Analysis
- max time kernel
111s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 22:37
Behavioral task
behavioral1
Sample
2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 877KB
- Sample260629-2jwy7agy6v
- SHA256 b93c55890bc1de6274b6eeb630d09c65670bf49b7e0dd0c345c44b64e4c61651
- MD5 49d2e76e4ac6bd4fe3f39d1389a883c6
- SHA1 3577d13f49bef235cd9ade951d049579f2f92cf4
- SHA512 a67e3a94b9435a648638447590fc1dc1613316148913d05b2bb8688885406e85ce03be5bf8a88a2d9f51ab3dcc1a92611e83fec8a26b34f79055d204ac03931a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsi6:A3k03kB56rp
- TLSH T191156A17E6850FA4D10FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral2/memory/2148-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c563-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c9-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2148-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1324-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f4-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8e-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bb30-191.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018980-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018982-295.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018984-458.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a62-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a63-586.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a60-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-765.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1459.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1539.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1541.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1560.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1561.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1563.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1565.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1602.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1603.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1604.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1605.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1606.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1619.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1699.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1846.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-2027.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-2172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-2173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-2187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-2196.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-2197.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-2227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-2246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-2247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-2278.dat INDICATOR_EXE_Packed_ASPack - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral2/files/0x000e00000001c563-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c9-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f4-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8e-60.dat aspack_v212_v242 behavioral2/files/0x000400000001bb30-191.dat aspack_v212_v242 behavioral2/files/0x0005000000018980-258.dat aspack_v212_v242 behavioral2/files/0x0004000000018982-295.dat aspack_v212_v242 behavioral2/files/0x0004000000018984-458.dat aspack_v212_v242 behavioral2/files/0x0013000000018a62-501.dat aspack_v212_v242 behavioral2/files/0x0005000000018a63-586.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-623.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-642.dat aspack_v212_v242 behavioral2/files/0x0004000000018a60-733.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-765.