8daaa50ea61993e27ba61a61df7bb0ba58dd564e813996a5f7b1512fdd3bd2a8

Analysis

max time kernel
90s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Size 770KB
Sample260704-sr4vbscz3l
SHA256 8daaa50ea61993e27ba61a61df7bb0ba58dd564e813996a5f7b1512fdd3bd2a8
MD5 5f6768938335df57bc98dfd00809a4f7
SHA1 4ba3845efcf0758a4dc581126b06dfbbe988e0ae
SHA512 a835c9d5d29b9a32e3b101e481314522f0b7a9fec5e4b6545fee4a42f5f5f3d2968c5609f976afaa135ae47c08d7d86c88b3751abcb7796184fbacb636b9fc9d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE:J/sCv7QExqatgl8beJTTx0yFzaE
TLSH
T1F3F45B53BA4485A2D416023044EB4753EB71F81A1F11978F27BCAB6D2E32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/5964-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c592-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c9-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f4-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8d-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a63-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000017627-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-781.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-973.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0009000000019850-1040.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1077.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1278.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1418.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1515.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1546.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1553.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1566.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1567.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1569.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1570.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1608.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1609.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1612.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001bb30-1698.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5964-1705-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/720-1743-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-2029.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-2108.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-2181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-2194.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-2201.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-2226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-2245.dat	INDICATOR_EXE_Packed_ASPack

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
720	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{3BDCE2D9-6123-4B42-B017-893C31E6C6B0}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{26D37F2F-E385-49AC-94D3-A5206C5BC4F3}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	explorer.exe
1188	explorer.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeCreatePagefilePrivilege	1188	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
900	sihost.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5964	2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
720	patcher.exe
2888	SearchHost.exe
6032	StartMenuExperienceHost.exe
1188	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1188	900	sihost.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_5f6768938335df57bc98dfd00809a4f7_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5964

