Analysis
- max time kernel
109s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 04:47
Behavioral task
behavioral1
Sample
2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 778KB
- Sample260701-fe2g8agv8w
- SHA256 55557dfe9ec6d5e95822f89a51b72704b0289456d8beeef8fa6efe84ca81cc1c
- MD5 5c8b4769c82eeff71160d69e186cfa05
- SHA1 158585474cbefef7ad4049298a28523a081f9331
- SHA512 98defc463797c044fd7e3a1a3569edf8a8f30542be8866541138d28ee8fd6faa24849292cb3a502483e1821e70901eb0411e6a06d76f08c5f45f9708ee542cde
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa:A3mnXoZjzyacNVOE/jeD5TvinrmlEa
- TLSH T183057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 64 IoCs
resource yara_rule behavioral2/memory/3256-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4b1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3256-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6048-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c73-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a09-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a15-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-295.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-404.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-423.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-442.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-455.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-462.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-464.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-471.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-516.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-524.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-532.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-533.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-534.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-536.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-538.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-539.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-606.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b55-661.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b90-680.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019aea-759.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bae-778.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019ad2-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019ae3-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b2b-835.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b2f-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b0c-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b61-919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b38-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b6c-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b09-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b4a-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b67-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b4d-1087.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a63c-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a3ef-1209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ab38-1312.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cfc-1367.dat INDICATOR_EXE_Packed_ASPack - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral2/files/0x000e00000001c4b1-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b7-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c73-59.dat aspack_v212_v242 behavioral2/files/0x0004000000018a09-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a15-210.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-247.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-260.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-261.dat aspack_v212_v242 behavioral2/files/0x0004000000018a48-262.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-295.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-308.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-327.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-340.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-353.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-372.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-385.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-404.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-423.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-442.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-455.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-462.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-464.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-471.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-485.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-492.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-508.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-509.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-516.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-523.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-524.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-525.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-532.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-533.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-534.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-536.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-538.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-539.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-606.dat aspack_v212_v242 behavioral2/files/0x0003000000019b55-661.dat aspack_v212_v242 behavioral2/files/0x0003000000019b90-680.dat aspack_v212_v242 behavioral2/files/0x0003000000019aea-759.dat aspack_v212_v242 behavioral2/files/0x0003000000019bae-778.dat aspack_v212_v242 behavioral2/files/0x0003000000019ad2-803.dat aspack_v212_v242 behavioral2/files/0x0003000000019ae3-828.dat aspack_v212_v242 behavioral2/files/0x0003000000019b2b-835.dat aspack_v212_v242 behavioral2/files/0x0003000000019b2f-866.dat aspack_v212_v242 behavioral2/files/0x0003000000019b0c-885.dat aspack_v212_v242 behavioral2/files/0x0003000000019b61-919.dat aspack_v212_v242 behavioral2/files/0x0003000000019b38-920.dat aspack_v212_v242 behavioral2/files/0x0003000000019b6c-934.dat aspack_v212_v242 behavioral2/files/0x0003000000019b09-945.dat aspack_v212_v242 behavioral2/files/0x0003000000019b4a-946.dat aspack_v212_v242 behavioral2/files/0x0003000000019b67-1065.dat aspack_v212_v242 behavioral2/files/0x0003000000019b4d-1087.dat aspack_v212_v242 behavioral2/files/0x000300000001a63c-1142.dat aspack_v212_v242 behavioral2/files/0x000300000001a3ef-1209.dat aspack_v212_v242 behavioral2/files/0x000300000001ab38-1312.dat aspack_v212_v242 behavioral2/files/0x0004000000019cfc-1367.dat aspack_v212_v242 behavioral2/files/0x0004000000019f19-1411.dat aspack_v212_v242 behavioral2/files/0x000400000001a254-1563.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6048 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\E: explorer.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{E04212F4-7937-4676-8CA7-ED7893E587D1} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{C2504E62-37FA-42EA-9DBA-9A9F47F1A048} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 368 explorer.exe 368 explorer.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe Token: SeShutdownPrivilege 368 explorer.exe Token: SeCreatePagefilePrivilege 368 explorer.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 3064 sihost.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe 368 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3256 2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 6048 patcher.exe 5132 StartMenuExperienceHost.exe 368 explorer.exe 2652 SearchHost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3064 wrote to memory of 368 3064 sihost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_5c8b4769c82eeff71160d69e186cfa05_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3256
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6048
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:368
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5132
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2652
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 778KB
- SHA256 55557dfe9ec6d5e95822f89a51b72704b0289456d8beeef8fa6efe84ca81cc1c
- MD5 5c8b4769c82eeff71160d69e186cfa05
- SHA1 158585474cbefef7ad4049298a28523a081f9331
- SHA512 98defc463797c044fd7e3a1a3569edf8a8f30542be8866541138d28ee8fd6faa24849292cb3a502483e1821e70901eb0411e6a06d76f08c5f45f9708ee542cde
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa:A3mnXoZjzyacNVOE/jeD5TvinrmlEa
- TLSH T183057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 a575ffe023e583389b0cc2fdbbd949ce1d2a545ce175632cc6c28cdf17896629
- MD5 84c4d7e3052c575ff180c17a82bc9e1e
- SHA1 cc0e212c1c14b0e5cbbdde601750699280ce2916
- SHA512 c5bdc06fa85c3766687b066c285139c17066858e1171b8dbf4ca71b0ed401f9bf36db615e5de81c1cc317d8a214cce5589095490c1a50055a5ff0cb85b04ea6c
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEaP0Le5ji0hmxNrM:A3kMP56rkPji0Aj
- TLSH T114555A16F6A44BB5D02BC078C5D2969AEA733C425F3087CB13549E283F277D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 826KB
- SHA256 2a44771473ffcdb9e57d35be2aa4ec201cd395666252944da45922b3b88758eb
- MD5 ef028e8ef36b2004e595e5d757aadaa8
- SHA1 35c338b0d52a718d74086e32b4b8e19bc78e1ad4
- SHA512 c0f12a001b5fff07e9c47393b61a5fe58c3b5083d5ce903d9efe4fd71600d59297dbeb194ef5540cfb26569d1d3ed4ae17ebecb115b08ac5680c5e086a292cc2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEayb:A3mnXoZjzyacNVOE/jeD5TvinrmlEayb
- TLSH T1B4057B03A6940FE9D11F817499A24662EB777C125F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 802KB
- SHA256 9c5aeaa3d840126ea8aa421d347ffd5dd1e2506a5ae1a3e7853d8ca250ee36d7
- MD5 1103dd5627567c3d82e25b33dcb9df4e
- SHA1 952c2d2bc377d690c4bb821b136d1c22f2635842
- SHA512 b667592afc2354ac3cf5f27990384eae95cb1e055cd335b71772ceabec0a5fd4211343357495db0ee4cf9309995e1faec1269906745bcde7150e6de16835c2c1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEapZ:A3mnXoZjzyacNVOE/jeD5TvinrmlEapZ
- TLSH T1AA057B07A6940FE9D11F817499924662EB737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 802KB
- SHA256 47c3d2dff8698062c0dfeefad78b87c9614031da4621424d5f1ec0454099531c
- MD5 1a6cc33dce810df751720352bd51dc1b
- SHA1 80dfc1feac870aadd04d709bdee25f519fd9bd2e
- SHA512 0bb2c89deb34774135940057cde16c524f0fb4060aebccdbc5f46c61b42bb7f6a488cb43654c20cf7816d18738ec24cce359aa40ead5b62249f4d7b740047763
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaC1:A3mnXoZjzyacNVOE/jeD5TvinrmlEaC1
- TLSH T180057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 802KB
- SHA256 6b02d57c920a2101f2d8ef2ad75ae6301d48de969b7972e095ee95d25e088386
- MD5 350ad792bcfa2646f8b113a3c39e70ca
- SHA1 17124bb42bec507953ecfc4f170f9b1a0b91d423
- SHA512 c542cd694f5ff49deb5bb29db5036a73eff1d5342fedddcf2534d46e063fce175399cac486002fe6c4546694132f36e051a994d78957db4690a2aa4392f5733e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEao6:A3mnXoZjzyacNVOE/jeD5TvinrmlEao6
- TLSH T1AB057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 802KB
- SHA256 7d1484321d759e7cfb28f494bf81f4b4e0c142b69b228d0651159b8bcccce604
- MD5 9f34178c9cdc7b5ae66e498aadacf5e9
- SHA1 dcb0a06741fbe8f08c8b81568a0ed833b0b2b011
- SHA512 2a69aeab77778cdcf014a65d7fdddd1e714effcb4ebe1e9389e97dd5f57ded0c64165ae07d4e37210647fd61219974a494835ccb42916ac21d657d853278ec0a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa8o:A3mnXoZjzyacNVOE/jeD5TvinrmlEa8o
- TLSH T1FA057B07A6940FE9D11F817499924662EB737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 802KB
- SHA256 c43eec0a843bc9e586c181f543695d85d17f75921965625b55872e31707485f7
- MD5 33c3a32b104c98188ccb2200a14490cf
- SHA1 c05ea223f23dcf43900259287933122930ab2d1f
- SHA512 d9c5255486493954678c12296c660fe4acdd6a3d4c7a531c9495e3b58b6a2375a9ceb81300916695d6e62b42a284ab2d53a0b029802ca33e58f2aac839e5f2f6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEacu:A3mnXoZjzyacNVOE/jeD5TvinrmlEacu
- TLSH T116057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 940KB
- SHA256 fe036f82ef555dc7eb0a4a897bfe113709e957e4a07c3562138839e1a1dd794d
- MD5 f2f5d72521bc20e913dc36b727faffcb
- SHA1 889f2911979d74c69d911187b90b5688ac3235c0
- SHA512 76795c971a3721df058fc47459cb0ed3738a041b4a229df31a88961e214010821c7453904541040f83b0cfa33391729f4efd350c0a8809c31dc48a313f362d7c
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEawzy8:A3kMP56rLT
- TLSH T137256B17A6941FE9D11F813489924A62E7737C225F2087DF1364AE253F327D0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 802KB
- SHA256 3edd74fb3dc1cb483d58c2dbc76854367a17a5d499a57a9eccb4394b1d997fcc
- MD5 448e6c0f88a65f14ebff3cd466bc8f64
- SHA1 f87af71f248be5fb0244d0005ab437045bf223ea
- SHA512 3f88330f65231ea729517220b309e6eaeee173ea28d453e54b9ca57bce86ba4798920a221babd662f7ce799ed4b43e4d08ee527f02fd36cbe2231eeac34f8ec6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEag9:A3mnXoZjzyacNVOE/jeD5TvinrmlEag9
- TLSH T13E057B07A6940FE9D11F817499924662E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 802KB
- SHA256 2c04219a4607b990dd56e84fb3cac5aa743120fea05aa269aa524d3f69f39307
- MD5 0b4a95aa3ff747efc76bae9cda00ce28
- SHA1 a6da4ba0d72db157452343580b56a5140151cef8
- SHA512 5ddd9875faece8d7979bcbe8d8cb7f40bebeb855b284ede17edb136c9898a82ba23230418db5b9d243f50424457465905b8eeac44d52b611c64dbfef3c55e2a5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaoc:A3mnXoZjzyacNVOE/jeD5TvinrmlEaoc
- TLSH T183057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 802KB
- SHA256 626b98b4ea99ff20824fee1ef27ed74bc0cb189e6c235f7fd4efadc5213d69f4
- MD5 a390ffd8006d1e8ec5c7ddbaf129d927
- SHA1 43bfe423df9a3de4f4fffa399bf2ad96a670ddc1
- SHA512 fdc24f932e46044d29ddeed84b0b72190ff345caab9c7cbf5948ffedbba03c730df9a06d6b283359175517180d0f2c6480d5ac8426139c532ad686bb8ca5ba12
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaBp:A3mnXoZjzyacNVOE/jeD5TvinrmlEaBp
- TLSH T157057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 802KB
- SHA256 231d9bdc19a25ead74a3b589b4cb6d99ed11c8e12e8c8b1e7cf867abb97592a6
- MD5 fed972a2b9f467e6407dcdca6b78a009
- SHA1 4d3ca9abcca294abe6f9bf1082da13e1c0d6090a
- SHA512 14e62148c420e16c840de248940f7fc7d264e3c7f20b9ad4c80d434b5681ba5137aa711ee83d2cf7e7e7c5a602a4023f45c583f782cff35bb4f4002f26245fc8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaW0a:A3mnXoZjzyacNVOE/jeD5TvinrmlEaWN
- TLSH T1E8057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 802KB
- SHA256 81316099b00279662873fadf3aee849efc1b099588b3b2de77efd3be5402d096
- MD5 cc1e2c5c015445e7e4d9c9177d1ea3fa
- SHA1 ca50ccdac46a34cc7a39687b2dc80c8b7001938c
- SHA512 15ca020369090ef2780bce51d78b8cad61d450e0026443b6f35408fd22015617fa41f7edde4879aefe8f0d9dd01285c2e00ff9503259beecbc339ad67fe1cc6e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaaF:A3mnXoZjzyacNVOE/jeD5TvinrmlEaaF
- TLSH T1C5057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 802KB
- SHA256 355710b17e7c9df48dd94872f8706261747cee66d6808563e40f13ea005b5757
- MD5 8ad71da73c8658bbaf20f6d1f9b3ca0a
- SHA1 18c2401fd664b65f16f86f2d151878c5919ad625
- SHA512 85d9ce2f0b11b37168da0c7de5401dcceadb354c49f8129627f417f927a28494f14456f07c8841621e01161f447bf16904f4001bf437855018c219589d33bc26
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEavC:A3mnXoZjzyacNVOE/jeD5TvinrmlEavC
- TLSH T173057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 802KB
- SHA256 8c3002c40b376d72c011889d16d69653e6ebbb0a98e61ff1ee0cb8c377de424d
- MD5 16294590f9369b6e7905ee12f752e07f
- SHA1 beedf1c46bfac795c367de0f4b9ef72d73603cbd
- SHA512 07d78d0fd453d00bc5f867c74c68b4011bc5794a5d3ec85b497fca96b6689c1cad00a0330fcab6cc162ef4dfed6cbc25944acf18ef6211a17d450b8e736ea459
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaQw:A3mnXoZjzyacNVOE/jeD5TvinrmlEaQw
- TLSH T163057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 802KB
- SHA256 a04dda9c328361e61273d8b9d6e2b289eb8889eec6b720a711f854c25ffe0568
- MD5 a2e967932652e220a83115851837f1d5
- SHA1 c6c16a86b26f77d746d57bd27bae0bdb9a8e36e2
- SHA512 5936f26fdae5eda9cd56932ec0f2fed46a681615ae60aef9453fea406e42aca4f6f7f03d7541eedf456b1bdeb36f71b634c1f6c23dba3250133caeeea13a8db4
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEavT:A3mnXoZjzyacNVOE/jeD5TvinrmlEavT
- TLSH T10B057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 802KB
- SHA256 32b486255e5377714855538ce3000bf0bd45d3fdd4382e3539b9ad678a4adc3a
- MD5 2df008d95909ea55b77f0287e0d03df6
- SHA1 a1dccdfd9f2cf090b10c188ef3c4cda0dfee4319
- SHA512 f96f0383c815b8d8f8fd2793a163593dc28e95da76896b869311a2f9a838a1656726755c6ac0b635d4dc899eaea85299c4c718f95898e193e55498c387567287
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEapu:A3mnXoZjzyacNVOE/jeD5TvinrmlEapu
- TLSH T1F3057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 802KB
- SHA256 163e04edb771f3ab21fa7526e91e899d9ddb9d8be547be4306bb7378d61064d2
- MD5 39c9fb82bf0a9843745ebd30c2182904
- SHA1 b55b61fe7ce6484938fa0a0923e903b1b2d9a068
- SHA512 bbae400b719a2266066dba8e619f2936fc1259adf49b31f9d01f4e05b48b46c5da8c626da6306a1c99d39a344a866be54217fe97a7ba882347bdee2adf6bcb50
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEahb:A3mnXoZjzyacNVOE/jeD5TvinrmlEahb
- TLSH T176057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 802KB
- SHA256 9609e2d327545486920833f1fb434b3bfdaa2ff104635612e1255d6f53dd7980
- MD5 767eba60c27213edd850400edcf7d005
- SHA1 83f8b218070c25753d2763e1121c26c0e7bc1456
- SHA512 0ee4c515dcb71ecf16635559413e1a73f58eaaf6e92b784a6f9aecedb40ed0cab83d3448584efeeff1bd1fa2a76411aac9054d313d767788aa7ab89d7971321d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEapf:A3mnXoZjzyacNVOE/jeD5TvinrmlEapf
- TLSH T163057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 802KB
- SHA256 696d99b37ea79a583d284db7263c1f6cf55442630159bf6e8315d88fb6f2d8ed
- MD5 a65c5bfe3608fe225bd9d2439805d722
- SHA1 c03dc36ed1326bcd3e1dc29849d66f1093de38b5
- SHA512 0c08108f7b4fb2bae83cc43d9a2c36861fef860c5fb1b20480bcb7577a8d0efb047a1752a0152115cfaa70e05feffe23706b421666a969f803aa51cabf9ad931
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaSK:A3mnXoZjzyacNVOE/jeD5TvinrmlEaSK
- TLSH T108057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 802KB
- SHA256 35b42e82366ad8618056f22dfbe6ba7579953d744d1b82e7b8507d4e9d4ab44d
- MD5 e150d9f74c25d2006b9f77abf89ce7d6
- SHA1 4ab487dceb6d5b32929b01683065037b93222ec5
- SHA512 6cc08a0818dec1c24024a3df7e619d67654c9c0cee9f986bc83b445a2e0b758592c6a2be6ee4888119ca1752c747140ac7efebe52868a7554e4ed1b4621eba45
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa3k:A3mnXoZjzyacNVOE/jeD5TvinrmlEa3k
- TLSH T18D057B07A6940FE9D11F817499924662EB737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 802KB
- SHA256 7f3798ce14dfafd727b52a2e6543e8d7a5dfde5ae9a344118477b04c9fde71a7
- MD5 7772c17d004c9e89b03bfeb2e4e575b3
- SHA1 44cf1ed07809ae9242738b1aaf1fbccd83ca0bd6
- SHA512 7e7187949b37f563eeb237f903df578244efc6b6813f7127da0762dffe5f9769942ac336341299e7a166823eec5698fdeb55325cd30edecd466a8317b68cc9c6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaA0:A3mnXoZjzyacNVOE/jeD5TvinrmlEaA0
- TLSH T1C9057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 802KB
- SHA256 f83a36ae77e12754d33c43f3f1c8e08b2cca870f83502197c406b79cda94df22
- MD5 e4d1dae19dd4d2476a7f976352ed457b
- SHA1 ccafaa32c78bc79fa4964514d340717b43f1f9a1
- SHA512 8ad64b213e9ce80f3885d38634a27c71c6135cf0b67483ab1c84dd8b70cdaa6d64c5c8aa0041394e3371759032336dfaff0b738038f04d97927f0cc722f2a27a
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEab70:A3mnXoZjzyacNVOE/jeD5TvinrmlEabg
- TLSH T1F4057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 802KB
- SHA256 901510f5dc08df4472e8cdfbc8a6807c4930d898c83ee1ce18877021b6804ee4
- MD5 357dbe0bb95ac6f56199474c73763800
- SHA1 f92174d8ccfce20e8bf7b283b852a3f6d57adf27
- SHA512 e631a276f43cbd894573927a9557d1803f84081ac1691a1dffe538bba74324af81bb5d2566f87870f1942c6dff0ddbf1443e2fd345d55252a753d31259996488
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaWr:A3mnXoZjzyacNVOE/jeD5TvinrmlEaWr
- TLSH T19C057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 802KB
- SHA256 01cbf4247f6779177c52ff23fa311240b5677529ee78f20c98170f2d98d6af6b
- MD5 5ab52557c72c96d4eef47bb1737c80f6
- SHA1 590502c08ab5d888e2670235737286164e125b1c
- SHA512 75c834e799ab8b6f4484a772726e62368e750b557d4d427578f84affdc29353209d493a919657b8d0fcd38523bed32c944bc194ecf17d7e66d9077dc935550a9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa8n:A3mnXoZjzyacNVOE/jeD5TvinrmlEa8n
- TLSH T1B5057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 802KB
- SHA256 63984cb8a8344195972c8b3e332ade811b2713d804d4fa385a612e72dadc2695
- MD5 15ded919332833f4f4889f19fee7f525
- SHA1 a89ccadcb9a1a97c0daac1b71dde252c297ed61c
- SHA512 2556484c305cdf854d843502a4f18fdcba900596ee078e656b4effd2141985cc3388d04cacb416510a4cb53a210c7789d234180205f29b68f39253e8b35414d8
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa6x:A3mnXoZjzyacNVOE/jeD5TvinrmlEa6x
- TLSH T1F9057B07A6940FE9D11F817499924662EB737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 802KB
- SHA256 188be2d7b4235edf2ceacf18659f9779e7a5f21c2ed1a8657064dafd1277cf62
- MD5 c7a06ede05f16bcc6ac1dbef7f48ed15
- SHA1 a4c007cc40b9b6fc896a00d78b4322059ecf57c8
- SHA512 1afcbb5fb7427e13f37bcb85861c90ba74bd874aaac0ad134d88438ea4dc14dc62b1dfcf8dff1a5aa2550c22e37f1d8c5e286dfeaa477626d965dbc40597ee59
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa8A:A3mnXoZjzyacNVOE/jeD5TvinrmlEa8A
- TLSH T185057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 802KB
- SHA256 2e1136abaed9ed855dcbea34811912505fea14f502e129bee7bc658d61b8de18
- MD5 1f7437df56b2d6a9da6999c1a5892f50
- SHA1 59b663194b0b2eba7bf2ea04c424bb68a1db6b78
- SHA512 ddf2aa5fbd813f185c4edb30b55c91fc7bb18ea88ac2e701de20a9c7ad93124c7581272a335b79df9b7e12dc4a33cbedc1178c30c96f77e78c4d99d61cdbbc1d
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEal9Q:A3kMP56rx
- TLSH T118057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 802KB
- SHA256 bfc893a73d306f0a6fde90e14817a013e500d3f885d55cb99e6646321d0ccf33
- MD5 311b009f0be0916ce03e15b4f9d7e634
- SHA1 25344472ca55918ee6b8515c0022b41baa453a71
- SHA512 e7bf208e9671e8cc19a3f15ca61f72a19e6e18edde4cd8a85e3e4f597e1e1fdf41bd7a20d5e38edc9ed3b0f3ccb04ba3278a3e5f2e2ae6337cc58d68e51861c9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaQ4:A3mnXoZjzyacNVOE/jeD5TvinrmlEaQ4
- TLSH T116057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 802KB
- SHA256 e30d6597b9a8a60429a5c093a0a3a8fbd9496d489c6ebdddf1045e59d07d57e0
- MD5 6d51d79ae5225f1cd56853d06a051f3b
- SHA1 15ee62d3f6e3bc7bc23f74399fa85cf26e90cbe2
- SHA512 b7e407a3308f7777a5bdc802efa484d5027c81e2f18250a7524e26be3eca33bf929d7b1dbfe63b975ad05bae91458b098e420101596917ccc7808fb75349d677
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaTu:A3mnXoZjzyacNVOE/jeD5TvinrmlEaTu
- TLSH T1B1057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 802KB
- SHA256 0fceea02940230b626018abc59af7c27f31df3cc0af72e1b7931ada56788ec8c
- MD5 f24aa5b44922cbac1fb87c4f5f05412b
- SHA1 85d3dbe8b70b973f0369b47ad67132b428b9a0ee
- SHA512 2055a135ba4892e0e91d3be4a0748f0af39bdb58b3851d7b05107dcc8ae31492328219dbd286fc18225cdbc572569f72db1e57dab8c867640f0c68d9ebb32cec
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaOj:A3mnXoZjzyacNVOE/jeD5TvinrmlEaOj
- TLSH T1E6057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 802KB
- SHA256 82bd36dedf75e46372e80c97f7d4107d34646190867edadfe7a1a05736c8c929
- MD5 cb81f7bcdebfdf441c875ef31ee9d603
- SHA1 191fb0a345c25a8f9455e7c120ce95c2d72265ca
- SHA512 cc763d7e7d59a829106fddd8e2c8ae6a3209efbf04541e97a73fe08c2f23ec7895061336e54f36e8d7a76a756a423646645e4c607e633f96a58a5d76e23b26e7
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa7g:A3mnXoZjzyacNVOE/jeD5TvinrmlEa7g
- TLSH T187057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 802KB
- SHA256 b4f07363a6b44ee80c7c7c89d56c970e5c9fe072a9678cb0b45080bf40181301
- MD5 f581eaea5ef92cc566f7ffe0a1c346ce
- SHA1 7f26ae593abcc72201e76405960d2e9c66fadd5a
- SHA512 bbc6e672ac4568abb0989da3b158987628401846a8b196baa89d37053ebc80f75898cf23dba04f09321e83db40167329da829df45b139894efa02998bbaab280
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEamI:A3mnXoZjzyacNVOE/jeD5TvinrmlEamI
- TLSH T151057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 802KB
- SHA256 8d1b7d82bf6402f1d96de53f1c262165f84e6674897ed98467e64d9980e2d91b
- MD5 b1df9ef24bfd4bf7fe70232e3fd55e98
- SHA1 272d831d757209e83d4209cac33d213df8f0a97b
- SHA512 05a7d53fec5201669aa03fea5ce401c0f448ba9b681346c6435cf44e8ea8dbe50ed35ac72b5a0f21882b49fa6b0b2e099b4b8bb756bad44fd70c3077fa14865d
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaUo:A3mnXoZjzyacNVOE/jeD5TvinrmlEaUo
- TLSH T180057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 802KB
- SHA256 ca30a6bf1ecb0fd9d0fcfb5a7d32e709f73ece740148d952c84b7da9e06deb00
- MD5 84b649228ea062c9f6afe5bb84ab6cb1
- SHA1 0f7e0fb5caad688d86ac80acdefce464957d60a6
- SHA512 37976bc814a44f946b0abcb156c2a747e9fdba17aec2becb742e1655fc6c809c1d29f8a59a438b3a80031c0b70db41438e275ec696332f27ed7e3dac85fb6114
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEa3+:A3mnXoZjzyacNVOE/jeD5TvinrmlEa3+
- TLSH T193057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 802KB
- SHA256 45b66254fb8a9aac1a1b8e25d9c868acf64d51d6d4d99d37cbc1c74ff71b419f
- MD5 77a489156e742cf4458bb79da15673fb
- SHA1 6647c38a16a435267bb742731595977525056f63
- SHA512 b56dbbbe4aeb6979f9b58f5048f0fe45fb0ea7fb885abe41227e8cdba2c0c6ccbbaaf54f6a92c7183fa3726795d58376b831c24aa3baf1211e2be5718c3eabf2
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaNQ:A3mnXoZjzyacNVOE/jeD5TvinrmlEaNQ
- TLSH T19F057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 802KB
- SHA256 606ff49788cfae9214bcdd6ea5b4d21e1ba304b7bc7b2ae084e4d04865a61de6
- MD5 9526145bd1c2ecff42e70210cfbc4ed3
- SHA1 167863a83ca909765d1317ba84f476f2f9773966
- SHA512 f4d9b59cb4f144ac7a845a1892262636589941bd52a55167477d7d28f40302c1b42a6e98cc8aa34664d2e9c16a2fa13f32b43f90796a8aa99e8da94fe0f50e75
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaCX:A3mnXoZjzyacNVOE/jeD5TvinrmlEaCX
- TLSH T144057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 802KB
- SHA256 42873240cce63100b68fecb032af6a74d7a30ad364afdd43fec95a5b3b924614
- MD5 17871f8f86e026e1b24392480b099f6a
- SHA1 64547fa9758fc0712a14589ab0a4b4fd54418ff0
- SHA512 ce70a73608c7a7cf7f5d185fc2986bf641f8375cb61a3bfcbf07f3e98095c9d1b323522d72ffcb19631f94900fff6b0407dab765979944a725551689c67f2cbe
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEakL:A3mnXoZjzyacNVOE/jeD5TvinrmlEakL
- TLSH T13C057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 802KB
- SHA256 cb5b95ffa6eccd7affb899741cf163cac4fc19a2f1213a67c4367401ab533f9b
- MD5 f32f5fe22ddb08967a3a9d13388ff554
- SHA1 61095b2baa6ea3342f8af88b9e6c693a1366270c
- SHA512 c767f8d90200ca54ca73c40f8becfcf0d42f3f56599f8e935eb40620846029928a2a1f7e36364408540caba7b7a0083fccc307121c61667480c6199e5631fb94
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaAFC:A3mnXoZjzyacNVOE/jeD5TvinrmlEaAM
- TLSH T108057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 802KB
- SHA256 a5a8b3ecd302b4ff6e1ab8c95bbe42f0ae0efc88c2af0226808ad5eee24545f6
- MD5 b49654d89006c45082a1077691112c9e
- SHA1 66d574c12cc4d00857bd82ecbcf211406fdcc561
- SHA512 44af474e0cf5bfe07bd4193491a70f094f6644eac77130e57532ed7178347836f1af10194a96819bdcaba952ce4950bd39e1c64c94b66b34502b247932222e50
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEahh:A3mnXoZjzyacNVOE/jeD5TvinrmlEahh
- TLSH T1B8057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 802KB
- SHA256 2e98d3cb7e2781a4033ea2d1abfb21119d4e5a24692da300314d95d8ba903a32
- MD5 ae5480e98b8076c0cd32a7318c67c114
- SHA1 6a2d780d9d2841f1061f59527f8c51e1d68094e3
- SHA512 18526729d6fc17046ce9f4793a47283b875da91268fc9dee8e551a9e8aec537c483b15699c2957e60719b671baef83c5482520571b4d20aea400bf49f9f3862e
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaIM:A3mnXoZjzyacNVOE/jeD5TvinrmlEaIM
- TLSH T15E057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
- Size 881KB
- SHA256 eac1baa77b709b7ef7992bbe79e2838c9d14b4720c3b0a05de5c294cd364e700
- MD5 156b719b347ba87d185f51bd7952683f
- SHA1 2dd184583e680a05adb69f14baeda029ddf1e70f
- SHA512 e0f39e7e4abbb55de4a65e273347cea6f197c25fd6857bae4b167dca2d013ca72f6c82e9f75044f61dc52c34c00264fd997fe7c4cc0d51be89b5b04fc8545242
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEaBI3E:A3kMP56rqx
- TLSH T1FA156A13A2940FE4D12F813499A54922EB737C165F6087DF1364AE253F327D0AE3AB67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
- Size 802KB
- SHA256 3cdd04d20fe8269acb7ad9239afeabd17043eedb73d7c41acf0f6f84518f46cf
- MD5 96e9bbc6487a612f416e689a955c2e7e
- SHA1 f09b9d3e9ff5c323f873c78a53cd3a4773ec3baf
- SHA512 64ce15f46a7514c7ca8598dc22fbc2c34a11c1bba2864e7853f74074600a077d5f00afda3f6e0fbcf40f1ffdb22d739cdee2c94f74166c441dbcaca677a0e1ef
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaPY:A3mnXoZjzyacNVOE/jeD5TvinrmlEaPY
- TLSH T1ED057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
- Size 927KB
- SHA256 578dcf62b65425265639199b5a5f2585b9304da6caf3ef120f198ac74fcc5e62
- MD5 1b49c4973b4343139369721e03d9dc3a
- SHA1 718ed0e9fb3492c9b146f53e46a9ada8526c841a
- SHA512 a639ad19f0856d33f579384092f983c4748f4df7c789a32ed5b4351a49ded4feefaf8de04f8dec0175c42b625da34819ab98926cf60f7ed5823a0320ddef8bc1
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEa3HdfnJ:A3kMP56r2
- TLSH T1AF156B03A6940FE9D12F813499914662E7737C125F209BDF1354AE263F327D0AE3AB67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
- Size 802KB
- SHA256 e26a04cf97cf6838a0ac6dcbda75f935ef2fd0d79f41d2b85aa3bbc22f52462a
- MD5 2ef3f504cf757de389829c134b7a90ad
- SHA1 ee78f622e963151d77a92f7ca63aa8459fbd259f
- SHA512 04003a3b98cb3ff02b383ac3a5422ab5bee49f2ce012bf163c357d962f11e42ebb30fc368911df7404c29c0436628a740bb9f1f76b6d335128abf0809278c9f6
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaLQ:A3mnXoZjzyacNVOE/jeD5TvinrmlEaLQ
- TLSH T142057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 802KB
- SHA256 0a48350dab1643c2df17e60aa4a37978902083f61a7f59f6d9efe9aa98d57281
- MD5 8ffc3192ba35c80d3f7b62652857f64e
- SHA1 b284fc330563d349a97d18a459df23d05e31f80c
- SHA512 4ef22a4c135b166a78aad4566cf79999f60b89f6dee525ec479653cabc607189d5557be2bbdeed3ee5d51f3ccc9ed43c1bea7b171fcae29c771e0c011a7232ad
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaVt:A3mnXoZjzyacNVOE/jeD5TvinrmlEaVt
- TLSH T1F6057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 802KB
- SHA256 9f4930cce171b6b78127af00854f203a3057553a1f8cac532f708c2ec984bdf6
- MD5 e2bddea64e6dc5d9da7d2eb345ab9ebc
- SHA1 6fe5c7961e88397225b7bd0b4e74d9bb57143fde
- SHA512 055139806c7529a34273874be3bba60350ff9544e4613214de61a1665eaff47fd825edaf5576a838bec3e18f224817a73a201a9373a0f06d9283b8b91cadc478
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaQQ:A3mnXoZjzyacNVOE/jeD5TvinrmlEaQQ
- TLSH T153057B07A6940FE9D11F817499924662EB737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
- Size 802KB
- SHA256 172d57bada575e6ebee6e02e4a943c288b22779df836b359f5f3fc6cf6bd724a
- MD5 773c6b687e11085e1b6db6f2cc48f37b
- SHA1 8699319343365e9fa62d73f29ebd3e30a5c9e7cf
- SHA512 4148c50616c3b3556d9a182745f09bcf7cbf452ae304366f598b875e4d5763bfa2d2f8d755ac8249cd998b648f750ec39702ffeb3c4aa50b66944184d0ba8439
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaBV:A3mnXoZjzyacNVOE/jeD5TvinrmlEaBV
- TLSH T1FD057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
- Size 802KB
- SHA256 8a6fe64d7be50a6ac6b63d05571957b02e95145756fb045e2c46831cc0955e9f
- MD5 b06213fe05bff69b0184d8dcf071ee72
- SHA1 9abf5bded546517a1fee021589db8ea932990f4e
- SHA512 b55302c35204242b571f34189b45588c380b9ff2986d8d53fd47654dde147ba6db60dcd7484cb3e3d731ce29c647633f765b5e7adac8da50f3d55b50b52dc467
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEau9O:A3kMP56rk
- TLSH T1BC057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
- Size 802KB
- SHA256 db1cb9cfd6fd065d4d4811092908e0e75687418b3e1c9344cf06b0146176d2eb
- MD5 743e04852db08313f110aab1ca7bc1c4
- SHA1 4d7a7f86c5f0df11f7e220cdb6edde0d68993667
- SHA512 ca9e8b20e1f994edf4be10e8a34a0a39e7306379bfcd03210b4d22c40d19e006eb21fea973f85197050d719d81dcadbd2f4e72bd4d24a1d7829d440fa3e66e68
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEap5/:A3kMP56rI/
- TLSH T1E1057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
- Size 802KB
- SHA256 0c7f9abcec6197c144e6c3d7ddece89a063a9d5f9080864b86663c8d10220bb7
- MD5 f85209c763075bfdfa0815ccf4b5bc3f
- SHA1 d5fa942311df710d70ae52c8a3fc5a693d205e8e
- SHA512 251220c9dc9fd17a09c121c1edce6f8a28830f63b2c7f1dba07799b0c1c7d53ebf44ed45edf1f7426c63479183fd1354e92b509e1b80f03fec24e3ece8f450a1
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEahT:A3mnXoZjzyacNVOE/jeD5TvinrmlEahT
- TLSH T145057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
- Size 802KB
- SHA256 f59be85bbe4e3eb234f6d0a822e73ee3fbd47e9d57a4e618bbec48f0b2578a07
- MD5 ba935c40e88c0abe63c794bdd99582f9
- SHA1 df6ebaead13f8bb4689b4076f6c0157f72bc7a3b
- SHA512 bd3550857621e78c6e5efcad8195fb063bd7fc2e7eb34a08ad2303388185fb6b03a3172fb79d6b28c534a3565aef9c418524d83362ef7996a0366bd6a664ded5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaHs:A3mnXoZjzyacNVOE/jeD5TvinrmlEaHs
- TLSH T12A057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 802KB
- SHA256 b9e0de1358a520ca26dec0dec17fd6edbd246c38454595449b7686930e1b0de9
- MD5 a6ef864188ebae8c82d0f7352a1d853c
- SHA1 1dcc645690b0b75f1d26495b244116f92370e5ce
- SHA512 329e3027b268053ef7e871cf8572c577ceaf8e0cf5d90f19e3eb1f2239daa274eabe260221812151201c20b756fa8b674db5a0038e3ff0808a0e5ad72c5e13b9
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEayC:A3mnXoZjzyacNVOE/jeD5TvinrmlEayC
- TLSH T178057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 802KB
- SHA256 4b8cd9c9c1864b16df11193cb5893d3fa1a6c6af654ea19aebb97c88a45879c5
- MD5 c94d38c220ad35d93e1d0623f053cf0f
- SHA1 ae6e330d8cc9670f53b8bae32aeaccd3f469aa1a
- SHA512 2236a6e701f39934f2b059e7b44f789a81a42f74ef374aa43c7c494d03945739f63e3dfc40acb84d4722ce7ddccf58124f7c23966b1d1f2f9a5cb5c83c6b3c3b
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEawI:A3mnXoZjzyacNVOE/jeD5TvinrmlEawI
- TLSH T1CD057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
- Size 876KB
- SHA256 ab458382fc80aebf89b658167f40e2b27148fdcb5fe637562e9445ee74fd4e2c
- MD5 983bf4a329a05abf68d718c40dad024e
- SHA1 b5b870701861a10c13dea670abd838da182a04d1
- SHA512 f47fa8f6ba0a60e6438104835727a957545d6d1849deef5876ba7ec07672206f914b40523477d76a93a3f0b5a419ea4abcc5f4bba80abacbde40d5f7ed21e1eb
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEaaf2aps:A3kMP56rLs
- TLSH T10B157C03A6940FE4E12F817499A14562EB737C125F209BDF1354AE253F32BD0AE39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 802KB
- SHA256 dcaf15b761a6e658861ec0571bd3074a1c8ec3c6582741d60d80300354423be0
- MD5 5c7a4cf5f0494c55f33e1f24f9132609
- SHA1 095dfbf841fd152da9bfd488a5dd8a0d89026607
- SHA512 76ecd739664c75e190f92f5fb302008fa37d5c408efb07932c2f8b0c11ca862f95bd4f48b3768c7d2634fbe7a1c28b765e61f15abcb4f0a52f8b503d323c5635
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEahv:A3mnXoZjzyacNVOE/jeD5TvinrmlEahv
- TLSH T136057B07A6940FE9D11F817499924A62E7737C125F2087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
- Size 921KB
- SHA256 d42de7fa4e5b0f9e408f8f303f13422b63cf4a1d7f30ec946d85a8ccae7d4cf3
- MD5 cdf374c943f50725f030777b71323110
- SHA1 c3ca1ec67c1ffff00ee545a7c8052ae50759265b
- SHA512 89f3e3572931390285aa3bd835ce15848137fcec8e6dbe25bf91ea6e96eca0f55efccc09b968375716e2805218bcb41b9d5bd7449c7dc2df648b329ece850305
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEadMlDhNDS5lS/A:A3kMP56rNhNDS5lS/A
- TLSH T124155917A6940FE9D11F813489914A66E773BC225F2083DF1364BE293F32790AE39767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE
- Size 903KB
- SHA256 9152974d8b4cc32a5afd7e2986cd6b1a46755f70f95f82c1c8a228e80644bc6f
- MD5 eb947d3b13640509618d8187534d71dc
- SHA1 04351d98ca808aa2b35636bbe4368543271bcf5b
- SHA512 71f12acff67b3e1f054c6bcefa1c571128b575fcbc00da8c093c90df5abd0607520eb540a5398a32d0133a7fdaf9b9e810be78b3c2088d27192ebebd2a1f1ab0
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEazGq9:A3kMP56rdi
- TLSH T10A157C07A6940FE9D11F817489954A62E773BC225F2087DF1364AE253F327C0AE3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
- Size 960KB
- SHA256 01f77ac83f25b45c946ea8967978022bd32fdb17aa0a6bbd5508dfce010d0541
- MD5 8a8aa448fe89d3bd6a0879cc07cc9317
- SHA1 f5fed47a75dccfcf62f6c69eaa4d5d1e15c9ea36
- SHA512 57333c1e783961dcc69029a5283edd9f161ef6217dfba09c73aa84b5aaf16b4259bef5888f2d8167000a6592fa9fb1ac7adedd97e8d1aa3123bea1a88b52b7d2
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEa+3t7C8GebG:A3kMP56rF7Cf
- TLSH T185255B13A6580FE5C11F82748AA58962EB777C111F109BCF1394BEB93F367806E3A257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE
- Size 894KB
- SHA256 4857cf0e16dad7f6e46bed00484537a6865625a7ae54f27f4c59f08b1ad25b69
- MD5 fdca78dac1100ebec872dc684cca9d93
- SHA1 5f81b7a01b71ad8eb3942b6186a9a371a749ce9f
- SHA512 9f5bc4c28ff95269658aa93ddb80746852a2773e102425886b2088d34cd0deb968a976bde8369387d1d036cd9e4da2761e03ea396ee747c5a95c4aece1bdcaf2
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEaIFn6wK3:A3kMP56rJ6F
- TLSH T191156A17A6940FE5D01F813499A64662E773BC125F6087DF1364AE263F327C0AE3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
- Size 933KB
- SHA256 232516ffeb40cfe98f6a03edba9bd047192b1fc78d8815b2b513440f78805a91
- MD5 5886c840e762e74572995731e8d79ba0
- SHA1 e2995ea6caec531cb62ddf5ddcbd722a86ecf737
- SHA512 3691e44820a32c39e945495dd56cccabf4a1ddad9971b5b563c116045ce9d21f02ca31ff06bc8b6783bbac8e9b32fb00f725964ed6889b9abfcb29838db0e469
- SSDEEP 24576:A3mnXoZjzyacNVOE/jeD5TvinrmlEaVdSKelZ:A3kMP56rSdSZ
- TLSH T137155A07A6940FE9D11F817489A54662E773BC225F2093DF1364AE293F327C0AE39767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 812KB
- SHA256 c311afd069ed405ab53dc9fd42c4fa8c25b42e0948d2302a3c29560f58d545fd
- MD5 927d6d4b1221ddca462c46b055acb0b8
- SHA1 bac1476c64b37ad7fec5456e2200050057994100
- SHA512 17bfcbdf83deb4d3f3f05a090668d621c33679a502f84785984ea60d3f5cd265d9c12842b46c2d81f247ad121f7c9078b579c47d187fa2f4f52cbcb3fc7d66be
- SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/jeD3JeU7vinrmlEaO1:A3mnXoZjzyacNVOE/jeD5TvinrmlEaO1
- TLSH T1CE057B07A6940FE5D11F813499924A62EB737C125F6087DF1364AE253F327C0AE3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH