e298fcf9a8bad49086caef992c071a66bc9f73d4582d290eb4b05d62a6b57ca6

Analysis

max time kernel
112s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 946KB
Sample260702-yprd4sdx81
SHA256 e298fcf9a8bad49086caef992c071a66bc9f73d4582d290eb4b05d62a6b57ca6
MD5 9b7cf9383760b6b3cbd0f3cd84d646f9
SHA1 67ba303f43764b49fd21072d00b3084569d30c3f
SHA512 ef1504595afe9ce311f0dcea661e03e76aaf1e4e71f1cca7f5826b0508601344c8324561de364776b89eb7d1c4a4bb0fee48260fc459ef3a191c271a82086922
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU:A3k03kB56rQRJ
TLSH
T1A2255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware aspackv2 discovery persistence spyware

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5992-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c47f-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2be-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5992-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4452-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001896c-199.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001896e-206.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a4b-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019838-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-247.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-254.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-298.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-436.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-455.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-462.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-488.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-518.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-521.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-528.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-541.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-597.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-631.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-633.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-654.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-655.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-662.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-772.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-803.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c47f-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2be-11.dat	aspack_v212_v242
behavioral2/files/0x000400000001896c-199.dat	aspack_v212_v242
behavioral2/files/0x000400000001896e-206.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a4b-220.dat	aspack_v212_v242
behavioral2/files/0x0004000000019838-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-247.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-254.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-298.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-329.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-354.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-436.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-455.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-462.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-487.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-488.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-509.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-510.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-518.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-521.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-528.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-541.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-572.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-597.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-618.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-631.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-633.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-641.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-654.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-655.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-662.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-772.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-803.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4452	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{3F3C564C-A411-4283-922B-D29D45EAC4CC}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{770FE1ED-0092-47BF-97D9-7CB263BED210}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	explorer.exe
2820	explorer.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe
Token: SeShutdownPrivilege	2820	explorer.exe
Token: SeCreatePagefilePrivilege	2820	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3000	sihost.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5992	2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4452	patcher.exe
5224	SearchHost.exe
2188	StartMenuExperienceHost.exe
2820	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2820	3000	sihost.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_9b7cf9383760b6b3cbd0f3cd84d646f9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5992

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2820

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5224

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 e298fcf9a8bad49086caef992c071a66bc9f73d4582d290eb4b05d62a6b57ca6
MD5 9b7cf9383760b6b3cbd0f3cd84d646f9
SHA1 67ba303f43764b49fd21072d00b3084569d30c3f
SHA512 ef1504595afe9ce311f0dcea661e03e76aaf1e4e71f1cca7f5826b0508601344c8324561de364776b89eb7d1c4a4bb0fee48260fc459ef3a191c271a82086922
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU:A3k03kB56rQRJ
TLSH
T1A2255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 7ea23e9ce0589bd14fd3e68313c78013a2c6eeaefba0f377815706511babb86d
MD5 6405ae1845068ab47f7156ebb7468108
SHA1 93ef0d5ee9803765284a90a5499156a563108165
SHA512 ca373409e1d8d04d11481cbf6e9931de771912802f062a63060872031909f5674e3be90ca6f69cd4b628547a37495bd87bc3fdd1ab404d38925fecf1d5bf112e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrM:A3k03kB56rQRJ+Pji0Aj
TLSH
T16B654A16F6A44BA5D06FC078C5D29656EA733C421F3097CB0354AE293F77BD19A3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 970KB
SHA256 e64089eb07c444171ceb1f09d3b5aa0a0d58aa4acd4b93f1f614edf995a744ec
MD5 c2c6605c8d4b066fed5965ef0ce5def1
SHA1 2e6b066d8b670db6b419300e23a0f96d292dd12b
SHA512 387d3f98fb65239cfc98aafadc03479df2faea9a260ec396f2fbc8965a128f6c2fa0acb05e745894bef9c935397a7fa1676200731e3b4b6219b5ebc6413212be
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUpZ:A3k03kB56rQRJM
TLSH
T130256A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 970KB
SHA256 3c523f9e139c84c3f897d35cd843329cc2e5f4120fcbf624c0fc4d101c3ab5f6
MD5 35036b98ca5529454c8eb39dd0a6c163
SHA1 db7b10e58b0e428a57e018a4312904cb7cdcc899
SHA512 b253857b15ac97dd1c308cefd11ce4b37db923f6f2801811d5cf033e5c9718da242039f074f3d83d49b183c3a4e818a4a58eae640667a040367673539dfd497b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUC1:A3k03kB56rQRJD
TLSH
T169255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 970KB
SHA256 994bba5eee9c36bb4ce1e078adcbc3a1cad076f471cd41ea6423f22ee77e821a
MD5 871e3a8b4a6f57cb836bb83c6f1e8042
SHA1 0d35d9a34978f35f3c39cc8c114c4f51c7180aa4
SHA512 58343c3d5b269f115d61ba501b2f1496851c2b47f2240c9c54984f5de13b9628c9e08eae6f9239de589bc20c2bcf5434f0ce7254e8b36b14e95dbcbda09ec1ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUo6:A3k03kB56rQRJo
TLSH
T114255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 970KB
SHA256 cd9faaff8761f035eac43fba22110f346fc8e1a230e1badc074ea52726b121b7
MD5 ea203d373f293503035990d61c805277
SHA1 72aeea24b114f15e9e925fa2d5b6a62aa390d2d2
SHA512 f88daf144483fc06a8e550f304808fe78e55df44a81a137bb0f253955b7a98486a1914281132aa49f15dea918231954b46d2abde0c74cab42bbc1c8be047338f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUsN:A3k03kB56rQRJV
TLSH
T14B256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 970KB
SHA256 2c6f95ec3b562309e0c70a66c330c555c571319c8325529e0fbac3ff36b618d1
MD5 e39331c9d09a8a3df1ab2a52b66d9677
SHA1 a3d6b19b77b939f18223acc3b747a5d9b1aa9f26
SHA512 e299995286f7a632a131814425849665096a9eff0634002146dd69f8d62a7fe42dd421aaa49173f1ff2b132e7e1edc89f2654628b53bd100882c8f79cb5df73f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUif:A3k03kB56rQRJN
TLSH
T1A9255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 970KB
SHA256 f59768dd92ce59ada6c22a2d6423afc6c5be3416daef2a97531de98682f48af7
MD5 1d1e404b12efd316743f78ea97ac3ca6
SHA1 4129cf6917fd12a916be2d2f72f8f020d2775595
SHA512 0fbef01bfd208703258be1ef789374d4741204e861ef61c7982c987a466933b5c8972fafab85da2a018ffbac3f05a0277d3ee0f063b9a84cc8ef1a74583287a7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU8o:A3k03kB56rQRJ4
TLSH
T1F7255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 970KB
SHA256 7b533fcbd34aac83eb59215f86516d83f9792635c8e68660e6291f785ea2169b
MD5 a559d52fa0a15fc2e02d8edc367a43b8
SHA1 fd4a0b6b65861661d8f615dbd3e53a591a6f5a92
SHA512 652724ba93a2c2624ab8fc20f12a9ea463c119a55efe681e21fda12aaf9019011c21ae4944d05d83a69328a442eb7394aba9d548f827d9edc58ea57f4e77c0f4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUcu:A3k03kB56rQRJK
TLSH
T124255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 970KB
SHA256 6ac18e760d68a3199632f9d9c1f6fc806e71deacb70f0fa2a75f62f38e8200b1
MD5 566befe30922faf99f964d494ecb030f
SHA1 b3a8b06c14617dc604e2431cb1b681f43cbb2435
SHA512 a2a1aa5a47c0508c09853c77029617f84e452513aee8c59c99d8c07028f5564383fd9cd82bf4f3f5ca79b6b5a93c9f3f4a40ce18ea73686ec66eb43ef7d5ce5d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUg9:A3k03kB56rQRJr
TLSH
T1E8256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 970KB
SHA256 09b2a74797f7e5b8049bbe167f9714269995ae5808e3047dceac884d21b6c463
MD5 9e00b9f9f60ff4141531e8c45a112eeb
SHA1 b9b3eeb6f66149bd86922fa5cba06857c5d467bc
SHA512 3b50241b8f43a375ba390108fb17caf7d67f4deb9aed3477a67b8cb3870afe929919185e63cb9b1017e4b02f8706e76a6cc2483fe9c4a3d311a060426267c5c7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUoc:A3k03kB56rQRJi
TLSH
T1D2255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 970KB
SHA256 4b1fc52bdbe0577fdd5df370b673ac5c2e1e2ecf01a4e5e6dc6635e727e3d03d
MD5 d3e90cf27b977db18c155914a06cdf95
SHA1 ec818916efec5c211d97fa93c026440b481ac41c
SHA512 c6ccb2bb241d8f0b3ce16d4ba2476f48b6018179a86983ea1a6f209589ded69a7aa0f493ba603c7e07a88462a411d27618322573ff735a6c98611d7c42fbe314
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUBp:A3k03kB56rQRJI
TLSH
T178255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 970KB
SHA256 b6cb45e2f30adb767064349594729b32a230ef6e5f2c6f2a5318a77a586cba31
MD5 552ef63bcb6bd3b641e9dbbe6b936c4b
SHA1 8f08c8650d9712448e7fccdd55db8834b31c9b96
SHA512 190a376b396513d3294a70635b347ec87958276cf1f9004f40daaac23b48086e3de33fdcabd9a5722d7658aadb5599ba358735589815cf40b9a29caf00291361
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUWN:A3k03kB56rQRJX
TLSH
T1BA256A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 970KB
SHA256 94b8851409fcc499bc985715ba99ffec72c3248fb0febbdd9c99b14e3ede8b15
MD5 2137d553be45391509d19bf22ef662c8
SHA1 56fc4e0a334d77b36ffc0f828e5cb9222c48937b
SHA512 edf2b7777a35919c52a72864ca7c46b3bcbca324a22adc5e52d59f679ab167931f93076d0d91898170275ef341d458349d164e659bcec9051e7f3cad913976c5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUaF:A3k03kB56rQRJR
TLSH
T18F255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 970KB
SHA256 c374124cab383c94ff16b0607764f09ee4311ff3f0d76ca23ab2f4ca447aff3f
MD5 5aff7961050e885c8c9a8695f842bb4c
SHA1 fd46990976156cfab8eab11f4950a17a84af445f
SHA512 5e563a8959e1e3c1118b198c780a1aed2a9e2228c6789bd674ddaa33a510b7ac435c727a7c41eea3b5b187e113db82ab40c293fae5424ce9a1fd1ddddf2c0674
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUvC:A3k03kB56rQRJ9
TLSH
T1D7255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 970KB
SHA256 53db10145648da0a3a7d2eef9149e2f0d529ec135b5b6d0d2ff0040e611af199
MD5 c83043eceaa86d0f3e57efa6851ef08f
SHA1 b5efa09ca890153030064a50431739aa96b890f0
SHA512 8790f02644a7dbf3bef4f1fea3ecca2e0ce27a06448a60d0c253e0ca7614f10a86bcebe8070a3c4b452bff5c466d63c4a7c36f1e9ece77ba7e245d6700f208fd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUQw:A3k03kB56rQRJA
TLSH
T1E1256A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 970KB
SHA256 70658aec06402bdcef8dae1dd402ae91ab871d5eef0e0f73f4d658c20f7bc2bb
MD5 eb6ffcc32dfcb8bd61eae4f6c75b3b57
SHA1 b65546a7ea3b862311ea10c1aba42800fcbd7f59
SHA512 5e09a2c8536032d8c1d4e5cf5960660378388d9ac15738abaaf317c442bbc69f2c06aeea54cdb23c308692e20b4775d9507481bee0e92f9c0c444ae0658fc5c5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUvT:A3k03kB56rQRJY
TLSH
T153255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 970KB
SHA256 5f30632628fb94ad5affdf335d612a9fb552323d6a8e1fd5263c74a5a57cabe2
MD5 a007e2ac64e944bad2badc2e8d758f20
SHA1 1c9b32879876e1781f4be36a4222f8ee1d376531
SHA512 2639373a07a51ee12707ad932b1709851267d0dcae3563fc53cd34194186944dee2f1cea1a1eca35db6124c6800e0e20c663fb454fd05d8084018a25d5f82091
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUpu:A3k03kB56rQRJn
TLSH
T1B4256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 970KB
SHA256 b0c37086b2181885d2e328e6f6214a634c06f72bacceb5ea186e6a018a79edc3
MD5 a86c0a4291c79bb075aaff1720ae3520
SHA1 bb9239a7f48b97414d7e0ec29d6aaf88f63ae2af
SHA512 75ba7feaccf9ca5b509551f1a685b8c9c915673f5dc55d59fb0f86e91e761afe014c49ed0fa00eff51f5b6e7fabd7f0e575865069cfcef94f5b634f523c4ab35
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUhb:A3k03kB56rQRJe
TLSH
T172255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 970KB
SHA256 ffdada519b07a573b93a3c21512232b9d3e6ad2c539badf9ab7543350debd7a8
MD5 8e46e44bdf47bad9b461017fee1a2803
SHA1 65fefb8c6e933a1953149dffddd25efe3b1a332a
SHA512 6c98b4f0bfb17dfb8aa898137bfa961224cdd41a7b24a375ec34260678e54513d77a3b481ac7268b88d389a24ec5916debbd012916c32ca8bf9ed4cfe3863347
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUpf:A3k03kB56rQRJ+
TLSH
T16A255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 970KB
SHA256 865abb004a3d7daae76d002a66c227a7062ea73e6978ceecb076af4488f46867
MD5 0691c59b9e096d8109c15f1ab8d3a21f
SHA1 89c56db5fd6661b01b69952e5bdea241ae281cf7
SHA512 d34d2cf072b13280ac309373c6fed389a5ca5bc82f48d016eb1a1a000e60a05d926158e7b7575881e5c09217ba8c3b936c05292188b533b822e691399073db2e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUSK:A3k03kB56rQRJe
TLSH
T1E7256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 970KB
SHA256 53ae5c677d7bd28cbda03d042ef7ccb8dd7b52ec7ddd805c3c19ed2e333fe608
MD5 d891a60a55df70b17467b113af717b4a
SHA1 4993adfcdec1ff16dabb24098ca2f53e30f7ee3e
SHA512 964130af0772841fb44102587a8230d1f632da786fb48b0ef535915e7d78ca76b5a6ca03727d628b27c5b09619bc54a57f2f8f8f010df3106e10c86f63b3579f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU3k:A3k03kB56rQRJD
TLSH
T176255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 970KB
SHA256 316d1ec8fc572593260c52753b22ae68adcce9063837ab1e4f88c1b0893a5e1a
MD5 b1c518ba8b7563502fb5f1bc573217da
SHA1 105d565202d2bf17c7c5b4a8bc5cb6779a3443a9
SHA512 ee03e5a5f14cc7538d804539ac0391b050cfec7fecc8bf7df209b8822f1d53515c5c4fb4146f8df41a7285d5886de7a1fd5cb5ea7fbb004c42ad95365e92cf6c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUA0:A3k03kB56rQRJC
TLSH
T11E255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 970KB
SHA256 0783d40e3b3a2e6ecfc725e764c63346c41b17782eadd8d0397910cad3eaeee4
MD5 ce8a65d5c4a993eb85893ca633c5f2fb
SHA1 5fa709218f96e0e98a1acc10c0afaf98fb3e352a
SHA512 d47f0de735f38c2eb7e639d9f851db0737883e9fdd61f0fb2b19a598e789b59fff7887e4f07442d908251fc39b352ef8ff112feb74ed0acd8e4c0dc13a993894
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUbg:A3k03kB56rQRJ7
TLSH
T109255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 970KB
SHA256 119aa466ace9fd9ee2c418e683ba77ee0e88ecad51fbf326b42b9a02f63013e8
MD5 893875d2cbe3fd8c17dbb34f4501d537
SHA1 0961227b12601fdd697cf52062ab66653ba7cc85
SHA512 6bed4727acdd114bcf01d9a0d0eeecc17d60d688b678052e8a1fe0472b3ffe729907d6d6701d1706997e5e2dbf7f2f803cc57dc667b68d5e030d0f6d63b68d44
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUWr:A3k03kB56rQRJt
TLSH
T159256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 970KB
SHA256 0ef8454fdc04f0fcd7cef26df1a87ab974935cc488e77ba153640e2034155c9d
MD5 901e7e46dca1b98df0e792993ba22aa2
SHA1 5bfaeddd7ccb9109fe6c4097a73b2d46e0d7ff6a
SHA512 db414528f1ac3898aff99f129138c480da97e1a2e87eb7ad905f5aaeea5618e9bf3c1ae1a4537c436d161961df5b011800acf3242f6d092355d53a8286f5c423
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU8n:A3k03kB56rQRJv
TLSH
T1EB256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 970KB
SHA256 34d4954abbeeaedac9fe3f7f010a137fa507741d42b2af84d739676547a8998f
MD5 936d94838b6c9c523d0ad2732972e33a
SHA1 6e82e7653d7571862598e320f63e31b7dbd6cc31
SHA512 6981bd12a4f8a68013af79b64808d95028715f0547602dfb7e9dbe72e6cbc05ca6546a0b3d996a51efb78fdd6c99ab46c44f237f93053bbb91fe7758433a03cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU6x:A3k03kB56rQRJV
TLSH
T1BB255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 970KB
SHA256 5580a70788de2dc7d5fc308b11ba94a076d317b8965b980c7877d647edd00302
MD5 7136ff03f2b04a9520ff63f90fcd345a
SHA1 b8ed3239a7834ef9e93c958800f8ab76e9b06c1e
SHA512 5e9e8db2af29ccd210bfc291134e6a044f7b3a50e7e36575d8f07aff043f12fcc480547a663c021ce95b9bf436c9b5d03bae2f725a46e9a40c522aeaa28ded8f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU8A:A3k03kB56rQRJa
TLSH
T13C255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 970KB
SHA256 4eeaee4bb9965b0f7dc86f6333aa703495a1258d34403b37ddf96831e979bd47
MD5 ec6240f9a12c1c37b8f6812e130659e9
SHA1 3172e89f1ea6ff6a5217a643074d7089d6d20dda
SHA512 70d32660de23589d964908514d56ac5de671ce0bf7c579fada2e8770ce4423cdb6fe9818a94ab57e15f16c15c070070dfe0b84f30fae37e09e40e53250b1b97d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUl9Q:A3k03kB56rQRJn
TLSH
T1DA255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 970KB
SHA256 6dfaeccc060ff7a45a2d06b78a3bbc370278951387bd8822dfe7d6eff16a9f9f
MD5 853a4a0afc90045e0c1ed25a0326d128
SHA1 bd85f9146fd097e9bd2dba4938a17298c48d559b
SHA512 d066b46fe881645405017092bb277b2d56c05e0a06fe158fcc5c0d27fc16973e86ab9b71128d4d03139e9b8bba3acc4e35571313b5a524349689d6db00f274c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUQ4:A3k03kB56rQRJ4
TLSH
T15E255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 970KB
SHA256 0d26aea2953495540183f635521a5a6cb8357e1a6fd05296c1d041982f9e2630
MD5 abd99795017528dd9d1a4c191cec70df
SHA1 3923f9562acb087be16b7385ba0f1a9391a95432
SHA512 4171a0d1890be5eabb8159eeb1e8a43d2eeda9b8791307406e21883a4282dc9e2d14517a1f449867187c8d24347482f7d83a09158aeb75cdeba9585c6f01120a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUTu:A3k03kB56rQRJJ
TLSH
T1E0255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 970KB
SHA256 a935f1425fa2502e57502fec97d6cf90b9c08be918e58159dbce393870973efa
MD5 53ad24b59ea351e0d2fdaa6cf213314a
SHA1 2380301e0184668b2d34d671403daf5b95d543f2
SHA512 1d744cb649a40e3be8b90e0b13424c3595ce0f7a827cb8fa632f643cccf0fd691f827a59c627655adc783d4cc5db7d838f67d67a0f4da7585ca6d65961f2de05
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUOj:A3k03kB56rQRJT
TLSH
T1A1256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 970KB
SHA256 e72180d53846afcae472644ae4a3cf72c0bcd3d5920f50829562bd0babb1bee1
MD5 4cdd5f4b9605f14de4f68568e7a2a0bc
SHA1 290f5b5669cb9206b762e71728636fb535bc2ac2
SHA512 bf524bbae0e842877b4550465eb22f241cb2ffd8b5737c6f58ba1ce2975d586e9d5173affa620c73773b1d7f5559de39a3ff836021835546f180e0303afd6428
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU7g:A3k03kB56rQRJ7
TLSH
T139256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 970KB
SHA256 96ea530c695fea36bf5f647d35cc7e1a2327bfbc92956fa4ca4413e9ccb0c3ed
MD5 cbfbcaea27e20a6e3c4baa1a7dc406b7
SHA1 799938571c73b4c72ab0491e801f7a8b717f3de5
SHA512 e057b9afced64c91efe1bae0f333e2720bd943de79d0511ba453dd7b45d65f42ae8f234e3cd50ad2552831aa6970eda03c05623f54f869ebe69989e4787246e5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUmI:A3k03kB56rQRJy
TLSH
T1B7256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 970KB
SHA256 c5232156ab70047a0b13abdedfa578ca38a3f571c09677286ab02e1059532051
MD5 a00433f6ae1808e6127e6a56c5553929
SHA1 eef63e3eb9f27aeb36980d3fc0e7d992a3c09f1e
SHA512 0c38a781acfe642bd894ad0454a9efc0fe1527f4b42812cb6c9e14e470c150162bb30f47f0ad78521cc62fcfe152449cce6ab8b5c02a56f1c4c93eebeee6f2b8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUUo:A3k03kB56rQRJQ
TLSH
T14F255A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 970KB
SHA256 441ae385c7653d8bf58c79b9752be8ab4ec4ae70ff451984b60b4f180f300046
MD5 08e7e240c826bb1bb439aed067c52017
SHA1 8f7e7cc86982baad22551f58a20f2f13055b2bad
SHA512 d1fd2620e05b61291f156a37250fcbacee8167ea4f1d5babda38f6057dfe34c21412d8aa1c409bd5094e9b8a9556921b2688a329f2ef763046db4cd8cd315f7c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfU3+:A3k03kB56rQRJd
TLSH
T145256A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 970KB
SHA256 2156c27f1fc2c7aac7b4440effae0d5b285b8f322a3540f3363aac7986a9e358
MD5 c0bcfd8b990500199fd56631eff3861b
SHA1 0a3b68e9ae4871cc252f9be563f9ffd8a4526380
SHA512 800dabcc2e77d370a4eef209ef14ab5c29b6417639eadc0a20a8f76ef39a7486ed016fed5bf9b1f41aaf28f2da995100a383e47b9b56be3a849778410d28cb38
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUNQ:A3k03kB56rQRJV
TLSH
T14F255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 970KB
SHA256 7ebff90875801f9530a3bb0f712f77a41beed3f984af0227b5a94c41a1030ae6
MD5 a8152c40fca99a08c8b2e5b87d423727
SHA1 2ccc4ea55683f791a0032adf352dd8262b1e704d
SHA512 a4ab3e1e5cf17f112ca1ffbc29aee9c20a3a295a35b754712487c6163fac0f5d9fe450c699503b44169422a9214b7eb91cc40fa35d9f3f09e87917f87a689d03
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUCX:A3k03kB56rQRJB
TLSH
T1AA255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 970KB
SHA256 1f3be291aec733fdd5dc3986db69e32e8cb630fd7e640c3218d7d041caf26dea
MD5 babc0bc27eae97346c834eaf66c73ea9
SHA1 a3ba80ce28004d4273e24c885fe5c0a8afc3dae3
SHA512 df0ad5a8eb570067c54eb5b098f24837d9ee14ccb747574350fc4246d98f51bf832a5590bbe2ef48b442a76560bb5d3bb9bcd3d54c34337023b5e82e772884bc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUkL:A3k03kB56rQRJL
TLSH
T1CD256A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 970KB
SHA256 2495e8f4adc16a090dc5cca60439d896ed97425764580a76bc00d839ba904c2e
MD5 c23a4516131267a95412a55a6de31bbb
SHA1 0cf415b893ff55ed04bcba1456cbd681bf104ee6
SHA512 70c09a1c97f0a9cbfa6526e351b4b783ad48643a74356102a20edc91606277eac4f737a2874a583a09b2eaf296fb1e1f830f840c7562158dbc2246113daa50a0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUAM:A3k03kB56rQRJG
TLSH
T185255A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 970KB
SHA256 1084055470c79068cd178db6808bb4b668c2bf64121d21a1df573393ec14a1e7
MD5 b89f0c8cdad92d3c32cd24178ee34941
SHA1 a75c7a90d1e82b1a7599d7357c06648b1065e928
SHA512 76ab13e03cc15bbf2b094d7b09a2b88a517c944da1c246e3a4b940d2ab5c5a86ea4efdd6ffec7d6a9fd8384727f6b71a14f467fdc8f440dcac9eb0efa61c35b2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUhh:A3k03kB56rQRJY
TLSH
T19C256A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4452-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5224-932-0x000002B580040000-0x000002B580140000-memory.dmp

Download

memory/5224-960-0x000002B594070000-0x000002B594090000-memory.dmp

Download

memory/5224-945-0x000002B583B10000-0x000002B583B30000-memory.dmp

Download

memory/5224-940-0x000002B593B70000-0x000002B593C70000-memory.dmp

Download

memory/5224-939-0x000002B583770000-0x000002B583790000-memory.dmp

Download

memory/5992-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5992-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download