Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
21/04/2026, 15:00
General
- Target processhacker-2.39-setup.exe
- Size 8.9MB
- Sample260421-sdgsmsbz2z
- SHA256 9735334a3ef57e5097db833be88ff35d7fdabfa40c4583052b8a659ab57b3709
- MD5 f443df52332cab851ada11f1822ee506
- SHA1 4f1432dc72629e09897552d458d4dac80323259c
- SHA512 394b3bfd8f614e979757c2168b109d7c12cce9fef622a130f541f687e8092af3c57a992a4aa168bc078311d346f0a7f1caa6f3a39a0e4e15ab879b0b949c3685
- SSDEEP 98304:8TvyB9snV6Hedgo3iUr0vuAcedAJyT1kM/bMNKA/SesqzxMxh9/ULkjKxtTGP6V6:8GK61dcedA6nTM+1/ULRjVZdLSEe
- TLSH T1AD96D05B9DD35BC6C2B9D0340E52E3336A72A43CD295962CF84AF721BECFE11499960C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3496 created 3420 3496 SppExtComObj.exe 57 - XMRig Miner payload 2 IoCs
resource yara_rule behavioral1/files/0x00070000000284c3-24.dat family_xmrig behavioral1/files/0x00070000000284c3-24.dat xmrig - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation processhacker-2.39-setup.exe - Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 5 IoCs
pid Process 4960 MicrosoftUpdate.exe 5240 MicrosoftUpdate.tmp 3496 SppExtComObj.exe 5964 SearchIndexer.exe 2268 SppExtComObj.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsMonitorService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\SppExtComObj.exe\" -s" processhacker-2.39-setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com - Drops file in Program Files directory 42 IoCs
description ioc Process File opened for modification C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-MKETP.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-J146O.tmp MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\unins000.dat MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\x86\plugins\DotNetTools.dll MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\peview.exe MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\UserNotes.dll MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-C5RDS.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-S633C.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-A0FHV.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-NR9LQ.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-AAVGT.tmp MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dll MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\Updater.dll MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-K1GNN.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-UKIBS.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-S69J5.tmp MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\x86\ProcessHacker.exe MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-TG9DE.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-15GS7.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\x86\is-NVPR2.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-4GUOU.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-PRUJ0.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-TU3LO.tmp MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-V4LAT.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-C578D.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-33QMP.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-UG3CT.tmp MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\ProcessHacker.exe MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\plugins\is-KFK3L.tmp MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\NetworkTools.dll MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll MicrosoftUpdate.tmp File opened for modification C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\unins000.dat MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-28LF3.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\x86\plugins\is-3AA8M.tmp MicrosoftUpdate.tmp File created C:\Program Files\Process Hacker 2\is-GPDCT.tmp MicrosoftUpdate.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftUpdate.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftUpdate.exe - Inno Setup is an open-source installation builder for Windows applications. 7 IoCs
Inno Setup installer
resource yara_rule behavioral1/files/0x0009000000023309-2.dat innosetup behavioral1/memory/4960-17-0x0000000000400000-0x000000000042B000-memory.dmp innosetup behavioral1/files/0x00070000000284c6-23.dat innosetup behavioral1/memory/3372-40-0x00007FF6D3DB0000-0x00007FF6D46A8000-memory.dmp innosetup behavioral1/memory/2268-44-0x00007FF6640F0000-0x00007FF6649E8000-memory.dmp innosetup behavioral1/memory/4960-45-0x0000000000400000-0x000000000042B000-memory.dmp innosetup behavioral1/memory/3496-48-0x00007FF6640F0000-0x00007FF6649E8000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 processhacker-2.39-setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString processhacker-2.39-setup.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings taskmgr.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4752 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3372 processhacker-2.39-setup.exe 3372 processhacker-2.39-setup.exe 3496 SppExtComObj.exe 3496 SppExtComObj.exe 3496 SppExtComObj.exe 3496 SppExtComObj.exe 2268 SppExtComObj.exe 2268 SppExtComObj.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5240 MicrosoftUpdate.tmp 5240 MicrosoftUpdate.tmp 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 1252 taskmgr.exe 1252 taskmgr.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 1252 taskmgr.exe 1252 taskmgr.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 1252 taskmgr.exe 1252 taskmgr.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 1252 taskmgr.exe 1252 taskmgr.exe 5964 SearchIndexer.exe 5964 SearchIndexer.exe 1252 taskmgr.exe 1252 taskmgr.exe 5964 SearchIndexer.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeLockMemoryPrivilege 5964 SearchIndexer.exe Token: SeLockMemoryPrivilege 5964 SearchIndexer.exe Token: SeDebugPrivilege 1252 taskmgr.exe Token: SeSystemProfilePrivilege 1252 taskmgr.exe Token: SeCreateGlobalPrivilege 1252 taskmgr.exe Token: 33 1252 taskmgr.exe Token: SeIncBasePriorityPrivilege 1252 taskmgr.exe - Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 5964 SearchIndexer.exe 5240 MicrosoftUpdate.tmp 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe - Suspicious use of SendNotifyMessage 61 IoCs
pid Process 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe 1252 taskmgr.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3372 wrote to memory of 4960 3372 processhacker-2.39-setup.exe 82 PID 3372 wrote to memory of 4752 3372 processhacker-2.39-setup.exe 83 PID 4960 wrote to memory of 5240 4960 MicrosoftUpdate.exe 85 PID 3372 wrote to memory of 3496 3372 processhacker-2.39-setup.exe 86 PID 3496 wrote to memory of 5964 3496 SppExtComObj.exe 87 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\processhacker-2.39-setup.exe"C:\Users\Admin\AppData\Local\Temp\processhacker-2.39-setup.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdate.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdate.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\is-8UNBQ.tmp\MicrosoftUpdate.tmp"C:\Users\Admin\AppData\Local\Temp\is-8UNBQ.tmp\MicrosoftUpdate.tmp" /SL5="$90042,1874675,150016,C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdate.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5240
-
-
-
C:\Windows\system32\schtasks.exeC:\Windows\system32\schtasks.exe /create /tn "WindowsMonitorService" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SppExtComObj.exe\" -s" /sc onlogon /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4752
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SppExtComObj.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SppExtComObj.exe" -s3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe" --config="C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\nh5b294f.dat" --no-color --log-file=""2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5964
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1252
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SppExtComObj.exe"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SppExtComObj.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2268
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:456
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Process Hacker 2\ProcessHacker.exe
- Size 1.6MB
- SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
- MD5 b365af317ae730a67c936f21432b9c71
- SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
- SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b
- SSDEEP 24576:V7eokafnkAwgcU+29fR4PQviXq1pj3EDT5m+m8I:V6efnkdlUF92PGBOT3m8
- TLSH T10D857C5262E44098D2BBDE76C5629A22EAB13C061F34CADF4650F5792F33BE1DA3C711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdate.exe
- Size 2.2MB
- SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
- MD5 54daad58cce5003bee58b28a4f465f49
- SHA1 162b08b0b11827cc024e6b2eed5887ec86339baa
- SHA512 8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
- SSDEEP 49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq
- TLSH T14CA53303DF540D3BD5B79B76973FCB154E6A734528346C63B20D5C8E8BA47A288923B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-8UNBQ.tmp\MicrosoftUpdate.tmp
- Size 785KB
- SHA256 b10cf8cdf541ca0dd6df79e66fb4b0854dcac717aba034ba0c4961bff92fd021
- MD5 1c96ed29e0136825e06f037bf10b2419
- SHA1 b74a55279474253639bebf9c92f10f947145ff30
- SHA512 0e74854d9de4e3944b2cff9b5de7eb19fdec1fee6c9576cae6cd81741adf84eac421cb743b1df30183f645ffe849357b6a85b5be8d7f6e2efe289bbe4573e177
- SSDEEP 24576:rQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafMyx9CD:102rPD37zzH2A6SBIfNaf1s
- TLSH T136058D32F2A08837D1731F789D1B82D55936BE103E39A59736E91F0C4F796817A2B2D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe
- Size 5.4MB
- SHA256 d1c1948bc597b45cef897b8b1810d91f009f683806bf0de0897bcc48f3faad8a
- MD5 40e6ff6ffd14f684306ec293893f561e
- SHA1 5c340432314921d89396e32750a03f98e2e1b75c
- SHA512 edd949d7547a8d0d5c1afa2b3fba21c5f95839bf6bb3d6089b356c59679f6c2bda4854f7f4b3a8da03d0a56a9b00ea1c387a1980f72b98bc8b41df2b893e5846
- SSDEEP 98304:+CBASf848A7cUtXle0sgV5oS8+KEdHtMQXfvHgUTwDmkM/bIhM9IxvbAzeD5kw:+a7U48afHHEKkeI26pbOEH
- TLSH T124469D66B2A500E8C8BAC13CC5478613E7F2B8195370E7DB17A456BA1F33AD55E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SppExtComObj.exe
- Size 8.9MB
- SHA256 9735334a3ef57e5097db833be88ff35d7fdabfa40c4583052b8a659ab57b3709
- MD5 f443df52332cab851ada11f1822ee506
- SHA1 4f1432dc72629e09897552d458d4dac80323259c
- SHA512 394b3bfd8f614e979757c2168b109d7c12cce9fef622a130f541f687e8092af3c57a992a4aa168bc078311d346f0a7f1caa6f3a39a0e4e15ab879b0b949c3685
- SSDEEP 98304:8TvyB9snV6Hedgo3iUr0vuAcedAJyT1kM/bMNKA/SesqzxMxh9/ULkjKxtTGP6V6:8GK61dcedA6nTM+1/ULRjVZdLSEe
- TLSH T1AD96D05B9DD35BC6C2B9D0340E52E3336A72A43CD295962CF84AF721BECFE11499960C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\WinRing0x64.sys
- Size 14KB
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- TLSH T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\libuv-1.dll
- Size 365KB
- SHA256 838c6ea30e4bfb101afcb1e6b9042a32df37a65ba9fa0b3a605580f91496b698
- MD5 bb1669d0dd02ea471f73684965db218e
- SHA1 1899deb719496c853c831aaffcd03416a735a2d7
- SHA512 8042236c4f30496770b0814f894a2fd9104e3e9a20674206b8620adb9cf792554a8bd38fe357ec652a84d798fd77727239d0f4994000491fc19b6c6874e0adba
- SSDEEP 6144:OZ96VDHf/G448F5fkZy4aQ0lNTo9HYXLUSPf/6f/7mf/egwqUPGJf/pLp5NRimJM:c96tHf/G448rko4iNT2cUCf/6f/7mf/s
- TLSH T14F84D93BE772CC5AC0DBA1B4BBC385E164B9BD654A31A01E01A58750771BDA07FBE6C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\nh5b294f.dat
- Size 534B
- SHA256 71f37ace7890d38c8f76c52c6d307a767332d6e652c2dba3c542dea7ae4df144
- MD5 8f099bd5756e6de98d1c16fe6cc9e670
- SHA1 4e2c5c371454da4777b613aa6c59fff827094108
- SHA512 d4ca09fa9434ef10cc0a563473ee6fdc93cd09d022cc790ae996fe62c0a80678f1e26a856b0906c58396e81d5edb4492009b07e78be19e0cf9285baa2c408fe7
- TLSH T109F09E31C4501CBB05F8A228A6F6B103D9189B6B12650D2B76FE925D1F779760182F94
- MD5 SHA1 SHA512 TLSH