expiro | 64335d170991053aa432dd2326936e3e7a81480fd3c1c4f8978a2a7abf32ac54

Analysis

max time kernel
156s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
Size 406KB
Sample240404-2w5f4add64
SHA256 64335d170991053aa432dd2326936e3e7a81480fd3c1c4f8978a2a7abf32ac54
MD5 c400da7d3b78ed5be349c884bc326780
SHA1 3f3473024dfddb57639e03036fae156e4bd8a54f
SHA512 03152bf0d659af706c61f6f69aef2ef3f537e6e90ab1266783b9736621b2d5f71f4511909fae5500abc142e1d080a1d0b138ca1bb576d187b49ae063f9969a2c
SSDEEP 6144:zIzfx0tsmxGjd9suGjPIDhAJSbnVrw8/LppZ2oqIqOEhspJ:KfqOwGTlWgN0Qrw62obqap
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

expiro backdoor discovery evasion trojan

Malware Config

Signatures

Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 5 IoCs

backdoor

resource	yara_rule
behavioral2/memory/2604-0-0x0000000000D80000-0x0000000000E7D000-memory.dmp	family_expiro1
behavioral2/memory/2604-1-0x0000000000D80000-0x0000000000E7D000-memory.dmp	family_expiro1
behavioral2/memory/2604-3-0x0000000000D80000-0x0000000000E7D000-memory.dmp	family_expiro1
behavioral2/memory/2604-64-0x0000000000D80000-0x0000000000E7D000-memory.dmp	family_expiro1
behavioral2/memory/2092-103-0x0000000140000000-0x0000000140136000-memory.dmp	family_expiro1

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 8 IoCs

pid	Process
2092	alg.exe
2776	DiagnosticsHub.StandardCollector.Service.exe
2044	fxssvc.exe
1464	elevation_service.exe
4952	elevation_service.exe
1948	maintenanceservice.exe
2044	msdtc.exe
3100	msiexec.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3808065738-1666277613-1125846146-1000	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3808065738-1666277613-1125846146-1000\EnableNotifications = "0"	alg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\L:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\Z:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\S:	alg.exe
File opened (read-only)	\??\W:	alg.exe
File opened (read-only)	\??\I:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\O:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\S:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\E:	alg.exe
File opened (read-only)	\??\Q:	alg.exe
File opened (read-only)	\??\T:	alg.exe
File opened (read-only)	\??\E:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\W:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\O:	alg.exe
File opened (read-only)	\??\U:	alg.exe
File opened (read-only)	\??\P:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\Q:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\T:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\U:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\Y:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\H:	alg.exe
File opened (read-only)	\??\I:	alg.exe
File opened (read-only)	\??\K:	alg.exe
File opened (read-only)	\??\M:	alg.exe
File opened (read-only)	\??\R:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\V:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\X:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\G:	alg.exe
File opened (read-only)	\??\L:	alg.exe
File opened (read-only)	\??\Y:	alg.exe
File opened (read-only)	\??\Z:	alg.exe
File opened (read-only)	\??\N:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\N:	alg.exe
File opened (read-only)	\??\P:	alg.exe
File opened (read-only)	\??\R:	alg.exe
File opened (read-only)	\??\V:	alg.exe
File opened (read-only)	\??\K:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\M:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\J:	alg.exe
File opened (read-only)	\??\X:	alg.exe
File opened (read-only)	\??\G:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened (read-only)	\??\J:	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	alg.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	alg.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\hlpqkhnc.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\eqolopbn.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\akdgeeko.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\vds.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	alg.exe
File opened for modification	\??\c:\windows\system32\locator.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	alg.exe
File created	\??\c:\windows\system32\amjakjog.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\bmhdqmie.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vds.exe	alg.exe
File created	\??\c:\windows\system32\perceptionsimulation\dbmciepp.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\alg.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\mldlefdn.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\wbem\mihnfilo.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\pkeanoqe.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\eabhpmhb.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\locator.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\kgpjklka.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\phandbik.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	alg.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fbombidh.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\kmfcelll.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\ckimlcof.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\windows\system32\diagsvcs\cbaacplc.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe

Drops file in Program Files directory 58 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\122.0.2365.52\elevation_service.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File created	C:\Program Files\7-Zip\gkooamha.tmp	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hlepeenn.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mgecidfd.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\jgpijieg.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cedpmnkl.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\nccafaqk.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\jbphfnpk.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\nccafaqk.tmp	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	alg.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	alg.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\fccdaimp.tmp	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\gkooamha.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	alg.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\lncjookl.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\122.0.2365.52\bkkfejqa.tmp	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\occlljkq.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\iekehklh.tmp	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	\??\c:\program files\windows media player\pibepeem.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mnmjadqg.tmp	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\122.0.2365.52\elevation_service.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\jgpijieg.tmp	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File created	C:\Program Files\7-Zip\cedpmnkl.tmp	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	alg.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe
2092	alg.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2604	c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2092	alg.exe
Token: SeAuditPrivilege	2044	fxssvc.exe
Token: SeSecurityPrivilege	3100	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3624	OpenWith.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	alg.exe

C:\Users\Admin\AppData\Local\Temp\c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c400da7d3b78ed5be349c884bc326780_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2092

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4552

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=764 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:4356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1948

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bkkfejqa.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\bkkfejqa.tmp
Size 2.0MB
SHA256 ce8fc5b080159b17df77b10719c1631544a5513d7d752f0e8cb989247cbbc620
MD5 07e49b546e2b4817fe0bc743f9cf5b75
SHA1 d7caccd1a40701ced831acf0f3dc6baeb0ffb05e
SHA512 67b51559e757a5badccd80d0064f681f6317e77c9344141d6045c633fffb1591220269392646dba2872515baf5946cd814eeaf1e5f4fccaa5b6fe2b491af6a15
SSDEEP 24576:DvmQl7551Usytwm4B/AfbilWeD3fe1mVKebksuOv5cLwKx8PP/KOqFNC:d7T3mwzB/iYlzGQMebksutsKSN0NC
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 940KB
SHA256 c6e8c62611217d679fdf399b48f1620e224c4f378cca8a194cf0c310a90fd07c
MD5 29a9fb2dd020ffa148c6e36c9d841dd0
SHA1 87f8848abeeb9e7adf253526cf0c9282fad047a2
SHA512 f67f68e51415de121cbf1b1d305e9fb391321c7f068186cff6cafd22b6023ce80dada675d9eabbac36080f463c3c48671126beb086acb1f5b72a4f68949f8f4d
SSDEEP 12288:C7a3iwbihym2g7XO3LWUrfh4CogyJVa1t/J+ppUpDugQi3WyJtRtgOVEYQ8YEst/:L+gkEhfh4Coja1WpepDugQi3xAZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.3MB
SHA256 f626f1068bed003321ce2798845839860542fbc2ed0a0a79f6ddb0486be3415d
MD5 c0984f430b201c22286a8e47500d3edf
SHA1 ef66949ef9f5d3a69aff3d14f5a6c7bb00450179
SHA512 5e9cd071f0b83753013822a0b3c73f3b7dbbdfea874a84b9f8adc1a23bb02e050cf9e4b8a9c5f53622304cc1d86ead1a8d56a14a29cacb7810ceda2d43314f73
SSDEEP 24576:JBpDRmi78gkPXlyo0G5jrVQI3LjG8nVf6X4:rNRmi78gkPX4o0G5jBQ2Tf6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.1MB
SHA256 e683154f2c6b1658d71089daa06667361eeb92aa804e117a78452ece1899e8ab
MD5 ad5c466177acc9c9035397be11eff9b5
SHA1 eeaf4e8c9a29c422658ad8045d7a2a173e430627
SHA512 e24b47a3b30344d0013be3028322e6a494c683aa2ade67a32c7a38fe7259f7ec4b419b7154dbaadbee7808b84368f58880a4b47bdfa2c102be3d9bd30335ec85
SSDEEP 12288:ffC6Aj+TN5uixZN+8rKhUdTC/wE12D0Ca5ZIXV7xgJKSzaNaa8PdAz72aq/eogXp:3LOS2oEPIXV7xhSzaNaxPdAz7zxXp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 410KB
SHA256 97d771b0efc9dbc341981617839be9154237b16368a1ae38c4ea1e351043f527
MD5 ab983827d0b4faffb93d6242f6f0d263
SHA1 c402d1f9d9ab1a9c1d6c4c0efe52b157e2536674
SHA512 90bb4be1ff3029761c9ac64c04ca9293f845be3dd9cb5c53e211f6bbf51377d2b8e79c0cf79d6f9f7cf42c746d61c34238277423f1126e1e91474057eee7c264
SSDEEP 6144:saltBkI4oW5umTYYtmXy5+R1YKBvwG7s/wvJWiojcs2hwN0bULwyGo4B5TdoxbRi:sogHhYYwKKJr0W3hhRpyUBtdutCnv
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 672KB
SHA256 afc6a00eb3330922229ae42d9845af99de3cc1ea37fdb9a9b978a0d64604842e
MD5 52f1397c832b27721a14e75cd5eb44b5
SHA1 8a56bf46929ff372a5588f8722c3365a32a0a1d8
SHA512 fcb0da847ff0764543447839a6f2a94c757099b9116d4d6f144bbb25d4590db075dca3fe8415e547015d7f98de2a2844b94b0f09311c527190bc524a3dcf5208
SSDEEP 12288:ueBNUbTVO86UqHcyB53eEYRbA1F8eKEa6Nmz7wSm8YEst/:uJIUqHrB5ZeM1jNmz7wSil
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.5MB
SHA256 5c99ee7d0674a2be8b9bed4d39c0d9120763aedcefc70806c204b9b4200dbedc
MD5 93df450be868746ecf18264b8db76861
SHA1 ba90b85cc0a3f266b0ee30e418e3a90cfdbf014b
SHA512 5df7b3785f2981627457b086a410c089a56a0bf3d12d0d672423a6d6c43351c6865bb98d1e03b4b42e4b6037f37ffd0bc5ed87b0127f79369055d573f6cc821c
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJc9DN5J8NRV3TH8:mQvGAdlCEL8c/cRNw5CMIco
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 738KB
SHA256 2159d4c19abf2e7a4f1e6472354761db7985220e0bd5efce777bd7b456679747
MD5 58a41cab0be25b0be46bdc82fc6d9dcc
SHA1 de71ad204e840abce2f098c65ca592d27db40f48
SHA512 e64693ec357b64ba2113e90ed746cca5e4c9f4c439b7fce0a4fe622c13c03409bf9f47bb64af644a0c185bd34acfb24fd8f90e38f1813655024e1a4212cbeb7c
SSDEEP 12288:+AwSfxL/2Dc3jDLLmt0LDQewsHjhWW1d9cnO0qIlp7+x9xhIS2:jGewsHjoW1d9cvNa98
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.8MB
SHA256 e52c2ea638ed41d0aa7e6937cc67d2d13a56b042eee6100ff1796a2ebea42b76
MD5 0f35eab679c96788905569d67e54f4e9
SHA1 c6ee1a0126e4aa4dab2da86cbda4e1bad9cb3ea9
SHA512 ec9fccc59684f8f6c8c0a4b4a76427fd7ae4eb890a84070bcecd3395f45c0f90d1013dcd1588ddcbd24ffb5827fd53b27aba2a4bcf90d1fe19aaa7f598cc6b86
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHK8:5UEtQevvqc2W1cpV2EI32K
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.5MB
SHA256 45f8b00ba9519898100a461d16eabe58aa7ceaaac096890fe3537e1f9c654649
MD5 0af2015db9c61ad288fdba4a78ed17a2
SHA1 1fce5e8140582c6d7f94f42a5fe244c97a6e3ea0
SHA512 ed9c61ab917ce27b4335b1d683605f7d5e150b913decc5ac125f6b42863c70fa809bf8dd3b6039f2891825baba253863c51b231a576acae7115367905d1fd628
SSDEEP 49152:HCbRquA/m2yL5zFfFiV+XenmE3/z/pGu+fSZr5O385:Qoq4VjnmQpB+fSZr5O3
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.0MB
SHA256 79042032cf1bface0508d9b11befdce2ee04e1892732f0324cda96ae8a2bf27a
MD5 c608aa9fab28887204137986877d3ae0
SHA1 4f1aa4a05df69f76cb97bb626b7e291adfa61947
SHA512 380f794a1ba20091a6b00b81cc93a75d67e372a10d592f19a2122dcfab989a98a0a3b9959045a8f16640cd30dd0f8f17f2b441faf22d0826f725f01a863a3773
SSDEEP 49152:2a/3xXBSZ4K5MJ1LvTMxbGsYBYSgxu9+fw4TmRwNkpHXPyy:4Z4K5MJabGsYNLRwNkpy
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbiljkph.tmp

Path C:\Users\Admin\AppData\Local\arrlnmkl\dbiljkph.tmp
Size 625KB
SHA256 6fa1c7368919df6c61350d5a49dc738f955c8c15948ba212ce12f1d95f256c22
MD5 edd7c16e400f4747285b25d1fa24633e
SHA1 4a6adbe7b2a11851b9b498b1699063442eeeff12
SHA512 0197204ba8238261ecc3bd3d15ed3abdcba932c7e2325950ad328665aae1de62c4f0b9e3a2e50ee55a339da33df20693e2552ec97bbb21c9e760d2290c0e3c46
SSDEEP 12288:H4K2B+Ob2I0NXI9Nf+azET1V3MvzwDse/5xPUX:YK2B+Ob5SIrftgkEDX/P8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe

Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Size 818KB
SHA256 6ae5baaae8431f56e4fd43ac91b826663c4661f1e0f42a718ec8e075657c65cd
MD5 7c1e656878ad3eecd5ec08e6713b14c5
SHA1 88170b437203b2949614bcb7e419cdd5520f804a
SHA512 a0b2e7dacc06bbffab9afdef522bdf5fb9166e69e4eba71302e360a4353607f3c991d23ebd45a3a90f5aad79eb8b8a56c94c33996656b02dccc02c75b35c8d06
SSDEEP 24576:RKZwW2KjJ4Td3kJnbsPhnzqZgzvsSDRwlrk:GbnJ4Td3mbsPhne2zvs6R
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 487KB
SHA256 99395099473058dfdc29631022b3aed16a248fee65c5d8ba58d5824545c41512
MD5 bf7e5ada275fd2eb0559d4546af39399
SHA1 3305281b396e06f0c258c1dfece9ddf50d889a6d
SHA512 8d87f22def82fa8641d6c7fc7210c580bbac36d1ddacb9fc79f598b9b5855336a379b6073e073d0f907cc52d4bb83405ce88abdb6c37326735218dfc62776bc5
SSDEEP 12288:KhbHjfXtPeGKLnSGzcVW7x2ZArcYSwfe:KhbHjPayW2lYz
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.0MB
SHA256 1e9203ff791f3191ae04dad9b093342b0f16cab313de59b815f5383cbde2862f
MD5 5a8dc02c8d80145cc0db9c9b42c6c87c
SHA1 df6ec165114995c7d3f1cfd091eb9c1e5f2f055b
SHA512 2da0636ef246cf7ab95dd1510033585d9144bab88de75ac4ad13a699554ffbe5ebc75107f0502faac8aeed6e2e6e6d6d5343251e820b8e31b68490474242532e
SSDEEP 24576:e3YgnJcRTk4yti+R5d4R/qONG4iRfKrBke:eIgnaTk46p4R/fdiZ8ke
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 489KB
SHA256 b52133008be95f8e2661c64b875a323549fd8ad591871dedb7237e29b93012a9
MD5 5b11069a88ce76607eee02dd45077cd3
SHA1 cbd0f1d90d18c2a7b7421f39e4d991b54e504339
SHA512 6170e59f001cb55ef78aa92d472ad00a06e37c755a98fcc5adf565fcd538f5a26f486c3a331c2284756c626e0675f3d54a67314736a9112a601d17d14793408b
SSDEEP 12288:6EP3Rg83eKUhpOa2ciidxxfcrBNo6tJasB:ZguUh92ciQxxsBftx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 540KB
SHA256 898685bfcf59395ed98f31f236cb783ef9ece1ed6b4cf7d367c0d3ca9d89dcf0
MD5 2e419a3c7a939522da07d52cf7054ce3
SHA1 003291b65109ddb257a7581215bdfc150bc3cb6c
SHA512 77f1f36de38d4d7208cda1b304ee553508279241dabfdace14e4d40eeee1991575157b5bf153af19d1434b1877b36b75934a67280b8054dd08475e549bd9a9da
SSDEEP 12288:JjkyOpLw0V0Tdp+DcyjLr5tlyWL6c60VSqSdPM4bCcTMBo451:JIyMwOV1jLzl9Lr6ZqSdPB1Mz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 463KB
SHA256 77135b832cafb142fc4397c3a8f8bcd96be043f8579262e51e09e4506a3a1505
MD5 7e2b180a29eb08ae9b7e0108036cc8c7
SHA1 149fb9acc702388f20a78b11a61db8e5f7f86dc8
SHA512 20edf07d263e486716e1eb4257bea4c4d0c67f9e448b18f5155334a4cfbc161f51375db6b1dc14c4cfe546fb12883c7f05fcbe03033b323d177d0197773bc536
SSDEEP 12288:I4g5TIi4nj65+8jM6+4tshKx4P+pUKD3/qd5:U5TIi4njh8jM6+4tshKu23DvqD
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 5.4MB
SHA256 5048f38d6c515cf2cb640612a151c4aaf1f3fd547387c9567df899af60025b94
MD5 dfdd2fc5a3dc7daca67032ef24ff7642
SHA1 c175dbfbdba92e410573a03383c2512744a96f28
SHA512 45d90c5d9e6ac7da01725c0ce7013762d8a4a843615ec455d8c9ae8b87c9c73c083b1fe143f65538a827f493d5440fcbcde0e12283d8192e55619de29f402412
SSDEEP 98304:37M701RgX4iuSl1DtlEq81xZPGnzURnBh6gG4/QmvD/cTwY2h3lAQw:LM7pTXexZPGzURnBh6gG4F+W3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
Size 613KB
SHA256 9d66d6367529d43751890e62853062ad24e00c99bd0de2c92d77562772a439f1
MD5 c9f245b2acb855d7a9901043c4c2c45b
SHA1 8b9891dd74ee0657791f5a2d61e65d2b3665c321
SHA512 c50d87bc807f501189bd6461fda6fa30a0111dbbd385fe285b830629f06007500fa626984c5f4503457ed489bbf978e934658a04da2c5b673f8e7718ca40dced
SSDEEP 6144:03i/HYpiS2zJw2qtFJRvHAJFQlX2DT85uJ4TNZ/beoLsIsk4JqJGnxGjDSO3nbYS:0CzP9Q/JcuiAUYcONrc+3AQx3WuQhvC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ose.exe

Path \??\c:\program files\common files\microsoft shared\source engine\ose.exe
Size 637KB
SHA256 f562a35471bee57e00475450d1c2ff2260d40c06cef380ed09615d4aecc42018
MD5 c0e8e02e0b57a8f4ff3b380eed646645
SHA1 76289cb893c3ad430a25c24930e0a480882a5a03
SHA512 e1ede996dd687d1270b9a741eb8dcb44e9356bb4249b6c5ced20437f0943c7aa146b44f184b8b7373756fe827a656f3766342f08c8442279b25252a34ff815cd
SSDEEP 12288:bmw5HEjsChNdBFgl0WDm+C7ve0uAZ1+AaMuR57fhexPzMSHXCFd:6wuAOWB0XZ1+A9gVaPzN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Appvclient.exe

Path \??\c:\windows\system32\Appvclient.exe
Size 1.1MB
SHA256 db8c94361fd259d562e44def042b9260211be28488f207f7c75e4a8b0030b861
MD5 f43571005c75465f8fab387519412611
SHA1 09e5a985ff61cf971ebc9f7aab256c401a8440ba
SHA512 bc9a850d424d27ddbf7cb94d39c91a90f1e53f4189b03c277914ef5c0a67b5e46eb70f2eb2d7a7d3dda88d4e6470bd966804269d63c71842aa9b88544bf8fd68
SSDEEP 24576:n1QT7EcpfxR+N5AWAz3ooiY5jMqbfgCQ9AC/b7ts3LVyTq5arqD3:aTDxR+N5YzTXjMmwOuOLVQca+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1948-80-0x00007FF7BCDE0000-0x00007FF7BCF37000-memory.dmp

Download

memory/2044-87-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/2044-49-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2044-167-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/2044-51-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2092-46-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2092-103-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2092-23-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2604-0-0x0000000000D80000-0x0000000000E7D000-memory.dmp

Download

memory/2604-64-0x0000000000D80000-0x0000000000E7D000-memory.dmp

Download

memory/2604-3-0x0000000000D80000-0x0000000000E7D000-memory.dmp

Download

memory/2604-1-0x0000000000D80000-0x0000000000E7D000-memory.dmp

Download

memory/2776-116-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2776-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3100-178-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/3100-104-0x0000000140000000-0x0000000140131000-memory.dmp

Download