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:720

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1188

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 770KB
SHA256 8daaa50ea61993e27ba61a61df7bb0ba58dd564e813996a5f7b1512fdd3bd2a8
MD5 5f6768938335df57bc98dfd00809a4f7
SHA1 4ba3845efcf0758a4dc581126b06dfbbe988e0ae
SHA512 a835c9d5d29b9a32e3b101e481314522f0b7a9fec5e4b6545fee4a42f5f5f3d2968c5609f976afaa135ae47c08d7d86c88b3751abcb7796184fbacb636b9fc9d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE:J/sCv7QExqatgl8beJTTx0yFzaE
TLSH
T1F3F45B53BA4485A2D416023044EB4753EB71F81A1F11978F27BCAB6D2E32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 08ff7036e1f0560405efd540714a2c50497b6e1f5fa780fda6c3a9bc4b56a705
MD5 e21520c69cb99a2c3abe6141746e76c9
SHA1 a43312544f02810a4eeff294dc77a676b96a3037
SHA512 8c07245031a30cdc1d7c4fb1883ab67e83e3e310b227a839d2b431a4b31cb51d7af23561380ab25e417b6abe888db4043c1caf123edc191e013361885057852f
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFzaEP0Le5ji0hmxNrM:NDqatgl9TK2Pji0Aj
TLSH
T178554A53F6648672D0228175C4E79686EA31B4461B3086CB13ADDB7C2F33BF1A63A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 784KB
SHA256 10bb81fa3ff7844e1ce0b48058bb555df69c59aacb71620e188df7cc708dfa63
MD5 38c2af4108e8f3ab7fa14bd556a3b1c3
SHA1 67fcf61e58698d4e77fbe77e404ff3b4a72c796e
SHA512 be7e7c52955853022898e152d0bd9d88eab1f8b3fd7558e683c2733c8c657db21667d907827bace8e8c6201be54d4c17d384d7f8fef6ee53e3b5201b5292c172
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaERa:J/sCv7QExqatgl8beJTTx0yFzaERa
TLSH
T1C7054B53BB4485A2D416023044EB4653EB71F81A1F11978F27BCAB6D1E32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 817KB
SHA256 2ced33b03f5cbbdb33e33fbaa3549324ecbe384231ed2ead1b5fe798e4398fdd
MD5 ddb54e3ad78ad74bbe2a161af3adbdfc
SHA1 8b5fcb4fb07ff7f8030b17a2cca55e53931bc0a9
SHA512 4fbd0b1e5adfcf00388554dbf4e7595b2e236c7159ebb9e8adf720c96abb2bab838a5f58ecb9acaed924d9eb0536ca529f8cf073ff768756cb6eeb80cc9251d3
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEyb:J/sCv7QExqatgl8beJTTx0yFzaEyb
TLSH
T15A055C43BB4485A2D416023054EB4653EB71F81A1F11978F27BCAB6D2E32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 793KB
SHA256 4ab4b14d1b5ffbd0b39202e2ba8a62078b2815dc0ef55999e5c0616ccceba32c
MD5 25da2287357f7457a337dd572a6e5a0b
SHA1 c7ce1fda671204725f24773026f03e6782979837
SHA512 1b81801c3fc39a8ad48e7a8f6aa26a092483f623c8d382ea2935d340fba04114c6b57e97d0ea0dab3d779b2364e8b0398b4a122b69ff322533289b6636cedd76
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEo6:J/sCv7QExqatgl8beJTTx0yFzaEo6
TLSH
T1A3055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 793KB
SHA256 0248399ac1ff23a52edd2bd3ffdb0ca3249573ef292b21cd447a5c85da2f13fc
MD5 e0527aafb924e0bc59a26041fa614dea
SHA1 18331829f04b40de71389662d9754a286d164d03
SHA512 7a862466d5034a691633617fa62dc2c3f9c3e3fbfe30b3067c1cac337b13d2a4f6e0e9691aa15d8517c8365d129440c510414550a0f996844bfd809a4ceb958e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEsN:J/sCv7QExqatgl8beJTTx0yFzaEsN
TLSH
T1DA054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 793KB
SHA256 1623471fd5d411c1a85f12266d4a1e11b7ae165feb245e67a241b3e366f341c3
MD5 550bded88d130bf7e8cbc3debb0af68f
SHA1 14d0395dfac3907f1e6bfd0c8d57b25f5e5db319
SHA512 be1a235de02ab5c2c5677e7ff7a74963dc87b7cc0db2f1b9a40deccc47b8f3a4b9e25e3fea214dbc20056a2ac41866e951d2506ee1f93b7292e4cd1d98c4b40e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEif:J/sCv7QExqatgl8beJTTx0yFzaEif
TLSH
T19C055B53BA4485A2D416023044EB4653EB71F81A1F11978F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 931KB
SHA256 020631f8ba792bd2c8afe8217fd695b05ff18609e356b253a1372a58a3c4b2db
MD5 d9bb5c184d5bc8db380e58fdd33851d0
SHA1 affad9968d1e893cb87afacd4b449835e3fe95d2
SHA512 2c4be76046208e1e77d2c28862af7c692df0e720175ab059a665bad218253197fe082554137c3911bc0a702cb23bc918c85d074057f940bfe6a2f6f9a8e9e17d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEQyPz5L87:J/sCv7QExqatgl8beJTTx0yFzaEhzy7
TLSH
T19F154B53BB4445E2D416023048AB4652EB71F81A1F21968F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 793KB
SHA256 06e74410677948e946e79f72aac47118394573d297bff450ee4490e51bd926e4
MD5 8cd2a833257119f17d2d37f4c726d966
SHA1 631700cc220a8f2da63328e36677e11dafe1f795
SHA512 70a328f102e60856c78efeac7d343bdc13abc14c77a8ef1070eda39582d844f1fabb2d5ffa419e7f942e92275ab0570fd5aaa0626accebf8e2eba7b9f8f27b24
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE8o:J/sCv7QExqatgl8beJTTx0yFzaE8o
TLSH
T1CD054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 793KB
SHA256 268f4f49a00f9ae29d153aa473d121cff5010057895daf81c1880a6ddae30ad0
MD5 d3388bdec9a1262dd578286713997932
SHA1 c8ea1f1c72225301cfdc6a58de45492d55eba2a7
SHA512 9c5a5c715a1882fe3c915b9ad1213494800e3e71ed7821623516632443504406481b8f90880bf9ff7887e3304cb651893f6e19489bf03bcec4c7a0840f220e9c
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEcu:J/sCv7QExqatgl8beJTTx0yFzaEcu
TLSH
T1AC055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 931KB
SHA256 1c650b3b07d6d2a164b22bde5cb75ebca65592b6abf8532dbe8daa6fa21ddca7
MD5 9be8e32e3d72fa4520764130619ab531
SHA1 ad933a2f819c748c1c9a48c7771a2607b01c8515
SHA512 622077a8867f2ecc09daddd86cd28184be7feebcfe5c1f384dc867d1658df63522b68759ab0299c537849ac262af12cd99ecb735f06d93b78193842bac7988ce
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEhyPz5L88:J/sCv7QExqatgl8beJTTx0yFzaEwzy8
TLSH
T108154B53BB4445E2D416023048AB4652EB71F81A1F21968F27BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 793KB
SHA256 78e6544baf8944b5f3c0b6331da241c1ddfe1186f27ff8c96aa698acdf354ac8
MD5 f1a4e0c1c9e29aa98cf7f857e0c9795e
SHA1 81042658b533b11cf3ba2a378f219033191a9447
SHA512 ba8b2fa677aca9aff4b2be1597b23cc6f800c15efdd81c17e85c21eb0fdd8ddb0b22d210413b16da3273cd5c1ac7c53ff2f39d71070bedbcc4cf27e0890ccad2
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEg9:J/sCv7QExqatgl8beJTTx0yFzaEg9
TLSH
T1BC054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 793KB
SHA256 56eadc3c85ac1914d65f1e82a3264e3a40bcf652bf51aea3d0c50c40c2a0fdf9
MD5 d1d8aefc89904339ac008616426a354e
SHA1 215f8f1c60cd68f4dae33148e2ace91cfc611099
SHA512 e0680d519647a4cd775ed9b13694c43b6a06c118b468ba7ea7ffd40edb0290b7c21010035e752110149234d74d2449198f4c677b7a97fa9cfac4228d97279ac5
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEoc:J/sCv7QExqatgl8beJTTx0yFzaEoc
TLSH
T1B5054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 793KB
SHA256 11faa6d24ec269f33f1d19282574c1bf4a5043bb22afa60743d78e892c3ede06
MD5 5a541940d46690c81ddb7ea9c5dde3a1
SHA1 a075724590ab8b2f8825075d30fc5ebee6904e6e
SHA512 18599147f9aea3625500652a5c1b89655440e8114006b4e5dfdb9cd967dadec72d36fecb0d97ee4ae6ac8e7b03911c036136ed531f6558a4a5ce8b90f059cc59
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEBp:J/sCv7QExqatgl8beJTTx0yFzaEBp
TLSH
T152054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 793KB
SHA256 25a302fc5262edf93baa558c2bc5bc7d5ea5893d31e6d1d4e4c3e5576d4ddc29
MD5 81f432c05ef3b010066872c5c85772ca
SHA1 43d4f6e62086f1f975a78cf06f1da4fbb0fb036b
SHA512 a66687ede8275f73293c22fb235a48c14e2cf69b2b839a0dd9f25125a49184f5043436b402e260ba03a29b6ffcb792324bda762f2c46e14439463b028b30ba7e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEW0a:J/sCv7QExqatgl8beJTTx0yFzaEWN
TLSH
T110054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 793KB
SHA256 5ffbd6d78875d871a14c08f4e5e38350601afe4a1bc43613b359f26b0d792bc9
MD5 65ddd9e2a219e7cd34d5c2df2ac95161
SHA1 6c3e34aa9582fdd53db71e572d6ff55b49cd59df
SHA512 0abf1cd43019398ca15480b70363e5346f895eff71b2aa20aac1c706405757fffde8fe1a590241bc1da803f4e16a68cdf087a9ec3114cc66e30728d7a80cec4e
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEaF:J/sCv7QExqatgl8beJTTx0yFzaEaF
TLSH
T115055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 793KB
SHA256 f92cec8c797f6518dd03ad33f37136bca012333210f88149df720fb014d74229
MD5 5d7841bc7357a12ee60414c87634666f
SHA1 4c546b69c7cbeb2b0af37c937272c4abcff23bf0
SHA512 62136cd977a9d10cb9dbd50f36316b602856460908156abcb529dbc3378b166dfa5000a641c8ac12bf22a93b3af207908f0f54b0aa83bdea342f7a977eed14ae
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEvC:J/sCv7QExqatgl8beJTTx0yFzaEvC
TLSH
T176054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 793KB
SHA256 549059d2cd3a54a1764430ca3f1292bf3f7d731037924e33a90205f5e58b0f29
MD5 23d5d576f2494ddd5a3324e8a3a87837
SHA1 6cf54049b02308c0d8e7dcb4fb8f45593525778f
SHA512 7269c817481fd00da7c2864f57bc615791be0bd889d8bc3c23cde7d80efbff88b4fedf222077182715872f367553a2a531c13a77719e731d3349f37a10a5a9f5
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEQw:J/sCv7QExqatgl8beJTTx0yFzaEQw
TLSH
T1F6055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 793KB
SHA256 dd5176e5dadbbfbb79dc73a4a4aa75f84e5f9c92ab25baa334e838b853bb899a
MD5 218703da6bd1569866c436f7636bb673
SHA1 1f929a6b0c92fde9317c0350fcb4de1973c8fbcd
SHA512 8858b440f8dd375f5310b64785dd5301e9dd5c07443f961ae2ec11538606b2c26cf5452355332cb96743d5895fb2378f65efc583b28c58d844674e662f7f3538
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEvT:J/sCv7QExqatgl8beJTTx0yFzaEvT
TLSH
T193054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 793KB
SHA256 5abdb68be1400ceb7e931e13668a11ccec7e3dc7db5972df42264bbdb628a189
MD5 03b53887ead4c09e5347958278ac7c3c
SHA1 a393eaa179f53c6b30be48de83219134f272a8da
SHA512 31ccc6c193c03d6d2dd9d118b340b482c927e338138793cb3af732b845928591b3755fe481f4e74824243c92dcfd53774bc4354ef59ea78ff5ba02eb09acf3d9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEpu:J/sCv7QExqatgl8beJTTx0yFzaEpu
TLSH
T187054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 793KB
SHA256 8716cdbba986361313c98c061391eeb9936bda33c60941a49e702285df1a0d1f
MD5 4905c3517642e2bfba94f591e6fd6ff9
SHA1 04623776994546367c95877bc37cc54632449427
SHA512 f67dce6802294df5c555bf8391c32f1b5fcb61fbe576059f7a5c03111f36d98d14371a5a2620c312ba7f21147287d5018561324badecf1c64d8663553fc1e575
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEhb:J/sCv7QExqatgl8beJTTx0yFzaEhb
TLSH
T1AA054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 793KB
SHA256 4ada69b52716a2be4489370075e5c7417bb4fad9e740eb9ddc2a0201080665f0
MD5 b7fdb2b785bbcc0a6b46aef122e5d52a
SHA1 414d82b20620b28207bfc61ff65202e756aed9ce
SHA512 4be533da7a6664d121472b433375722dd507135d0c94b2c9dc662e873277995c3e4cd8a0495a4c71f626c07c7b7cd3d257ae3d12d78129744edf8e46ec8ffff9
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEpf:J/sCv7QExqatgl8beJTTx0yFzaEpf
TLSH
T1CA054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 793KB
SHA256 0d22a103d9ed9030b9e899440f779cde0b3f4be8b7bd7046ea991dc3dfb49807
MD5 8a51fb749262efcf36a0195178e7bcea
SHA1 5e9bb3147290cff877c599804ab01c21bcb48824
SHA512 8584932e66123c381e3bcb43294897c29c3e06eaaece8fe81b8d4502207f7943c42a55ed6de7fd58c97563e75dd5cde125c73104105656d98e2be84950f30315
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaESK:J/sCv7QExqatgl8beJTTx0yFzaESK
TLSH
T1B6054B53BA4485A2D416023144EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 793KB
SHA256 e289348e510b9d3b541234d3c93c0b73001f32fd426133581648500b5a604861
MD5 6cf18924771e1c2e464121560e9cf375
SHA1 53adb0510100a941ed53066ac2d8a260aa96499a
SHA512 37904f52f4ecce976405d53695ba6f12c14e3c702ae16376893765e76280995d5379cc57ec9e3fef9f817de360c1c5b5ef2530dfd6fbacee29ef51abb1905e28
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE3k:J/sCv7QExqatgl8beJTTx0yFzaE3k
TLSH
T14B054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 793KB
SHA256 904507a949a16fae7e1729a257582fc64ede933e394f66b70c13845f29202137
MD5 45af6ffd7431ceb6d1443fa33bddfffc
SHA1 1512ac10cd4b42e3b26cd6499660b388d4df477f
SHA512 094a126053f50f23efa3f37890ecad6239c19b3ae781d520b8a6a0485f6f1b6f84e985cd54e3c6b04494fefd8b05acb933257c2f5e85c41e36f0287710b537fd
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEA0:J/sCv7QExqatgl8beJTTx0yFzaEA0
TLSH
T166054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 793KB
SHA256 7f0ea2c992d428184c36a15e16b9179174deaac952227fa6bc96881f2f03b896
MD5 b25b78c811c43e022122f02a2a71617c
SHA1 cf12c43c5d1b5ae5b229274b6489356abfa51504
SHA512 7450e6c5b5de520e30905cc2ed2a821a5b44a4680d020f21fb4bb89df816f54d973d5daf2a1103d03d8afd437ee9059010b8429b98bae0924c4b6b7073e41752
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEb70:J/sCv7QExqatgl8beJTTx0yFzaEbg
TLSH
T145054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 793KB
SHA256 dba2b649832e70c1919aeaa7d549f938be70c1da3568e2f33a0a6f61309aa365
MD5 b493c61507e3d129853b3eef2d4fd7e0
SHA1 78d87111804c450f16f9e4937b0c1197356d6866
SHA512 d8d417e31de946d42b10d818de0e8dfc03093398044a06cbbd9c6c73be405d54a4e5928f934d606031a347517982f462734ce8f5299a00b28142eea559171310
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEWr:J/sCv7QExqatgl8beJTTx0yFzaEWr
TLSH
T10E054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 793KB
SHA256 683cd22ded0e2b6478fb39f3399e146c7bca4ef4569c40828bf91ea52e91a2d1
MD5 579c43cdd818df7156b865fd0750042c
SHA1 4f11e9201f50449054a3ac76a806cfd2c5bda4e7
SHA512 139b4f2d11e22ad15638b7b8dab371e10870a7c6e39ebea8356b950439552a76a0588d28985573c56f3411783bbb048ec1b114268f11432e5598985e73a6eb91
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE8n:J/sCv7QExqatgl8beJTTx0yFzaE8n
TLSH
T108054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 793KB
SHA256 e5b4356d18ea7232393dc102c4b24e8e0b7f9f414a4566ef6cb18f3e6bc79833
MD5 fa845044e322ba23d921991427fe8488
SHA1 7d30561f47077c764ab62eb0f3d655e23b9c84df
SHA512 2f099307209d2df748cf4955f96f0428266a462d932bb41c987d072ffa06363c0d95f877b530cda83d0e1a6a3a8de5bbe9b1095a07195bc68b16dfcd56115c79
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE6x:J/sCv7QExqatgl8beJTTx0yFzaE6x
TLSH
T1C8054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 793KB
SHA256 ca0860b176869ad9af03bb569d1575a8fd31d2b550dcbc378ced9bd6ea9a720d
MD5 d3211217b02fc84672c0ffc64ef6b1ee
SHA1 0f5f2b6070585df676535b157a8e11dcebd7027b
SHA512 1919909bbc150b0cc9bdee0ffcc5d2ea88390f72abe532c5d08e9c4eeb2626150e172f859ea68278871cf6059003b7b25857835db1fc8369249dde061091bb85
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE8A:J/sCv7QExqatgl8beJTTx0yFzaE8A
TLSH
T117054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 793KB
SHA256 f6b43678227d2d16e0cb8cf83a8005b50c71996b29065d9ba142c5304fbb5f91
MD5 82ccffd2ebbeae654a4a7996fe8472f5
SHA1 8f0d22ae2bd7f5e9bd0f0629e84a4b8a8437a541
SHA512 effbed6905ff412d306cd58cf18c895b4d66cdfcd150ddd43c7e9873d10dc8e8f18453fb18c59afbb3f223e583ca5e0c88a914e4da9a0279a56cb78816d4d886
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEl9Q:J/sCv7QExqatgl8beJTTx0yFzaEl9Q
TLSH
T1E6055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 793KB
SHA256 b7576c82bdf580f22fc138786c6f445bbf12e3b7d1d7047e64d951caaccd5cad
MD5 31f7066d9c93c133d370a4349e1db483
SHA1 bac590928d4865dc8d3333576d2bc3b6d9dae341
SHA512 92d9abe722d1c59fbd8ab34f8d7eb4d0bfa8f5aaea7fea857737b4f00adf023a874125c01635b97bc52e0ba2d387a3765999fc7e4918978eb8f40e1175d114bf
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEQ4:J/sCv7QExqatgl8beJTTx0yFzaEQ4
TLSH
T169054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 793KB
SHA256 7580af290bc7e9b476fd987587615e5f7fb210ed5d19117318c4f215cb474c7e
MD5 3733149ab7399fe96f8b46001256618f
SHA1 e6f32a4aa929a5832043995428f037140eb06a4f
SHA512 bd43e8def8dafd7f8404df2db1ccb93006bd53976ee635b5e2e57c803b1be04950a5077a89e171723e54a404e70848ad788bbf45b1b25a1f164840d235c215b2
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaETu:J/sCv7QExqatgl8beJTTx0yFzaETu
TLSH
T115054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 793KB
SHA256 46c3ee70bb8225aeead1f5edf3036dbb3480d759825a4d99a113eb4221fff45d
MD5 faea827f078ad8ddad7952fe677523f9
SHA1 71ffabf8ebd16067362b954dd199c891d7bda759
SHA512 305e89bc79238b18d2b38172bb14a726ceb8932e8627c43be7b313a37afe55532c34dc8a81fb7a13da4f6b04f4b75c09530b217745e5575ef789aa64ccc32419
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEOj:J/sCv7QExqatgl8beJTTx0yFzaEOj
TLSH
T190054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 793KB
SHA256 386ab6cdbb054e17c4b2cc084973c947ae76a38adb44c5cfb8cfca4375a0ffb0
MD5 04dd93f535953c0061d012e158db586a
SHA1 dd6a66a4cfe63722bd6f73f36ef2d62a72586e55
SHA512 0ae183422815aee21ac866757cc35141c76b3795e2e48463c9871e4d6007330c5f8f67f0572bbea3c819a0ab634e4ce2b84523edf34742c65234852966eaeb93
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE7g:J/sCv7QExqatgl8beJTTx0yFzaE7g
TLSH
T11F054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 793KB
SHA256 174b1aa0a954e519349ec7a63280b896cfece739f988f8ab9c89cc9ebd9c1d8c
MD5 eaf409cff8cd6223212923b82314ac7e
SHA1 2915a825dfba1bd54251e8c630e2642bfa3b3332
SHA512 227acbd440f69863ab020d82c48951cdb8d8a4b699dc8100e00d9f3ddd68440082769581c7664773f5c991e23dd30e049d2bc926a052217f7181dffc90a761bd
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEmI:J/sCv7QExqatgl8beJTTx0yFzaEmI
TLSH
T18E054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 793KB
SHA256 03366ab8acb6272e650f8c15e4b1b48b7180ea41e5ca54628497355103044d7e
MD5 0896f963255bf36463c7ec4a53103986
SHA1 693b8ad22c351a009b8f8eaafa5c11658e9f6615
SHA512 fb0cd02ce845c3900941c9d7a249c082153746eefe6fb45c482f3513b2c5879396a89c5ebdef8b15f91040e4a66ff2bacbbea1cf9103b1fe032cd9eae35470c6
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEUo:J/sCv7QExqatgl8beJTTx0yFzaEUo
TLSH
T1A5054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 793KB
SHA256 46fd58bfc8f1dd0dca03f23f7288685d6ba1a3c0a4e5368b9770f631b8d0ce54
MD5 baaa0be5fba00ad8c97eb35f0c6ba84d
SHA1 4b3b20c7d0c9c064de8f9d80f963fdb58ca3c4f9
SHA512 73685bb8e2da7d49438ea6f740174a35c4428d842fae10189632f27d65455814316e326872d1c6e6aaf3353cad1e9aec98415e6d78d607e05d11c192fe5a8dcf
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaE3+:J/sCv7QExqatgl8beJTTx0yFzaE3+
TLSH
T10E054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 793KB
SHA256 0809106022c4e70874844211ba4756904cfa37e6ce6b54cb8d4d7a0f8dfebc73
MD5 2eb040422bc236061859ab5f7d15534f
SHA1 a68e9d2ebef5001043da9e2cddc20641961983ee
SHA512 6e3f86cd2ac690d0ff73a3b6d14f89da6d4d4a6a983e6954102b097a7318db07ace487d00ea0db237c57a78a5e5880cd429bce988586af38a415651a1f853d3f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaENQ:J/sCv7QExqatgl8beJTTx0yFzaENQ
TLSH
T158054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 793KB
SHA256 c3ba14c23767536b5b3f5e9520834dc49c6420743e4fd4cfb27c8a2fe0a5c84d
MD5 8563ac7010d05106737a4b1d4b9a735d
SHA1 ac68aa5059f918e78f463850d14781e2b1dac7b5
SHA512 028a08f1ea150bc4d8fe9bcc253bb8e30a28ccaeea3d58824b9913c24f2e0e39a4c2e6464d51538404fdcc050cdc6e18b3229b1026136bec5eb58bc72cab4545
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaECX:J/sCv7QExqatgl8beJTTx0yFzaECX
TLSH
T141055B53BA4485A2D416023044EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 793KB
SHA256 efcf96fe6006973b20e068b2a19d62a3cccdedf4fd2159e36d6aa2526f73c7cc
MD5 cd2f95a524e2add2e75c59fef8951c49
SHA1 97f44f211272181fb18d76b609fdad8139de1271
SHA512 b39d7180416fa9b2dcace6c97c06da6b34daa686631622f801e30df11d7a7c8265485d1ab1ac99b8e4cf3ac2d7081b0298f14629f27b31d28a06153b73e7da33
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEkL:J/sCv7QExqatgl8beJTTx0yFzaEkL
TLSH
T1EC054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 793KB
SHA256 55658b870db99e2d9f1645f385c5d2873aa34b12a59ac7f0433177f06b9df2dc
MD5 041ba7c457d535bafb43126931b3bf3f
SHA1 d79fa06e3b59ac5cd378b65d22b4f250f58b99ac
SHA512 221ee8a8054ca01aa0080ea337cbb0dc17c801337fa5a04d507fd39156e8ed6deece891fa6c75e87b7a12b4e490746063a8eed04290ed6e17419bc77fe72edd8
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEAFC:J/sCv7QExqatgl8beJTTx0yFzaEAM
TLSH
T1E2054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 793KB
SHA256 de75d29ef4eb97068d9ea4f397870202e4b1fe9731a5e10ddde5a36b06a20091
MD5 4a74b17e99ec9c49b16754e16e3a1084
SHA1 7da5ee7b71c14ef6a54c2cc12e319c2c83676546
SHA512 9d3161db1ef715e116e2ba9089318d4d151de29ff2b7346fe510c6912c7dfa9634b197fd08411ef5314479bee52f0b2eb7bda9b6d350093eb50e3704ab2e0888
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaEhh:J/sCv7QExqatgl8beJTTx0yFzaEhh
TLSH
T1B4054B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-1743-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2888-525-0x0000022E02B90000-0x0000022E02BB0000-memory.dmp

Download

memory/2888-497-0x0000022E001E0000-0x0000022E002E0000-memory.dmp

Download

memory/2888-509-0x0000022E02A30000-0x0000022E02A50000-memory.dmp

Download

memory/2888-511-0x0000022E02E50000-0x0000022E02F50000-memory.dmp

Download

memory/2888-547-0x0000022E14270000-0x0000022E14290000-memory.dmp

Download

memory/5964-1705-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5964-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download