37d329eb904230c7bd4eeb57662855d52d9c470dddd1a515c2a0851aa77bce33

Analysis

max time kernel
92s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 951KB
Sample260703-reybcaaw4z
SHA256 37d329eb904230c7bd4eeb57662855d52d9c470dddd1a515c2a0851aa77bce33
MD5 81cf1525e2a7c76531fdc84b81430afb
SHA1 854cdb6a95ac61130c57cbedc2484e42b949ae91
SHA512 a84857db6414271983ede80e092ba8cb2981aef83528a7840a40db1c65b02d500248d3272c76e3b0eb712eaaefb39b6c3b3a8c8a8befe84004d9e2c9aad18475
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa:A3k03kB56r
TLSH
T1EB257C03E6940FE4D11F81749AA64A62EA737C125F2097DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware aspackv2 discovery persistence spyware

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/3256-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4b1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3256-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3224-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e4-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a09-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a15-209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a4b-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-247.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-248.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-289.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-308.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-435.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-449.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-462.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-463.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-482.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-505.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-522.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-529.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-657.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-773.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1119.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1277.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1405.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4b1-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b7-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e4-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a09-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a15-209.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a4b-240.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-247.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-248.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-261.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-289.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-308.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-346.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-409.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-435.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-449.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-462.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-463.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-482.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-497.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-498.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-505.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-506.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-522.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-529.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-657.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-773.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1119.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1277.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1350.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3224	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{DC000132-DB0F-4299-9D94-4E063361087B}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{B63AB02E-9C07-4CC9-A23A-39DD5C2F577D}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4272	explorer.exe
4272	explorer.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe
Token: SeShutdownPrivilege	4272	explorer.exe
Token: SeCreatePagefilePrivilege	4272	explorer.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
5828	sihost.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe
4272	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3256	2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3224	patcher.exe
3492	StartMenuExperienceHost.exe
3692	SearchHost.exe
4272	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 4272	5828	sihost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_81cf1525e2a7c76531fdc84b81430afb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3256

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3224

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4272

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3692

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 951KB
SHA256 37d329eb904230c7bd4eeb57662855d52d9c470dddd1a515c2a0851aa77bce33
MD5 81cf1525e2a7c76531fdc84b81430afb
SHA1 854cdb6a95ac61130c57cbedc2484e42b949ae91
SHA512 a84857db6414271983ede80e092ba8cb2981aef83528a7840a40db1c65b02d500248d3272c76e3b0eb712eaaefb39b6c3b3a8c8a8befe84004d9e2c9aad18475
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa:A3k03kB56r
TLSH
T1EB257C03E6940FE4D11F81749AA64A62EA737C125F2097DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 4fdf203d9e4b6c6f7a4533fe18ec3003a6696252fe00ed798e151358746d5c5d
MD5 47667765273ff31dab57c53b88cbf3e8
SHA1 595aeb239930dfe6789779407450a89be0f93fa9
SHA512 e444e8e84106f5b3ee56fd19cb00fe78350493901d173a636a6b111f7dd348dfbfe36d09324f2e54f2df741410cd0a0fc391981e6e7d352a061c6b0edd36157d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaP0Le5ji0hmxNrM:A3k03kB56r9Pji0Aj
TLSH
T10F654A16E6A44BA5D06BC074C5D29666EA733C421F3087CB1354EE283F77BD19A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 965KB
SHA256 be0cf74864f7aa842b60e54fc88459f6515cab909e5d08ff911c52c1c87eaa29
MD5 032564f5139e6bc61860ec5f08196486
SHA1 315c1ac14a3a976207f49461b3b594a248c2eb2b
SHA512 705a9306a7be0da269a9105b5d590c1059f1a8870e0d6aca2efe6f28cb3e76a4e3e64abd00db29ae0293928fb549a26ef4766fa402427d2c3f5890ac2363e1f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaRa:A3k03kB56r
TLSH
T106257C03E6940FA4D11F81749AA64A62EA737C115F2097DF1354BE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 974KB
SHA256 a64f86c11169df66c3578345d9d2ee84955735b8ba65ff9a58ae8411ca9d9f35
MD5 da219a2841573757d72c58f4f49422c9
SHA1 da243b94749159268959df93451e35ee5c90fac7
SHA512 8189a82f43e3c5599b6bc2f4d56567f1ad0c3c30ae00ed7ffcb50a805d94b9818d725baaa50d7cd81d9be7dd0b02e6b3fec906546ba5ca3475ab187d0978d411
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERapZ:A3k03kB56rx
TLSH
T1BE258C03E6940FE4D11F81749AA64662EA737C125F6097CF1364AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 974KB
SHA256 1dd04c7ed641df54e2e83f2e849a552f3f4513fccaa0e5971ac18175f25a3b0a
MD5 72e999a59d5da4effa7120f25afd8fb6
SHA1 2d5430db5efe7c06e48871963bede80d354fffb1
SHA512 293c188f42e5b5e68cfd070b2465c788c0f4796463942fb71562ed6382801246d76397d4188ba19f3b4af211ef7261ebb5e810be2ea72f5b4fb58a5125d5eae6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaC1:A3k03kB56r+
TLSH
T1EE258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 974KB
SHA256 3b81a54d3091c8fa5c3f7bda64e6a9c42338fddd74815b473376c420c9b63b12
MD5 3fa2ff05fff2f8f705ea343d62df1eff
SHA1 cc4f489e396697602b97d46322a9ff87a15dac2e
SHA512 aa7ef3e6df1426809d9b121cb8eda34ef3530ae45d3078833df863c23897d14d04d92cdb94fd938773c929f22ae97c0638cd04f54cb224231473a683f1d988ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERao6:A3k03kB56rZ
TLSH
T104258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 974KB
SHA256 4adc9093aa295b73bfb51c0b3294ad62d9221d56975164c479bf00e954b0e4a4
MD5 afe8e135fe367196ce5fa8a2e83c0ebc
SHA1 7e79e47bf6809ac3c8f762015d7e0b5cefb075d9
SHA512 6e647172caea8377d50998a82ef431e390222fba13d521211ec8d8a0d9c53cc8536ffd9075cf9921ea9cc1c8d13146529d8348c0e16f4e735f5bbbf0418dfb70
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERasN:A3k03kB56rA
TLSH
T1D7258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 974KB
SHA256 afa2590e48a05638a0ffa5ce3ff0e3aa4e685870d81f0ddf7afd5debc22309c2
MD5 6087f743fb1e67329fa7b762dd770e9f
SHA1 7557c41d5ad4ed79794bc6b2a3f26b2fc292c518
SHA512 940a6979e7d2470503a64e7bf8e198b8428b129a0403a81f458f06bc2ccc0a5138bd1c95ae9b6d159a379d38f8718714cdd2b2079c8ef812d7d7708eb24c90c4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaif:A3k03kB56rY
TLSH
T15C258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 974KB
SHA256 27c49e82e7e45cce8ddc1318f3eebaf37c23b389b52bede7f65c7e3cd0929698
MD5 22197c92b213e9084054a00a2a92982e
SHA1 0262ecaf2bdfb3fed0679d23028c03a88b7090ea
SHA512 0136cfe86762f2b05bfad1bd29b2c8ca8f91628e796dab03e909f0cfd2f0e63b465ca775f24e92941e5962dbf6946fb7cda5429d4cac4bcc8fefad8cab9d7f40
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa8o:A3k03kB56rF
TLSH
T1A0258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 974KB
SHA256 9a73a195dc8aa90fcfab9eecf433168c41540c140885ae24871d37068629201b
MD5 0442e8eaf521d5d99098b254b03bf220
SHA1 f3ac5077139f21349ae53dc8fc5e3308e44bb574
SHA512 d30cb73f26da3e35be716869c78c761b5be71cd9b4e2e459c685a70b73f445c7d4cb3f5b793bd49654a33ca5ae344add7e5b6214a55dba194e0b43efcedf56f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERacu:A3k03kB56rn
TLSH
T1FA258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 974KB
SHA256 2a4b2d4c68266820be920200e46157c480d811b73016fe233f54f6021aedddf8
MD5 421cb56edb911f8a1b240413388df495
SHA1 e3c77d13efcaeafd3a2ba49f3c56141da5805c2d
SHA512 8a750af873a205682eec5836bf8694c1d5b3e27cff8ea6efa99b06bd1278ee2e583259ec3d03abe325c0e7487a204e47bd71af47c48b13f106c7acdcb3dcc5b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERag9:A3k03kB56rm
TLSH
T193258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 974KB
SHA256 1593384df1d37a92f66d303466aec7df1e3a214c1d51c5dd9a50217a060c19ea
MD5 25abed80711fa1e4c65043b0e24d2763
SHA1 805bd657d9ec0d940546e2e30ae7d143806aea24
SHA512 e3b5c6971199c7144840af6283278dc33135b62f063e9036d303c03ae5c1e0da164695e671bf49fad229d451ee45a0f92c148d309d9b0cca64cfcf7f620d9cd5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaoc:A3k03kB56rL
TLSH
T187258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 974KB
SHA256 ca2b7e1c364711ba403617fe8391125b4c8fd59c8da3ddc40c2902324e97bfc3
MD5 66da16cee0a1016529f9d486a60a2e9b
SHA1 7d2269ec7e68d8f29c3efbc583b6fd37b781b028
SHA512 8023d67ed32097ae5dcaa042439877850fa894b0118d373e752e7665a4c820a8f71729d2de93a801604148bf81ee29533aca0c1bd7ff2151a40601b044e82075
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaBp:A3k03kB56rp
TLSH
T122258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 974KB
SHA256 4811932952dc9a8e1b9a44480366accbf0e55d12dbe67381c37876c6d7aac1f1
MD5 03d197e6e863f7d7a4066d6573063fe2
SHA1 7ca2bb0d0218ed3c7ff373b5b7702b8d750bd60d
SHA512 68e3f21a5aef3465ee9c829d837b0228a06515da99e89aaa4f2a9a5fec31a06ba4c73f966493c1ea4f83b74d5a6aa6f4326d9164c853c6a845fa2dcb68e930b2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaWN:A3k03kB56ry
TLSH
T1C6258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 974KB
SHA256 10de542e7d5f8de76c1c95782361e287cf98904c0a725d75bb8efd450b4b8654
MD5 bd9dd299d7e959335b948b76531f0ea1
SHA1 9ab77ccb4bad015c79382f5cf439097ce8895369
SHA512 6216d30749dc05c3a8cb04997358491d4fa10c18e9b24807ca70629eb6383e2e4c854a432a26bf72030bf7783aa710c98ea426a5265d28a9497c1bb055a3b94c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaaF:A3k03kB56rY
TLSH
T1DB258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 974KB
SHA256 7f7a79b3d33acc9ae86c675dd96a77d0003d0d72acd8713db75b23825fcf1f59
MD5 ae17605755959e7a9217fb66e618e2fb
SHA1 5b129f5c9be45edd917f57c995682900df42eed9
SHA512 21d972b64573d63b1a69039537083ca72ff0755998e4bcb9f4c5e6b978bd9f0f9969e72339c93c04b55d03276488d74783112810f12958ab35c54f411cb3dba8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERavC:A3k03kB56rs
TLSH
T153258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 974KB
SHA256 b638bb8dbce7cdeb819eb10a26f1bd946cdaccc9f177a6e5ad4e3236b0cc9b57
MD5 cbb42bc53704ad82c20c67240c84e276
SHA1 1b8033c6e58e4a7a14ae91b955a68a14edb0cfd7
SHA512 18ae07e6e3dcd754781baec118de4f993259c4192da796c2efee5947b699bb8a232b1338ba6aa2160c050533b9c2944a7a866b9442f78eefc0f9661d3f990198
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaQw:A3k03kB56rh
TLSH
T106258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 974KB
SHA256 fcabc2ff25781cb7d99bb6f11eea4bc9031ee3ee282f6d6f466cf8299427f529
MD5 6b020e8ed0b22b3a220f9b23a56148eb
SHA1 811a24c6bac4f69b2abd6ce7fd9b9e930a57f0d8
SHA512 1e59f48e1198d86718ab6f60795659a1944a05921852283537f97c3e3dfbe20463905a3372733f1ba19afd3196805bd4e007e8d3bc3c16b0accc3565f28405cb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERavT:A3k03kB56rV
TLSH
T167258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 974KB
SHA256 651e6c58c58d5d40855910f49b08f9c1fbb3151b7394fdbfe3bf438535bf578e
MD5 4b3420b7c008d0901bbfc14f17d3f19c
SHA1 da324dc7cd119d4eb1bf0e5e44c7d50effa4b42a
SHA512 98af70fb1ae8ddc8b8c24a9cd620234439397c9c4f46db6e1d1a94f675bc0d714ecc399b25506c84e4e3ee8c55be025903a40834d0c9dea533c56fb2322cb9a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERapu:A3k03kB56rK
TLSH
T1DB258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 974KB
SHA256 a12d77e55f6dcb8e03badd445912585a87fa6cec53124e6d27209a84904acb41
MD5 c5c5d60286c4b8b8def8ec129f625167
SHA1 5175da63a40a3c54847d13d3934916811aa7e472
SHA512 8b59971837937d13a596783202f5da8b57484967fbeadfa7f4f7c416556af79826f784f6ea00c88c73868e6913d09d160a391fcb8c0311799e8ce4eb9e19bb1c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERahb:A3k03kB56rr
TLSH
T1A9258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 974KB
SHA256 c34893abacdcfb845eb622f55af6853fdd3f24a12c4e0840ad36543c73da5a6b
MD5 0db8c23671db59cd9dde018d488e8786
SHA1 ea150c3f53cb5545b4a0ba285bd7433a6377f1f9
SHA512 364ae1284795c47cd1e7242655dd9a4c7c2f08517b66f0164e5f3290fc9ea685504bc930832540bf9062faca9158a60dcb7d6ae309b8185b1bd15d465d7b671f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERapf:A3k03kB56rz
TLSH
T107258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 974KB
SHA256 2019e496d970d17f5086ee47afa84762dc7cd537345561a4998b756a19c92b00
MD5 840286d7bec369a1fa0b1a48d71b4d8b
SHA1 206e03329038406189bc4eead106fba73a0fda15
SHA512 e349312ac6e4adacc7533a7de5d1f0f20ede5e0a257deaca652fd0c84b39998b0cd12a45aa708b814cdefd1bd8adf4c603fe6ce88f393aad2bfad2a2124538eb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaSK:A3k03kB56rj
TLSH
T1B7258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 974KB
SHA256 b18195a1614985df1b74d5cd8302e0a56b2c04ca68e0fbd97c6cb43fde70bd82
MD5 b3e8f0cffa187b48dfcbb9317cc258ea
SHA1 e3f65be20b5f4875572f52c9e7f67e76eab81195
SHA512 c36c7a147f78ed45a2e6e63f56ce7040876e4647627787702d61a72c5d5ead60265ad5c27acf245769066ff532b844687f1ff969d5b8eb330c7e640a94afa0fe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa3k:A3k03kB56rO
TLSH
T12B258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 974KB
SHA256 812732d007f4102f26789e9e51859f47736e5f46c87ea8d21bc10851f3fee82b
MD5 363e6afd9152fd2018449f8dad70b35b
SHA1 c3d54c894639d3e016cd0852d8bc83c486743fe6
SHA512 269134b596d4fa576252c4b30e64a5dd5f0d857aee7ad469bcbc0e2e98d264667544a52ab538f86b5344f907c05b33f6013895bcc2adb8dde28b8f04756b8342
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaA0:A3k03kB56rT
TLSH
T16B258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 974KB
SHA256 507abfca499e769284975d0561a42d15b89e5c6a82e7088f7acdc7c286b1a223
MD5 2c9f6d31d4b1e768c21141116b0999c1
SHA1 ad4019434397db49a4a99e36f3d3dd2575fe608d
SHA512 93159efd564b416dfeb86bd5bd6590c243c8d18cfc22059b2b97bf75708df0bf6e39fc0eae1068c38009f0114a0bc16df317a8bd0150bf953902e7e4ae04df0c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERabg:A3k03kB56rW
TLSH
T165258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 974KB
SHA256 93ac691fd9afc85ceb11346b9fe14e97422bb11394899d03189135a5543eaaef
MD5 b80df481b9be00a8a92e5080dddcde89
SHA1 508f24904073c911ee10ec2406f4b0f8b4468f94
SHA512 15dbe35c506e00657dd4122ffb47974d8ba5e6f1803cbdf6bab69e8112fdf6a5a7708a0a42b87595aa812ce47ad5a57b861c092c0107e2d8da67b0f5de1f13cc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaWr:A3k03kB56rY
TLSH
T155258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 974KB
SHA256 a49419bfb2426e302b0f390cfafc8272914c3b9ca3d7889a0c7680630dda3c18
MD5 600a76ef8932d5cd894baa5115b3355a
SHA1 3306d185750511ac58925bc8efed6e6856b75b67
SHA512 89367f855b81076334a6cb4508a10a964ead12a30dbd7cce9aec4870cac2dadb59a29127bf2fb05e20ede0155df8fd4c866d2031b27b638ca39c1c6b5839737d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa8n:A3k03kB56ra
TLSH
T1A3258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 974KB
SHA256 e250296bd4f680d6d68812a66a92e8798d5daf525f035fd182cd35c07c66c840
MD5 f7dce4436bb983371d07135e3eaae4d6
SHA1 494fb38de4e8269533feaaf6e61c09e1b6f51b58
SHA512 60192a6160418bb84953d4b96d669a1d7098da0c54adf1a341549a63fc7469a86873cad4f74b1f6feb76c6dd989abf0d161c1ad9512962a4b1c2c7a19e384336
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa6x:A3k03kB56rY
TLSH
T12B258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 974KB
SHA256 3439704928b9ec9c46089ad3bebbfdfcc2dee94a0b4de818618114e04076cd29
MD5 186185ddabec2463f699a79ce2bae5be
SHA1 e60509c2465687919d1b8ad33d88295204f3fe3c
SHA512 a074eb0c57028d4f8cae9ee8b87558d288335cccfc0e8e608fd8c683b58b74c89519269dcf3d28bb1b94d118109537f087f0f4b7da5c2f4bfe1892743728dc83
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa8A:A3k03kB56rb
TLSH
T190258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 974KB
SHA256 308ce5251a22976d59977d1faf330016d8e820719ee92c6cdb5fe067cb571db3
MD5 c001a9307d180dd3ceb2743875184e57
SHA1 e87929e9bca22edcea85da11b24328ac8d22b261
SHA512 65c9bc71fa463869fdfd87bd955d85d1f864a9f115ddc262ce552a59ce666032107a708eff65608583f5081df56aceb0638f2294ab1ab3521cea121cf6395421
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERal9Q:A3k03kB56r2
TLSH
T1A2258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 974KB
SHA256 fe9bad40cbed44960111adaec1b984e30d925e6465c2d13ca6601da9fff3ddc0
MD5 cc5c3b1aad0ea683a7c385eb21871868
SHA1 657e2e71c7be7d313a3574c6896cb3821d161698
SHA512 c02d2036aa82b1b582139bf13c23f94ac1aa2d90d294c47c9754a7796c52475b64f6d9ef0d833f9f78c7dcd69c62cfabe3b274b628812d0e9ee10e8fd7abb139
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaQ4:A3k03kB56rl
TLSH
T1DC258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 974KB
SHA256 cb158a667bbf0c691229ed13fec6a2d5eee768b959b34db74ee13ef176562100
MD5 c5d61c8c153d67c133bf300774fdfb1a
SHA1 c6fad5e5727d0405ee05e34a3c444e3c4a5291d7
SHA512 596874d68f541296dad138337e544ef0139dd0b1d8093708c8508716939663e9b578fc05715e16bd9dcad0f74afe120d674d59784d80484b9a743c8a7dc8aa8a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaTu:A3k03kB56rQ
TLSH
T1EB258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 974KB
SHA256 199c8df2f0aa88441aeddab54dbcd9b69ca8543201205505df81114fe75b12f4
MD5 35b62cc7ee696917a4f6aa84ffbf488d
SHA1 5a963cb6d891126de248a7dd388893d67189dfd8
SHA512 57798d195da58e19383f54af27bc33185041964cea5af9ed19eb4fa7dd01e78c47dd42e54026c9c8edb3ac98577b16a17709b21f2a82c6f03eee4e62b0b38686
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaOj:A3k03kB56rK
TLSH
T155258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 974KB
SHA256 931ae8b4b269fc2ae3291c0dbd2ddd5dd4ba834ff8f03c4f4e40f49a3cd4dd1e
MD5 916f788fdc9649cf0191e0dad546b190
SHA1 0cd1e0d6fd8a3f275188232277d191b137147ee3
SHA512 04957286a9769212b2430b777171d0f49ee481b1ef6e75cbedbdc75167fec9a69af33579c38491a8a5d9e0e84b89481548dd01b02c0f5506d8609511d87924e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa7g:A3k03kB56re
TLSH
T1B3258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 974KB
SHA256 0c6f20329fb8a6fade2da5498eba87aba245d2352257a2ff08f82f048a368921
MD5 f0e5a2011b22cc179e43badb274c82ac
SHA1 4a33d904d676534af41b4817ef93dd14ed137523
SHA512 b5bac59a10ed203acb9c4073ef54934f4f154dbff0993b9d3ca5d89b307091276b6c13da31942678311cef91522df76b37734d22aad0ba7792d3d4b1a4e44bec
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERamI:A3k03kB56r3
TLSH
T117258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 974KB
SHA256 a489c70a92c823b2cfa71034c0ab75408b6bbb83334623b35510949f9422b183
MD5 3e858873fd34ee7d9d67b0ee90489118
SHA1 6d8293079faaf14ce636615792fea5ea051c34f8
SHA512 f7d9d06f43c9e908a4bf36d307a281fcc275d2fd058007a62bede636dd0ee81dc7ea69f7e16736b9b2cee2f15304a5a23837c27243842f9970d5aaef481b373a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaUo:A3k03kB56rx
TLSH
T119258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 974KB
SHA256 c1d67332f00a3495325f05ea798c34afac759f37986e48ad25a18c9372b1b631
MD5 84b2ab7806fe9b0e28596333e15c1b88
SHA1 ce8e11067856c4d0212849f2bd5b8853b6e32e85
SHA512 45bcde0616fb7ed0e9a56325f1816ba4273a21143429f54c2cc5491e33a184815f207e7a67d205e99ef2f4aa5434f6bc6d8a569ca6c288d52ff4db654ae63592
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERa3+:A3k03kB56rU
TLSH
T108258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 974KB
SHA256 4a1cbef2dacdf41ae4219445718eda444554c9bca428832068df8763f6c832b4
MD5 161a974cc7dc51d24e2472849967cdd5
SHA1 484738a6204ba64264ac2caf841800f2742f9405
SHA512 3762683b720cd52476b00dcdaa2dba5376789d2338feafd1004f42fd2dc9eafa9eebbd5711b654d13f209ba1824179e499698de0486035d100362c7518d1f436
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaNQ:A3k03kB56rc
TLSH
T1E7258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 974KB
SHA256 576ba9f96e0143b1de022e8f611c9e1520f2eae6245a0c1075a7d33f8e00413b
MD5 70a86b4e311b61027ba62332628934b0
SHA1 6206d6aea2c61fed5fad6090ee15162104681cb6
SHA512 519b70fd8392b26e53caa464a62e3850c5a5bffed72489c9dce5250a2d465bacd3f0179bc943e34760896761c4fd874d28b3d4e552df4ae2f29b93c4528afcb2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaCX:A3k03kB56r8
TLSH
T186258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 974KB
SHA256 1786c2bedca1f25c13fd7a5fc3f51526cdea3e224360cde657307b57a0f4a948
MD5 9120266e454a22acb667feba5169b94c
SHA1 f3ef2681dd294da74d8da7f7ceb74411e9c8d833
SHA512 ba1ac4c19871cc422627481256d73e9dbcd872584c17e178b2b447aeddd2111bfd480cd73ef2543b51a318cd27e1b0ae0e99246144c377f7b25a4677e3fc7c3a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERakL:A3k03kB56rm
TLSH
T1AC258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 974KB
SHA256 cdee055af00f9a8b00eeb00173582c58f1538079e4b0c61cc01665bd7ac64ab9
MD5 d3a495ec03d7723119071d68b45ac130
SHA1 7e29b9d726101bdd0c33c8810d972e3f0279772f
SHA512 51f9997144e8f9529cf85fe27f08f601fb8bd7d6183c18b410dba25887b97a05e502fbc11cc76a23a870ae6a8770937800485f73784bba881f27f16d64ebb793
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERaAM:A3k03kB56rD
TLSH
T12D258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 974KB
SHA256 e8d0e62ea5097ce71110b26ddc49bea820b91f96b5d39fa9f54134358ef642ad
MD5 dadd1ab1751961a1df79ab103bcd4b98
SHA1 1f7c40055a89871a45117b1a3945760449d03878
SHA512 8922064f2ab12eb6b0eb2d055c7045c34460b47c011854c0b1b6e380240d25dbcb1b7eb9da4c5b57fdab7078fe08a8a245120a7d678405beb7a286b8f9a94412
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYCFB7xEaERahh:A3k03kB56r9
TLSH
T150258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3224-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3256-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3256-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3692-947-0x000001C493EE0000-0x000001C493FE0000-memory.dmp

Download

memory/3692-932-0x000001C4801E0000-0x000001C4802E0000-memory.dmp

Download

memory/3692-931-0x000001C4801E0000-0x000001C4802E0000-memory.dmp

Download

memory/3692-930-0x000001C4801E0000-0x000001C4802E0000-memory.dmp

Download

memory/3692-962-0x000001C483DD0000-0x000001C483DF0000-memory.dmp

Download

memory/3692-976-0x000001C494270000-0x000001C494290000-memory.dmp

Download

memory/3692-945-0x000001C483A30000-0x000001C483A50000-memory.dmp

Download