1a0d522295ceb6dd8291d0c65b411fec82bf710facf170db56c344657b133999

Analysis

user interaction
yes
max time kernel
329s
max time network
326s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
forc.exe
Size 11.9MB
Sample260906-1p341stbrf
SHA256 1a0d522295ceb6dd8291d0c65b411fec82bf710facf170db56c344657b133999
MD5 0cc99cdea69fdf1c2eb4a1bb274e73a8
SHA1 ec7268cb8116b420a4580bd8865400fdf8b0e8e3
SHA512 3b20482725245ef3d879f09c069ddbfd7d4907eca2a8d05cc6d31c3175a427f4bd877894440b91c0cbb9607b5ec681e5dbb533c05fb69a0f741c1595a9b2e1a8
SSDEEP 196608:lrDVhJ7klBTxVY4g/peTX0GiIIiw7lpMISy297mkktp:RDPstDmeThiIIiwppMISy2rwp
TLSH
T13CC6BF56E2FD00E8D5BAC0B8C6574627EBB23455133067EB16A08A692F37FE16E7D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	forc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	forc.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\wordpad.exe	forc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h	forc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h	forc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	forc.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	forc.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	forc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jawt.h	forc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h	forc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	forc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	forc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	forc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	forc.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	forc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h	forc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	forc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	forc.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	forc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	forc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h	forc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	forc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	forc.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	forc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	forc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	forc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	forc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	forc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	forc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	forc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	forc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	forc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	forc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	forc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	forc.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	forc.exe

Drops file in Windows directory 45 IoCs

description	ioc	Process
File created	C:\Windows\INF\BITS\bitsctr.h	forc.exe
File created	C:\Windows\INF\.NET CLR Data\_DataPerfCounters.h	forc.exe
File created	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.h	forc.exe
File created	C:\Windows\INF\.NET CLR Networking\_NetworkingPerfCounters_v2.h	forc.exe
File created	C:\Windows\INF\.NET Data Provider for SqlServer\_dataperfcounters_shared12_neutral.h	forc.exe
File created	C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.h	forc.exe
File created	C:\Windows\INF\.NET CLR Networking 4.0.0.0\_NetworkingPerfCounters.h	forc.exe
File opened for modification	C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\_ServiceModelEndpointPerfCounters.h	forc.exe
File created	C:\Windows\INF\BITS\bitsctr.h	forc.exe
File created	C:\Windows\INF\MSDTC Bridge 4.0.0.0\_TransactionBridgePerfCounters.h	forc.exe
File created	C:\Windows\INF\RemoteAccess\rasctrnm.h	forc.exe
File created	C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h	forc.exe
File opened for modification	C:\Windows\INF\MSDTC Bridge 3.0.0.0\_TransactionBridgePerfCounters.h	forc.exe
File opened for modification	C:\Windows\INF\Outlook\outlperf.h	forc.exe
File opened for modification	C:\Windows\INF\SMSvcHost 3.0.0.0\_SMSvcHostPerfCounters.h	forc.exe
File created	C:\Windows\INF\MSDTC\msdtcprf.h	forc.exe
File created	C:\Windows\INF\.NET CLR Networking 4.0.0.0\_NetworkingPerfCounters.h	forc.exe
File created	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.h	forc.exe
File created	C:\Windows\INF\MSDTC Bridge 4.0.0.0\_TransactionBridgePerfCounters.h	forc.exe
File created	C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.h	forc.exe
File created	C:\Windows\INF\.NET CLR Data\_DataPerfCounters.h	forc.exe
File created	C:\Windows\INF\.NET CLR Networking\_NetworkingPerfCounters_v2.h	forc.exe
File created	C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h	forc.exe
File created	C:\Windows\INF\LSM\lagcounterdef.h	forc.exe
File created	C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h	forc.exe
File opened for modification	C:\Windows\INF\ServiceModelOperation 3.0.0.0\_ServiceModelOperationPerfCounters.h	forc.exe
File created	C:\Windows\INF\BITS\bitsctr.h	forc.exe
File created	C:\Windows\INF\.NET Data Provider for SqlServer\_dataperfcounters_shared12_neutral.h	forc.exe
File opened for modification	C:\Windows\INF\ServiceModelService 3.0.0.0\_ServiceModelServicePerfCounters.h	forc.exe
File created	C:\Windows\INF\.NET CLR Networking\_NetworkingPerfCounters_v2.h	forc.exe
File created	C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h	forc.exe
File created	C:\Windows\INF\LSM\lagcounterdef.h	forc.exe
File created	C:\Windows\INF\RemoteAccess\rasctrnm.h	forc.exe
File created	C:\Windows\INF\.NET CLR Networking 4.0.0.0\_NetworkingPerfCounters.h	forc.exe
File created	C:\Windows\INF\.NET CLR Data\_DataPerfCounters.h	forc.exe
File created	C:\Windows\INF\rdyboost\ReadyBoostPerfCounters.h	forc.exe
File created	C:\Windows\INF\.NETFramework\CORPerfMonSymbols.h	forc.exe
File created	C:\Windows\INF\MSDTC\msdtcprf.h	forc.exe
File created	C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h	forc.exe
File created	C:\Windows\INF\.NET Data Provider for SqlServer\_dataperfcounters_shared12_neutral.h	forc.exe
File created	C:\Windows\INF\LSM\lagcounterdef.h	forc.exe
File created	C:\Windows\INF\MSDTC\msdtcprf.h	forc.exe
File created	C:\Windows\INF\RemoteAccess\rasctrnm.h	forc.exe
File created	C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.h	forc.exe
File created	C:\Windows\INF\MSDTC Bridge 4.0.0.0\_TransactionBridgePerfCounters.h	forc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	forc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	forc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	forc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	forc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	forc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	forc.exe

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
3856	NOTEPAD.EXE
1604	NOTEPAD.EXE
3780	NOTEPAD.EXE
1848	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\forc.exe
"C:\Users\Admin\AppData\Local\Temp\forc.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3328

C:\Users\Admin\AppData\Local\Temp\forc.exe
"C:\Users\Admin\AppData\Local\Temp\forc.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
PID:5000

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
1⤵
- Opens file in notepad (likely ransom note)
PID:3780

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
1⤵
- Opens file in notepad (likely ransom note)
PID:1848

C:\Users\Admin\AppData\Local\Temp\forc.exe
"C:\Users\Admin\AppData\Local\Temp\forc.exe"
1⤵
- Drops file in Windows directory
- Checks processor information in registry
PID:4904

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
1⤵
- Opens file in notepad (likely ransom note)
PID:3856

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
1⤵
- Opens file in notepad (likely ransom note)
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classfile_constants.h

Path C:\Program Files\Java\jdk-1.8\include\classfile_constants.h
Size 20KB
SHA256 c2e84a52c1eb1e7cc5ba1e5bf2809eb6b8b9a8133374db962f423d847364b7aa
MD5 317e9e6b494a07a791c4d2796b64f8d9
SHA1 f1ffb50268681fb92d1561af970ae78a74155340
SHA512 85784689fa9e69376d196f32250db0f84533bfdad9e8dab7b32ccb76ad1c4bd4922b2805e6d4bfa00d80b22695b30fcadcf25961155497ba33823f23b222a631
SSDEEP 384:6aQWnTNKzmC1UetDA+ln11+uNn/QUsgspEWCoUqMJg0VNQkCkqRgr75+d:AW4mC1UetDA+9vNnUGWIY
TLSH
T13092629002915CF3562FDA30AA2D38A046C1D59B3EF97C80740F1C8AAF6DA5D5BB97CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jawt.h

Path C:\Program Files\Java\jdk-1.8\include\jawt.h
Size 8KB
SHA256 caff245c2b99be18889498bef88fc9f837fd97a8dacff77e34400d17480f0717
MD5 672246cf4d5b69772b59f6713732c54f
SHA1 71c5263351da4e477934a907e138b6dd6b4275d8
SHA512 819c0f300fbaf11cc86ec10fa181038b189f00f7e9a92f1746ec870bbccd259e436cded8c9225d95fe74cba50db5c4eaa0c3263848f6bf9b38c544ea2f24cff6
SSDEEP 192:Bxmx01hC+EUx/G9sqBLn8hzfwwoQCw7fOmma2UuyJycxsMr5bw4ipr:Cx01hCjQ/GxB+fwXJSr58Tpr
TLSH
T14F12634B2BA1188259B70271567F70D1D695A1BF93ABC08C749F67390F48FD98620FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdwpTransport.h

Path C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h
Size 6KB
SHA256 15540eb4c91ee6cab9c75dfa561a547edefe6d22bf815208081eca9c6088574b
MD5 66c7f9517ca14406700919b393ec9d43
SHA1 5837a9820e82c3429e08c668903e3408674c41fe
SHA512 772d5142b017f0b5616d773f95ef70cb35fe7aa77170fda615140206a0f3ebfd21cc8168c1b49eade873c5b198eed307988bf595346bd9703b499e2748d413a8
SSDEEP 192:BxBHOIniDEOqtUk5yx5c29T/YOsH5snppf:hOeOqy7R
TLSH
T1EBE1315896A2608701F7C53B83DAA19C3148AE5361826899351E83FF0FDA6CDFB71DD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jni.h

Path C:\Program Files\Java\jdk-1.8\include\jni.h
Size 72KB
SHA256 6be248dc81201235c4f7ae70d24e0b058f7e68f29edc846914256176fb0f46f5
MD5 723b551dcbb234f5af3f20f93d8051c8
SHA1 030c253c7c16d068016a4f6892934ebc10fcd18e
SHA512 3edfc84a125867a9b9396b6d9885c4c20b8bc90492e2fa33c894d8060b40b0f1562d5a01e544355d9f0f00d0858cd0b88104a1d05314656001c0fe516d1cb8f5
SSDEEP 1536:Op294hWixXRL7pLv0PdV7PSiFfXsvb6JFpJrRuXXyl18CycfWYf8MtqIdACWDYT/:a294hWqhHNs116YFpJrRuXXyl18CyU3f
TLSH
T1F673E5845CE3E3E11A37F71E4D1BA11D9860B523221EFC50FDDDEA858F8501A49A2F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvmti.h

Path C:\Program Files\Java\jdk-1.8\include\jvmti.h
Size 76KB
SHA256 cbb8850bda1e0238caac1b5e7a6bc36d3a58e6e7a3c756d315297e438ee86efe
MD5 b1fd0e8deb9d7da17e9232dca6b592bd
SHA1 0ad830dc89610156c438b478d5257169cf1e8c38
SHA512 8df0f457b30d23c2f6fb43423946dd98064f78306626ee80a22429b1a974af640229b263425dc509645ea3dd5093a93a31c8edec6587d9faff3f7fb4b26b9b98
SSDEEP 1536:ipZtzpUsIBsiwKGd3PXwjullnXofSK1rrzwAlbnpyv4m76X0uvu/zPR:vsIBNwKGd3PXwj8lnXofSK1rrzwAlbna
TLSH
T13D734395C5F270D300B7A931918F306B40F7B6133849B648B8ACE56D1F9F92FA9706E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvmticmlr.h

Path C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h
Size 4KB
SHA256 7a8885955c202d6d5518d721139c6167d4b7e1a3fa21d0b69f53d7777d02b627
MD5 67ab692afd0b1aa27565f42392f7be98
SHA1 32fcb953c2a2075d8f7b520c8a19681d7713c0df
SHA512 40c47619324a9af187b45018d0c11b9c64b4707708c237080de8ffcc0548ab7151d41626bdac37be6ded354dcff9988933bf45e2a451bf641fd6fd8a8f3b82b4
SSDEEP 96:BxppFw5ysNEVOF3E2wGJIgTpnT6I5FzVVvBVPjsB7w1:Bx2pNEkfwX6lL5VLsB7w1
TLSH
T1F2915F2B1D7E3507845A42A1A34A30AE03D7A05E378798897CFF536E5F0A9F85231FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ratman_infect.log

Path C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
Size 3KB
SHA256 7ea8e2637b79af54f409a67ac6980e757f26254f9946d1fe49ada7ca1f5068a3
MD5 1acfbc2a7a0fd6d77ee4fa5ecb14ff4e
SHA1 b1b61dd0939c504ba9abc8737cf4b6384e761484
SHA512 7aa5fe3549a9b9cdedcc02539714af8b483325abbd31096d1942a70e1218e3df689ec7887b7f7c21dcfe6a2cbb5dd4addca46e7281477e20d7e1fd75b4a712f5
TLSH
T1F661CD189CFB82A77A0F64C56B086D8BA7827FCB15445979335C85C6F4C0F28676F292
MD5 SHA1 SHA512 TLSH

Submit Download

ratman_infect.log

Path C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
Size 3KB
SHA256 1bb584fd9a05f624ed8d3167b6a4081562a764a0848a7571c7e63c268faa8d45
MD5 aacf9a7e93a328ee64b425c3a7c0b5a2
SHA1 a9c68d70f2228699c7e91842e237c4bd7fa404d5
SHA512 c96de09fb1ac5189440a52a60f55fa15d242a1052400a983bdffb810af11b0084d711dc7dbef3c0dade59c60019d431b0770d317000f8a79f38c1ce130eaa0a7
TLSH
T1C471EF189CFB82A77A0F64C56B086DCFA7827FCB15445979335886C6F4C0F28676F292
MD5 SHA1 SHA512 TLSH

Submit Download

ratman_infect.log

Path C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
Size 3KB
SHA256 ceff61a31f0260bc0bd0bc31d415bb06450246d26aaa480dfbcfea0d202fb538
MD5 64e42439106334f14d78607635cd7c32
SHA1 2eb39c52414eb8fc93a33fda5b1e3058d6fca497
SHA512 494fe685e81c973379007730ff0e684ddab88ff8d95655d28a4e0e5707941343ec12ceafa70ba2f84495d21e8ba60ba9a45e7909e9974efb2ddf819bad21862e
TLSH
T1A47101189CFBD2A73A0F64C56B086D8FA7827FCB15445939335886C6B4C0F28676F292
MD5 SHA1 SHA512 TLSH

Submit Download

ratman_infect.log

Path C:\Users\Admin\AppData\Local\Temp\ratman_infect.log
Size 3KB
SHA256 20cf49a1f3b88134f24ee0426dbf550b87fc3b19ee3b888fe4408759f96cf70c
MD5 f518f937c567aa905516a7125521bffb
SHA1 be9e977f60b6c57053dce9132228f48ec9008456
SHA512 55a02df4329f1fc146d611499764bdf709c94a83cc4d3b4731d48ec423eebd7e2ca0d1ef5fa9d54072f29b07692173a15373fd86b6916f84995c05e23a4987b0
TLSH
T1CF8102199CFBD2673A0F64C567086DCFA7827FCB25445939335886C6B4C0F28676F292
MD5 SHA1 SHA512 TLSH

Submit Download

_TransactionBridgePerfCounters.h

Path C:\Windows\INF\MSDTC Bridge 3.0.0.0\_TransactionBridgePerfCounters.h
Size 1KB
SHA256 88e8c8ea5534e2fd0a2e8242d7f6355133795e602386d2e7399d6591de9ce649
MD5 336bb34cd44b5cc4c2e9aaefe42afb1d
SHA1 24e0f0bef3edbc4b647ed6d1821d9bf0db9ce482
SHA512 f6b4b055cc2bc819aaa4d52df9e6ee7b203a51b6780c5fdd1df89c30c4b3cea64898850c446c51e5ee775be96fe037d3aae643599c21043d869bfb2c3d19a988
TLSH
T1F22167996ED96A2E68B6F92385A932121440E81F0D70D2B431CF4FD9BD811CF76F208D
MD5 SHA1 SHA512 TLSH

Submit Download

outlperf.h

Path C:\Windows\INF\Outlook\outlperf.h
Size 1017B
SHA256 d3531dda47ab9b6d2f13b34e46e940989dc8e10849ff540d051e010b59f8a61f
MD5 1781f75c2a0331eed86e99392a864673
SHA1 2e636bb1993b2520c9dce2d295ce80cf647b0f6d
SHA512 7e47c51092631a7b3abcb38eb801d3e1fafe9f0de461b159e7ad44ec6b52a975f63bb912d12f7b905b328e5cadabc3f7d6f02e8b204fbd614f566a3af6221c90
TLSH
T146115E2D4CC721998579B61601CD21015098EA7F983245CE3D2D8F4D5F0D58D4AFBCEC
MD5 SHA1 SHA512 TLSH

Submit Download

_SMSvcHostPerfCounters.h

Path C:\Windows\INF\SMSvcHost 3.0.0.0\_SMSvcHostPerfCounters.h
Size 1KB
SHA256 4355ebe899037a8a6782d7758600dfb64089cfd0525ed49f828daf74d5031e5d
MD5 2cf12cab89740c4c0056a09e35bf8710
SHA1 dbf08d61e91d5edb433d46f286570bde7efd192e
SHA512 4c95bb2b21ce3d2f28b055e3af70ae4fc29476bc88865f0e20b93da480da4c53e35415b641bce15b9f950f2537f5973602e09494b4234e1744e0f791df3fc343
TLSH
T14321374E2BE8250E5D22B116F49DE0C1700AE83F41F474AD709D8A694DA52C988F6FEC
MD5 SHA1 SHA512 TLSH

Submit Download

_ServiceModelEndpointPerfCounters.h

Path C:\Windows\INF\ServiceModelEndpoint 3.0.0.0\_ServiceModelEndpointPerfCounters.h
Size 1KB
SHA256 724ca2af5eaa70685bf08ee29d091b2b98e30c3b747e1b166618a76b10a13d8a
MD5 a48703cc3560c2ce286037940fc76435
SHA1 84fa30d554c91e76a1d550b68c74d6c25913c5b1
SHA512 a3643c7a75878f99a56265e9f1904ff3424753246d998575957892fa4b1a840642354529a891fec5f7375c94cd622db442d9ad833eae8d21aa92440f837835a7
TLSH
T1233123BD1F9B058E4EED71A138281452004BF4DBB1052DE6341E890F9C0E37BA3EA8BC
MD5 SHA1 SHA512 TLSH

Submit Download

_ServiceModelOperationPerfCounters.h

Path C:\Windows\INF\ServiceModelOperation 3.0.0.0\_ServiceModelOperationPerfCounters.h
Size 1KB
SHA256 e76d3df3b67ba200ee85ca91c3be24c0ce1f98c4f6c861275fe721307c8de559
MD5 a0b320e290b239509dacdb699ff2cefa
SHA1 98547f172aa327b3516af2c3a84ffbb2a669ef95
SHA512 1a9bc02256a4009a548961ca18171ce0013defa3801daf196f9342b38e0519e09aec923dbc9f359cf4f31946c376d9f8389b7ed4afca930948a9959df5e445fc
TLSH
T18221D7BE3F970EDFC965B0216009A44300D3F49711996F8634998DA99D2636EC3E28BE
MD5 SHA1 SHA512 TLSH

Submit Download

_ServiceModelServicePerfCounters.h

Path C:\Windows\INF\ServiceModelService 3.0.0.0\_ServiceModelServicePerfCounters.h
Size 2KB
SHA256 207b2955ef0abf7fa6b672d39c0c31bf5212c416d17d2d87d30e36ad61ccedb9
MD5 e2ad3b164acaa877927c95515054bb18
SHA1 9fe4dcd81f71fe8c0a275b3f123e8a76875c46b2
SHA512 39a1570adb6d18bf7d4ff7facea0d64ba32e0962e2e7cb9d5c580995e00a5f815b2bec97d47f31c209f04666d2ba86d375c6b62172b68f85256dd657ae1384e2
TLSH
T16541A49D3F9B018E6FA53149314818974846F4B311320D86765FDE1EEC2E266C3F28ED
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads