hxxps://github[.]com/zDominik111/Holzer/blob/main/Holzer[.]zip

Analysis

user interaction
yes
max time kernel
95s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/zDominik111/Holzer/blob/main/Holzer.zip
Sample260629-cemsaaay3v

Score

8^/10

adware bootkit defense_evasion discovery persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Holzer.exe

Disables Task Manager via registry modification
defense_evasion

Manipulates Digital Signatures 1 TTPs 3 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
7388	icacls.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
62	raw.githubusercontent.com
63	raw.githubusercontent.com
64	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	cleanmgr.exe
File opened (read-only)	\??\B:	cleanmgr.exe
File opened (read-only)	\??\G:	cleanmgr.exe
File opened (read-only)	\??\I:	cleanmgr.exe
File opened (read-only)	\??\K:	cleanmgr.exe
File opened (read-only)	\??\L:	cleanmgr.exe
File opened (read-only)	\??\S:	cleanmgr.exe
File opened (read-only)	\??\J:	cleanmgr.exe
File opened (read-only)	\??\N:	cleanmgr.exe
File opened (read-only)	\??\R:	cleanmgr.exe
File opened (read-only)	\??\T:	cleanmgr.exe
File opened (read-only)	\??\U:	cleanmgr.exe
File opened (read-only)	\??\V:	cleanmgr.exe
File opened (read-only)	\??\W:	cleanmgr.exe
File opened (read-only)	\??\H:	cleanmgr.exe
File opened (read-only)	\??\P:	cleanmgr.exe
File opened (read-only)	\??\Q:	cleanmgr.exe
File opened (read-only)	\??\X:	cleanmgr.exe
File opened (read-only)	\??\Y:	cleanmgr.exe
File opened (read-only)	\??\E:	cleanmgr.exe
File opened (read-only)	\??\M:	cleanmgr.exe
File opened (read-only)	\??\O:	cleanmgr.exe
File opened (read-only)	\??\Z:	cleanmgr.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
7840	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Holzer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmmon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmstp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AtBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auditpol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootcfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	credwiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundTaskHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CameraSettingsUIHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CertEnrollCtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	charmap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compact.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	convert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CredentialUIBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chkdsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chkntfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cipher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cliconfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CloudNotifications.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cttune.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certreq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmdkey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTransferHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cleanmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Holzer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheckNetIsolation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmdl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cttunesvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
11384	RpcPing.exe
6444	PATHPING.EXE
5744	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	chrome.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	bootcfg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	bootcfg.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkntfs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	convert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
7928	ipconfig.exe
4472	NETSTAT.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271719831101347"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	certreq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5744	PING.EXE

Runs regedit.exe 2 IoCs

pid	Process
10048	regedit.exe
2812	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5728	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4468	Holzer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
5728	explorer.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3848	OpenWith.exe
4560	certreq.exe
5164	CloudNotifications.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 744	2084	chrome.exe	85
PID 2084 wrote to memory of 1436	2084	chrome.exe	86
PID 2084 wrote to memory of 1436	2084	chrome.exe	86
PID 2084 wrote to memory of 4380	2084	chrome.exe	87
PID 2084 wrote to memory of 4408	2084	chrome.exe	88
PID 2084 wrote to memory of 4408	2084	chrome.exe	88
PID 2084 wrote to memory of 2308	2084	chrome.exe	90
PID 2084 wrote to memory of 2032	2084	chrome.exe	91
PID 2084 wrote to memory of 2308	2084	chrome.exe	90
PID 2084 wrote to memory of 2032	2084	chrome.exe	91
PID 2084 wrote to memory of 2272	2084	chrome.exe	92
PID 2084 wrote to memory of 2272	2084	chrome.exe	92
PID 2084 wrote to memory of 3904	2084	chrome.exe	93
PID 2084 wrote to memory of 3756	2084	chrome.exe	99
PID 2084 wrote to memory of 2800	2084	chrome.exe	106
PID 2084 wrote to memory of 3920	2084	chrome.exe	107
PID 2084 wrote to memory of 2568	2084	chrome.exe	108
PID 4468 wrote to memory of 3064	4468	Holzer.exe	119
PID 4468 wrote to memory of 1784	4468	Holzer.exe	120
PID 4468 wrote to memory of 1632	4468	Holzer.exe	123
PID 4468 wrote to memory of 3596	4468	Holzer.exe	125
PID 4468 wrote to memory of 2932	4468	Holzer.exe	127
PID 4468 wrote to memory of 1664	4468	Holzer.exe	129
PID 4468 wrote to memory of 3808	4468	Holzer.exe	131
PID 4468 wrote to memory of 4560	4468	Holzer.exe	136
PID 4468 wrote to memory of 4268	4468	Holzer.exe	137
PID 4468 wrote to memory of 1936	4468	Holzer.exe	138
PID 4468 wrote to memory of 2712	4468	Holzer.exe	140
PID 4468 wrote to memory of 2296	4468	Holzer.exe	142
PID 4468 wrote to memory of 884	4468	Holzer.exe	144
PID 4468 wrote to memory of 2452	4468	Holzer.exe	146
PID 4468 wrote to memory of 1852	4468	Holzer.exe	148
PID 4468 wrote to memory of 4672	4468	Holzer.exe	150
PID 4468 wrote to memory of 2196	4468	Holzer.exe	151
PID 4468 wrote to memory of 4560	4468	Holzer.exe	152
PID 4468 wrote to memory of 4908	4468	Holzer.exe	159
PID 4468 wrote to memory of 4592	4468	Holzer.exe	161
PID 4468 wrote to memory of 1664	4468	Holzer.exe	162
PID 4468 wrote to memory of 4204	4468	Holzer.exe	164
PID 4468 wrote to memory of 2360	4468	Holzer.exe	166
PID 4468 wrote to memory of 3768	4468	Holzer.exe	169
PID 4468 wrote to memory of 3848	4468	Holzer.exe	171
PID 4468 wrote to memory of 3804	4468	Holzer.exe	173
PID 4468 wrote to memory of 3976	4468	Holzer.exe	174
PID 4468 wrote to memory of 5124	4468	Holzer.exe	175
PID 4468 wrote to memory of 5164	4468	Holzer.exe	177
PID 4468 wrote to memory of 5208	4468	Holzer.exe	178
PID 4468 wrote to memory of 5260	4468	Holzer.exe	180
PID 4468 wrote to memory of 5320	4468	Holzer.exe	182
PID 4468 wrote to memory of 5340	4468	Holzer.exe	183
PID 4468 wrote to memory of 5356	4468	Holzer.exe	184
PID 4468 wrote to memory of 5372	4468	Holzer.exe	185
PID 4468 wrote to memory of 5408	4468	Holzer.exe	186
PID 4468 wrote to memory of 5452	4468	Holzer.exe	188
PID 4468 wrote to memory of 5504	4468	Holzer.exe	190
PID 4468 wrote to memory of 5544	4468	Holzer.exe	191
PID 4468 wrote to memory of 5720	4468	Holzer.exe	194
PID 4468 wrote to memory of 5812	4468	Holzer.exe	197
PID 4468 wrote to memory of 5836	4468	Holzer.exe	198
PID 4468 wrote to memory of 5908	4468	Holzer.exe	334
PID 4468 wrote to memory of 6072	4468	Holzer.exe	203
PID 4468 wrote to memory of 5292	4468	Holzer.exe	204
PID 4468 wrote to memory of 5232	4468	Holzer.exe	205

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1664	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/zDominik111/Holzer/blob/main/Holzer.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff90109c728,0x7ff90109c734,0x7ff90109c740
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,17299380325255110759,5415906281582460104,262144 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,14411945080907277757,4596732605408073779,524288 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,14317626081816234826,5929716773587823375,524288 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,628665540153874693,6279604356845500860,2097152 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,2895647274311860020,16967903085001911849,2097152 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,11863508595141963567,12084951797107509769,2097152 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,10320605857400831880,8026168780153872584,524288 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,17084980140443639665,12215098050148175517,524288 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,3051845727431131659,6068250887121133797,524288 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,14340160716440549546,8150287910887713068,524288 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,13738254263178608055,2299094391965673076,524288 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5680,i,8901650471000222270,3963937153854882817,262144 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:7380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,8713673279228127023,3994200832872117640,524288 --field-trial-handle=2004,i,16910281359524341497,14207523443086914577,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:11452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2784

C:\Users\Admin\Downloads\Holzer\Holzer.exe
"C:\Users\Admin\Downloads\Holzer\Holzer.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\agentactivationruntimestarter.exe
  "C:\Windows\System32\agentactivationruntimestarter.exe"
  2⤵
  PID:3064
- C:\Windows\SysWOW64\appidtel.exe
  "C:\Windows\System32\appidtel.exe"
  2⤵
  PID:1784
- C:\Windows\SysWOW64\ARP.EXE
  "C:\Windows\System32\ARP.EXE"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1632
- C:\Windows\SysWOW64\at.exe
  "C:\Windows\System32\at.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3596
- C:\Windows\SysWOW64\AtBroker.exe
  "C:\Windows\System32\AtBroker.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1664
- C:\Windows\SysWOW64\auditpol.exe
  "C:\Windows\System32\auditpol.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3808
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\System32\autochk.exe"
  2⤵
  PID:2004
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\System32\autoconv.exe"
  2⤵
  PID:4152
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\System32\autofmt.exe"
  2⤵
  PID:4900
- C:\Windows\SysWOW64\backgroundTaskHost.exe
  "C:\Windows\System32\backgroundTaskHost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4560
- C:\Windows\SysWOW64\BackgroundTransferHost.exe
  "C:\Windows\System32\BackgroundTransferHost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4268
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\Windows\SysWOW64\bootcfg.exe
  "C:\Windows\System32\bootcfg.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:2712
- C:\Windows\SysWOW64\bthudtask.exe
  "C:\Windows\System32\bthudtask.exe"
  2⤵
  PID:2296
- C:\Windows\SysWOW64\ByteCodeGenerator.exe
  "C:\Windows\System32\ByteCodeGenerator.exe"
  2⤵
  PID:884
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1852
- C:\Windows\SysWOW64\CameraSettingsUIHost.exe
  "C:\Windows\System32\CameraSettingsUIHost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4672
- C:\Windows\SysWOW64\CertEnrollCtrl.exe
  "C:\Windows\System32\CertEnrollCtrl.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2196
- C:\Windows\SysWOW64\certreq.exe
  "C:\Windows\System32\certreq.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4560
- C:\Windows\SysWOW64\certutil.exe
  "C:\Windows\System32\certutil.exe"
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Windows\SysWOW64\charmap.exe
  "C:\Windows\System32\charmap.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4592
- C:\Windows\SysWOW64\CheckNetIsolation.exe
  "C:\Windows\System32\CheckNetIsolation.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1664
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\System32\chkdsk.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:4204
- C:\Windows\SysWOW64\chkntfs.exe
  "C:\Windows\System32\chkntfs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:2360
- C:\Windows\SysWOW64\choice.exe
  "C:\Windows\System32\choice.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3768
- C:\Windows\SysWOW64\cipher.exe
  "C:\Windows\System32\cipher.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3848
- C:\Windows\SysWOW64\cleanmgr.exe
  "C:\Windows\System32\cleanmgr.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:3804
- C:\Windows\SysWOW64\cliconfg.exe
  "C:\Windows\System32\cliconfg.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3976
- C:\Windows\SysWOW64\clip.exe
  "C:\Windows\System32\clip.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5124
- C:\Windows\SysWOW64\CloudNotifications.exe
  "C:\Windows\System32\CloudNotifications.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5208
- C:\Windows\SysWOW64\cmdkey.exe
  "C:\Windows\System32\cmdkey.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5260
- C:\Windows\SysWOW64\cmdl32.exe
  "C:\Windows\System32\cmdl32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5320
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\System32\cmmon32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5340
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\System32\cmstp.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5356
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\System32\colorcpl.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5372
- C:\Windows\SysWOW64\comp.exe
  "C:\Windows\System32\comp.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5408
- C:\Windows\SysWOW64\compact.exe
  "C:\Windows\System32\compact.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5452
- C:\Windows\SysWOW64\ComputerDefaults.exe
  "C:\Windows\System32\ComputerDefaults.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5504
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5544
- C:\Windows\SysWOW64\convert.exe
  "C:\Windows\System32\convert.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  PID:5720
- C:\Windows\SysWOW64\CredentialUIBroker.exe
  "C:\Windows\System32\CredentialUIBroker.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5812
- C:\Windows\SysWOW64\credwiz.exe
  "C:\Windows\System32\credwiz.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5836
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\System32\cscript.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5908
- C:\Windows\SysWOW64\ctfmon.exe
  "C:\Windows\System32\ctfmon.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6072
- C:\Windows\SysWOW64\cttune.exe
  "C:\Windows\System32\cttune.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5292
- C:\Windows\SysWOW64\cttunesvr.exe
  "C:\Windows\System32\cttunesvr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5232
- C:\Windows\SysWOW64\curl.exe
  "C:\Windows\System32\curl.exe"
  2⤵
  PID:6064
- C:\Windows\SysWOW64\dccw.exe
  "C:\Windows\System32\dccw.exe"
  2⤵
  PID:5612
- C:\Windows\SysWOW64\dcomcnfg.exe
  "C:\Windows\System32\dcomcnfg.exe"
  2⤵
  PID:5512
- - C:\Windows\system32\mmc.exe
    C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc
    3⤵
    PID:5540
- C:\Windows\SysWOW64\ddodiag.exe
  "C:\Windows\System32\ddodiag.exe"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\DevicePairingWizard.exe
  "C:\Windows\System32\DevicePairingWizard.exe"
  2⤵
  PID:5516
- C:\Windows\SysWOW64\dfrgui.exe
  "C:\Windows\System32\dfrgui.exe"
  2⤵
  PID:6152
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\System32\dialer.exe"
  2⤵
  PID:6400
- C:\Windows\SysWOW64\diskpart.exe
  "C:\Windows\System32\diskpart.exe"
  2⤵
  PID:6536
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\System32\diskperf.exe"
  2⤵
  PID:6716
- C:\Windows\SysWOW64\Dism.exe
  "C:\Windows\System32\Dism.exe"
  2⤵
  PID:6852
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\System32\dllhost.exe"
  2⤵
  PID:7040
- C:\Windows\SysWOW64\dllhst3g.exe
  "C:\Windows\System32\dllhst3g.exe"
  2⤵
  PID:7124
- C:\Windows\SysWOW64\doskey.exe
  "C:\Windows\System32\doskey.exe"
  2⤵
  PID:3344
- C:\Windows\SysWOW64\dpapimig.exe
  "C:\Windows\System32\dpapimig.exe"
  2⤵
  PID:6772
- C:\Windows\SysWOW64\DpiScaling.exe
  "C:\Windows\System32\DpiScaling.exe"
  2⤵
  PID:7044
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" ms-settings:display
    3⤵
    PID:6016
- C:\Windows\SysWOW64\driverquery.exe
  "C:\Windows\System32\driverquery.exe"
  2⤵
  PID:6888
- C:\Windows\SysWOW64\dtdump.exe
  "C:\Windows\System32\dtdump.exe"
  2⤵
  PID:2564
- C:\Windows\SysWOW64\dvdplay.exe
  "C:\Windows\System32\dvdplay.exe"
  2⤵
  PID:6352
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    /device:dvd
    3⤵
    PID:2496
  - - C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      4⤵
      PID:3736
    - - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        5⤵
        
        PID:7260
- C:\Windows\SysWOW64\DWWIN.EXE
  "C:\Windows\System32\DWWIN.EXE"
  2⤵
  PID:1644
- C:\Windows\SysWOW64\dxdiag.exe
  "C:\Windows\System32\dxdiag.exe"
  2⤵
  PID:7244
- C:\Windows\SysWOW64\EaseOfAccessDialog.exe
  "C:\Windows\System32\EaseOfAccessDialog.exe"
  2⤵
  PID:7432
- C:\Windows\SysWOW64\edpnotify.exe
  "C:\Windows\System32\edpnotify.exe"
  2⤵
  PID:7512
- C:\Windows\SysWOW64\efsui.exe
  "C:\Windows\System32\efsui.exe"
  2⤵
  PID:7568
- C:\Windows\SysWOW64\EhStorAuthn.exe
  "C:\Windows\System32\EhStorAuthn.exe"
  2⤵
  PID:7588
- C:\Windows\SysWOW64\esentutl.exe
  "C:\Windows\System32\esentutl.exe"
  2⤵
  PID:7604
- C:\Windows\SysWOW64\eudcedit.exe
  "C:\Windows\System32\eudcedit.exe"
  2⤵
  PID:7724
- C:\Windows\SysWOW64\eventcreate.exe
  "C:\Windows\System32\eventcreate.exe"
  2⤵
  PID:7748
- C:\Windows\SysWOW64\eventvwr.exe
  "C:\Windows\System32\eventvwr.exe"
  2⤵
  PID:7788
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
    3⤵
    PID:7804
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\eventvwr.msc" "C:\Windows\system32\eventvwr.msc"
      4⤵
      PID:7832
- C:\Windows\SysWOW64\expand.exe
  "C:\Windows\System32\expand.exe"
  2⤵
  PID:7852
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe"
  2⤵
  PID:7928
- C:\Windows\SysWOW64\extrac32.exe
  "C:\Windows\System32\extrac32.exe"
  2⤵
  PID:7984
- C:\Windows\SysWOW64\fc.exe
  "C:\Windows\System32\fc.exe"
  2⤵
  PID:8016
- C:\Windows\SysWOW64\find.exe
  "C:\Windows\System32\find.exe"
  2⤵
  PID:8060
- C:\Windows\SysWOW64\findstr.exe
  "C:\Windows\System32\findstr.exe"
  2⤵
  PID:8108
- C:\Windows\SysWOW64\finger.exe
  "C:\Windows\System32\finger.exe"
  2⤵
  PID:8184
- C:\Windows\SysWOW64\fixmapi.exe
  "C:\Windows\System32\fixmapi.exe"
  2⤵
  PID:7220
- C:\Windows\SysWOW64\fltMC.exe
  "C:\Windows\System32\fltMC.exe"
  2⤵
  PID:7172
- C:\Windows\SysWOW64\Fondue.exe
  "C:\Windows\System32\Fondue.exe"
  2⤵
  PID:7408
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  PID:7468
- C:\Windows\SysWOW64\fontview.exe
  "C:\Windows\System32\fontview.exe"
  2⤵
  PID:7456
- C:\Windows\SysWOW64\forfiles.exe
  "C:\Windows\System32\forfiles.exe"
  2⤵
  PID:7492
- - C:\Windows\SysWOW64\cmd.exe
    /c echo "Holzer.exe"
    3⤵
    PID:7292
- C:\Windows\SysWOW64\fsquirt.exe
  "C:\Windows\System32\fsquirt.exe"
  2⤵
  PID:7312
- C:\Windows\SysWOW64\fsutil.exe
  "C:\Windows\System32\fsutil.exe"
  2⤵
  PID:7356
- C:\Windows\SysWOW64\ftp.exe
  "C:\Windows\System32\ftp.exe"
  2⤵
  PID:7544
- C:\Windows\SysWOW64\GameBarPresenceWriter.exe
  "C:\Windows\System32\GameBarPresenceWriter.exe"
  2⤵
  PID:7572
- C:\Windows\SysWOW64\GamePanel.exe
  "C:\Windows\System32\GamePanel.exe"
  2⤵
  PID:7588
- C:\Windows\SysWOW64\getmac.exe
  "C:\Windows\System32\getmac.exe"
  2⤵
  PID:7264
- C:\Windows\SysWOW64\gpresult.exe
  "C:\Windows\System32\gpresult.exe"
  2⤵
  PID:7712
- C:\Windows\SysWOW64\gpscript.exe
  "C:\Windows\System32\gpscript.exe"
  2⤵
  PID:5460
- C:\Windows\SysWOW64\gpupdate.exe
  "C:\Windows\System32\gpupdate.exe"
  2⤵
  PID:7768
- C:\Windows\SysWOW64\grpconv.exe
  "C:\Windows\System32\grpconv.exe"
  2⤵
  PID:7936
- C:\Windows\SysWOW64\hdwwiz.exe
  "C:\Windows\System32\hdwwiz.exe"
  2⤵
  PID:3276
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\System32\help.exe"
  2⤵
  PID:8120
- C:\Windows\SysWOW64\hh.exe
  "C:\Windows\System32\hh.exe"
  2⤵
  PID:8144
- C:\Windows\SysWOW64\HOSTNAME.EXE
  "C:\Windows\System32\HOSTNAME.EXE"
  2⤵
  PID:8092
- C:\Windows\SysWOW64\icacls.exe
  "C:\Windows\System32\icacls.exe"
  2⤵
  - Modifies file permissions
  PID:7388
- C:\Windows\SysWOW64\icsunattend.exe
  "C:\Windows\System32\icsunattend.exe"
  2⤵
  PID:7468
- C:\Windows\SysWOW64\ieUnatt.exe
  "C:\Windows\System32\ieUnatt.exe"
  2⤵
  PID:7872
- C:\Windows\SysWOW64\iexpress.exe
  "C:\Windows\System32\iexpress.exe"
  2⤵
  PID:2116
- C:\Windows\SysWOW64\InfDefaultInstall.exe
  "C:\Windows\System32\InfDefaultInstall.exe"
  2⤵
  PID:1936
- C:\Windows\SysWOW64\InputSwitchToastHandler.exe
  "C:\Windows\System32\InputSwitchToastHandler.exe"
  2⤵
  PID:4612
- C:\Windows\SysWOW64\instnm.exe
  "C:\Windows\System32\instnm.exe"
  2⤵
  PID:1560
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe"
  2⤵
  - Gathers network information
  PID:7928
- C:\Windows\SysWOW64\iscsicli.exe
  "C:\Windows\System32\iscsicli.exe"
  2⤵
  PID:368
- C:\Windows\SysWOW64\iscsicpl.exe
  "C:\Windows\System32\iscsicpl.exe"
  2⤵
  PID:7264
- - C:\Windows\system32\RunDll32.exe
    C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL iscsicpl.dll,,0
    3⤵
    PID:7428
- C:\Windows\SysWOW64\isoburn.exe
  "C:\Windows\System32\isoburn.exe"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\ktmutil.exe
  "C:\Windows\System32\ktmutil.exe"
  2⤵
  PID:8188
- C:\Windows\SysWOW64\label.exe
  "C:\Windows\System32\label.exe"
  2⤵
  PID:7200
- C:\Windows\SysWOW64\LaunchTM.exe
  "C:\Windows\System32\LaunchTM.exe"
  2⤵
  PID:7448
- - C:\Windows\SysWOW64\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    PID:7856
- C:\Windows\SysWOW64\LaunchWinApp.exe
  "C:\Windows\System32\LaunchWinApp.exe"
  2⤵
  PID:7968
- C:\Windows\SysWOW64\lodctr.exe
  "C:\Windows\System32\lodctr.exe"
  2⤵
  PID:7468
- C:\Windows\SysWOW64\logagent.exe
  "C:\Windows\System32\logagent.exe"
  2⤵
  PID:4268
- C:\Windows\SysWOW64\logman.exe
  "C:\Windows\System32\logman.exe"
  2⤵
  PID:5444
- C:\Windows\SysWOW64\Magnify.exe
  "C:\Windows\System32\Magnify.exe"
  2⤵
  PID:7384
- C:\Windows\SysWOW64\makecab.exe
  "C:\Windows\System32\makecab.exe"
  2⤵
  PID:7696
- C:\Windows\SysWOW64\mavinject.exe
  "C:\Windows\System32\mavinject.exe"
  2⤵
  PID:8028
- C:\Windows\SysWOW64\mcbuilder.exe
  "C:\Windows\System32\mcbuilder.exe"
  2⤵
  PID:6984
- C:\Windows\SysWOW64\mfpmp.exe
  "C:\Windows\System32\mfpmp.exe"
  2⤵
  PID:3808
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\System32\mmc.exe"
  2⤵
  PID:8260
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe"
    3⤵
    PID:8280
- C:\Windows\SysWOW64\mmgaserver.exe
  "C:\Windows\System32\mmgaserver.exe"
  2⤵
  PID:8292
- C:\Windows\SysWOW64\mobsync.exe
  "C:\Windows\System32\mobsync.exe"
  2⤵
  PID:8348
- C:\Windows\SysWOW64\mountvol.exe
  "C:\Windows\System32\mountvol.exe"
  2⤵
  PID:8408
- C:\Windows\SysWOW64\MRINFO.EXE
  "C:\Windows\System32\MRINFO.EXE"
  2⤵
  PID:8540
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\System32\msdt.exe"
  2⤵
  PID:8624
- C:\Windows\SysWOW64\msfeedssync.exe
  "C:\Windows\System32\msfeedssync.exe"
  2⤵
  PID:8684
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe"
  2⤵
  PID:8732
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe"
  2⤵
  PID:8776
- C:\Windows\SysWOW64\msinfo32.exe
  "C:\Windows\System32\msinfo32.exe"
  2⤵
  PID:8828
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:8932
- C:\Windows\SysWOW64\msra.exe
  "C:\Windows\System32\msra.exe"
  2⤵
  PID:8976
- - C:\Windows\system32\msra.exe
    "C:\Windows\system32\msra.exe"
    3⤵
    PID:9180
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\System32\mstsc.exe"
  2⤵
  PID:9092
- - C:\Windows\system32\mstsc.exe
    "C:\Windows\System32\mstsc.exe"
    3⤵
    PID:9112
- C:\Windows\SysWOW64\mtstocom.exe
  "C:\Windows\System32\mtstocom.exe"
  2⤵
  PID:9192
- C:\Windows\SysWOW64\MuiUnattend.exe
  "C:\Windows\System32\MuiUnattend.exe"
  2⤵
  PID:7660
- C:\Windows\SysWOW64\ndadmin.exe
  "C:\Windows\System32\ndadmin.exe"
  2⤵
  PID:7128
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe"
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1
    3⤵
    PID:8684
- C:\Windows\SysWOW64\net1.exe
  "C:\Windows\System32\net1.exe"
  2⤵
  PID:2564
- C:\Windows\SysWOW64\netbtugc.exe
  "C:\Windows\System32\netbtugc.exe"
  2⤵
  PID:8688
- C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe
  "C:\Windows\System32\NetCfgNotifyObjectHost.exe"
  2⤵
  PID:8796
- C:\Windows\SysWOW64\netiougc.exe
  "C:\Windows\System32\netiougc.exe"
  2⤵
  PID:7208
- C:\Windows\SysWOW64\Netplwiz.exe
  "C:\Windows\System32\Netplwiz.exe"
  2⤵
  PID:5444
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe"
  2⤵
  PID:9096
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\System32\NETSTAT.EXE"
  2⤵
  - Gathers network information
  PID:4472
- C:\Windows\SysWOW64\newdev.exe
  "C:\Windows\System32\newdev.exe"
  2⤵
  PID:8676
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2376
- C:\Windows\SysWOW64\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  PID:7660
- C:\Windows\SysWOW64\ntprint.exe
  "C:\Windows\System32\ntprint.exe"
  2⤵
  PID:8532
- C:\Windows\SysWOW64\odbcad32.exe
  "C:\Windows\System32\odbcad32.exe"
  2⤵
  PID:6900
- C:\Windows\SysWOW64\odbcconf.exe
  "C:\Windows\System32\odbcconf.exe"
  2⤵
  PID:116
- C:\Windows\SysWOW64\OneDriveSetup.exe
  "C:\Windows\System32\OneDriveSetup.exe"
  2⤵
  PID:7748
- - C:\Windows\SysWOW64\OneDriveSetup.exe
    "C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /permachine /childprocess /silent /cusid:S-1-5-21-540052884-2969440504-464782435-1000
    3⤵
    PID:5304
- - C:\Windows\SysWOW64\OneDriveSetup.exe
    C:\Windows\SysWOW64\OneDriveSetup.exe /peruser /childprocess
    3⤵
    PID:9616
- C:\Windows\SysWOW64\openfiles.exe
  "C:\Windows\System32\openfiles.exe"
  2⤵
  PID:8772
- C:\Windows\SysWOW64\OpenWith.exe
  "C:\Windows\System32\OpenWith.exe"
  2⤵
  PID:8508
- C:\Windows\SysWOW64\OposHost.exe
  "C:\Windows\System32\OposHost.exe"
  2⤵
  PID:2296
- C:\Windows\SysWOW64\PackagedCWALauncher.exe
  "C:\Windows\System32\PackagedCWALauncher.exe"
  2⤵
  PID:884
- C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe
  "C:\Windows\System32\PasswordOnWakeSettingFlyout.exe"
  2⤵
  PID:8216
- C:\Windows\SysWOW64\PATHPING.EXE
  "C:\Windows\System32\PATHPING.EXE"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6444
- C:\Windows\SysWOW64\pcaui.exe
  "C:\Windows\System32\pcaui.exe"
  2⤵
  PID:6368
- C:\Windows\SysWOW64\perfhost.exe
  "C:\Windows\System32\perfhost.exe"
  2⤵
  PID:8576
- C:\Windows\SysWOW64\perfmon.exe
  "C:\Windows\System32\perfmon.exe"
  2⤵
  PID:6620
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\perfmon.msc" /32
    3⤵
    PID:6684
- C:\Windows\SysWOW64\PickerHost.exe
  "C:\Windows\System32\PickerHost.exe"
  2⤵
  PID:7784
- C:\Windows\SysWOW64\PING.EXE
  "C:\Windows\System32\PING.EXE"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5744
- C:\Windows\SysWOW64\PkgMgr.exe
  "C:\Windows\System32\PkgMgr.exe"
  2⤵
  PID:5080
- C:\Windows\SysWOW64\poqexec.exe
  "C:\Windows\System32\poqexec.exe"
  2⤵
  PID:8144
- C:\Windows\SysWOW64\powercfg.exe
  "C:\Windows\System32\powercfg.exe"
  2⤵
  - Power Settings
  PID:7840
- C:\Windows\SysWOW64\PresentationHost.exe
  "C:\Windows\System32\PresentationHost.exe"
  2⤵
  PID:8412
- C:\Windows\SysWOW64\prevhost.exe
  "C:\Windows\System32\prevhost.exe"
  2⤵
  PID:8772
- C:\Windows\SysWOW64\print.exe
  "C:\Windows\System32\print.exe"
  2⤵
  PID:3904
- C:\Windows\SysWOW64\printui.exe
  "C:\Windows\System32\printui.exe"
  2⤵
  PID:7972
- C:\Windows\SysWOW64\proquota.exe
  "C:\Windows\System32\proquota.exe"
  2⤵
  PID:9160
- C:\Windows\SysWOW64\provlaunch.exe
  "C:\Windows\System32\provlaunch.exe"
  2⤵
  PID:7840
- C:\Windows\SysWOW64\psr.exe
  "C:\Windows\System32\psr.exe"
  2⤵
  PID:5592
- - C:\Windows\system32\psr.exe
    "C:\Windows\system32\psr.exe"
    3⤵
    PID:6388
- C:\Windows\SysWOW64\quickassist.exe
  "C:\Windows\System32\quickassist.exe"
  2⤵
  PID:6868
- C:\Windows\SysWOW64\rasautou.exe
  "C:\Windows\System32\rasautou.exe"
  2⤵
  PID:6528
- C:\Windows\SysWOW64\rasdial.exe
  "C:\Windows\System32\rasdial.exe"
  2⤵
  PID:8588
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\System32\raserver.exe"
  2⤵
  PID:8412
- C:\Windows\SysWOW64\rasphone.exe
  "C:\Windows\System32\rasphone.exe"
  2⤵
  PID:6008
- C:\Windows\SysWOW64\RdpSa.exe
  "C:\Windows\System32\RdpSa.exe"
  2⤵
  PID:9228
- C:\Windows\SysWOW64\RdpSaProxy.exe
  "C:\Windows\System32\RdpSaProxy.exe"
  2⤵
  PID:9348
- - C:\Windows\SysWOW64\RdpSa.exe
    "C:\Windows\system32\RdpSa.exe"
    3⤵
    PID:9788
- C:\Windows\SysWOW64\RdpSaUacHelper.exe
  "C:\Windows\System32\RdpSaUacHelper.exe"
  2⤵
  PID:9520
- C:\Windows\SysWOW64\rdrleakdiag.exe
  "C:\Windows\System32\rdrleakdiag.exe"
  2⤵
  PID:9604
- C:\Windows\SysWOW64\ReAgentc.exe
  "C:\Windows\System32\ReAgentc.exe"
  2⤵
  PID:9664
- C:\Windows\SysWOW64\recover.exe
  "C:\Windows\System32\recover.exe"
  2⤵
  PID:9752
- C:\Windows\SysWOW64\reg.exe
  "C:\Windows\System32\reg.exe"
  2⤵
  PID:9888
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - Runs regedit.exe
  PID:10048
- C:\Windows\SysWOW64\regedt32.exe
  "C:\Windows\System32\regedt32.exe"
  2⤵
  PID:10192
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:2812
- C:\Windows\SysWOW64\regini.exe
  "C:\Windows\System32\regini.exe"
  2⤵
  PID:5176
- C:\Windows\SysWOW64\Register-CimProvider.exe
  "C:\Windows\System32\Register-CimProvider.exe"
  2⤵
  PID:9636
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe"
  2⤵
  PID:9748
- C:\Windows\SysWOW64\rekeywiz.exe
  "C:\Windows\System32\rekeywiz.exe"
  2⤵
  PID:11940
- C:\Windows\SysWOW64\relog.exe
  "C:\Windows\System32\relog.exe"
  2⤵
  PID:12004
- C:\Windows\SysWOW64\replace.exe
  "C:\Windows\System32\replace.exe"
  2⤵
  PID:12192
- C:\Windows\SysWOW64\resmon.exe
  "C:\Windows\System32\resmon.exe"
  2⤵
  PID:12280
- - C:\Windows\SysWOW64\perfmon.exe
    "C:\Windows\System32\perfmon.exe" /res
    3⤵
    PID:1864
  - - C:\Windows\system32\perfmon.exe
      "C:\Windows\Sysnative\perfmon.exe" /res
      4⤵
      PID:11112
- C:\Windows\SysWOW64\RMActivate.exe
  "C:\Windows\System32\RMActivate.exe"
  2⤵
  PID:8844
- C:\Windows\SysWOW64\RMActivate_isv.exe
  "C:\Windows\System32\RMActivate_isv.exe"
  2⤵
  PID:8732
- C:\Windows\SysWOW64\RMActivate_ssp.exe
  "C:\Windows\System32\RMActivate_ssp.exe"
  2⤵
  PID:5656
- C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
  "C:\Windows\System32\RMActivate_ssp_isv.exe"
  2⤵
  PID:9752
- C:\Windows\SysWOW64\RmClient.exe
  "C:\Windows\System32\RmClient.exe"
  2⤵
  PID:10244
- C:\Windows\SysWOW64\Robocopy.exe
  "C:\Windows\System32\Robocopy.exe"
  2⤵
  PID:7576
- C:\Windows\SysWOW64\ROUTE.EXE
  "C:\Windows\System32\ROUTE.EXE"
  2⤵
  PID:6712
- C:\Windows\SysWOW64\RpcPing.exe
  "C:\Windows\System32\RpcPing.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:11384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418 0x308
1⤵
PID:2628

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv bP8vJqwo5kaPGIDNsilxmQ.0
1⤵
PID:4108

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
PID:1384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3848

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv lTt5XVH8ukuRcKKeRH+Ajw.0
1⤵
PID:1964

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:2872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:5728

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:6216
- C:\Windows\system32\dashost.exe
  dashost.exe {8fc64126-1dca-4368-b8106d15f48ad869}
  2⤵
  PID:6372
- C:\Windows\system32\dashost.exe
  dashost.exe {48c6d36b-fc30-42d5-9a15cc1be1c1f7e5}
  2⤵
  PID:6604
- C:\Windows\system32\dashost.exe
  dashost.exe {deb8f8a3-87db-4ede-894e86c3850fb948}
  2⤵
  PID:7032

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:6252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:6476

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:6828

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:6956

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:3348

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4552

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 7d8e52a7e5df9e306a0395ad9010e4dd bP8vJqwo5kaPGIDNsilxmQ.0.1.0.0.0
1⤵
PID:5908

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:8676

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv ECy1vSrFjka5L4wlQhoPag.0
1⤵
PID:8816

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:8856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b3f00fc0e04293f32ea8dc0ba24f5390_930c87ba-0301-45df-9148-1e0277c5c198

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b3f00fc0e04293f32ea8dc0ba24f5390_930c87ba-0301-45df-9148-1e0277c5c198
Size 2KB
SHA256 34ee3f34c27ddcd41a6c1f59109c59dc3e3c3c644cd25b857dd8bb4358792be6
MD5 8821271d83423e5364792595226cc07c
SHA1 18b1774dc2d832300cdf4d17aa5bced97372f357
SHA512 caf507429cfb655a693b86acd59aa1ad113ad5f961006118e5d91bd54a3aa5b37e87c3de92be3c15707a37e128401ff8952a2b65126da66782e0ead07ef52915
TLSH
T178412C3B6A9010C0E9AC1C347C6E6B715EB38667F2F5C239F29E80242D9F188C0D9B17
MD5 SHA1 SHA512 TLSH

Submit Download

b3f00fc0e04293f32ea8dc0ba24f5390_930c87ba-0301-45df-9148-1e0277c5c198

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b3f00fc0e04293f32ea8dc0ba24f5390_930c87ba-0301-45df-9148-1e0277c5c198
Size 2KB
SHA256 e740ab1f7ad48082d23f5d5b4b87e20d8866aa22565e0056da729ca67ccee8fd
MD5 5505373db55a8a01b5f64a7a7f3e73a9
SHA1 0a19aed739c0530ca49b353f82fde62671cfb648
SHA512 c31083fa6af5eb4650f58aba0d676f69b3ffb528acae92aae063549db87ebf0e99d8b8b6bf00e0e7d23bd12eccbe365fdeb4ade30661a708f7173b512de01a89
TLSH
T117414C45579104ADF44C85738D8FD1A2A246CE66DB93C5563E0D931A2A951240C33DD2
MD5 SHA1 SHA512 TLSH

Submit Download

CERT-Machine-2048.drm

Path C:\ProgramData\Microsoft\DRM\Server\S-1-5-21-540052884-2969440504-464782435-1000\CERT-Machine-2048.drm
Size 28KB
SHA256 0ce65cd38b0f447b108038a504ee10e27235ca6a463c9ef4887f6a206df55e83
MD5 78b970235ffc0553a42fe855d5247066
SHA1 1dec81e60bec49b81c68a26b5568dfa02aa05f0a
SHA512 8ca45dfa6ea1162e70a3566ce52547ceafb026a9b4148d014330f5f41a87661f55bf158afffe732d776b9e20cfc2d57dfcd66611ba78b74eedfa88dd2d05218b
SSDEEP 384:ksoFOJ35a7GRZ5oF7XCKb95GR1K801fKFSXX3OTKk:InqIpXhBU1K8ufKFSXX3OTKk
TLSH
T1EBD2792377FE6019B473BB998FF5D8D1DA2BF92125268D1F10A11B0F4251C629D82F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CERT-Machine.drm

Path C:\ProgramData\Microsoft\DRM\Server\S-1-5-21-540052884-2969440504-464782435-1000\CERT-Machine.drm
Size 25KB
SHA256 6d5aff2068e2ba78a322427b8fd3f065129448831b76e93a4d3582c9d2475e26
MD5 002b94a58ee7dab5984a2a441f2e522a
SHA1 28c8029776a2c36d0a5b66d6eae098e06b497cca
SHA512 c7f11059b61fd7371cc9d9d265d7358d60a419faeb287c4400ab6ee6911547fd688378a6b0fdc948c2b24e24b66e380593409325eeb3956182dedac0a3b2255b
SSDEEP 384:kAW9an57+O+1W9tft0AODyKx0SKl73qPKoLt:957dl0gKx0SKl73qPKEt
TLSH
T1DDC2581377FE6019B5B3BB998FF4D4D1DA2BFD1126268E1F10A41A0F4291C629C92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B7CEBA4139B7484BAF665AC9E712D61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B7CEBA4139B7484BAF665AC9E712D61
Size 1KB
SHA256 603a7a5dc17d8306416cd71e8fde135d87388d3d7bfdd22d3ae8a782ea58960e
MD5 19736da8bf8e2485618328d0c8797e7a
SHA1 f1df1c281f5f458d471237340daab1de6d58c98f
SHA512 0585ed17fba47d32085d974a59959745368268e04dd567bb96dba1a817905d53f3d4a99dcc5c619efd55a740b112d88ad09e842070283c26984fb1ec8f257b55
TLSH
T19D116512491C9D02FD557970CD5EFEC1DC793193A3C4CC3B285A2A49105AFA26BD76C7
MD5 SHA1 SHA512 TLSH

Submit Download

ACA15F73AED45B992F0387578EC2D19B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACA15F73AED45B992F0387578EC2D19B
Size 1KB
SHA256 6a4d3b214cfb1627ce7a8966fe2f8676f21bde5fe741424f36892e82794b204c
MD5 3dea2c0bb20b7e4e765316c6533d7503
SHA1 3c669502dbfff82506d13863df9fd0cefdb63795
SHA512 99ff553d4289a8bfec237fc6581395f6ff1f76b23f10bfb8f134c2e841b75320920d6252860f71a574a527b75c40ca5d9bf781bb65037761b320510814200dd1
TLSH
T1D921458CC16D3397E5C3DC5069A878E3B6B453C359D0A2757488E5880413FC6FA9F756
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7179dec7afb2d7bdd0501f5248eb047a63689db1acd26c800b0dab6bf3935dfc
MD5 86c98d67a15912cac63fd83552f2b1e2
SHA1 7a5e98e908fe1acb8ab6575ea34ec155cf6b035b
SHA512 c8f71ba5855095130bc58dbe3017e92caea901e0d6d6655d9c84d9e3f0bda5fe49b1cd80bc371a98632cd7f40d3b824af7609532490c1c856513ca846fa4a838
TLSH
T117E02BAACC25AC3709FD471860584B8AEB64175B2B91550F3E3D960CCFB163745CACAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 74fee9269b5030e39b5360974af6b6cbd5c02b68e049160011f783fe1d326ecf
MD5 7d3908123380f160d2675bf08b2e151c
SHA1 e05c980aff98a813006399810e754b23f4db445b
SHA512 a8ea2e63e0b25049eb7bffaa7e7dd356c511bd29d6c0064f8feae83bc0f5401cd712e2a8c6a588eaa926a62c67e65fe715436ac75927355ac7316a740ca17180
TLSH
T1D8510E38E6BF2150EB936976DAD5ADE873351100C10B0E2262E1C87EDDD6FE22116819
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 eea765f2644eebe87fddb8aa738977502db1a83bea314ccd7d3ff184aa06f73e
MD5 3a6bf76e246cc3e6a2ef76e4598d156a
SHA1 2a62cb191e0947a698fe4c9327db712107d59c43
SHA512 2d30e6d968e973f234988c8d2626ecbff5b69990860c27aca1875e8edcd7572e438f608b12b694c1b99e7aaeca3707e07819eb48e84d61ebc14158a0e1da332a
TLSH
T1EC61ABF787F5896D8A1195F0EB14AE1FCE690524431C38BA88E07E5B93E3972E10075F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a4f5589af7de1b424a333f690f717f7b63dd4198cb28489f4fbc6887021d5750
MD5 0a64e92d4efa581051fb23f3e4e857f1
SHA1 af6b84a7a256f9bbad1036c00f289293a6ba74b8
SHA512 2eeb6c83489bea4d4150e308d83bbae8f66286d00e8733110bd215e22019a548b1d37a7f643e8c6a4f9189c60952a9f084a1c14f1d78cd186bc6e8a18cffeb58
SSDEEP 192:KRtp3G6rU1Q6Yv7spAPRp226qm49wHsb+WNnEm2ww2w4AkwgQaxoVyIsnAUge:KRtpKQ6EYUX/9KwvO20NaOe
TLSH
T19842C62EBD14297B9DCAC32AF9667757D7F5502122C41E84EAFCCA1C09DB9CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1db657b8329e293d19e4d004ee214c94c6720dc23263b1f2d9bf72e48408349f
MD5 21989e3147eceb5c51fe17c811474175
SHA1 8b98dfb12bd9b8d49141678ee4df9dd8e0bf62ce
SHA512 a42a998f8b1f363ecb19deda8f808554d261a2d254a96b0f4131f08206d5b567679300e293a690bbdcc0ca41d6cdedd8a199133dde9f483c834ae72b8dcbf732
SSDEEP 192:KRQV3G6rU1Q6Nv7spOPRpA26qm49wHsb+WNnEm2zneq4AkwgQaxWVyIsnAUgE:KRQVKQ6tYmX99KwveeiNagE
TLSH
T1A952D72EB914297B9DCAD329F9527B57D7F5502122D01E88EAFCCA1C15DBACC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 acf365e3c6f808b2ec11ef30974f6a51c7f9c8149ccad3c10aa8454366531d15
MD5 2f5e367e53320d101f2d4316d1b5a891
SHA1 ccf5dec3607e988ef34027fb07b6b1bd44c25228
SHA512 633f2fd133e306f587f314f831cc63df732b27d28ed4fcd693e4d923bba2813664c20961292c908c374113a722ccd48c5438187663c78255de8bb1f8d051d361
SSDEEP 192:KRtV3G6rU1Q6Nv7spAPRp226qm49wHsb+WNnEm2zneZ4AkwgQaxoVyIsnAUge:KRtVKQ6tYUX/9Kwvee3NaOe
TLSH
T17D42C62EBD14297B9DCAC329F9667757D7F5002122C41E84EAFCCA1C09DB9CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 72c88458dbfe31c265193573a77673af4cfcf6b5a83b105724d6fe1f6dca95a2
MD5 b8b5d9ed22e220ec476cc6b8931b2226
SHA1 056102d357f48df5a894f3ed88cdca13f7a39759
SHA512 d626455b9e6e6ed7eccefb2de48ed594db0ce65cf8a533e1d85e58dc85135223b8b2a808bc837dd54fc3d44c32f7cb01ea2ac53bc007f10095588dccfdb6b444
SSDEEP 192:KRQVoG6rU1Q6Nv7spOPRpAPqm49wHsb+WNnEm2zneq4AkwgQaxWVyIsnAUgE:KRQVLQ6tYmXZKwveeiNagE
TLSH
T17852E82EB914293B9DCAD319F9567B57D7F5502122D01E88EAFCCA1C05DB9CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7a827fcbf16470e7176e13f477c457ee1a6d7106669fdcfecaea8e462158caf8
MD5 0664c41ce4690d1d3fa98a75eea5da99
SHA1 38c57f8a4aed4d7963b8f5c60711c856ff76ddc3
SHA512 1fbaace529b3936a18b1bc62ae4552686974c06de6751033872612918cfeef4703b9014d1c37af0edd022d76c58d61232922f143cd5af2e470fbb033a4c0e097
TLSH
T134B0125080016182C09606F4214294C872185F19960E170253E16A23C82A2618024560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585d0f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585d0f.TMP
Size 96B
SHA256 e5a30121afeb785afb6c774558dc5808ccb2d9e8c6000b29134e1946a457fac4
MD5 0b325024e949d6f8d56b09e1ff52f744
SHA1 60b6009c66c4f83e3c6739cf5b028c55c33fcd69
SHA512 32ea112feed60389d4013b81125c8a2150f74196227c81bccd905d5ddb0a9c60e883ca622a5af4e90a9159f0751c95a155036405c79f20b72013d3b006dbf2bb
TLSH
T112B02232C2222202C00303F020C082E83020CF2EC203A203C3F00B22EC2033000200B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 234b574b0cd6457731770bf8ae0705b072ce5d2b127016bf4cb0277bf4704bd3
MD5 a9cdc3a36112221096390c37a706127c
SHA1 4e98e8a04f7af5d9fe500686315814ee975037bc
SHA512 9810271f1d996e265931b810b652d99bb2ac03db4c4e1626b5e69a9702cf2eb6a52c0156f3161bf7ff7e101ce59e13ea8e044dc1f373c04c6984997d131ac34a
SSDEEP 3072:52Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Lm7Rkm1tYpBeh2BAoK
TLSH
T19FC3123B5D75A83799B9BB0EB08E0B1F1EF189A6C920DD46C8D85A0437EA7CC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 33e5a313e2c1bc9498b9e4fe61036be4f2a994f069d3d0c65780f92925ab3f24
MD5 82d3e5db156ffce4774906bbad7db09d
SHA1 1cb54f40756af081bb834fbcd57716d0f05fb3d1
SHA512 d245622e119d4f19c0a1277adb4da3a5b9055a7ed68d458cd4995f07d90db48f16a5461373d89809f8507a7b2cf83e0ed90d895ce8a0337dcfe3f7e460dedeb1
SSDEEP 3072:jGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:am7Rkm1tYpBeh2BAoK
TLSH
T15EC3123B5D65E8779979A70EB08E0B1F1EF149A2C920DE92C8D85B0437EA7C90A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a4871438d3554029f90460af6fe39a36215f6e2c79425b6393bd076c2d2f82d6
MD5 2f7cb1718943966c0bd47fa8d7964fa3
SHA1 7fe8e8a6d59a46d98989bbf0fb7a0082558c8484
SHA512 e5bbd96a4af3312e4516128e5c6a8812baff71f24b44d46163c67e271decb0ee4f02a9644e2273e57a129f67a199bf877575024629ba8bc91da4169831c02e09
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:em7Rkm1tYpBeh2BAoK
TLSH
T175C312375D65EC3759B5BB5EB08E0B1F1EF189A7C920DD52C8D85B0827EA7CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 f86d02a809ee80369dc6bc3397297db7c44e8d989bb5240fcd2aee18fd4bb361
MD5 594f959a3f35e5faaa6a70423f58e042
SHA1 846a4a8617e2d0a6f389222dc709c8fa85377a5d
SHA512 f3a6b445b371ba9d10124da24223222adc06ba15f7a27b13fc71d374469dbc03144c1ef20e9ab27f39e27af2e1e8cf1e580aa3dccaafe6ab3e64ea7a886d1540
SSDEEP 3072:92Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Pm7Rkm1tYpBeh2BAoK
TLSH
T13DC3123B5D75A83799B5BB0EB08E0B1F1EF149A6C920DD56C8D85E0437EA7CC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 140c37715554cf22bf1b2d498aebbd690c6ffb47eddc74da625454b9725e4eed
MD5 6fd8bf57a54ea20730a8a7ab8f0847f3
SHA1 d648b7fac48bed6b8b2729c5419b1436f17d1f1d
SHA512 63de8001c7b0191ca162da07c05d1d304bb0c71cdb9a36d79082ce17b19396fe561ee1855466e93f53cc1788c8828cf6a94b3817cf8891a6076e2869da3f2b89
SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:bm7Rkm1tYpBeh2BAoK
TLSH
T1D8C3123B5D65E83759B5BB4EB08E0B1F1EF189A6C920DD52C8D85B0427EA7CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CERT-Machine-2048.drm

Path C:\Users\Admin\AppData\Local\Microsoft\DRM\CERT-Machine-2048.drm
Size 28KB
SHA256 e8c95b8e66219d8a22215ec65616d2a85a9df8eee9203ff23d6064b4e04b9efc
MD5 eda0a25d2c0bac4e6e7c4aecadab6883
SHA1 b90a31abfda7c81b2c75ce99e7cf709ed113b384
SHA512 78c921f637e7dd465f3ec7731a910767188b1f327dc7259bd01f8e05e6f4aa66431427e3a07304c223e0ed6437495b5693936f4117f2fb7dabff95a472020e32
SSDEEP 384:jAOdImWPAUtHeaJcSAOLiMtHeaJcgK3E2ZpeZKIqTFX3OTKk:5I5fJcWhJcgK3rZOKIqTFX3OTKk
TLSH
T1F3D2782377FE6019B4B3BB998FF5D891DE2BFD2126168D1F10A11A0F4291C619C92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CERT-Machine.drm

Path C:\Users\Admin\AppData\Local\Microsoft\DRM\CERT-Machine.drm
Size 25KB
SHA256 de1d6121ddb94867672465137edfdff990d816321ce7115eb936f599f4d8867e
MD5 5b022415cbc3924a9d285560fedfcea0
SHA1 12dddb71c90da1004b3b77641ea3db455cfba437
SHA512 82b619fec678e6bf40c23344321217aeb449537258017805e35f8e3209ca4877237dc58e1e0cb8bcfd6cce208c584c0610f400a6d9db1e982ea4b441f36828ff
SSDEEP 384:j13F/w4+zrrN3QQT13F/wRX1rN3QQyKQWWKxf73qPKoLt:ha42QQxaxTQQyKQWWKJ73qPKEt
TLSH
T1D6C2362377FE6019A5B3BB998FF5D4D5DA2BFD1126228E1F10701A0F4291C629C92F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 3410f52d16ceb39dd651c6162f77fb0f6dbe1b1d8ef59f0eb928e441f5922d6b
MD5 14f3fdb0c6eccbb170dabf227c8561d3
SHA1 7e40bf3214968f1eb132fa70d30a910b4ffd0d27
SHA512 582abe2318e5e4468cb73398c8c8eafd42cc313f3378208f77efeb6801a5ad2a5d034d2a67c8d9e9a4e6851acfefda081c4214eb3fe2ad0fc51eff8e0e494489
SSDEEP 768:+0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:QZP2tFPuNnY4UmqEMioTaBacg
TLSH
T1C6154237D190B085CF2C71B1E5ED5F08BA23B10712E052465FB8A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

userTelemetryCache.otc.session

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session
Size 20KB
SHA256 c1dbc9cc463b785dc570baba708db6e6c5f0be4f9b14b2184722116a5983915b
MD5 5f218e5f1d6c5a18391881fb5779c41c
SHA1 795ffb6236aafcc0a98e3972209d7ffa2d82464a
SHA512 c23f3056dfc863a98c90f20cb70976504bc25881a76a67d6f0c784b24bee1df270662a8ebd641001684f77f7ceec5ba378d24b6c104eb2f9f833435fc2c54e3e
SSDEEP 12:TLFV+/Tdiw3CgApztZFUY5xXn0yF/KsfoYmTQDXAmeNxRx0vTQDXAPQ3b:TL2wx7f5R0gggXyrXTr
TLSH
T1CD9225428D146522FF2004F26531102352BF1D6D84B7BACE3FEC11754B43AC941232FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resmon.ResmonCfg

Path C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
Size 17B
SHA256 568269850dbb3f5f52e0e38e3c0b29be06c70c58fe425b39746f5ccefdd668a4
MD5 407aab8c27cf7081eece071c90a65b83
SHA1 d9ec9f9d3768fb1c3646284d77f519f74ee6b8cc
SHA512 88a35933e87dbdd298577bdb33afb1f878dc68f43e7916c4102e893fe04812a9522ed66755df03105fd199fdc3c6bd197051c22b2ea2765d0adba5c375ddd35c
MD5 SHA1 SHA512

Submit Download

tmpA634.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA634.tmp
Size 18.8MB
SHA256 f3fcbd90b9f2c7ac2877c038ff64b98e2ec406a577507ba11751d96713ba770f
MD5 2df709366595d847a336c6559f8dbd42
SHA1 715340b73367129728e0f5ea6215ece63928f46d
SHA512 947c7b7c32eedf84301558a86c48e1094c900e1b199c5ab5267755b7d913ef5f73199646a82435f5fb82417f3638af1b6a68b4b7f297e602b17a543e0c2708c1
SSDEEP 393216:1RwDJJ4zqsZ7Q6n1l90ew1mThOvkXFN0+U+OdlqQWui+XZSWZcj1WMJE:fwDzDsBnXydqA+UHdl2ui3WOskE
TLSH
T1CD1733B6E6D9573DFF01E2B8F22567B9D86A004FDE2A40296B346347D02471D39B22D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 7cef6f2185e87b159ba54f88083ff4a8b8fa12bcb99e037b7975e6b5722c91c5
MD5 2a4ef3a471aa5958141355acf70a16d9
SHA1 4ae5048b60e03cb7b33048a23855d54a4a382c3d
SHA512 5a3601a4be5fc86d41aaa2a35c71d46f83ed899f9b2c5266c891fc6cd65265faa5963894ac11a5f75750b38348a2cb6034b4f7692ff14cdd9dc45c3aba4205a3
TLSH
T122214C561B8ED8708AE01BE71DEC8E2673B7C7CE4351D0A5B349A039481652D6B3D16D
MD5 SHA1 SHA512 TLSH

Submit Download

Holzer.zip.crdownload

Path C:\Users\Admin\Downloads\Holzer.zip.crdownload
Size 50KB
SHA256 f7f624d237f1d81858259c1783be9c7a605fe260b22092af064bc91035010fef
MD5 46c66dccda54ac15c941e7589a5da5ca
SHA1 49a4f3b61753f261fc5f3e7d69f599ac0a5e083e
SHA512 c4c96aebf3d0de7127e3e45c5670323781ed8ae4bc0413c6b35cb2f5e9ee8ccaf84d5dbf655b384a1cec4b8d8fcbe5970c43e79bad76cf9a17ada1b3717c57a2
SSDEEP 1536:5dlKxgjOc91+xkuSL7/jVqFqGBh8tCxFngg/:PlJjOc9WkuoQtF1gg/
TLSH
T169330121D8547B19B8A5BC7500BDC6EBD3B643677A13E8A3AB427A04F41C1D15CB84FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 2.1MB
SHA256 2a074a7daf365620185b6437ad6918cc6320e79fea3bb2b21a680dd1bf0f9e02
MD5 d3dc2998ffd07bbac953d40fd89f54fe
SHA1 efdd1164edfbcc0624e150aac79cf20ddf67d67c
SHA512 51b5dcb84a9fdb40ef3870e926239c6ad2ff1c06b998421239ce4eb00d920f1a35ea0ca06688ef7cb96fcceaba183a67719de1ed2a3237668a9fefaccf650666
SSDEEP 6144:5ewXKA2P1dVxfXYYUK9LWZ+tKgb3krYx5sPMdYC6oprgfS7GdDjDXcX+xp4pfXsV:5yqAzqQB+9lxulyY1Ms55C+Va
TLSH
T17FA5DE3E13BF09225105848376759BBC5E8732876FC9F718393FD226ABC6D928A152DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 11KB
SHA256 cf4eec18c554ca683b72d38f820ed23b8e179ccb3d58664eb5fe288ab532e86f
MD5 cfaf48ee51568785a697cd002c43db61
SHA1 0d18ea4365cb437128349190b20f3f5a662428e7
SHA512 6d41786ae8507b7c68f35fbc3c91d753a3fec4c91020bec8122576bd88ac9604850dec41d73ca0b5c141c7d2c139a2b5d261483dc8ee1722e2d5c92e5fa6d05e
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnHwFHMwiGdgbnQ:53gbq3gbq3gbY3gbq3gbHw93gbHVnqr
TLSH
T12E42A339B1992EBB5C9446F9DFD038C26F8097794106A03395C4FEAFA279042F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 23085484aa541bc0da3a5e8e486fc82710d1ae15adc6c484285e472fa342dddd
MD5 e49155528c5eadeb9c7344a0a6d4a435
SHA1 909fc133c1d4ba504cd43c11b1e33e1d4ede85ce
SHA512 c392f1b839bb8396d7e874f1ce0350f0459d083e17e2f2b1f52041f9b667f24dc9cd1128b8becc0d14c9ffc56687a7cc35fbbc8e0a3923486e2306059479c7ba
SSDEEP 192:53gbq3gbq3gbY3gbq3gbHw93gbHVnqY3gbHZ+H:53Iq3Iq3IY3Iq3Im3Iv3I5i
TLSH
T11552B339B1992EBB5C9446F8DFD038C26B8097794106A03795C4FDAFB279082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 16KB
SHA256 b1ecb844cb5f81b81085bbe154c71f015b0e4f9d3debc9074e260ba5fd47a985
MD5 958a4b532bae7e414c4c3e02e51a772c
SHA1 e8cd1b3aaa9b0f44b631c4d8a819d8b37611e1aa
SHA512 808ad78bb696811e9b7b851e08a1e7abd0ecb32a0da9ea214d1416092d31348a3aec4693c3dcb66b77c0e5904dd0434dc8332d36add84a8c9338c170b274c0fd
SSDEEP 192:53gbq3gbq3gbY3gbq3gbHw93gbHVnqY3gbHZ+G3gbHpRp:53Iq3Iq3IY3Iq3Im3Iv3I5X3I1
TLSH
T1EF72C539B1992EBB5C9446F8DFD038C26B8097794106A03795C4FDAFB279082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 12KB
SHA256 96aaab364680e9150040adda45e5f104e4b8b43ec2dd619489d059423c7a396d
MD5 9ec9bbd1b5d0c3e1cc28a7400d500c03
SHA1 6b47c3a3499d052b5a117dbcbcfd76d381d5664a
SHA512 8646eaee44985d372f969fdb3497ee471c1c3ae0e110d2336acf82e253a005aca5da837c548d47afa0e376536e35284a5990b32e125fdad5e2c2024c994ca2a2
SSDEEP 96:5MwiGdgbneLHMwiGdgbnEjgCcZhjdjUjHBHMwiGdgbnYMwiGdgbneLHMwiGdgbnt:53gbq3gbE7cP5od3gbY3gbq3gbq3gbt
TLSH
T15D42D339B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279082F5B07DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 14KB
SHA256 b679a5081730e8d30ad29a3c66418b403c6b60cf2d2a7840619073c40e005cec
MD5 ae4709076f724bf3530a8dc11f190d21
SHA1 458ace567e578368694c4f32cfe30180e07d5e8e
SHA512 879c84ca64b5b15529961a6f66d7090853ca9a28c0555cf3fd531c27ad705c4fd21e861ac74941074c14a988dfc9495ad376eaed37e6a80e8bf7288f9eb3fe39
SSDEEP 192:53gbq3gbE7cP5od3gbY3gbq3gbq3gbq3gbD:53Iq3IScs3IY3Iq3Iq3Iq3ID
TLSH
T1B362C339B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA279082F5B07DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 16KB
SHA256 68765522ef5f029bf0df37498e9991aeb91a4604ba9962fa6e21e3867ae27e43
MD5 3981716d01ca00f98b7b18ff8ef8b52f
SHA1 e35cd241205ddb07c765cc22bfed86783af01d5e
SHA512 f57f39f3d054bf195f7392d4c2c0ea857942ea1bad7f11c04d607515d7a9581403d132392d576ca461d0178919bbe779b36bc1d39d369995a4e1ad171d958963
SSDEEP 192:53gbq3gbE7cP5od3gbY3gbq3gbq3gbq3gbq3gbD:53Iq3IScs3IY3Iq3Iq3Iq3Iq3ID
TLSH
T1CE72B329B1992EBB5C9446F8DFD038C26F8097794106A03795C4FDAFA239082F5B07CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 43KB
SHA256 014bf573a12bafa30e003bd95a7901c27c7752a96cc329019f13c893f2bd4c5d
MD5 5013234e7880825c542a35574d1a2fb0
SHA1 6ad25a7e6f53236d73d07cba9be360ac2f2593e6
SHA512 3b535ee9ab667b5f99180e290201f29b904fd1c8b27e7aba7a0937b787f948fe4dbd4d90fc81957a866521b5181dbec465e113d8772bdccf260da4575aa23b30
SSDEEP 768:NVToNfzRjuPzwHToHPij9McFretdEj8pSGtVOHkQHnOHcwBZYK3K2mAs7nVB:roNfzRjurwHToHPij9McFrejEj8pSGtM
TLSH
T12613D3324B3540263A9B9190B3DE0B6DBDE7720B639CA05C777F45151B00E2AC6E9E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 43KB
SHA256 e9b95a0ee0bebe8111f88e827d8e7bb0c49b16f6411e0f4ec2e1fec71174d616
MD5 1efc00d168f209c9efc9431d9c861f99
SHA1 f7ec22e851c5ee5827390cb613f64a9eb3c76a9c
SHA512 0f1388807eb287cfb5d980e80b6f94fc5e276e8765f114723edc585297f8a84bd6476882f16e3195362dcbfa38a86aa642881e00e2723a2542094a6bd16a8e90
SSDEEP 768:NVToNfzRjuPzwHToHPij9McFretdEj8pSGtVOHkQHnOHcwBZYK3K2mAs7nV8:roNfzRjurwHToHPij9McFrejEj8pSGth
TLSH
T1A513C3324B3540263A9B9190B3DE0B6DBDE7720B639CA05C777F45151B00E2AC6E9D7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 44KB
SHA256 668a8c3d4aa117c5372483205b20d8ab4d25010350297e9cc76c13c354a320eb
MD5 fc7d32e84996d62b68955c3037da327b
SHA1 bdb33c9622ff27b053c0640a515bde8e72815a46
SHA512 a803ddad87b36a79dd29972ec66ed46adf92aae13444722bf4cd7ed9d882afdd1700c36162c14b9594698e134f8c6a35328081b54df237250c3fc37663259597
SSDEEP 768:NVToNfzRjuPzwHToHPij9McFretdEj8pSGtVOHkQHnOHcwBZYK3K2mAs7nVN:roNfzRjurwHToHPij9McFrejEj8pSGtw
TLSH
T1AD13C2324B3540263A979190B3DE0B6DBEE7720B639CA05C777F45151B00E2AC6E9E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 305B
SHA256 546c1cd187d57694b017eae260d8661226b827905fbf646d543130f4d5b08383
MD5 d668b4b510a5f002de26c8bcb687c9f6
SHA1 b80ec2d44f2020bd982dc9b4eb4eaee7b20df759
SHA512 6ea332994cd2d12ada8cdb97b2ce9eb8f9cbdb41304cde6a4e689429f362023669400ada8d46f645ff1d9c6a69e565204e818deb0f0a52047ae7262cd5d29505
TLSH
T181E02B234B650323022352523259535006E841F5BA1D0347F4BE6F74774FC9495B5D26
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 585B
SHA256 86fafad4a99e9a8d7e62ad7d5da59e8661c6bbbe54be002f4317d8cb5330e5aa
MD5 b6d3218813610d6235a6a681972547d6
SHA1 0048fa133c5db0745a1e36d01496201fa80c5214
SHA512 c5936bbb044caa5f9e7e60510e3b8aba14f5506cfcf8ddd9b616af4d09e6f41d71a5d5f34a8e5face0ea98ce6c841302f90eca04d98e201f585480c293851267
TLSH
T101F0C0235F5D43270233A111250D432006E601EEA5184346B4FD9BB4335FCE495F7EA2
MD5 SHA1 SHA512 TLSH

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 811B
SHA256 f19bc962787bdcbdd12bc00dfdf668ff5d2de498382a6968b529068bcb8c4088
MD5 6506f75a830758cf6cde7dd03b477c3f
SHA1 c5a108d8797c6b22a531fa96c5de0c3c753df7cf
SHA512 8849c25c4e4b1c757a9f5be4fd25147b65e267b346f9672e9c19f9076e8ea4d30c0f0cb73bc01c22fad7b9f05a6810448d4a8643f653caae51c734797fa63ac4
TLSH
T1150190236F1983275273A661654D433007A702EE95154396B0AC9BE0335ACE894F7EA3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5656-1346-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/5656-1304-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/5656-1307-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/5656-1335-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/5656-1305-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Download

memory/7604-375-0x0000000001200000-0x0000000001210000-memory.dmp

Download

memory/8412-519-0x00000000359E0000-0x00000000359F0000-memory.dmp

Download

memory/8732-1366-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/8732-1293-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/8732-1291-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/8732-1357-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/8732-1365-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/8732-1292-0x0000000000FF0000-0x0000000001000000-memory.dmp

Download

memory/8844-1343-0x0000000001010000-0x0000000001020000-memory.dmp

Download

memory/8844-1342-0x0000000001010000-0x0000000001020000-memory.dmp

Download

memory/8844-1333-0x0000000001010000-0x0000000001020000-memory.dmp

Download

memory/8844-1277-0x0000000001010000-0x0000000001020000-memory.dmp

Download

memory/8844-1278-0x0000000001010000-0x0000000001020000-memory.dmp

Download

memory/8844-1279-0x0000000001010000-0x0000000001020000-memory.dmp

Download

memory/9752-1370-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/9752-1322-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/9752-1323-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/9752-1375-0x0000000000450000-0x0000000000460000-memory.dmp

Download

memory/9752-1325-0x0000000000450000-0x0000000000460000-memory.dmp

Download