f3ce16dd53ebd554742a344e5f2d0703a5c3697d044b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbXj:A3k03kB56rR
- TLSH T19C157B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 933KB
- SHA256 af24fccb86d0bf18842d39cf1460519c9348333eaa69639b3696bc7100d80a68
- MD5 64d44cdcecdbe59f303ed2b2f618f74d
- SHA1 68879f4d8ef6df6856e7b82f851a29f229dfa4ef
- SHA512 f864a6008c5429bfecc5f763e40a2b80e96773207473f360d27a0c9f2dd207b3184d0e62724fd8ef310cc68e8ac76430f3b2a347b6f213c52f4e1b08cd5d74b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbCg:A3k03kB56rV
- TLSH T116157B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 933KB
- SHA256 0495b98821c5bd7308255438cdd464eb232d382eb887e07600ada2cd7bf01687
- MD5 b9276b1a8c35e2e02b2e89a01a8c68e6
- SHA1 54369057208dafd8971d8f9749f3b87e74d98c9c
- SHA512 c693e24ccb8f22642ecccfce92127a9e2273965285bd628ecd1c6b2a198ba80f30ad3e72faa36b215e33e4bb703e185cd92d3b1ae15902d4c7b603050090f1b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mb9I:A3k03kB56rc
- TLSH T147157B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 933KB
- SHA256 c2a828fa2755bd00d29dfcadf62d1abdd1d86d93dd80d4fcb7fa53af5d81cc17
- MD5 8e35ce64985381117c19192bd8ee9d77
- SHA1 fe808d45847f81335490614784c98d78f21e32d3
- SHA512 ccd3e9fba4288f220ae0b1fbf4626414ffc69a5c9813caa28bc43a8920ebde3f7dded1b052075789736af84a5e159eb9ac839cec57bfecbfff6244747f4ee841
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbvo:A3k03kB56re
- TLSH T1AA157B03E6850FA9D00F81749A954662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 933KB
- SHA256 57274d321057bfe80053c1e687c2794954abf7c6963a35530e6f12eb1ab33215
- MD5 13d5a921302f6a10870790e94e128a32
- SHA1 67985184af727dc073868b21bab9b08f03a46e91
- SHA512 24d52e1912cd942a15b06d1cd3b849032cc1280e6210ebd07e676bf9aedbeb2b8e7da13b661be124f40eb2cb095e2fd28f219faf061cf0424d7b906fbc34fcec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mb0+:A3k03kB56rL
- TLSH T1E6157B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 933KB
- SHA256 35de6aa7aa95e51357bac94d0923d88170fd2dacab887376024df51cb2d8018e
- MD5 007ff2476196de7634481656371953c4
- SHA1 f33208d06f36254c4f3caa54838c0a923d64cf3e
- SHA512 b613d73552abde4030d345d44853374e58158789f1ae3618076bb4bda60eb85fb025c539db3ca07b55ca1105edd3f5e20d6e25fb77766b6b606c8e40195c3da9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mb8Q:A3k03kB56rP
- TLSH T193157B03E6850FA5D00F81749A958662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 933KB
- SHA256 39189779278ce1a62ce178fe663ed488ff9dabc4db9e849d1cb400190eb0c6fd
- MD5 8be12af1e273160515b5c84148b0b6b5
- SHA1 fca11c25b5ef8046747cc389f331a329ab397e50
- SHA512 fdb03c0be2232d664d368fbbfbd23dce48bbd31a6780384d6e15517f3003e6e0f5f21a7af63fe2b7b3ea9368eb2405eba907d918cbe7b8c5a61c9664bdaf7f66
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mblX:A3k03kB56rD
- TLSH T162157B03E6850FA5D00FC1749A958662EA777C425F6093DF2358AE153F72BC06B3E29B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 933KB
- SHA256 360ab6d98d63cd13f931b93c2374ee19a1f20b53f307cbffb9dbc63a20b05deb
- MD5 3963973b3db381715c4f5014d53202a8
- SHA1 696a1a69cee8505b9fa4b8a0c6c40c4df2572c92
- SHA512 9b4948b9586114e24d05d24393ce573436a6b1635add43f014266eceb3b2d0dd167e1ca33bd3e99e596b795d69f82787b6c5eb0fa829c5577d6348c86725f1ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbHL:A3k03kB56rN
- TLSH T18F157B03E6850FA4D00F81749A964662EA777C465F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 933KB
- SHA256 bb72a412e66ce6195ebb887ca097f1209d26cbb304c2822fa11f819311af499c
- MD5 376a5346a575425a348fabf08ecbd70c
- SHA1 862eb90e643fea6f29f3e49c5be5ea8908fb5adc
- SHA512 a40458c6f0b3b85773ff5d99675860a927d5c206ea99036433c8c5e12ba243126bcafb890ff4a16749663052b7579f1e577d6a2e6286f517811d1d20873b3695
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mb9M:A3k03kB56r0
- TLSH T159157B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 933KB
- SHA256 c6bf5ad66c1330ebe9b358f6486e924af07ebf92d0b0e3a868dffca0cf576b17
- MD5 126700e93121416a6bfe3e34a4f252d9
- SHA1 f422e78d4a3e539ec3881a25dd175372d01ebe55
- SHA512 fffa841bffc6c75641e5312de11df747daf81dc9c5a64dc0fc8a13a9249f6ac498caf64687c7850995304dc603e86587c48af81eea44e79ebfe1cea7c7386472
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mbuh:A3k03kB56ru
- TLSH T1EC157B03E6850FA5D00F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH