56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242

Analysis

max time kernel
91s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
Size 12.2MB
Sample260709-ml7fdagx6p
SHA256 56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242
MD5 1e2904ac82d0d7d8e7dd3e644d3304cf
SHA1 624e01fa94d131645db27b09c5bd09bbe23087ae
SHA512 8e170a188e51ea4e3dc31479d3f93ff4db33e25ff08ad238d01e74041c2bd1ba3ca76844098db20b8ffceb1970399398bfb116aa26e16ca642d1ad09e99f8846
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAAT:mqnq7yZ/K0ttYZT
TLSH
T1A4D67C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\drivers\spo0lve.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File created	C:\windows\SysWOW64\drivers\spo0lve.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe"	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe"	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp"	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Control Panel\Desktop\WallpaperStyle = "2"	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Control Panel\Desktop\TileWallpaper = "2"	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{C9D97792-EA22-4162-852D-6B117045030F}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{E3979476-5A03-4C0F-97BE-8F10F5A95108}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe
Token: SeShutdownPrivilege	6024	explorer.exe
Token: SeCreatePagefilePrivilege	6024	explorer.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
6068	sihost.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe
6024	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
3716	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
2364	56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
5300	StartMenuExperienceHost.exe
5472	SearchHost.exe
6024	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 6024	6068	sihost.exe	95

C:\Users\Admin\AppData\Local\Temp\56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
"C:\Users\Admin\AppData\Local\Temp\56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3716

C:\Users\Admin\AppData\Local\Temp\56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
C:\Users\Admin\AppData\Local\Temp/56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242.exe
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2364

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6024

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5472

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 12.5MB
SHA256 f9be75256f3d3d8484d4a12ed22c6bedce945bad3204a5739edf10d7f35029a8
MD5 c780743b0c6e851885d00d8d1c250d52
SHA1 65307796ceb2a19d620d9a70813bfa2d78438c08
SHA512 ddf3141cc0c59a3d2097bebc770fdcd656be51fd1f155be4c2b825d0afa246f65fff7f9f61c2329de0d338c9cb04ea0ecd79e4da7b62f5495ad2d590085ff53e
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATY:mqnq7yZ/K0ttYZTY
TLSH
T1C7D67C13F1A440E9E16AD174CE569231EB327C494BF1A6EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 24.5MB
SHA256 3819d36f2874a1ba509672eb383f4e62072bb76a1d3acd11cf240cf557f4f5f1
MD5 c03329e3c6c4c04318f231813b5d3e6c
SHA1 fad655c7f9c8290a43ec776fad8ce8f0c788a945
SHA512 ae7e9608aab71452cfdd028c4b80f8ae4ee650280143980737edc176c9f302a586b2bf2e3b3242d93f5a7c800ef3ed71e01664045490cf580e7d109bceff5c40
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/W:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTh
TLSH
T1A9477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 28.5MB
SHA256 f30648a28e5e428ffb4aac0f26748edc0f2d3cb2cebdbb5f8dc93b5cba72b8f3
MD5 1fff490f2451d72af6948fbcb732e82d
SHA1 ff43779c44bca5b791b3bb5c8b042e165609ca02
SHA512 9905ce38a8ac8a1448b1d8380e2394eccfd2fe96236b1f3f8970ddbf7857084d76e78bd90f1e7107db18393897bf8924a9418f43860cd3ce009e6f1329f59a07
SSDEEP 393216:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT/vyEYKbi:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT3A
TLSH
T103676C13F6A440E9D166D134CE669231EB727C494BF1A6EF2240B6D92F33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 24.8MB
SHA256 59591949be4089d113113a04c2cf1e761cffe5bdadaaca898d988c2b07904157
MD5 44abf5f040c121b054573a48f0cca683
SHA1 be3e39ccc390c1df4727aa5ebb1e52d5268d7fdf
SHA512 f832984e0c05389db620df6a22b2b391f1eac4e27ae9cfe8c694dde9b745a87fa36d710d1e0a56d343d58330ac4ec88f4f2efa31e8bd9e7d7cb6a853160ef3a0
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/S:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT1
TLSH
T1FB477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 47.9MB
SHA256 e443e36fd177f7c7cd3d353d18cc12a3c9e52e6bf802a8f08f6f1a983074cef9
MD5 9340e00a36a8ef523844dd9fbc931656
SHA1 034d24b70f3d5c79adfe6164e0f187ba50d71ae9
SHA512 833d67f94278fe62209b6d9f36bf4f57ee803841e5f3ecb718f2e88bbc800085d280e2f526ac767cb4d22fbda64bdcc0fbcd8a50c952d08af1b7b531b743a6b6
SSDEEP 786432:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT9E8c23pV2X+T:mqnqmZ/K0ttYRfqnqmZ/K0ttYR9Eh2ZJ
TLSH
T1ACB75A42B6E443E6E266D134C9718272EB717C0E5BB162FB2174B29E1E376D07E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 14.3MB
SHA256 a1b693524e028476573da3bbe42d6b5eb2873fad59b42913cc552c09eff72ec2
MD5 b110cbbe3b5e030632070e3c627e11cb
SHA1 b3b17217fcb0c178520f4110943dca119d459b7d
SHA512 7a590080e9873b7fdb77bc219fc36dfac40abf2cb73384f534eb9859dedf42051757754af8ab17c7d0589d0f2fb7a618aab2d98831804a752a8c0134457195b1
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAAToGn:mqnq7yZ/K0ttYZToG
TLSH
T151E66C13F1A440E9D1A6D174CE568632EB327C494BF1A6EF3250B6D92E33AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 30.5MB
SHA256 38d20e9e81ffa2785a5b8c530590a754b59eeb21e82c1f137c12a7656c2f650c
MD5 3212d7fff522b334b4116e585d47093e
SHA1 2ad0e39d8901f68ceb1a0b56af5f769c549c3ecb
SHA512 1fc118a03cfa47774de6350b20ab72c84fbdb612f40a518221d2981b1a04517834abc4409044d9b46c4ede22bd85577d8d2289db774948096737b7f34f30668a
SSDEEP 786432:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT5Fz:mqnqmZ/K0ttYRfqnqmZ/K0ttYR51
TLSH
T1FC677D13F2A540E9E06AD174CE659232DB327C4A47F1A6EF328076D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 26.7MB
SHA256 ad9ae150a7da9174adb23f3cc585a39cb9892a969b85cfa20fc89fa5a0bcf908
MD5 b69dcd6d94dc28209f3b9b621ccaf54d
SHA1 da0ad23c7bcfdbd305985566c9c560b2cf424fac
SHA512 8abb4be384b9ce515f8af669e741f878eff903b997f92f9dcb74ca18a4964736022aa2eed84339e51c68a6d0a423213de681e0bd8cb2b6b2c83c41619043674c
SSDEEP 786432:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTH0G:mqnqmZ/K0ttYRfqnqmZ/K0ttYRH0G
TLSH
T1B4577C13F1A540E9E06AD174CE569232EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 26.3MB
SHA256 aa41e5346cfd026d4abb9f0aa4e5fd84ba350c56b226dddfa76dffb432b223b3
MD5 882ff4821bf8a9d717b2cbf8bf09bdf7
SHA1 0d33ae52cc7a863c0d3c3bda182468e7c3efa4c0
SHA512 bdf8689498db44fe24877b8634bfa46534a727ef6ea44c2712c6edd52d06d8b78bfaa668a1e36ff402f79993f911a052145064cf30c95d13be2a1db18751ef0f
SSDEEP 786432:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZToCg:mqnqmZ/K0ttYRfqnqmZ/K0ttYRoF
TLSH
T1B6577D03F1A540E9E1AAD174CE569232EB327C494BF1A5EF3240B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 27.5MB
SHA256 f188fd99156d632cb26ed957fa488ee326eb32ecda8f602835051107bc11d3e5
MD5 c0435c57780480db9ce69b11c42726f2
SHA1 611b41f32eb25b118e6cf2f4922021052f78dbbe
SHA512 963ea13521d81013eaf44e3f1f21f1810b0c1a663c4a3ecac753077289781fd39142d2a09907440321fe0b1b23ba93b08a58cf885a2ca5240ca263c299d8e703
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/A:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTsO
TLSH
T104577C13F1A540E9E06AD174CE569232EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 25.8MB
SHA256 c9fadf0e39ce64583ebe236c2a04a4a92bdcef16aefcff1b3c4fa3d5886ca449
MD5 cf1a6cb2dfad43e0540857f8c353efc8
SHA1 a0db77a5d6c83215624e0da01b13153bdff80d5f
SHA512 90ad1253c5fb891641b33ea2bcb979f1b279afe83c962b1ec09c77e5bedce652c1d079344f5d4bb1b04da8f36e6fb01a301045fa90d3b2026829e14c2e0919ed
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/C:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTa0
TLSH
T103577C13F1A540E9E06AD174CE569232EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 24.4MB
SHA256 a51ee4f5e0e04c62deb681ab35c5bc08c4cf244fba8210e421e9d5b01bb6089d
MD5 028735fe659dad4da8e7898061cd6672
SHA1 4945ce7f6869e623ca6200ff8679ae6d8e99f048
SHA512 f28b04b4c05c1cc7931772a210d01a38800b3aa3525ac28caa0e0105343ea41ff4ef45309789bee99676012eb8e001c54c06beeed0366d4d2310e8422fb4ca34
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/y:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTN
TLSH
T12B477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 24.4MB
SHA256 c06b260df6023f9eeb5c4f4df23c308483463995aafeffb08dc51059b3466968
MD5 1eddfbb683c03de234e0658c40af3c2f
SHA1 37657fb1c6be64b2758f11ad0bdb791309ee711b
SHA512 1297059db96cdc9bbd14febf48bae7982e91c9a664ad279ddd0adf538c7eeb6900718a9d58167f77e6807ce1419a155600c0ded5aed6dcb316cbcf378486ec4a
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/u:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTZ
TLSH
T11E477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 24.4MB
SHA256 c2d1c5e2e920e786401d4afc47b45d831e84f9435546e150d24062c0b249bf40
MD5 7b45d374067650e239781e2be3989a49
SHA1 337adeed178dcc53b7b563df52e87d5c77e4e460
SHA512 9a9dbb6fe5d8c4e4c2fa37beb70068ebcce0c37f335c4c568d1918d3f482c02351871da08e9e305e409e1da39815326dc2fa9f48bc61b2d3d308f8d29ec1aa04
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/p:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTC
TLSH
T12F477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 24.5MB
SHA256 b6950910a070c27d26bded474e2afa3c8d2d117bb654dac3e753958aa543cb27
MD5 5a65d62214c65426747263742aba2f7e
SHA1 08562e70452b8d1b55f3dd4841b60a7f9d8b25f8
SHA512 fd50b51fabeb28e2bd77dc9be83e6bd269908b8d787979711c03c3c6a3e1fdab0f83eb56098933fb23b2e4f9688fbdabbce36f7d52e220dc6b6d579372becccd
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/8:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT/
TLSH
T15A477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 24.4MB
SHA256 20461e3d2ce76debbdcbea76419e465bda92e5e35315e0552d564e0cd78e8b51
MD5 45b194ad0a350f2025cd85ac928db38c
SHA1 28f7b15070b813cde3647195da46b40bca11cfb0
SHA512 5dfba18e41c4f01d5fccd4920642e129d7e92dbcd02408758fdb85e41b594bbc4883ec5d5f01804350b2a958723703f1c591cddc854fb3465998e545490fc9bc
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/5:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT6
TLSH
T103477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 24.4MB
SHA256 3e2a935a443dece2f7ada8c633f7c9faf5c6b175d589086f751323e16a0ad60c
MD5 593b72219964e972f824c157dc086f30
SHA1 bc18cb62749c6808e518c61cc7f46147b226d359
SHA512 1eafa5dc7fcab687471514c3d0bc6bcbd7c42aa3acc3735a976e34d792b8a828870949d97ba418f32527fc01c95f433961eb34a774313185e47d51d4d7e1911b
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/G:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTV
TLSH
T12A477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 24.4MB
SHA256 ff9ad44e87736b73f490d1f5f7368f604f8318fdbaaea98cafb40ea9bb0338a0
MD5 10cde271f90202c666496c5c42e1fcb0
SHA1 a3b5d106c0a13fff18c602dc8d6be6c645cada52
SHA512 56c1fcaec4bf52819602d79dd8a3d9321362691b1d4fb4abafcb6307c5be136690dbbfabf0248822e15b7b81048e9ba221ac5779905d26f653bdcc0bc88e2a6b
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/R:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTi
TLSH
T13A477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 24.7MB
SHA256 896c7478a79ecb351043d3528e6136b33480d820bba55e2c5796a4e17be9ecf0
MD5 02290e25a195862a8486c7391f4f7c27
SHA1 bd000a9b50db7f140b784f38018bd49fbaff7aae
SHA512 bffc6dc559d0bad6083038335288a365d5840a3f4dd11174ee16f4e39ec591d96ec15b22c1dcab5ed8e04eaa3d31d6e604dc20648f8df5c161b599fd5856b6e9
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/7:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT9m
TLSH
T179477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 24.4MB
SHA256 423588261a0030adff9bc69275ff9bd6f860760e9025a9b50e6f9d288e15fffd
MD5 aec5269532f42b36da2b5fd87264a795
SHA1 2ce650201ec8856b73ce4dd5351db23713ed2738
SHA512 ceed730c2fc3c52fb024d054cc272d20e8610bb275f8d9a419249cea20d656e9af784376f439d5519351b83f3c18b5848e488b9a063e277997d9d941e12528f4
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/o:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTL
TLSH
T1E0477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 24.6MB
SHA256 a694a64655d1a12914ba67809b8d36d602430fecb904ececb087a0eaad0b8271
MD5 d54541f6d4eb0a99367577af2814dac0
SHA1 8a49b11c58ccb5c17fe3080eb63480ed6b280c46
SHA512 d0e37a4b83495a4fe66f2fa536073f20d7306ff4c552a7830ea50e6dfe52fa7cce9aa6eb6ee8699eef87ef082b14453ac9af968eab1f6cacaef40b4cf53d6000
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/0:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT3
TLSH
T1BD477C13F1A440E9E1AAD174CE569232EB327C4947F1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 24.4MB
SHA256 a3e9627a8eaa2fec0dca3002e2ace2ee327c22c23397589ddf90d3bc8c1658ef
MD5 ce728cd66ff2fe19061d86c400940c1e
SHA1 b0dc768ebf7d3a52cd48a79a17070616e0dcac4e
SHA512 734a9c76ff7feeeef81dfdf95e12d7c659a52fa9c940ce39325ce1bb50c326383d4041600372462f4cd463f1f8f00dcdb72a5280fcf64273ad7602cae84de13e
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/N:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTG
TLSH
T169477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 24.4MB
SHA256 8f2b49d77a422fb62a9b867d394dbee4d1dda5d68eedc74060727f59d6d2a7f3
MD5 c050898704aee14fd01029517f353840
SHA1 273e791590daa4143ad2db4d7465b4f00da0bbf3
SHA512 8e34edf3377755b79cbe4b047014dc219d284971637a2e4a85c2e0fd720fbcd20ae13de78d11f473897d7b334ff8a0e3a0285b01757664ee195d90674e3336ef
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ//:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTQ
TLSH
T181477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 12.4MB
SHA256 90be86adb247d82bf8acfb3759b2f439c6bb5e93e14baab67f1675f71243f1f4
MD5 edeab02c254a250967679b5e96bde889
SHA1 f0c59edbf65a61bf7cfc1eea04f3bcef75614bd7
SHA512 50efce4d706a2c1abdfd158c17b65b94f6e4d89fd61f3d25bc25b2301010b8b147f838071575eea4b97d4234f38e38fbc70e417199da40e25e35586b1d37f4e6
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATbT:mqnq7yZ/K0ttYZTn
TLSH
T10FD67C13F1A540E9E1AAD134CE569232EB327C4947F1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 24.7MB
SHA256 dc5b51ad7e39fbf3606858157f032a4faa8cddb8405d5f5c55d5da2f3b1d4eed
MD5 c72d8ebca8f09c642c7e86ddc3a7955e
SHA1 f3db049dd4966bfea5c75a1d0bc3859a7face2e8
SHA512 28188e0f990abcae0dc9f4f4b5f3451c66d5c83ed01e2b3ef54c09ab2a353514a7e0689be4ef6f832d7703c36546abd9162ddc250a46e7222c609224f90ca6c9
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/Q:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTj7
TLSH
T123477C13F1A440E9E1AAD174CE569232EB327C4947F1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 24.9MB
SHA256 e111a1ac963d408eaa1e690b3d3fde75179f8d6df091ac8eee8dc07c85c4ee74
MD5 b9a94776ff88db5a397ff339b414d3b5
SHA1 f44c980188d850ea1ceac4388c1d6eabc0370754
SHA512 d76e73cab5bff3a8442a8e3af68538d557fce271d0713c0ebec3dee6c0d4169ded4d8dc45d5daf9953d911e3c05b4ffeb4bfcfb0ff1b47154dfbdee2eeb2041f
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/X:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTUd
TLSH
T183477C13F1A440E9E1AAD174CE669231EB327C4947F1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 24.4MB
SHA256 23fb4c83c86254ed43c5aae6d8bd3760e859e06b5e2b091717b32ab56b7945e1
MD5 e99e107ec5c57850a3f791966afde3de
SHA1 a419507ac1aa502e14c5a38b1ccb10ddde4d3702
SHA512 bce7f9622768ddd16fe24e880aa2565c79910a31ba1d92e2bfc41b09f0dce9e7e678deeca5994038d4a0cc93eb73af68efe3bd8e070160681817bf5f5af76b83
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/+:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTl
TLSH
T1DE477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 24.4MB
SHA256 658f6b989fc7ecc5ca93c572aef213414d4ac8661840de7922485b126d6243c5
MD5 c451c004fa5d18bab23e6f50c41b41aa
SHA1 6123af7d77c7ea9c8534f6f7477774695e3ce79f
SHA512 a7fdce5dd38200c98ad6958b8d812a4fb7e98b1c3966ab0e5078e3c85f4231ae61d7f192f833c1e775c62711e7a5d4267b332b90f3c6197a32894027b210d43f
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/x:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT2
TLSH
T14F477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 24.4MB
SHA256 bea522a9f8d0266ce561f06189f45fb040d09473eeeebccc72cc65e32e8a30a1
MD5 ab09df638e22c9da0afecd1b770d9c52
SHA1 eeb915389fb6ac8ed78d786ba573eb97590b9df3
SHA512 19a5336f1e6419e22e34a4dfb23f5122af6257c22c1e8dd80f652bce78640d0f91fd370729bb77d23f54e6fb7793ec1121c76462a8397ddb865cd02a26c357eb
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/q:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT5
TLSH
T1EF477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 24.4MB
SHA256 efc4267d7913276d409a223e6397e037b827ad9e0ac55d4a1693658af56d1547
MD5 3991055f68ef278ec8f4858a83f4964e
SHA1 a61988bc9b5ec1289112b34ba188dfaa33986e1b
SHA512 30fcacb9c98ec58d12e98c2203d9b0d2f9bfe70e23e3837f0d4c53b8b36ae6c75cc36890addb28e0b5822f6ad12f729a6e4386f81b80344579207f9e5a99cebd
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/w:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTr
TLSH
T13F477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 24.4MB
SHA256 f013fdd3facc950bf39198974225cb05f30edce0cf5d14694df3bd2656698710
MD5 d6de1bea93dfc60ff172d9d6505923f4
SHA1 41417bc02178b3c63c4d86ee318edc96d411a68d
SHA512 e70f804f5394bcb96f99fd0d88b3ac7e71ac17426f243635332306860e4c50bea9735ee30a1bdafd93e7c13d2a6e413686f08b405f75fe11307a3eeec8457f7e
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/E:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTH
TLSH
T165477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 64KB
SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
MD5 071d69befc4545d16c8415ee31c5afdc
SHA1 98106920c20562db4df0d21c498f51369d927ad9
SHA512 994fdea351d7be4c5434f4840958dad54941761c7132fb3cdc5aa3821de5c697829bc462ca8428d6341e9076d304a231f945e48f12c618c86ab01045a26eda17
SSDEEP 192:2cBU2BtsR0Mc665DfEoHTgoPQ3bRcLAMZSwSH6BhnPb0SnHnQTt0UeG9ODBZHlsP:2sXDsmJDZzgyQsRDptkar4Vyg/B
TLSH
T14D530EF819C0F18AF8D1D571A0C9B33926EACDE5BB5047DB7C172B429EAE4800397D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 24.4MB
SHA256 9e7ea373a366074c1ef9e8900538b9094b97e4f18afe025312848e57e2914605
MD5 817dabf5662e4b439f6a0ace503ab5a8
SHA1 fc264a78c84db3334fb218d0eb527246e676d252
SHA512 8f13e21ed1b1db873e088e353cdfebac89a5a65ed778191086a7284b7e6b3134f0125c92ed9135d445c2340bc342ac947aa13febe83b0ee033923596832eb270
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/S:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTd
TLSH
T102477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 24.4MB
SHA256 e64cc969123164559558b2a6251e5b6f7e16c2d2676f90febd98746be789d744
MD5 e258f6e0b0038e35056eb4faf0d4b874
SHA1 3b8e71de62d5be36ed3e85378895f7a7f0f5885a
SHA512 7a790a7793a36dca87f86e87c3c4397babb21fb9f14304251a52c576ce3b52648f37d9f34c97bec973636824fc5b280add20b5862bd0b38042cb43dc199bccda
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/D:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTs
TLSH
T11C477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 24.4MB
SHA256 00d77233adedd8aa2ff982a01cf5acdcc2281ac90b17876e3fc54be82bf842dc
MD5 0272c0b66ea2b145a53ab4c151d0bc7d
SHA1 bb0f84dce616473af6e299677ccbabf845d58604
SHA512 bb567481b9aada3567b9fb414bbf9ad0d7716f4713cbaf82822b336a4c814ed60dfcd6ff0d5adcd481243d136e7a915651cd2c313f89927fcc25d6e13209a37c
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/r:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTc
TLSH
T17B477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 24.4MB
SHA256 adc00781550f293f2586c9f86082b15cd94a6c6d46e982838197121cd7e5b288
MD5 839c2fd8a2f3122fa052a489fd415024
SHA1 b925d0debfca873f89d37d69094a8bd066f6b2ed
SHA512 1b10e591aa092294f1f33f3bf5a00fdbff4c38d9bc6b32a23408f9d3f60f908bce3bb28f50a08eb8917cf260b6985d3547c1942b4f5883142e2ff1371ea03074
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/m:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTl
TLSH
T1A2477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 24.4MB
SHA256 49ca6612a277935368f1087ec2528e484c9168437a39636d19f309740d71ffff
MD5 6fe8154b1c1342728d8bf5d28d42aca7
SHA1 60cb3105122ad8bac0f9b937f63094d7af527873
SHA512 2297203f73a3cb0b754d74a02c6377614067ee77d3710f52df35d6075e91668c05c017b5d16f36af9e935bce055865fc1de3caf10e9fb40a77b8351afa4b4367
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/b:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTY
TLSH
T108477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 24.4MB
SHA256 9eb466185fa1a30a15afe2d9300a831e237be9aad8decdb935cb97d55cef86f1
MD5 c7fcf857a7288cee3821fa070140df6b
SHA1 d8097ea3751529dbcf62a95600791ec98ca0f5ac
SHA512 2dfb8a73560b98f89a804e7d1c3185c0d534b9dcc3d2d9cb1ca462a1c6f432e0f6ec65535671de88edefe81a77103bf53779c2cf615d011eac44e6dc8a9f83d1
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/w:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT/
TLSH
T18A477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 24.4MB
SHA256 0f627ae501b50025aedcf744d4f00102bc048420e6eddb18e3a358d364d8759c
MD5 3828addd166179ba0db4693ac3c1c136
SHA1 b0f617fc61614207562c86316ee40c111b5f7290
SHA512 5e7683cf82f6da522e6ee4dc0b0584ebcedf52e714af9199d102f148d8865b996982adb4a76b115067b8d34abd2c894318598bc36815669e42763c749827fea9
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/i:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT5
TLSH
T1FD477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 24.4MB
SHA256 166fa15200e16372ae0efcabbb74d48fce3d59c8987239ffd0826a2a5c6b69c3
MD5 8eca02e6e9b39074b806855d491883ab
SHA1 634989513ccf4ed0903734fa420172f808f36ce1
SHA512 f8cbb3514635722d0482da4f98de81bc7592c07cf4eca676a3e22e8bb1655f6e55d073333d69ce2f51d52e63c11f464cdb2f11df899684086ddc64fe12b94bbd
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/Q:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTX
TLSH
T1D3477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 24.4MB
SHA256 7da0070896094ceb41efb340e69723c34c5537cdc139382c264730a88d307a19
MD5 2d6d6fe55c9b813c99bb7d6b32684250
SHA1 edfa6ebec0f6d6c3045faa60efa4763f536d15b6
SHA512 1e4bfce02427d1c680b86f98bed972d49bb700c47f3ff4a96541173da831a80e51977960498dbe9eb8705b1d316957e35dc4ad053c0a210887d1f30d84b700e7
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/z:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTY
TLSH
T152477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 24.4MB
SHA256 74200de17f84605f9095bd0ccf98dcef7925dada305b05dfca3169fe5c984ff1
MD5 9426edbb4dd0d0a5c97b9eba96246cb4
SHA1 744c1313eda56fa09bfa337481f6aed6019fc097
SHA512 cc4786ea72cd5b4bc809cb953ed5e1c6eb2f7baaff1ca7e9d09725458f749a8c44f6187d41a96ed3d4ee222b503d26fc80b277a9a8e2779877c9fa2d7fe892f8
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/e:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTB
TLSH
T11A477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 24.4MB
SHA256 8d06daa756e2946ba9bc1ea1a6bb3fc0b9a4acc8b181ca83c37e39046e4ab109
MD5 498481c42b7e24a508aae921cedc605a
SHA1 67ee219af225055628221992470234d26fce8284
SHA512 2fc173ef739452eb74aac866eb7a013d77884d9fca3f22b1e6693a9bcbb00c8eefcc294798bee4d62fb9c823ba608da809717e4748955b73b77f3a16ee77f4e8
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/d:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTm
TLSH
T160477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 24.4MB
SHA256 b24fd35c194b702b2ebc7097454864fed097c49ceb10e2dd2a526f6783237882
MD5 e05ad940242ce5c4ac293258e52123ac
SHA1 509e2d80a91e6ea788793ac791907a141552df63
SHA512 f505a2c42b2d38b4ebe7af8f7c9e545f66aae3629eec5f8e026e39acb178fa99214e2e585cda4d054943efedd8693a6914d8a36fd74e96c9e0e610c0d6ef5a42
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/4:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT3
TLSH
T1BF477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 24.4MB
SHA256 85e2a11661ef1f79bb996913238cd5799a9d9517de53cfde1e8b70cd0295e3b2
MD5 43af8790bb3cacaa12b66febfb2d540e
SHA1 99ec2c38d875a0a34f7a3059ccf4c92d5e1f0cc8
SHA512 bfb37d4bd50c9b1f898874825d259a2d5fafe836b0db46ff2714c911943b8885cb0b6cde0aed99c4b82d534fc909caa1ffacce2bbb4f4c8639ecdee30beaf6f5
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/S:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT5
TLSH
T1F2477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 24.4MB
SHA256 09b617cd183ad921511e6998807e7f0c2c73313ea9dd1dd841268d3a057dd6ea
MD5 c9f4d5671d97181a1afaf7f7271721e9
SHA1 a7b639c8391d7a4a93d8ec5e387b7df775fddb1f
SHA512 d5e629404f665138af65b41ab4d41af2ce281d45d385f9ffbe7875ff076c14637d300ffd40141fa39e5090822c389308d2c8332ff454b5acc0d4b8280f1ae700
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/W:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTN
TLSH
T17C477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 24.4MB
SHA256 a872a23ed061a4981c882501714333b9def8160cd119a36c4c62e25fe789268e
MD5 abbcf97178a778978b1946519566bd62
SHA1 5205537d8768b1ea7bdade3a8e5998d543deac37
SHA512 dfcec0b71daad7c154a815de2d0e0a4829ca69c63f30cd71f0167f505b4c078dc14bed7e76aa7a403aa7edd43a0eff15b5e459b00ab153c4eaced36e8f8cda93
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ//:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTE
TLSH
T124477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 24.4MB
SHA256 29c48d1c0e60c188e3c2bafe62220df828f792f487c990b22c48c39f2b2b26f6
MD5 557687da67c2ab2f0db584281dcbcef7
SHA1 2f315c0b2722685f02f90050ef1bd4c581723b64
SHA512 923330f72659ac740d4101a7d8bc10b498387df60ab72ac7f21345e40f2ebd9c410e15cb26c9b9e301028124c1babbe90638dd1f70fdea55467d5690803aacab
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/p:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT2
TLSH
T10F477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 24.4MB
SHA256 1e8b6add42261a67df3d667159f4edc038e2ea17f7849d492fc6076c05fe0566
MD5 63342837dfdccb5afea75665e300b44d
SHA1 d7f00f77491fd561b1b73cd8b098182572b12c3c
SHA512 6c71c47e7980ae68ccb0017222f8c57177f61937014a0fb959b7f889f61ebfee8b9ddf3dea248ab5edfdebb4561df7e794b426b4321eedfd35ca8a3e67a660e9
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/M:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTj
TLSH
T129477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 24.4MB
SHA256 05ed0aad3455afb976935e39f75de0efd5021fb03fb6ba0fac7497ec76063112
MD5 f3db25dfc5f5f89a861846bb9e463bd4
SHA1 efd02d05dafd159af9a2712475855e884a2020af
SHA512 d7e136f513d2d7b6c2531a99b1195de4a4d0185fae14b20972505848d7fe1395e04a8e8a86e91a3750d87129abab495007046766603e028a7f35845b4ae24b2e
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/k:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT3
TLSH
T15C477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 24.4MB
SHA256 5582edd8251d631d054a1a211772ee9261e831b393d949e32e73439cd9bc1a81
MD5 500729eec353c4cf288853ad13107991
SHA1 3a3d931476503abc0a9f8af5423f37d94fe65cd6
SHA512 e674e628bc25f85603a614544ede4ee12627f053dde0c4aafed6b01384f8c16f4a30b466843f84832d6aba04cf2a679e1d3b0e9af6fc90b53d3ce6fa8695c4ec
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/E:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTr
TLSH
T1ED477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 24.6MB
SHA256 4f9c904b0dc3b99843309dbd150ddf0b679ee5d8d4d16c7bf0ec859588b32cea
MD5 153249ed354edb9ad982cedb3b276875
SHA1 e7f7f3153e243e44faed388d5b8c30bf9566552b
SHA512 d258d9254db813b8f395ef36cb07ee603a98e95dd82ed339db258d656e9ed28936a3ffafc45aa9067962f26423e24cb0a92c9af66435f578051450b195f5ef65
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/m:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZT5
TLSH
T156477C13F1A440E9E1AAD174CE569231EB327C4947F1A5EF3280B6D92E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 24.5MB
SHA256 fe9e479ebd66eb6c9fe57df16861c87b392b01363c72f64327e77357841ee31e
MD5 2e7d713000f18fbf3517cfb3bd87dc02
SHA1 7caa3ea0f469c2c2de4b79f599244f19b49df2cf
SHA512 f2c5ba3ed3660e77123557967364c6aee65e4e2f5bde89735f25f2c12e7492a45d525c81b2e41671fed065260c253fef8975e512573ca18cd182e8f584845437
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/e:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTF
TLSH
T189477C13F1A440E9E1AAD174CE569232EB327C4947F1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 24.5MB
SHA256 0cba3ed9fa34a803b01acd8eabcbbd9b5969c2c82ac319c679731a428d1339b0
MD5 99572a3dcb42a63e2cdfa7040b9b878d
SHA1 4361b312f2501a1a647886851e3e3416e6790d71
SHA512 d1505f20c03d852d448d8355d19114edf11e3d5ed7a4004aed9a0f9898a30c3438d77b3580b1f0cf08144870fa8d482a25ed8cf21227618aeb3f45a8b75bb721
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/Y:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTXj
TLSH
T1A9477C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 24.5MB
SHA256 6904adf8dfbbcc551c13a888615f8d348230f632d4318bf5b8ee1a1706430256
MD5 37d30f79e6b64cfd25da06819a5e6cb8
SHA1 c03d2d3660119dbd2a55fb89dcca7db6ff2deb49
SHA512 14143e77be20358aa4f0ccad5732ffa6f87d1bc373b6405d70ca189970803f8b7788b81a4bf8a2a6ddd426c099b180420d25fb66643d550f939ff4d2ea8aaacf
SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAATww/h1+vKmd0hw/h1+vKmd0rWyZ/q:mqnq7yZ/K0ttYZTfqnq7yZ/K0ttYZTlD
TLSH
T189477C13F1A440E9E1AAD174CE569232EB327C4947F1A5EF3280B6D52E37AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2364-9-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3716-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/3716-1-0x0000000000400000-0x00000000004E4000-memory.dmp

Download

memory/5472-351-0x0000011B001E0000-0x0000011B002E0000-memory.dmp

Download

memory/5472-353-0x0000011B001E0000-0x0000011B002E0000-memory.dmp

Download

memory/5472-404-0x0000011B14290000-0x0000011B142B0000-memory.dmp

Download

memory/5472-372-0x0000011B13E90000-0x0000011B13F90000-memory.dmp

Download

memory/5472-388-0x0000011B03D30000-0x0000011B03D50000-memory.dmp

Download

memory/5472-371-0x0000011B03E10000-0x0000011B03E30000-memory.dmp

Download

memory/5472-352-0x0000011B001E0000-0x0000011B002E0000-memory.dmp

Download