6856a3a3191dba1c2bd00dc2d72912e43849428de36d8fd24fd2539f8c8e97dd

Analysis

max time kernel
80s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 936KB
Sample260709-jpkh8set9m
SHA256 6856a3a3191dba1c2bd00dc2d72912e43849428de36d8fd24fd2539f8c8e97dd
MD5 e5757b97cbbaf40ceff4a3461d82c8e5
SHA1 92754f735b7523c5fc222103770b32bb0df4039b
SHA512 b53295408eec63e002a39495f2ea714b813c0453ad917436bbb3840bb6e3f276acf0e8651a3b5d6c572001f0418cf2fabeb328503043d2448be7b12339475e61
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmN:A3kMm56ry
TLSH
T108157C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware aspackv2 discovery persistence spyware

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5672-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c535-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b316-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5672-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1668-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b31b-35.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985e-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a72-806.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-967.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1036.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1214.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1271.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1513.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1545.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1566.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1567.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1569.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1615.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1644.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1694.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1751.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1993.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-2111.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-2190.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-2203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-2237.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-2262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-2263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-2300.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-2302.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-2317.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-2324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-2343.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c535-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b316-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b31b-35.dat	aspack_v212_v242
behavioral2/files/0x000400000001985e-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-498.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a72-806.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-967.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1036.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1092.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1214.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1271.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1356.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1513.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1545.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1566.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1567.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1569.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1572.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1615.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1616.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1617.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1618.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1644.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1694.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1726.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1751.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1993.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-2111.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-2190.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-2203.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-2237.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-2262.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-2263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-2300.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-2302.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-2317.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-2324.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-2343.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1668	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{AF756952-3176-484B-923B-22E7A476AA79}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{FC9DF6A5-0EAF-491E-80DF-7A9567B18B4C}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4484	explorer.exe
4484	explorer.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe
Token: SeShutdownPrivilege	4484	explorer.exe
Token: SeCreatePagefilePrivilege	4484	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2924	sihost.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe
4484	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5672	2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1668	patcher.exe
5544	SearchHost.exe
5448	StartMenuExperienceHost.exe
4484	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4484	2924	sihost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_e5757b97cbbaf40ceff4a3461d82c8e5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5672

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4484

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5544

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 936KB
SHA256 6856a3a3191dba1c2bd00dc2d72912e43849428de36d8fd24fd2539f8c8e97dd
MD5 e5757b97cbbaf40ceff4a3461d82c8e5
SHA1 92754f735b7523c5fc222103770b32bb0df4039b
SHA512 b53295408eec63e002a39495f2ea714b813c0453ad917436bbb3840bb6e3f276acf0e8651a3b5d6c572001f0418cf2fabeb328503043d2448be7b12339475e61
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmN:A3kMm56ry
TLSH
T108157C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 4177632604a0c4f4fbd1667114549c391e6569f051ac1b0413929fc7644b1dd1
MD5 d00751ec1209cad426a33ffab8b2afcc
SHA1 32af06379c4be958c51f06514586c7ed4eb6f16d
SHA512 af720ca7fbf87ac19d18a6d63f3fd197e86c6b4c06c1ca9f19406829467bc9e3b570224f9dc131ea737857d4d41734ca93627b09ce78bbb8f51032ef96007e55
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmZ0Le5ji0hmxNrM:A3kMm56ryPji0Aj
TLSH
T1C9655A16F6A44BA5D02BC174C5D2969AEA733C425F308BCB1354DE283F237D19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 950KB
SHA256 3b2a0abaef5838bf9b8731b0ec5e3bf9121f7c294cc8c59655016300285893f3
MD5 8dd8ea2bebbcf631cd4ecd1717fbdbec
SHA1 55a35699d1c4ab066b4c8dc3938c9f5407f761ab
SHA512 79817313ff203a4483bde8221ae99d1e8db83c80876d98186ade10cda1f704a0c1aa5a48f05d4410a18e2d8668fb9e94ec6bc4523b807918f630132ca6b2f64c
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmLa:A3kMm56r
TLSH
T1B9258D03A6940FE5E11F817499A54662EB737C125F6087CF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 959KB
SHA256 8ca8d6bce9a6bdb02b3e16018f37df8da078bc80aab46e56aa7cfbc167b71c32
MD5 eee048130fb2aad8fa22d9c08d85ab30
SHA1 b14dbe69d9c3aaf47667dc006c8a20cbab3b480e
SHA512 5558aa5201e1c652299368e23cda932a4b2a571ab6fa9c4b5d10e89c8140207a2b3e1435f87bd377ed3ada860c99925ce1c4b5ff464b02ac3d1a6f780f756087
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmK6:A3kMm56rc
TLSH
T191257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 959KB
SHA256 60ff9d19b64a03bf5f7b388204e4906824d768aa5be583fbd0ed25d0a0f22ffa
MD5 d87d89a29c3bfe50ab668ebe02ada809
SHA1 c4a9842742e288e10aac73f6061a070f4824092d
SHA512 e5161609dbcc8c0ae1dc618796cef9ba7cc19ee2d00186ccbaf9538ac33743b19e1c6c4c3cb63c9789ab0d3309142614c8bde3009416387e19e1486976cdb41a
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmiN:A3kMm56rB
TLSH
T1F9258C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 959KB
SHA256 cf9a20a28de741543fe3c7b64111978723e3bf3c6912e7fa61ae5810882686cd
MD5 542b28a829a00241157b5b5a346d8f5e
SHA1 1bf222fffd317afc7b3928125158b8112fb69946
SHA512 2b80e35c9d9153965d605db3c8363b0f63cf805b9259d90c1f07213217803bfdf6b4c6efbdccdc121c7dd3a105c402cd51149d64bd7434522c0f5ff8c6eb0825
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmYf:A3kMm56rh
TLSH
T17E257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 959KB
SHA256 b69c2ef3f1306c71306bea117772b84d66ac553a56198d3469550cf620545f0c
MD5 01c86b481288f88f6dec12a13262114b
SHA1 8bbb9daed1f85fba2a3d07bb4b60ebce095a0acc
SHA512 18201bc179ec929f1323fb760f5291fd28048d365a8df7caf3d8a7f80b6b87a6eeee8b58433d1205ca9e86d22a28355904815e16767a298e7f283fe35d5814af
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmyo:A3kMm56r0
TLSH
T1E3257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 959KB
SHA256 ce6916ba2bc35dbf001a4cab265237a2a215a76d8fd4bdbb208c24801ef201c7
MD5 25ae87c9645fcf944670a46a0f97f8c9
SHA1 df3dd19980902b7fcaf33d52b7fbd9ef89c9d3fb
SHA512 432e9a3f656a44fe3c34b3c84dd8e48744f41348a1a8691f70ef574f11d08d28c6e575ffbd4727494b556fe0a56c1d8c39da097cbe099cc5325526652fde3ecf
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmmu:A3kMm56rG
TLSH
T151257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 959KB
SHA256 8bcb55f00499d8f3277afbfcc40a2c30fc280d7a04cdba9dd92853c2afeb98e5
MD5 5a62c47de8562361ecb75251713ecf23
SHA1 fea1e5a14ec0088aa67cdb8007d338a292f7c9aa
SHA512 d141f04e54f19e1b10f5ada4a3cb34920f7e46fb3d0f84db071f419444f32203911b3bbef9d327458a8023331931c0709945fa2202fa055f3e44920afcd6bd7e
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bma9:A3kMm56rH
TLSH
T17A257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 959KB
SHA256 97c15b0da08db13d63a534e1f033cfa9e089797fbf788b0382ce0b6068300586
MD5 f7fb11f5a08e039e44c2c5fb1e14d756
SHA1 b36125bf8cec94b44d860e1d51b66f430449dbe6
SHA512 94ce7902a0bf468d08ac9b8f092ce037fd1e4dc5fa6284e088609ea8d5c739bde55d4f0bc45a846bea5630fa3df77dc6ca03d28d9e1a2dede76f174eff05203e
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmac:A3kMm56rW
TLSH
T1C4257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 959KB
SHA256 7535cbc450938ae86459a782e184cf505852987467fd7eb7b98509d364f1753d
MD5 bb1e5a2c2b3c77bea59516ebe28f69cc
SHA1 2a57b9e37c2f12e51a2f6bb9356065a9e70c4183
SHA512 3842f974b2a8ef906dd0cf3fb484093396aa01b69eed96dba8fd11222844319ad7e8d609e8976f544cc8c1adba70a76266c001a5b3cf2a9fa56053a99ea20e25
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmTp:A3kMm56rE
TLSH
T10D257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 959KB
SHA256 47edd0e5f9bb25e097d1a5d62e9672390f97d31af18a3da2bf94afbe7b9294f2
MD5 2481d25ef383f11bb731d456783d683c
SHA1 bd092c97802a5aa6fad766aea70ba880fe99d4f5
SHA512 5603ee4e77003d718129bc595dbb064fd0591e08b7269f737fc24819573e438093df230b854cf3823d5357e032675921e8e00f1fcdd98ec44987e9a392ff4c1a
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bm0N:A3kMm56rz
TLSH
T1C0257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 959KB
SHA256 19c5d4b0f15beadfeea8ff28f5cb69408a0dec753895327c91fdeac730a37cc6
MD5 02554ab24fae17cb8b51c3540fc37615
SHA1 ae0619b2b68808c4e07c5c8b7338313ce8e407a6
SHA512 8f6b27b2ec90aff2438bada93adba5ec13f8da397197b6da997d75de87ad2fe5b176165e163c8213645b1d83a8ac4a506ac092868903065cd585505fa0aa2eea
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmcF:A3kMm56rF
TLSH
T15D257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 959KB
SHA256 a33cfb1439ffda3c3b194787c745dcb9719fa47b9a7a1d4b50c7193f685e41e7
MD5 e2f8948c21804120105b33ad4631fe00
SHA1 2a533ff795f6ce503bd05e12ad3764e0e003a200
SHA512 6e7ee64d25e5ec0dbbaf690aa57850c9fee527e5daf915360d4ab1a4e2a2f142c548ef8a26ced076c27d75cbdf61fa02ee57baf7cdb94eb37411d708c4a96c33
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmJC:A3kMm56rp
TLSH
T15D257C03A6940FE5D11F817499A14662EB777C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 959KB
SHA256 a080499d417068fdd926828cdef10b12f94b9b2ca31452af21aba2f75ecea557
MD5 8966c962ec0d15a8565e0435c620af7e
SHA1 07944819a88980e0ac7f45633a922d4fdfc5eba3
SHA512 c438223e7b2cf7167c7551b2c31e046774242a893a46f53f3498b1104e4ea274786e773cb16f67445e1f1c4fa5d7c1a890a4a295abb6a656e2a35bdeb2fb41e4
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmqw:A3kMm56rU
TLSH
T181257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 959KB
SHA256 80f677f1b5cd225761715403dd509b813592efb7161b85fcf50606009cc3dc5a
MD5 5b7cf146523f0ed67aa6547c7819aac1
SHA1 305a2534466391018dd599db33367ab0f11eaf63
SHA512 b38c9540a2954be8fe91ecbbbdb2b2b215f68ec8da3c8efdb3da089de7a6f66ae15a9f248a2fdc5c97b6cdfe8299c5712083ba96dbaa109752ebca316aa0d946
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmxT:A3kMm56r8
TLSH
T192257C03A6940FE5D11F817499A14662EB777C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 959KB
SHA256 4d3abcf1053bacd535c6fe76eb6469c0327701f0f122ff4ce2f1a38b6c33d38b
MD5 d85fac914702bffdc934a1b3a40e8db4
SHA1 80ca1449153c822b302a187bb3fc7524b649b0d1
SHA512 a3fbe800083d13d6f6fe1a3223013dbb67c6c99f5c7f53e3a97e06949c4a34639736b94f29cf92b39e5c51ae71ac47d5fb83cf9afe04b22f0fe0e9f54b75292a
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmfu:A3kMm56rb
TLSH
T10C257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 959KB
SHA256 14f49cbc00b938fe9d9fd2b88ca69f1a28f1be89840a1ee29fbb8631b00163cf
MD5 8a0764805eea245084c10c9408f3a0a3
SHA1 f95abe41e95147ae3539dfc4843825b5b80345a5
SHA512 d9f787ed7ada7e440860e4423e248bed12da734b83b6075531ebf05f081b703516497a1edc24a8e28be02870cdbea2640a90b34520b5ad87d21029007ac80e20
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmDb:A3kMm56ry
TLSH
T1ED258C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 959KB
SHA256 fe0ded130173fe4b76d7dfb6e91d2c9342d693d0b91d400f5a80b1998bed29e4
MD5 ecc681843c6d6a33b8b0d9f948961cf4
SHA1 eedb68160b6e316ecb74314e48b324d8a241906d
SHA512 bb58c8b21a4a5fae4363bd44ab6bdd5f87675f3e1c84438121f15d7b0cf59b2d138e46308ffd3f55e19170bcfa0f5ce5b84427efb8384b20655f4e98ba6a0ccb
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmXf:A3kMm56rS
TLSH
T18A257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 959KB
SHA256 55346a576420875229ba59181ee070d84c96d9ca3ef711c5c4eda2c142d9097b
MD5 eee5e9bf30c2f5cbb002db5286f8d1ef
SHA1 e4501cfa97249dec246898b6b7d3db7ea97ff692
SHA512 7c47588da0c3eabbc552958b4c860c05512c75e6480a01a7af8be7ec423d5cd396402aaa0d625bfefdde7512e52491f52b3cab051af12c986098db1670229001
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmgK:A3kMm56ry
TLSH
T178257C03A6940FE5D11F817499A14662EB777C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 959KB
SHA256 f353e1fcaa0bf2996e1879404fe0534206009add10ee31b81403f9d3f36b21dd
MD5 304b55ae4996c3a446bcdc2f70e4aaf4
SHA1 996438bb0dfda5c34c91bdf9adffb77e41e7cfa6
SHA512 485e0c29f6eff79ffde95acb625493affa2ecbf324677d2d92f6a53d7da2d6a160811dfc1e0c1e6da19daf2a530984edc7e4dc9f0c0786910faf043f8c92021e
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmdk:A3kMm56rH
TLSH
T1A4257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 959KB
SHA256 0cdecfe84a2c16ea72ad9ca5afa3149f4674f24e7a2618a9b5ad0177a8536b21
MD5 e8ef85abb5481dd0937116345bedd6bb
SHA1 26215884e645703bdaf909dea6c5e60613a3cb15
SHA512 7802560c01f45d5e1fe9c7061e177d5f4dd17f75851ff594f757a92246343abff01e29332793c7f334e2ee67835cbb4a7847a914c1e53cd71556cfa78745de1a
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmC0:A3kMm56rG
TLSH
T124257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 959KB
SHA256 1fa810e4b12344fd20e5599e4a218b1794c234c60aa34c6a2a49f55cfff5a971
MD5 f266c41242eb901166ed29a070d72cef
SHA1 546aa3d501f9fd99a0da7160c0c08f69ccba881c
SHA512 1614ccd141c67b696d2d7f554097e92a781a84ba6b5394e8a73e6dc7f7da8603744ab34671d561969b91bbe2b17170b6ec2f7b60bf0ad1ec6eab2a4d3b32cee7
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmRg:A3kMm56r/
TLSH
T17D257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 959KB
SHA256 eebd0b75901f8f453dd87b8426cbacadea8b8742a003c28bd7b952f7c7a892ae
MD5 32dd025774e58ad34c93b9a576ac8602
SHA1 5d2b1ffceef002327a99dddd80b691c11aa0418e
SHA512 6ac27c8bef8e74fd3caa021d3afe743e273acb6407da4ea2239940c39fd63875731e60528eef6e789c2e1277155d7eb3ab4d669e982f158460b169d9841590f4
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bm4r:A3kMm56rZ
TLSH
T194257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 959KB
SHA256 82acd36429327c205ce70520081e764ea5618630550b083e12a5a2375724cb3d
MD5 3729d35bb123d8e37c8b1e8de05f772d
SHA1 3591afeb1ab5a5698c6636f257a09f3031afd7d2
SHA512 ae84c04c74819e77203c0827b246e64047664c763c9e44decfe1a68fe6aa3fa1263d82c940cfd1f9bf28f10a53700b123d40d2484e3027a7236c9638e33f54c4
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmWn:A3kMm56rT
TLSH
T1DD257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 959KB
SHA256 1f37778e231c3bc32637422ca71ad0e4dfa3add484a203d4c68dfaca0f860dec
MD5 e588f168dbb86eafaee8ed17962d502a
SHA1 43d0aad5c4347cc022670d3b12b6288b2b417d59
SHA512 d3b3b6898ef736cfc68b47e7f89ea81dabcc8617a7ac12961e799f1197c938d71021160d7f6a71f194272c07631f531e85196184274b4e3b38b6d7d857dd5cf2
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bm8x:A3kMm56rR
TLSH
T152257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 959KB
SHA256 330ec372ee27abb1f5bec3fae26d3a68e0552d448d6898801a383ca1d07abc5f
MD5 220f324cb19c1d4a8bd0bc654c4b6512
SHA1 8cdd75b9a41711d26f571d6639815a7e578469dc
SHA512 dc540890a79e1982af74e4838353db07dc8c7b13e00c7631a66a6975433a693475bc16732aba58679b689ef54a7c823c2abf08495087b75a4dad7cb1ed2a1d62
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bm2A:A3kMm56r+
TLSH
T135257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 959KB
SHA256 b95772aec07ebd5ca3f3e5a59433fe76168a0755313260e8725559ece4da0c9f
MD5 1eb197ec2a8f90a372bcd07db8999fc9
SHA1 927dc93b4e20f057d121a64d2506d3eb0b9a5aeb
SHA512 9770aad22d94c9f35083e23c80ff87d203185864ddaf5bacc3a14b3e5a1ffcd0a3808b5f032b974725e6e38be43cc24d9a1870cb146bdc38e0e4a0705ca7283c
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmv9Q:A3kMm56rj
TLSH
T184257C03A6940FE5D11F817499A14662EB777C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 959KB
SHA256 fc306ad8de29f2cf740ef3ca50e9379a51dbaf62f831889df5a7e53d8348583d
MD5 d9b3dd06f80ab5f69aa14151f4a26730
SHA1 c2670f389516bd47f932c23a3e22ed3fe99d2aea
SHA512 a360b98ec94c21c186dad9e4e881eaa2a6d1495e041238671b8e0ea17347569886dcf6804ed55b753b8ff84040ed0b0c6b34a1630f10f90d8d50c497d4bec0c8
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmG4:A3kMm56rE
TLSH
T11B257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 959KB
SHA256 a5ff5339b574ec2ec3c24d011c9f3bf17f7623ba5e404c5744c59ce6d0faa0b3
MD5 ae0f510f0810667239c8aa2c721af600
SHA1 513c6353f25c62a46a35fc50eedef672dd2c348d
SHA512 22a027f01dc6b5a3b285cee77824745bea6a3f60507788a8a93cd26ab0c8214a8ff84dec39275b1570f2e6138af173622dc5d2831156c76f059a291d9c32c096
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmVu:A3kMm56r1
TLSH
T143258C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 959KB
SHA256 0016ded59ab81cf62cf5e7e090d91ffb428bfaa9970c57acfd9efb98c4ffbeda
MD5 9593046a48e6238a7743f946f8ddc502
SHA1 53dcfddbfaea368cf1b19ec063ceedc5d44ad8f8
SHA512 8f568dc987fe6cd2051b7e343c5ea70fbb3d6f49d271e06c260e16f7c0da56f692b9d9867ef75a65cba1e8f6c40d9db3ccf0b507de96503a7107d110533c1bfa
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmIj:A3kMm56rX
TLSH
T1FC257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 959KB
SHA256 88ccff73264c2ab6b00240c1152aa36ef5035873d4e862a8ddf96bfd56de6336
MD5 cf800ebb883d37c41bbc616f1b281fc9
SHA1 ac550dc397899b5421e5ee5a6cf53744327197e6
SHA512 3b9447e3cbc7ba003e9dccc786b9f918f3750eae9f1b583ebcc23cde76d5ea08d0c2051129be77d5705b71f6aebb4367a78734f315c3675c9cda2f41f8d42813
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bm5g:A3kMm56r/
TLSH
T185257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 959KB
SHA256 1b00b5f79d4c5477062cc98ffcb1bc18e672de4abac366798e0b408812f9a5e9
MD5 de1962f6ab1506bd63b2d9f005c377a6
SHA1 870ed23355c07fa66b24a4557ca7188f80666e85
SHA512 07359b01b2ee63ed5a357880476f0c92b9a8b89bf418cb9da460418ba5fa08a8eff700ae57a07b38553fd082361ae6805fe4ad19ba442191a21067a25b13f1ba
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmgI:A3kMm56ru
TLSH
T15D258C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 959KB
SHA256 3577ac05578ff870c4890439f505cf9a12c69f1605a3b90212614acc7a7408e7
MD5 dcecc46aa8b4ff93dbd1bc395bcdc370
SHA1 236b6c057957bd90a99efaf47b9cc41c5d40a0f4
SHA512 d9fe26cfe7adb21d4a1ea19e297e1cc50d22b817c1b5c536070800935808089f21207698caf5c1f346943f04641ed75d2592015bf0bc003e9bec685a2032a53b
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmio:A3kMm56rs
TLSH
T163257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 959KB
SHA256 088add4f743f423db4fab2af57153f58b7d95b495add75c1fcd9ad919b01be8a
MD5 1aea2874e6aab4dea22c4204bba33d21
SHA1 47b26899b40c33c548e9b6b0b66a6f834b8d45af
SHA512 d504d494459eb5e68c7173c673641c22f8adba4eb5eba40a7387674c4203a772dfba09963e40a523f6dabdf3a80de6e1bbbfa4b0265efff63d51d8171842ed49
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmZ+:A3kMm56rB
TLSH
T165257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 959KB
SHA256 4e31199eeea3638f53ca10c68880bce295b420611d025725a2173148007cb223
MD5 c7a8b9e69b5a9933e4decc09aa4f5e47
SHA1 ed345b8d76d0b6cdf2c3eee9829139c612487c9d
SHA512 a2910995213bbdb21eb7b69bd0f24d4dd0314f4bf83412ec9ac4f6e7d85dbf0c40a110de421afbcf6a88c1345ba3c9664b48838646d5f1fe938668710431ea77
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmHQ:A3kMm56rB
TLSH
T18F258C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 959KB
SHA256 f3d848a395cb1336c00ddd016214bf6ce00e32d5c27f8f6e4cb169896e65367b
MD5 17b146fe448754d426aedaeda9a409db
SHA1 a9962f55083d786d3c8b62a5b89d061753f15c98
SHA512 939657f5fc9f6069dafd9e73ad41bb7b5b1d2a4b1b9086ceb3902a8515e865607394b01bd09764dbff973c04a90feda9fce4efd3e5c6825160a20b4d34e827d9
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmcX:A3kMm56rt
TLSH
T18E257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 959KB
SHA256 6c01e4d09c1ffa7513ba17b68e554916cbd2817484c3b36ddffd353b8a899fdd
MD5 defb71d0c5a20526c9622312b56a9ffd
SHA1 0c7262e2afb6a393838aaa3dc037a5cf9ea4e504
SHA512 967bada4681f7aebe708e6186ba393d8ab1be83fa7d7e5c0010b7c7ddcfb8facd8316da95ea4b20628b5da85fe0f46f31154968e0135756b8dbac21b6ede75c9
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+BmaL:A3kMm56rv
TLSH
T13E257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 959KB
SHA256 ce7f81b437423f5d19184cbbc36bf7d2c2e3ec624a153984f8f96858315775a3
MD5 9f48518b7f98498b5cd1b58db6fe0abb
SHA1 5e87253aeb3f25f7c52e682aa39a0d3a544341c8
SHA512 8d99bd267df38152fd3d30d53e92f2a0e5f774bbbe41a6a550684e84e285e208c03b30ea889954699fedede0ce330fe24e104f73f99aeab2ac0aa40351aaeb78
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bm+M:A3kMm56ra
TLSH
T1C8257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 959KB
SHA256 077ade43895845cc78c10b2f8f9c435ba08625f1d6df00763cda459c1ff7297f
MD5 ddba000f3b26255a4e68bbad59d0b5e5
SHA1 ce709287910d7ec4d6965a8ac0e3daf2a0697726
SHA512 b4b4b6b5899f21338c430e1eb28a8b38fab53684f355468431fc1b618a7ac0ea3fb764395e1af7602067cb9fe94bc7feeb7529bf85a82c5e59302b445777e7f1
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotF1i+Bmnh:A3kMm56rU
TLSH
T15A257C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1668-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4484-1037-0x000000000E4C0000-0x000000000ED3B000-memory.dmp

Download

memory/5544-668-0x0000021D13190000-0x0000021D131B0000-memory.dmp

Download

memory/5544-635-0x0000021D12E50000-0x0000021D12F50000-memory.dmp

Download

memory/5544-654-0x0000021D02B90000-0x0000021D02BB0000-memory.dmp

Download

memory/5544-634-0x0000021D02A30000-0x0000021D02A50000-memory.dmp

Download

memory/5544-622-0x0000021D001E0000-0x0000021D002E0000-memory.dmp

Download

memory/5544-623-0x0000021D001E0000-0x0000021D002E0000-memory.dmp

Download

memory/5544-624-0x0000021D001E0000-0x0000021D002E0000-memory.dmp

Download

memory/5672-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5672-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download