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1259.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1338.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1459.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1539.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1541.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1560.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1561.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1563.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1565.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1602.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1603.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1604.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1605.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1606.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1619.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1699.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1737.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1846.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-2027.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-2172.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-2173.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-2187.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-2196.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-2197.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-2227.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-2246.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-2247.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-2278.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1324 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{1E5B42F5-9F39-465E-B3B6-56CF96E3E1F6} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{55B45D0F-34F9-4224-8739-B54E047DA44F} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2592 explorer.exe 2592 explorer.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe Token: SeShutdownPrivilege 2592 explorer.exe Token: SeCreatePagefilePrivilege 2592 explorer.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 4524 sihost.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe 2592 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2148 2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1324 patcher.exe 1396 StartMenuExperienceHost.exe 2592 explorer.exe 3956 SearchHost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4524 wrote to memory of 2592 4524 sihost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_49d2e76e4ac6bd4fe3f39d1389a883c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2148
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1324
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2592
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1396
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3956
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 877KB
- SHA256 b93c55890bc1de6274b6eeb630d09c65670bf49b7e0dd0c345c44b64e4c61651
- MD5 49d2e76e4ac6bd4fe3f39d1389a883c6
- SHA1 3577d13f49bef235cd9ade951d049579f2f92cf4
- SHA512 a67e3a94b9435a648638447590fc1dc1613316148913d05b2bb8688885406e85ce03be5bf8a88a2d9f51ab3dcc1a92611e83fec8a26b34f79055d204ac03931a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsi6:A3k03kB56rp
- TLSH T191156A17E6850FA4D10FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 1d4b670fba8adf8d92603313ac863696a06547064f90ed67c2c425f5acb76f80
- MD5 d50fd019d2c6b770b5b2f2cb32df7d8c
- SHA1 4f7526f75520326634fc67055bcfd5b0cfac25ae
- SHA512 258f649de98d1c07f7ac1e4168b31bf1edc895902c6a4a278387fc316eb382f9010c4894ea4680e7f2114ed67cd7005974803e0a139b2a15ce0440faebb68667
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiK0Le5ji0hmxNrM:A3k03kB56rVPji0Aj
- TLSH T132654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 891KB
- SHA256 2a2227663174d280a03cff6cb276804c450a32822cb4882f6d867de29721d903
- MD5 2f85559da53c3d40b80170e8f709fce9
- SHA1 444077e53dd3b1bf1333da4823ee58313d5ea716
- SHA512 c102744819ff0c5c036431d381cd8e7bfaf9d756740eb3d52b48a168a770ece30b92d3ff596833345c8d6a7e7f477ddda60e73f71f9f842910407f9abb2ca018
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiEa:A3k03kB56r
- TLSH T156156B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 924KB
- SHA256 7ce724bc39588c1a5cbd2e55b383be8b88ac1863c3d37356f5712d0d54d527ca
- MD5 9d762de37065ba6ac4de7c68c64b6090
- SHA1 04c1677a6fbf63f8d89dcbd09122096e5f3a7cae
- SHA512 58db9dbd4c86b697f1d23759266c1cb7f5c40cce961f071ae48782467a30db42a9ae075859f1e53e055bc16f3f7c854ee751b9374cd22c42c8cdb6f9b2c991e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiPb:A3k03kB56r0b
- TLSH T1FC157B03E6840FA5D10F81749AA58672EA777C425F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 900KB
- SHA256 a73d2354ae3865e72f1d5d5c679fccf8f6925303efe938731a2ff385b5a0c188
- MD5 26e4a6ade96ff2a63d7f4d56f4442df8
- SHA1 8359937aa4b20336ae7b1633410c767785ffc563
- SHA512 4764c80480f73bdbd1645bd1943cfc1f12ab64a7b4a8680012d51f74a2e1a80df605f4354905be3a881133fcaa49ffe51379c6f61cabd66e4ec7399e3bcf47c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsi3s:A3k03kB56rp
- TLSH T1F4156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 921KB
- SHA256 d67e0f0fa4aa6a49cae31127771d1320621c9c21e519ea11b3e2091533e0d155
- MD5 d89f7708f87ff7338d9059b55eed20b3
- SHA1 ef0b2a9b65c41d6a57b32519642a92db918cf094
- SHA512 70f0c629b5b31c982bdeb7d7a94c057bce37cfcdd8496b1ad0015c1dd6519dafa9160b66d0ff18412176c75118f4c093d611385bcb59f61411b557580a133cd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiV:A3k03kB56r8
- TLSH T113157A13E6850FA4D00FC1749A968662EA737C425F2093DF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 900KB
- SHA256 b3cf4b36247e949c9dedca343b4868dd662a2d9f2866ae45dcfd6e920dea407e
- MD5 2693baa7b06339599cf73f232b63ff85
- SHA1 dd8d5f780af7a458c9cc7cf201c663113d1a75ca
- SHA512 361adba1eb6b47e8c2441683b75fc7710b7c665bf812c531b8d0caaf8b06d7dc2252146476729a0db5af749d43d695bdb4861b534f425c2a0de42dc9c4b9ce2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsieZ:A3k03kB56r5
- TLSH T1DB156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 900KB
- SHA256 b8c875ac22e1ae9f55e42eed5cdeeebe0f86f45a529e4c8df8a3ea59d5a9f7d4
- MD5 6a1364f0a107869df2940145f9e59c9d
- SHA1 264a980743e380b152ea033fe8513c40d4a9fde1
- SHA512 b05c69e11e50b922003ffefc1c1a244685a831d050fbbd0066dd2cb2c78ea28ed74d2e1b39439f8c5a961e3e839612e732965a5dae6cacaa84d2c2f3b7e9a6a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsi51:A3k03kB56rG
- TLSH T1C9156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 900KB
- SHA256 c8a1419e821801a56f8b6c4f82ab3503fbfe427927962df8b9b093e5ecda66b3
- MD5 0a7cf0653f3be51d49467af1e8e99e62
- SHA1 e463358208b8078c3b34d04d1ee2ee80507f146f
- SHA512 475a832de0bc7b308564c31c84c02a197d858d431a6cb6ae4e0b757b2641b15f78d9199ca42c36e391dd30edd58f7af5e758a3dbd8cb8c77e8537085a5583a03
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsi96:A3k03kB56rR
- TLSH T1F0156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 900KB
- SHA256 f19f86adda4b5642f4ca36177af8f1e74961cbc6e8c31a722107a1a9b94aa0cb
- MD5 f8701b8617bfc9bc5023836cace65399
- SHA1 0b29685a5ce950a551912f16b3ed6382d63b2b42
- SHA512 4d8248e0d2f4db5aba5cb82ac6913474686b4fa6eb4f650132a54567ad95015af8e0e692ca58a94e1d4c75ef15882573fd92641b866c190336084823878622d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiTN:A3k03kB56ro
- TLSH T151156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 900KB
- SHA256 58a6876bf6e666e225e0a9426b7665a6b399eda24ac9123a133275e4ab5ab61c
- MD5 48e6734ca43080719d3c047b38b142a6
- SHA1 848e1e3ff345684c980a524e808c0e8cbb9d4bbe
- SHA512 2fc3cad9d3965e5db1755dd55b9c96096ed2369246690b450d70992b27db35801810f4eb71421a027884c5dbfdbbd22baeece41bc48030ba7e36b9cd2778b34b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsihf:A3k03kB56rA
- TLSH T1F4156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 900KB
- SHA256 270ea6d7815ef80fc520f1d38bed656b9be55d336d4f6695bf46b793c771fee4
- MD5 e12b548395594c81bb2ef44c263941c0
- SHA1 51b187a76a1d2c21cf0789ecae412c1cce61f08c
- SHA512 2aa45f8373715f74d8b34202a587ce6ce31f9e6eedb9aae2b1d820d4fe13b26a441d0df4811992f405f96e401a2f393998b19081b43b7d2c560171cef7599be5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiDo:A3k03kB56rN
- TLSH T107156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 900KB
- SHA256 29a663a3bb3c1bfd4983c2d7699763cd1faf252d5aec057a47d107a86f07b6f7
- MD5 ab7b85d5a942486303d6b04b0c90beb7
- SHA1 24556924aa5c2c73fd0d4b6a1540179fa3f37905
- SHA512 d5abe1330d7f6ecb77918165736b9274d003e5d0e368cf4f0dae069aca279413b342388449cb261e5ecdfcd9522e768bec20b7b1b9d361891466b95dda3d91ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsi3u:A3k03kB56r/
- TLSH T144156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 900KB
- SHA256 b8647cecddede84fcfe595159d72f3c395aa63060fc3bec185b80bac083c21bc
- MD5 66b3a7bffef542f06dc3863930ef215c
- SHA1 44ec4ed4ca2d553369166c36c87f602117cd97d9
- SHA512 511ca0f841f46aa1ed713f4fde67e85ab3c398ae0f38f09e530cc1a83172e3d21c69fac1ab1dbfaa4ac658cd3a96f17a6d7775c6bc47a8825ead8fffa4921bc5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiF9:A3k03kB56r+
- TLSH T1D4156A13E6850FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 900KB
- SHA256 05851f2bfc9e4441295237ac2b3a3be162202c0ff275818034e4eedfda649122
- MD5 e7d3be0870fe493e5845ff175882049b
- SHA1 b6d2efcde7cbab45f225004780db5aa721a62969
- SHA512 b3af736c49152b70c876298a49e6d874fd38665f6707dece4bfc4bf779bedd90afac104bfed6b921265d3f4a59b4d9d6271f2aacfc078a1aff43683ca8e66761
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsihc:A3k03kB56rT
- TLSH T1C2156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 900KB
- SHA256 07244234d4a71630aa5b534cf329e9e71432bc03c7e22c353372d30473cbbce2
- MD5 8e402c32247395f9e9255aafcd5c6bea
- SHA1 4c97c741f40e5eb0653ee4c4212d589208d52c94
- SHA512 6a7b98ab5ab41ea8c9ce11e80083d07f588b3984a865d790c4b7352443afe8390156da86dd12563c9e2134dec14e5aa0e5b9a2beb8889c58137a2d5a32e21ca2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiKp:A3k03kB56rx
- TLSH T1D9156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 900KB
- SHA256 ae87d30017357359e9bd579423cf6e2f8a4893325346860eeea845698cb17ed5
- MD5 d2046c6b5726c95a08a9141c4bf0d43e
- SHA1 d04f66ab7a991c016024d64609822b5b52e99d8d
- SHA512 ae7531505e8e2f6c6ee7d94fb21133430c2260a13517520fd3dc84888bf010eb06944618b10ba813f61657a6201292fd2fc64b8b4c29ec040cb1f6ceb33acb3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsitN:A3k03kB56rq
- TLSH T1B5156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 900KB
- SHA256 1c9b434a240109b255fffcb3266a9ca9b95d31938d9d9f7f7b9806d8ba469930
- MD5 7b75a7d9f4eb7918efa6cfe4f259511c
- SHA1 1c549cb815b3c3fc7178c92b84db24a1cc738034
- SHA512 1064d9a658b3f56ae040a539794dbbda8dbeca7dfc4be26c07c44dc88297feeee99dc68d7beb449516043cd61e938f61fb7255c97a4908403368c2e63a8c875a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsifF:A3k03kB56rw
- TLSH T1CC156A13E6850FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 900KB
- SHA256 1cccdede8d4e18188f10a04a7feee940fb7a837f0fa22b58959ca051eeb7313c
- MD5 49aa35f7636055bb4763fed677ae0dfb
- SHA1 cc6d22fcdb2fb3faf5be6056774ddcc812662d6a
- SHA512 abe18ce419448a8ebad9279b4a40024f4cc6ce1cc02124ba635c29bf666f95734b05a5597063aa946e18530a874a180c27076cbfd3655e5bda74d3f6502a31ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiAC:A3k03kB56rE
- TLSH T179156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 900KB
- SHA256 4d3913f8ab88b3343d00d0a88a451cb1856ea6b32e87a7fe54a212039ca1fba9
- MD5 a55e1c1f56072d107d9ecbfbbcc41663
- SHA1 5d924d7a0c5febe1e3f9113abf48544e80f7486b
- SHA512 269b5e2ebf44ee5ce9bedc7c66491f4f621f88788d93406ee01fe8566aab2f2905a9945f2d3d598754f3bc1a248db598d83f4b602e413db6a899c48d506683fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiTw:A3k03kB56rZ
- TLSH T13C156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 900KB
- SHA256 ed2a003aa1f679a4c6eb88e9042ed5f777b04550de7f8b82cf42f3c3d0083d06
- MD5 df58477d3cb1210e49e18efd9ebf9f7f
- SHA1 54343bb408f4eb1be13107aeab25b4cfa32c7eaa
- SHA512 df921d1beb9c689b397b5736b93250e2c276bf977ee8f0dc835facd997d60fe3f42727ac8f84fd9eccbc201ec68d3b7f779420089bf818310bdd918c4fad6b89
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiaT:A3k03kB56rN
- TLSH T1F3156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 900KB
- SHA256 19cb8391b7c6dcd39b90e62ceab0de7da8f0eb365c22877db5a56584404ecda7
- MD5 9eedccf8ea92b6aa7ae43a5e3c8ea305
- SHA1 bcab9ad51d2098e5278dbb254388cf478801bf8c
- SHA512 b93e56617da495c33a6378a41a495269144a46dd4f64631b0a98041074ac000ae0804ba5b75c8f63e1bfbb21ebcdd8be7b6a292966a1f304c5f09c9b8574d582
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsi6u:A3k03kB56rS
- TLSH T19D156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 900KB
- SHA256 260f0731cc17b0989f594e91e2f3098e2f4f15239e8458bcc0a038c3b06a82d2
- MD5 483c00bc23513a6d256568fff97de13d
- SHA1 da6f24be139fff9239852635362fb9d34f03d836
- SHA512 fd6f59c4e11fae6042756a4eed5445b20815eab0117934a45695d91f8bbf0a12fdbe7892e02720f6332ad152282e1b82d4aa5d937b7406d970c51eb1c8c2ac37
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiEb:A3k03kB56rD
- TLSH T1E7157A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 900KB
- SHA256 1359668e98230ddb5028bde9e4539a47852dbd8c7e47d6bb4d4f6545c28dd3c6
- MD5 a97258906504e0e66b2dd1a9017e1db4
- SHA1 6fd7a43399328c835454bfb4175887cd62a9a1d5
- SHA512 6c3529eeef9b86eea16c3450691eb01074250652b5067a62981867b4f73fa65cadeac117c1ff4beb1a3f62808e780ea2799d918486bd9da4539ecd3f8767cb66
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiKf:A3k03kB56r7
- TLSH T1AF156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 900KB
- SHA256 3c29e93804e8d6090d484369171412fb96965bbc0949d1a40ed225e7b6b16950
- MD5 46cb71be3517c3bc4c40723b9e6722d3
- SHA1 bff1be25b1dfe8b3960318ef3c5ff1a311203309
- SHA512 72d621e678bc37a667c994b71d1082492ee24609037423c840b5567f7838f002b5c0666a91d6d196b445510cd2daf70857c93c2a2604c8a349aae525bc0731ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiXK:A3k03kB56rr
- TLSH T19F156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 900KB
- SHA256 1eed467b940401a345c7d414644e090fd3fa2a4971cd1bf619b315d5c6c7d489
- MD5 03a74d2141693771d97b527e85b47f3f
- SHA1 f619f3b7248e058a0b1a2f3b9235f714e83aa29c
- SHA512 30c739cc88c5a2de97d83bd7fdbf329656f1581c2daae69dee01bb006e938a791fb88f61099d9513cb194a0b0cfa04f733502798e462e7417e48cde1539431cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsigk:A3k03kB56rm
- TLSH T119156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 900KB
- SHA256 15274beb0b5d1553333a91b0e85225f4f57d0ad787129dc21e03eea5182362fb
- MD5 8f0225e23d7ed88f29721320247f2fe6
- SHA1 9421501fead658819ea88c47b463c079c3d4be67
- SHA512 ec34eaee816bcb901521bbfcd97a87c2c0554c7dfc0b31ab46bb9ef305b9b4ddede0a70834a2bdbce19e0beddeb5ed3c8705d212515ce95cf74a3f43b6419a47
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiR0:A3k03kB56rb
- TLSH T155156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 900KB
- SHA256 c41a39f15ef5af9e8a295ed2d4cd8d84c6e2093e8b37bea1b130b159f886e76c
- MD5 248fc1e26b1e00a04b836e3e029c4ce0
- SHA1 ea2617243e0148059f49efe82bebb1cd92167b2c
- SHA512 743fba7768ce200fc8ca009efd351be770ec9f17e1bcbfb9ba8fcb76aa6701e3c40bef67ca1fbf8974da638a6b322e4be13c11caf0f9833e6807a28a4774a671
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiEg:A3k03kB56ru
- TLSH T17E156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 900KB
- SHA256 5d97cb43c58a30708268b438bfa3a20b4f1a95369ec5757203d080c7791ddf63
- MD5 becb18e8c7797bfeaf7bebd10c51a4d6
- SHA1 11751ea48f125aea2fc48b7658c30e5f5a2ca07b
- SHA512 b3ed47a25455617196d95aa1859ec4931c09bd04aee28688ee0694e7d2a7d3aaf0d3e0a5bd90b26f51954ce2b7df0d05f1a260010a7e9a40ca8d13517416a9d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsihr:A3k03kB56rw
- TLSH T14A156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 900KB
- SHA256 91481a1d3c314481866cd21e068df554a16786a98770213e91b27085b70f8ba0
- MD5 b3229d4531bfcd701bc89f07ed3c620a
- SHA1 f8e9a02dde7604a41cbd96ad8fd88650b3a30245
- SHA512 ae4fd0be2ca4cc61d237c32e31e0002f422f913e1691208429a0b51dbf3ad5fbda13c9c6542016dd82d346ba58efd98e364da345f19437b35633dc48472637b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsijn:A3k03kB56ri
- TLSH T113156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 900KB
- SHA256 28ec61f976f2ee01c15111395f3f858349715ac882cd7dadfd2c9674272ed383
- MD5 e4cc11ba85841b380053b2893eba5f83
- SHA1 2e9583afa8115aba3e32249eca4f91d4e193417f
- SHA512 d09aa87ce7447e024b9cc469d66214afb650656b53026e7064046f66e1b0c505628342414614b05271a619dc7c026238e251a08838b18973d372a12e1f735b6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsi/x:A3k03kB56rQ
- TLSH T18C156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 900KB
- SHA256 4827d1ceb0cb8f1fee4036214d0f0e994d1a52a1b6547466fa3bf2bac78e7f9d
- MD5 06cae3e4216eaf8084211dc2f6f8ada3
- SHA1 b45139b7af4d34f78ee706bc2c756a7d2969e092
- SHA512 a42f66ffca5bdf9b0fdbb8987da9f3eec28184a0250316b19cad6b888609dcd3f7fd280ac3ddffb47dda8a576bc6e3479f8f2e749c8d1bcc865c833d67aef60c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsilA:A3k03kB56rz
- TLSH T148156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 900KB
- SHA256 ae27e2be8d7dcc208247532ed93844500a21bf653a92fa9f78940b1f28b0c1ba
- MD5 e4f468f2c112b051d8fc0c4773862ee7
- SHA1 40ed4fde67c4d1ace6fad8d882357feaa142e936
- SHA512 4e6a62a663bb1e302b48e32a9e7380fc393c7d266937a357d3b111ccfbc1bdc046405eff68eedbf9cc6b6c7aaed31dee4e508e34a52a3bcac883e3d5959cae3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsie9Q:A3k03kB56re
- TLSH T131156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 900KB
- SHA256 d115edd5bc0a5dfca65e86201e3bfd462bf6f02b57a0fb8e1da327d8207d6d5a
- MD5 f34ee428fcb24b3a5a7e3160b3f47975
- SHA1 6794a3cc70fe0a4e04348d198ad46b942c692a50
- SHA512 60540bed6cbf0eae8f3ebfe2fdc53b38fc6f134407149551569b3885b66eb5d0b4b2594da6d3698d2a3441a5d4dd94fc0c82ffaeaa99038d7c4e1e2e3508a10b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiL4:A3k03kB56rd
- TLSH T1C2156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 900KB
- SHA256 cbd43354766d54bb233a8f3654530d60e0edb1de426fa2a2b44c080e30e465dd
- MD5 7786ff8459e7acfdf0b1f26f59abecb3
- SHA1 9d6746a9fb8a5b97b2b70c4510f78429c1163533
- SHA512 128372a91c93e8ff27588f7ed4b37745655c217dd1d0ccaea2e63aa03b4d08b8d2be1ce096b0dc1040419350838405fefa86153542be8a3ddbbf87d735261462
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiCu:A3k03kB56r4
- TLSH T182156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 900KB
- SHA256 64486a80e2f2c011243e18cd21688137374373127a52041a0018e684d12e9286
- MD5 41869241e05832b7d9f5266b53cfefed
- SHA1 859eb977fb6b8b8363c58bc4a310bc2c53844eba
- SHA512 07bb775ebda22bebf697bfc05870ff71be69333b5164439a2807102b14ecedc42a6348165e321d931bf2f47b7b47705a861f18d4285160e92837d0a4b4fc8058
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiTj:A3k03kB56rS
- TLSH T1A5156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 900KB
- SHA256 af23a424e2354e29279b22564c24265edcff41af135d63dcb214fbe6d8daeddd
- MD5 942a01f0d549fa3dd99796b5ab910ddd
- SHA1 7326ebdc1ba0b7b1d31714329d25edf63fd72e27
- SHA512 77f98c626788e553f7b7103c288b488e662ba710c8f2f0491fe1dab4de11c02829260f6a2716f76b2f850229233089c6027a4f732d68ee5ea7e6d6a5bc994ec4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsieg:A3k03kB56rW
- TLSH T181156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 900KB
- SHA256 ff067899f428ef9dae1ce300ce02d40e7dc9425c2432c8a5c7b2418c0ee584c5
- MD5 3f5e810120a02191ce398752ff568d61
- SHA1 5b8e055933a3cbf0fb9589bd79d370b090237f7b
- SHA512 6b34c3b4d73bbd842da4a573f408324dd14ef64e28d9086957a308bbd8c920e534063655f9a2f563fa8dda72d3fc6632afbf2fa0af1209eebfe7eb0971b8b9d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiRI:A3k03kB56r/
- TLSH T133156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 900KB
- SHA256 0d497f9149e8c152c2ff0cf55c391b46588faf4d8b04a9ff374a4f60ed9ecf54
- MD5 c72a7a52ae4c080de2e61a0cfa7a42ff
- SHA1 b91dd3ad017fffeb92c0bef6e981ca0066582da5
- SHA512 9da964d90bac6c82f851fffae0762c757ae78e47f849e38008a8ff78b8beeec671316b2148453de7f75fd648fc0309219134151c867155e329766f54e42083a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiTo:A3k03kB56rp
- TLSH T1F1156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 900KB
- SHA256 1766ef5669e3248f821c4ae308d3fd88d7afbbf196229ee311d41d574c27758f
- MD5 3ef29409489b766e9af797cbea9756fd
- SHA1 345ef05fc8d6d834751001548287e0bea846c2b9
- SHA512 1b6bad6be86848d2294067e2453f5dd8c4d17e83970ff0b6a38a647d2d1bcf3863fd3451a320dd05b14f2af6d2a13334d4335447dc8b1bb081c37a99200c9e57
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiY+:A3k03kB56rM
- TLSH T1D7156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 900KB
- SHA256 d4775cd37ac0ad78ccf687f3fe4205ac5ed6a69bc22ec3e6683312f60a151eb9
- MD5 11bbcf8c718255b717aedb073e0cd612
- SHA1 c99595b9715c72808903e149b206fb9046351fa1
- SHA512 ea03f9c6ce1e9156bb13f11b8b04f0d8a6cabe95856be34a51aad7f3d881999bcc3a49063c826feba651b47dd8b1f44554f54cd5da05c91cd8e4c511d438ec85
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiwQ:A3k03kB56rk
- TLSH T18A156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 900KB
- SHA256 1442fb996b148c01dbeea717df085f4a90085a053a5687f50d15e5476408a10c
- MD5 567b90cdbc364db2781e7ea8ead09c36
- SHA1 c9ce7cc778141790270f0eac59b0a8a29bfaf426
- SHA512 4ab2286d4f02ce89f91797a4895a2695d5469b112663e51c985796ed9c8674cc9eb0b77a54628b17fd8a63d723e4ae1c61d5240b159827057df4d2aff7b04d0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiZX:A3k03kB56rE
- TLSH T1EE156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 900KB
- SHA256 8f7741e99445b1b692b0fc8fc7b0b49c8343d5ca6e2962a5e2d35579e82a76bf
- MD5 5a3f6606b97e4d8389cec6582139044a
- SHA1 6e19f88ec7dddb7ef22c143d4651fff91c17076e
- SHA512 aa6a984aed686ee5b468c99634659f06951afc841e65daa3ed20d5d697959c7cfc65ad525b237d80dfb4aa2f768e71437448ed9da2f50b57842ff6cd0cdee27e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsizL:A3k03kB56re
- TLSH T193156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 900KB
- SHA256 b5aa389c2591eb434cfa0d90ff2da348ed59c3e58a13daa748388e82b2c0a0db
- MD5 2ae5f5fdad79ff0ef8abbdf7d412e846
- SHA1 5d4588bf16693494f88e397ecf367394f2c56482
- SHA512 0e7a44e7f41d05240311de072daa79d15c06c02dfc1c99c529e5bb294113ef09bc7c0cd68045aec8c184095cbf67728c0dd5e1b0685847a98d27a519b797d937
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiZM:A3k03kB56rr
- TLSH T12F156A13E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 900KB
- SHA256 f1b6567ea2f8be408f5b06f14e7302929ab01a5e3a52c411624d0ae87f129777
- MD5 9ee4b4c8e8ef1f1a1fabf9685e3599db
- SHA1 d5bf113982a82e11aed673b70296912850b4b3b4
- SHA512 160c41f43c79cbe46627936197ea68c7372b62e0d26fffffa03e21f8ed07e6bae994c0f09c81e1c0abb0d855b8158d194ac75b0d0e38c1bea6949f66f66c9a03
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsiih:A3k03kB56rl
- TLSH T131156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH