44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
Size 3.6MB
Sample260702-vgcdfaas6x
SHA256 44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a
MD5 53303b9fbe6e6f9b5a3f78d65e7ec376
SHA1 1b8e7398f26d9519db6f0ab761af2321e4eaa400
SHA512 a8bad756fbe46e337eff30c23ea25ebd84380fa122eba2047690ea252cef5e128d657c3b3fa3ea902783a3bf711b64c2a60f29a53ebf1ffa63956ec3846829f5
SSDEEP 49152:tYRw5x6M1vgjI45TMwwapIgTUVO88hXl+UPji0Aj:Su5x6M1pLapI4/h1+yjo
TLSH
T129063922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe"	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe"	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File created	C:\Program Files\Windows Mail\wab.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Control Panel\Desktop\WallpaperStyle = "2"	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Control Panel\Desktop\TileWallpaper = "2"	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Control Panel\Desktop\WallpaperStyle = "2"	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Control Panel\Desktop\TileWallpaper = "2"	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{8E7F3477-317C-41EC-A63C-08FC06E46ED1}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{7DF2C99F-6253-47B6-8B0C-9CD6733557B1}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe
Token: SeShutdownPrivilege	6136	explorer.exe
Token: SeCreatePagefilePrivilege	6136	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4724	sihost.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe
6136	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2692	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2960	44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
2796	StartMenuExperienceHost.exe
6136	explorer.exe
3944	SearchHost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 6136	4724	sihost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
"C:\Users\Admin\AppData\Local\Temp\44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2692

C:\Users\Admin\AppData\Local\Temp\44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
C:\Users\Admin\AppData\Local\Temp/44002a13e61cbda76de131e2ab46bf6c8284d0c0e2277824f44f10745cb8826a.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2960

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6136

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 4.3MB
SHA256 3dfc467afab2ef432982b83d44ce993dd83ebf3315e42a3ea39525cf55a02391
MD5 adf34890976b349907734dd310d49640
SHA1 b8fd5af73fd41752ac42c0cd8ef530d318aaebd6
SHA512 fd82eea35029dd9be8e639cbc13613fceb627456c250893eaa60059b82dd9d10db309d291329b5ec88253172486e988af46c644e675720e95528bef6791d6749
SSDEEP 49152:tYRw5x6M1vgjI45TMwwapIgTUVO88hXl+UPji0AjmVO88hXl+:Su5x6M1pLapI4/h1+yjot/h1+
TLSH
T1F5264A22B1A14165C066C075CF929739EBB23C558BF087D76246F7D82F336D0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 7.2MB
SHA256 3a2dc755f61e3ab5f0e6d1a956469aba0218ea965e5ad7e257f99fc4ef0cccd5
MD5 6bfeb22f4912524976df7ec590dca8fc
SHA1 cacedff8f554d64ecdd771ff069b65e0abaf7b08
SHA512 3225d8f43bcd1895fcefa0f3bae4fb42c1ee4360bccd8579a92c969313e4a2a22d1082bc5a06ade3202600c53d3031f1c11b3454be0bcb15ba6183faa4fd0caa
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo:JtcI4/h1+koOtcI4/h1+ko
TLSH
T181763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 7.4MB
SHA256 ea93426ff7978709b0b9f386c870b041851c5be5813e10330197bae41126986d
MD5 c67d7a91d6b9d6253097cc417a288790
SHA1 52257fe7d49a2a46734f2700548427a47628be83
SHA512 916075ef73be1d9ed9b2f8f65e6b2cfe19908fc86b01d44b6703c10f507e7bc2f4b6b759da2a867bc9b8c7f5feace66af669c1dd169a68bd792e34189098f829
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjom:JtcI4/h1+koOtcI4/h1+kom
TLSH
T1F0763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B3D82F336D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 7.2MB
SHA256 eb95a949a0df58a09d6195997cdf3fd9c2793e02e52a885e0e79e3976aa8b889
MD5 9b33ad539f2e10c978b4d1d3d73eafb0
SHA1 cf81e94b49117d61c48e0684d5e4eca421f012c2
SHA512 6709e4744d8ed7f35dd4083b43f0cc55a16ba5104cb687aedd636d9256411d101a632313d730bc94b4743d5255a10868730c964726dcadb93a4a5c7a7a4e98e9
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoPb:JtcI4/h1+koOtcI4/h1+koPb
TLSH
T188763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 7.5MB
SHA256 c35f5582e405eb49e14885e08a1a9797bca3a515eff216c038884086f1f9d29d
MD5 8ba98c9c466dd521b2918580a4622367
SHA1 34f0e2b36a4e72960da1a9ed75da47fb3828001c
SHA512 b2b50e37af903d1391458ed5c2457c5957149ddac09fe5687e9bbfc0a9ce90a6c039695915b5b7638aaadabfd95bf420faf51dd15ac8e1dfb8c72e55e90deac3
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjon:JtcI4/h1+koOtcI4/h1+kon
TLSH
T1D6864A22B1E14165C1AA8071CF969735D7F23C698BF087D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 3.7MB
SHA256 02bb3395a8e7ab7cd174be7fc3d6cfdb6c0d778e9a17e27eb30105ca4f9cae3e
MD5 27dfad539646834b6318470ad40ed1b8
SHA1 a0871c062e7d0890878b3743267d37045fb55035
SHA512 521466524f66b45ba070a023995cd27f4b3ab7fb7392992d011f4536113a247622f8a7e4192e5cfdabe0bb62b2f6ee648bf4bde498ecd2ab60358d6fe81f89ad
SSDEEP 49152:tYRw5x6M1vgjI45TMwwapIgTUVO88hXl+UPji0Aj9:Su5x6M1pLapI4/h1+yjoB
TLSH
T1DF063922B1E14165C1AA8031CF969735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 13.2MB
SHA256 e5c9da69e479aaea648db3b55731199e73ff3b8b5d5d9ffc90348713cb031212
MD5 bdc201b1ba7fa7936af7e56940aec9f7
SHA1 0a4b06b32615437b8d506f5a2b455de10d57a259
SHA512 76ed50b1cfb26087fe14c17e5b321c2ab33b9aca11115c3208d3ca6215730552baa2767b01225b392cdf064abea4a894284ac77bfab2a991d8f48ea4fb0b80f1
SSDEEP 196608:JtcI4/h1+koOtcI4/h1+kozQyiKaUX+PNo:IuHuzQsas+PS
TLSH
T179D66C13F2F141A5D06AD474CF6A97319BB13C5A8BF083EB2144B6D52E72AD07B39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 8.9MB
SHA256 a42a37886fa3f98b262d1e7c07f00c115312ee9ac8593ff46b0f9e40a588de89
MD5 9316bcc5fd812f607efc049444af2f87
SHA1 28c0564deabdf74c326d84a79789613bc19a2897
SHA512 7cf548deae1626e6392e44ac9ea57f08e894efac4f414838e61b73ca865f9292691e361a577adf5ebfd77577487ad7e16ce4eba05d0120eefa77ceeb18ba48af
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjofthHRc/Q:JtcI4/h1+koOtcI4/h1+kofthHf
TLSH
T185963822B1E14165C06AD071CF869735D7E23C698FF087D7A205B3D92F726D07A3A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 10.6MB
SHA256 af38602eadfcab4b9990239c105af518b1155e40d082b7834406409ed6bc16b8
MD5 0cdaf2f3d09f4bb8c5901300e51a201c
SHA1 0f5baef821ae080ec962e97adba0d753b075c083
SHA512 3ffbc7e34d756f0bef412cbe1081ad4917925400e0c245f9a91edba887b8ba6a5311033e6e05b8a04dbab7c1b353f92287d2e7b4b28648656469b4cedec6389d
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoSy5112gYy5azzVvf69nLKnhs:JtcI4/h1+koOtcI4/h1+kobLIHuWhs
TLSH
T1AFB65A22B1E101A5C069C075CF869235EBB17C568BF197DB6241B3D92F33AD07B3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 9.4MB
SHA256 593b3f56e8790de20cd1bb42d4b327270d242d4c480490ce2146ba9b86a780de
MD5 c8d13603bedc5a4d94a47164202abf03
SHA1 2489958ecb88ada2ed337e74273cacf4d2d05351
SHA512 9a148f2b030f4aeff381a017adb600eca141082937588d066d36281358315fa3afccb144a13a9000aee57faeac78a277a954c4bf0ff3a46f7998353d3e43ae64
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjogu6Jm0xd2d3:JtcI4/h1+koOtcI4/h1+koL6Jm0G
TLSH
T187A66B22B1E141A5C06AC075CF869735EBB23C594BF087DB6245B3D82F736D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 8.8MB
SHA256 62a36a48e9fce4127412bcd47ee37309ee1636a1997e47ec4842984eb26726d0
MD5 ad232864fcaf016514402812b4a646f9
SHA1 9c6a40be266837cbc5f08a959e02c1996f13ce32
SHA512 0fd0a91324fefd35e09f9a02f9111cdcb48c64c289a8ce8bebf34f46b2b75e624bc37426f3346eb360acf753b41e7ba75e8a99606a7eef0eb713e543f114486d
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjosmifP5R7:JtcI4/h1+koOtcI4/h1+kowfPf
TLSH
T163965B22B1E141A5C06AC071CF869735EBB13C598BF087DB6245B7D82F736D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 9.0MB
SHA256 b90d93078648ae445bf08a4693939154dfd49f7c94ae62c4d63dc4996259f68a
MD5 93ac58cbbbfe32e9209328ba72c04f30
SHA1 06a46fece18240f9da213a81bec43bb157abae0b
SHA512 8a41c8aaffebd5a690333aacca1106cfa71defdaef84675e7ff2101d08ddb6781583e33d83e7e1819db7b0c09b0a30a8032268401bf248d481722933a73314c0
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjof5dKCi616:JtcI4/h1+koOtcI4/h1+koBdKC16
TLSH
T108965B22B1E14165D0AAC071CF969735DBB23C598BF087DB6245B3D82F336D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 10.2MB
SHA256 cbf4984452246255eb029edf9704b13328a31fde1b0c41497336384d65f8453a
MD5 271d6aac0d5bcc61da21aad55047b317
SHA1 b93ba259311ed425a6ce2a80ffa9776dc95d5d8d
SHA512 98a16ae2c450e846a10195064bb82e9700add3f492190855a8bd05c0c745a93e0f4adfc3291d16ced2b2e1c5cf97a4233bcbb71ea84c44986060a2a37d2ac256
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjotm7vj1BDlZG:JtcI4/h1+koOtcI4/h1+kowjnDO
TLSH
T12AB65A22B1E141A5C069C031CF869735EBB23C598BF087DB6245B7D92F736D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 8.6MB
SHA256 0ebe9d82833130f322bc9ac04cbf9813ece5223df489f0e4ec8ffec405dc2971
MD5 e39e1958a2fab02e5112de0c66a570dd
SHA1 8a48a0f05a9c8d23423f723b9f31a96cd5065733
SHA512 636fa839d4622aa2e711f48ba579657b5d0fcda498bd90f6c104d4ccf22448a87c9a4092116c1c8920b8f546218414d0271866cd23bea3dedc332bca9b21ab01
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo+X2iwphX:JtcI4/h1+koOtcI4/h1+koy2iw3
TLSH
T11E964A22B1E141A5C06AC071CF869735DBB23C598BF187DB6245B7D82F336D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 7.2MB
SHA256 2ec1dcf206234da865ed536cdabe987d2458ce6059122870bd7d77c89b1c2b48
MD5 f2fdc843a3634ef085cc1c7ec6f7334a
SHA1 a602cb63d1d09d0d49912f89618bd61391eb235c
SHA512 c84d032c523871cfd6a585591b288de674e745f57123e8660b455c01ce99575ccc533d9f672f4974e4498d544db7a3404bce87caa6e15758bde8b53e6735b9a6
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoj:JtcI4/h1+koOtcI4/h1+koj
TLSH
T137763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 7.2MB
SHA256 df0a98e4ecd69cd6b5b2b39e8379e881bc38bd9c174890dceb696801e43fbcce
MD5 bca715792c3e9898a41455a22f1944c8
SHA1 565169571c53bc84db95c3a26f2387b9ebd4da48
SHA512 69c1622b6fe7bf8ccd75c63725bc553aa925262c93856ca71eb7310191a4f3218fde55c48e74b5b668ec3ebf9f1e659f028bccb629a6ccbf51d5b078459a88db
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjor:JtcI4/h1+koOtcI4/h1+kor
TLSH
T1F9763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 7.2MB
SHA256 30832dfcb07e61facb2533188786f347f8c1a162c4d0e324c7e4007b81638ae0
MD5 bced66aff413796d0b8908a9b15ac337
SHA1 e3e51846725652c16a12d0e969c8ee02b2a773ef
SHA512 107c79461d4e59546c75b4f6d08a4ca54ce76006355c80cb7ba5d9be64473ce1e324cb73d412c3eb8888e3e3fd3a1f3cb5d6b0140c97d1920350710b6586d186
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo8:JtcI4/h1+koOtcI4/h1+ko8
TLSH
T1C3763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 7.2MB
SHA256 cb8702ebafe63297654e6fed5dcbc5746c76b11458c32329a5759bf72aca4452
MD5 07649d0ea9ce34595fac18128890eb57
SHA1 2f53c9affd4e594cb282df9d8614f8fa0d280d2f
SHA512 63a70f683e6f7fd23f202c4f9895d7517e2e16640d3ca8c8b48e031fa0698e2e571fd576262947fe6936f434bff53b526aaf8e829f9f25482b1a589dc5e261c9
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoV:JtcI4/h1+koOtcI4/h1+koV
TLSH
T1B7763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 7.2MB
SHA256 9ecea954bdab54f0675eb053bf6cb3adae9003fb83413fdfd1bc887807340320
MD5 3fa62587e30c0232ab1d436aebd0a987
SHA1 0f9782d6b1dadf92712f1094fe01868b029cd824
SHA512 93e881e7d56eb256cd7f9129d52cf6d6e195db7197751f1fb3f85301b02892be39a90d13bfd2b400be80728c6c2e35cb09a3ff01a1bef16e581904f294b27d88
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoo:JtcI4/h1+koOtcI4/h1+koo
TLSH
T102763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 7.2MB
SHA256 821b96816ff40bf2125c8c02469cb919c944cb666649001babd6d398383a563b
MD5 d759bf511597c04475c3c8f439a4487a
SHA1 854a56e549950a7af627f1e808c04186ce3bc67d
SHA512 9e0d1c04bece41ed4f42e27d55e2e1753d24bf632bf48d45798b0b8fa0c4df465d0225299b7bb11d808e51efc3a22318b842dc83cdd53ef5c280dea5f73b81e1
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjof:JtcI4/h1+koOtcI4/h1+kof
TLSH
T1B6763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 7.2MB
SHA256 3428226ad3828dfbe221182592387ad9af23d5ef7a1a6f4fac46db7d82da3449
MD5 70c6b47336c5285541d480512f1fc476
SHA1 1d50daefbc775b51bd2f1218a4630b4499682814
SHA512 5dd9d0ceb8a2287095cce55a17333bd91f8b6dd2aab9f86d28e226948b9de42322936dd66523ad479b08e86a834932eb4a8d9905f28843dff57a30f6e81688e4
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoU:JtcI4/h1+koOtcI4/h1+koU
TLSH
T163763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 7.4MB
SHA256 06d0faf81d534e333d8da4d0be5b8572305fc3f46e3c1d2b1892fa714b828e5c
MD5 d91efdb775c64834aef5657742995a92
SHA1 e3639680fe558e037443dcaa7b3e1d664b49624c
SHA512 3b7da5ce30195d10dd8a9d010a4ba77eaa11319ada7bcd36fc0a0632ce52291e0e74390c1515a350b203672981aad8a33b49b209e499737fd231afe15729c4e5
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjovzfu:JtcI4/h1+koOtcI4/h1+kobfu
TLSH
T110763922B1E14165C1AA8031CF969735D7F23C698BF087D7A245B7D82F336D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 7.2MB
SHA256 cf947f98bbf4cce901be6584be1d387b123707fa22b0cdd8cc603d62135a7161
MD5 963dd4c5bf49f33823abd65ab1fc6ba3
SHA1 c407f648dbc03ac9676854d4a8027d3f3040a569
SHA512 23ea6aab413f3e33e6a59223967adce10e79b1b057b195e8f8712e25c8e41a2b8b644f9d28e22b4b0488d87b0f35f8b8d4af44883ec69c1b87b36a7e506c7175
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjop:JtcI4/h1+koOtcI4/h1+kop
TLSH
T11A763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 7.2MB
SHA256 ab055cb66a3b6b5229ea62e807a1ee0ab574469efaf378789c6063ea1dee0fa1
MD5 0a5c1465ef2373700e3108f6b8cd125c
SHA1 819c220e180974f1802f53805e5e5612a1d9e51c
SHA512 6bb13ecb363cc3aae088b4e43a4accc18f273b3e3d71fa69deec65efaa9b175039b52558d893fea6a74b2a5ed4379dadad6b5a3816d87244301385b52acebfb7
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjop:JtcI4/h1+koOtcI4/h1+kop
TLSH
T135763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 7.3MB
SHA256 77b9f2ea2d8beda4078755fd65cd0b4d02b4967b5e5e6b3bc4268e19acb5f089
MD5 3a1ff5b142f9dd53d3d1d4e4deba6ecb
SHA1 13f94b4cf6d324fc542fec9db23cee51022aa962
SHA512 5d9a6f40d1afeebfdfc6cf8e7df5c577bfee38de67c93779278d5852c2b47f35db0bd0f3af6792ff9650f1f61256373e979be94d90c8d6d45b7ac2ceec8c29fd
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoss:JtcI4/h1+koOtcI4/h1+koss
TLSH
T122763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 7.2MB
SHA256 2c748bc398a90967ecb0723a8442248381a4139d677866f6b53c9e0eb1a18060
MD5 dafef835a1202b46a413c92b4bf9d726
SHA1 629ee4c097d63aba517f9fc35701f884b648f1ed
SHA512 da62a2694ddfe64102d3c1e50c31396ebcc32d7de7f6a7b70e75c12024efb472c6e6d76c1a177190ad5d2e9f72317e7e72cc0a4a58d5ede28a91ef95ede75a79
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoc:JtcI4/h1+koOtcI4/h1+koc
TLSH
T181763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 7.2MB
SHA256 23a89080969ed55b521aafebfb584b42718de0f3fd581a9fd046931747cb1469
MD5 4d542cec977bfe5918e791efff976c12
SHA1 8cd1adbb81caa0f385430fe6a605e8160a25e1a3
SHA512 d52fa6767fe2e8f6958392fe777635e85d4e4591b0298c68c14aae0b5235c2bbb3ca926d004c7593a9484b6fe5df8f507d5788af3d65e7c8e407f6dcb04011f4
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoe:JtcI4/h1+koOtcI4/h1+koe
TLSH
T187763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 7.3MB
SHA256 0aa1d01c7711baed6fcf369df626fa5e077acf5461f836d79265d28687776d20
MD5 adbf4f882eb2ce2e3ea789bed7b7b683
SHA1 bb22921b511a1ec55fb256218e3760120eb84118
SHA512 2965f6987d1055a6927d0380c9c4a6aa43f58ca20813e0e03ed409fbdc97d8034160faa9c44c3ecbd8c205207e67e46f04d448b1ef512e79b0cb8007c8e5baec
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo9T:JtcI4/h1+koOtcI4/h1+ko9T
TLSH
T1EC763922B1E14165C1AA8031CF969735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 7.4MB
SHA256 d44ebc41b5e354e1ad23e4b86f3befa3747db7bf3a3660a6ef0e6de1f6d08a21
MD5 60757fcfb14027452716d8f04bb12102
SHA1 60a9ebcb4bb953c9dcbefd70a713ef22fdd1765a
SHA512 a991ef7996af9c966ba4e64a74557a95e419d0a31d0bbebdbb9dd37d78da29f88b5ddb8bd1568c0bb0545c7fe702b0a644411828a23a6ac8821936eda0118f5f
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjodLtB:JtcI4/h1+koOtcI4/h1+kodtB
TLSH
T1E2763922B1E14165C1AA8031CF969735D7F23C698BF087D7A245B7D82F336D07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 7.6MB
SHA256 8d909624ebf7b24c8f70d1593e6de2b316976c88f363bb00377f6a5319357872
MD5 8ef7644975bd68b1814ec6d6ec630aa3
SHA1 7dd0d272c6c62a883a6486280472777413a9dbf3
SHA512 368f7a08b503808aa9a650f199055a7d6c6f68d76bfae6d3eceffeceb01c15579eb42532eff46766cd14652d8041c351e6a2a8fec87bb3732ac3d4847b63bd18
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjojCq6:JtcI4/h1+koOtcI4/h1+ko2q6
TLSH
T137863922B1E14165D1AAC031CF969735D7F23C598BF087D7A245B6D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 7.2MB
SHA256 2d8d2f9a6d3cbfa00001a0662860279e872aa5002c4c601ef46c351051445355
MD5 2122f95be459296bd5ae6d0af866d540
SHA1 bca4c347383c3c37aa29bb4daa0c09ede1ec25e8
SHA512 b1d0da13d8b146b3a0e2b40bfba7bcc2f559f268f17f9e1005ea21096a7337d50c7fca2deefe27f6d26df4861508e2d7f81db63a8281c092582f5288f80bd8ff
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjof:JtcI4/h1+koOtcI4/h1+kof
TLSH
T131763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 7.2MB
SHA256 7ce806839e44d0f873cba8a06ea6a1475145c06cc77869c55db287c9d047cc84
MD5 2b9c5aeca7c1256882fd8efa635c269c
SHA1 735586e9ab3b1cd75abc4d6b1af8447043acc629
SHA512 19bd671f4fc0025c019a772cc059afc243524ad28c55769691c112171de48945d8ccabf01b779464a71783e2699e2617a1786f226bb4cb6fef3a44a26187a52e
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoe:JtcI4/h1+koOtcI4/h1+koe
TLSH
T12C763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 7.2MB
SHA256 442403f0c40dbf8e295c178691fdd2626f3c312610e925f8060d7e64b916aef3
MD5 ee4842a15c1c00fb0883d9775ad3ca42
SHA1 dc332c0dce8f5c052c376ba3d78d3f6b12074ded
SHA512 217aaff28cabbb23e2c506c531c1baa6fef63baa051628af09e3f20f4544e5bf3f2ddfbe7d5a31b39b91e712f37153257b2d8b38f6ac73005e79f26584daa224
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjos:JtcI4/h1+koOtcI4/h1+kos
TLSH
T129763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 7.2MB
SHA256 9011ab022cd2ae03439f267db1c680124016a770b4ee4618fe7d388e9d2aeab6
MD5 787c687ab2b8f6ca24a6a31dcf0d2033
SHA1 c64af1fda49f286430f19b86cc8f61d494d1c102
SHA512 480e744745cecc62cc6334b675dc1913833ad92c6888b1dc33eadd23100b2c75741249fb1b1192046ca194639dc2f1d496355db1310f14fcaa0a90835fe317b2
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjor:JtcI4/h1+koOtcI4/h1+kor
TLSH
T10C763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 7.2MB
SHA256 1695aabf09efbc7a1d67c31457afe68fc3ae9680850d4647708ab49534953310
MD5 83cf47490a3d4d2ac6c028f80fc5219c
SHA1 097855dec7d1e770f462d2488cfb433451e8b019
SHA512 edeb0dcb6bd29d18dacd2a146ff2502ed22c33000fcef97ee7237f67aafc81463ce877e7bf903f93da15ed2784eb8320905b419209d898f5ade991153c96865c
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjod:JtcI4/h1+koOtcI4/h1+kod
TLSH
T15C763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 7.2MB
SHA256 329b75f70ac586f1f2f163a06fadb2ef0fe0dc301f37b3ccc87a722d31bac0cb
MD5 7d909c6c8fa041998cece1a054b98fbc
SHA1 3ced8f250a7a9821fb44c0823511e8c1c0710512
SHA512 4956bed900c40b15a7fdc194c335b864952357f2ad88d24fea1260dad21acbcb5b16e64711e5921b15db6e46cd1aaec97d1fb1244dd483d1fed7c216d2ddd3c0
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoB:JtcI4/h1+koOtcI4/h1+koB
TLSH
T171763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 7.2MB
SHA256 cede9921e42c996ea72d63aadc8c170bf609b4d9488b95efe377aacf9a1dd1fd
MD5 b8a6519e8a0cde22b1feb7f1fb051893
SHA1 12bd49fc9e0b2fa0c04fa032eeb444af4cef0bbd
SHA512 5163ff7bb7de46f89ee6c3634543cd8634156f24f1b260d3e7a2dc2978ca2ad16baaa9d874b42692093670febd54868ee7bdd42545afce06ddf73291a16f8bb7
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoM:JtcI4/h1+koOtcI4/h1+koM
TLSH
T10F763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 7.2MB
SHA256 59ad617c540fa5077eb119e97834b2568e6e1665b277ba1f9df6ed9200ddbe64
MD5 525a25037eb8afd2b6c403eeb679315a
SHA1 9f64c6dd41200f2a9450200e09a49edcc15deb31
SHA512 7ee0100ef03a397236523689f98a9eaa6322081d1ac0b0360162e6f6c78cda7a3c47ad69d59a5451664c2af1cda16a9f59adc888165493d3fbc667c4168cf95b
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo0:JtcI4/h1+koOtcI4/h1+ko0
TLSH
T103763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 7.2MB
SHA256 cf8852d2267c57033a5c5ffebc8e46d1d26d4b487c02a7cd5752cab8c81d106e
MD5 e7ff690972831db2d7b2e21466f8f930
SHA1 6b88ff9d44fb943862b920fd629c79cf56f259f9
SHA512 38848fbd2320c142def7d27ee6f42987b27d9838fbb86d94d3303204190913c616b19925e63cda48cd8c1834f8f1859f57854e39c0761e7baa581a3634c25ffd
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoj:JtcI4/h1+koOtcI4/h1+koj
TLSH
T16E763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 7.2MB
SHA256 8e8fe6b428d74b8826cff58b18efb216e6418285b53f6f2cf5fcb43d5caa3c9c
MD5 d6d04d3bf0b5e8fbd37c9d879191cbdd
SHA1 1e4cd2b132ea03cafe8021248a7019033652f1c4
SHA512 674e65b4a3e09b3e3b28c7541255954a9826fda7b82cedd9013adb9253cf0652a3eec82c6e5a879f9e67bc94778e4055a884b02483d335ac7a86322a79cb0bca
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoq:JtcI4/h1+koOtcI4/h1+koq
TLSH
T169763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 7.2MB
SHA256 befa12bd139690212a86bd56ebfa8748531287c8510ba6d62de0b523ef4ed5e8
MD5 0e5fcdda8ec577c8b66a4dc018b45d22
SHA1 6604f0f3956761b96b9b4a6c828e21b17c0220dd
SHA512 634413c3bef69647215c13217cf254bf3887ec8a71fb7625b3157fcf9ef9148aaa319d39cb49189a3dfb8062b7202f59b1067a94bef27902d923b168505ecbd7
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo6:JtcI4/h1+koOtcI4/h1+ko6
TLSH
T1B4763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 7.2MB
SHA256 c7e45a998c67934522e06579fde6ce627cca2b9dd30572c202dfbcc9d0dd4af5
MD5 85d68746f15ac98bf2d63de5f1a5f779
SHA1 1a5c5043906eed46279ee1b4b66463411a957d8f
SHA512 a6549efdad4f66ca3da39be381e34c9ec86ac4b203a41f457e3e1b86a719235b9d8dc1c6b701ffc25fd863fcb1fe5d6612e83e34686eef09a54a45d3d8675133
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo6:JtcI4/h1+koOtcI4/h1+ko6
TLSH
T13C763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 7.2MB
SHA256 905ad4d1858bcb6b83f1d64c40a0315d0681356a13a36ee60d3f72bc2fece678
MD5 ab8a776a4a42af2e60a89bbb92ddaa4d
SHA1 b42ace6ae9614d2ab22d2ea4f5bd90350e20c53c
SHA512 ab44e4424e69953447728683d48e5ebe57d08572c08da443241bb97ee8dd4cfdb253beb1a3528aef998153580f2a66ebfec5a68855505660e0bd2544a4edfd0b
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjof:JtcI4/h1+koOtcI4/h1+kof
TLSH
T1F1763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 7.2MB
SHA256 8947478ca3efecc8d17b782ad2fe5d38f0c870bfb3aa2f5884e2bc86f5d102ae
MD5 fa6fb99ab488805df2575e5951281f98
SHA1 225684a00e33cbcf04e63d92a3a1f384504379dd
SHA512 4c250df12c286ec8983201e4563340256e645f2b73db183c774b946c6627181f8915faa17d30252ff768cdc15953ba41875caef312efbd1626b979e20cba2bf3
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjou:JtcI4/h1+koOtcI4/h1+kou
TLSH
T11B763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 7.2MB
SHA256 5c1b0a8adeed7a8e4c082dc35055b7387008426024539ddf804945f1b8116ae8
MD5 1bfcc76f68eb2ba6968f804114b9bbaf
SHA1 c29a7af75885012bd7a6fcf56fe3100794c655b9
SHA512 e8af6d7d7b392ca0aedcd9ea09f2e18a7d514bd8e6938f8c812f24c3e3221a383ff45011e391d353392e4bd4ef669046203810b9fd4a7023388c299f3a11623d
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo3:JtcI4/h1+koOtcI4/h1+ko3
TLSH
T1D7763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 7.2MB
SHA256 e0a102b47027e4038c46c4864cb5f9467b34fffabad0d4c66748b5786031b53d
MD5 ebabdf0f172a2fe27a62346786bac9a1
SHA1 5a2866d5c3a749e122817bde9a5e5ffd4fe51853
SHA512 62e3148c155413bb73ad43528ab2ccc9a16bc0661241c5a8a5b345aa1fb6e5fdf31d40abd91732457d8a81bb5059d9ea7c0ba77bd713bb049ef12cf44497349e
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoR:JtcI4/h1+koOtcI4/h1+koR
TLSH
T1F3763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 7.2MB
SHA256 27f39b2f34fedaf24dea2ccbc5389d8956831aaf7ac5c154ca8bd422497e6793
MD5 ecd5cf5472a93fe4fcac18c22368d5e0
SHA1 1ba8d7175dd5dba88bca19fa633e6dd832f3c280
SHA512 ef22a6afddd2672664a45fbe2fd9e6edd40604445b1b29329e1a7d5a04a23efeb5d9c3816715b9e4062d72aa63227253882f008adf26ffc77b6dbbc678d5a33e
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjob:JtcI4/h1+koOtcI4/h1+kob
TLSH
T10D763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 7.2MB
SHA256 3abd28ddcf794891b1861bd07c547c0e2fd0c9de1054299deb0fe47b1793d0d9
MD5 e756b10c3247f54fca6acb55bcdfb5ef
SHA1 2c1cb9e3caae99ff64e4b35daebfad320429acc0
SHA512 55513fb344f7dabbd0dce3b7e3a3ce518eeeca3f0ac743d4c388419a7bbc352b881617156bdcc33c2ad25ffac3f9688ab456a2c6748548ef6bf45c112c3b9993
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoJ:JtcI4/h1+koOtcI4/h1+koJ
TLSH
T1DD763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 7.2MB
SHA256 45c6065814219762575b95e3d06f760aac4e4de6a32b3caa7ccca97a84922334
MD5 4bbd3586477d84ffa41e64b615804ee2
SHA1 38ce4657056c844a5d998c307e1e6124236adb10
SHA512 67b33cf8017b6724ac6905761b1a11fd70302b6c06c83fdc8bdcdc98f60dbcd9675dbb5a96a082d1ed46ccc1faa531c01a376fd740efac7421c5050ee557d782
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoW:JtcI4/h1+koOtcI4/h1+koW
TLSH
T132763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 7.2MB
SHA256 0d1306a1b355c32b84800ef03177f04675544d093df7bc754a5644b1a1592fff
MD5 7f62c0757034393f52bcb66c88176046
SHA1 349ca9d765e766ebf6dc3b8a1da23cd05694a181
SHA512 031c235cae07cfaabb216dc1edb3022f2f79e73bfcfc70967f2eb7142d59e5216f24576092a73eb38f5016981966099fb013180ffee574e76965bf92f8037487
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoL:JtcI4/h1+koOtcI4/h1+koL
TLSH
T16B763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 7.2MB
SHA256 76f0d7f29accebba371ee635f18f7213ecce9bfea5ad90bd74cedf1fdab38d67
MD5 d1ecfdc255fe935e2d89ddd5536bab15
SHA1 e07a07fcf46f171f9003d87178da3da48fb037bf
SHA512 2c9c405b8e1edd9b106d9b5409d1cf55240e27272662dc9493f3faf58037ce07e969f3c72221e1e23427647ff0544f109ad9ae121d2430b7e0eec0300131a260
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoc:JtcI4/h1+koOtcI4/h1+koc
TLSH
T139763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 7.2MB
SHA256 aa93eb7d5783baa2cd897da69d90e0af741b0e8b945adcdba091caf3c4f5c7b8
MD5 77cabf5f017594b664c84a6236ba9b22
SHA1 e772f8980862d154a3c9f735cd1bfbc427c79206
SHA512 b6c6a09761e7acd01552b60ce0a439d9ffef1547dc7a042680dfaa21be75937de8575cf41cb1e7cca1414ac114127ce1ec1116dbaa8097c0f37b6aecef6dc202
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjod:JtcI4/h1+koOtcI4/h1+kod
TLSH
T180763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 7.2MB
SHA256 fb8f923255284282ba48ac406f53e74eb372294bd7893a6638d1847d8178ddda
MD5 480c6b1c2fa66a0eb545398d67caf302
SHA1 b8642b599de22965bb54cea0d10a662e26932526
SHA512 520c5870ca5381fb987f9bbdd896ffa18f3a663210263c95bfbc72e5d8e154b4c6ab879483053558e51ab7d0d1338dab599ae54747e57adb887295ff5a99ac76
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjof:JtcI4/h1+koOtcI4/h1+kof
TLSH
T1BE763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 7.2MB
SHA256 67770d4cb469ffa634d3fabac067a9f706c99b0c0cc4f171f06f969306940bc4
MD5 0d8c1cacd2b0ec3c9cff7ecd50634906
SHA1 0c074c0142cc7839e8ad9a6c60baca854e5926b8
SHA512 aa25edb78b940e75536d47a9eb56b39e438bf8a91bf9c8a94db55ce329d319534d4b6deb6afe244a93b17b371ec7bcbba588f6572996c9a54b1553618e746abb
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoX:JtcI4/h1+koOtcI4/h1+koX
TLSH
T1F7763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 7.2MB
SHA256 25d5eee1f533645fe605be522ac1fefa8a1ad099acaeafb8045d38a6b3079e73
MD5 c39614ada84f722e4262f7beab14c2ca
SHA1 2092a460cd9c36c1971fb1aaf9dd51195119ed5f
SHA512 d876b3cb796fa2a3a44f209daa50d7e5262f4d6c3697a056f9bd054a67211b18e76d713a1b2c392014ede9312541096733a567a981d948ca68f3e3ea1c576f6f
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoW:JtcI4/h1+koOtcI4/h1+koW
TLSH
T172763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 7.2MB
SHA256 ae5e825aa2d203dbef06e9e900eee717d1c7a53ecbc7ad09e20a9afdcdbe8a42
MD5 2a89ba202dfced2cbb22b349e505d83d
SHA1 23907139cc06732371e19833ec774f95bda916d6
SHA512 c90a80431208f14d0a01c38583ada9a7c9ed81a49c8bae56b53c9eb904c32dbf65f50098af063843eeffacd66da1304dd47ba0357b139308e81235307c27c72d
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjok:JtcI4/h1+koOtcI4/h1+kok
TLSH
T1A3763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 7.2MB
SHA256 71fd6f05f6dbc5f78ff0ba0c87f0629786de6bef95f44792d1e95ff379f23899
MD5 3a814cccec51cc8bcd167b0886f9afe9
SHA1 580eabe448f8d5ff6fda87503fd1273519814499
SHA512 1ee4c3c0e166a710d300ac4c7e31a87971794728c1f230f035741555dad47b86e00ab2bd2fad010423d5dbc1873558aa2c95ae5a88124f519e62544e23bc4e36
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo5:JtcI4/h1+koOtcI4/h1+ko5
TLSH
T176763922B1E14165C1AA8071CF869735D7F23C698BF187D7A245B7D82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 7.3MB
SHA256 18c7730e18815fd7468192a7124b1e5e5d622031805ce72a693fa124012c6f5b
MD5 3deab572afc3ea67ee32aee08bb93e4c
SHA1 eec5c6bcfe1ebdb4465d7785908b67770d0e902c
SHA512 cd64bb9409a104a18b00e6f453171dc1665dfb7f1b3cb335c43c7f768be6f323e65feeccc9e468657650bfb4fef47cefacca81bfa1fc107a654b9072a9dc49e2
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoX:JtcI4/h1+koOtcI4/h1+koX
TLSH
T1CA763922B1E14165C16A8071CF869735E7F23C598BF187D7A245F6E82F336C07A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 7.2MB
SHA256 7f1e7ac8ae1998e2c647303523ce440737bbf76625cf539145ae9202f5ecb985
MD5 0ede396dd5578fe9221887a4395900b2
SHA1 d8e10b1fe77d102e072a41603a32cf8c2f576cf3
SHA512 0161e9b0257b66aaae8286f5927748b16f2a4c50289cf93a6dc22aed86985cafe39507278bd6e8d82dc03623f31195e85935e8c91461a598f3c2d0321291dc51
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoL:JtcI4/h1+koOtcI4/h1+koL
TLSH
T100763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 7.2MB
SHA256 add981faca5661dda0dea8d7503b133de5de235a523b799f5408e8498743c27c
MD5 395efe9ce3d39935d004f704c7d9886c
SHA1 49d3ed029bef649878e27b2db28e40af46b7e24d
SHA512 0df7768451177600cc3bbfc6d50180ef6dff836d07b3f4ab268353a066711c7101e836469d05a9404ff4d0081312bd6f19cb58fff8579ff06053d7cdda218e2d
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjo5j:JtcI4/h1+koOtcI4/h1+ko5j
TLSH
T169763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 7.2MB
SHA256 4ccc5ea285da1a95cc890e19ab10d893512dd3b3a825bdaf70a8e7d7f95043fc
MD5 1051ac3f99087d75419d1f3af5bd713c
SHA1 8b8f3a7d60a8e43761bffe3ee98b6f964a49eb51
SHA512 a352060d1c2bd350614f2c766aab57e71f3fdfd5f919bed78bf185bca7562954b0b5bfa4ba33a6f8bf42b049bbe2cb6d9bfab559616a49e9808aed2561ab909d
SSDEEP 98304:Su5x6M1pLapI4/h1+yjoJu5x6M1pLapI4/h1+yjoDD:JtcI4/h1+koOtcI4/h1+koDD
TLSH
T195763922B1E14165C1AA8071CF869735D7F23C598BF187D7A245B7D82F336C0BA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2692-24-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2692-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/2796-642-0x00000195C9000000-0x00000195C9305000-memory.dmp

Download

memory/2796-643-0x00000195C9000000-0x00000195C9305000-memory.dmp

Download

memory/2796-649-0x00000195C9000000-0x00000195C9305000-memory.dmp

Download

memory/2960-76-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3944-463-0x000001DE001E0000-0x000001DE002E0000-memory.dmp

Download

memory/3944-495-0x000001DE03C30000-0x000001DE03C50000-memory.dmp

Download

memory/3944-477-0x000001DE039D0000-0x000001DE039F0000-memory.dmp

Download

memory/3944-509-0x000001DE14640000-0x000001DE14660000-memory.dmp

Download

memory/3944-478-0x000001DE13E30000-0x000001DE13F30000-memory.dmp

Download