Analysis
- max time kernel
150s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 06:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe
- Size 3.6MB
- Sample261011-hb4vaaxtav
- SHA256 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923
- MD5 654e0a58a33d8a3b39389bf35132145b
- SHA1 9322fe4107f49a8ab804b6795088f0e6ea8feb98
- SHA512 932270775dcf5e543eb3f38811c04189d72606e084ee4a9f3c43d7b5202b4fa6030afa9cc0e0a0397dc30470430dd3e5d7426beedafbf6ce9d6a5e31500b2ed9
- SSDEEP 49152:ck90UFr4T6SqQ/3du7MAOqgjbzOGxb/AsrWLs/uwSdZHj0pBOH2pB2+65GzIarSM:JjFGqQ/3Y7MTbCGF/AsedZD0pB2ukJTy
- TLSH T18F06DF113AC2807BD9A30131497DE7FA197D7E351F3081E7A3C42A2D6E749E21A39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe - Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\System32\ReFsDedupSvc.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\System32\SensorDataService.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\System32\alg.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\System32\GameInputSvc.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\System32\snmptrap.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\TieringEngineService.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\AgentService.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\vssvc.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\SearchIndexer.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\msiexec.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\SysWow64\perfhost.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\locator.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\System32\vds.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\wbengine.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\system32\AppVClient.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Windows\System32\msdtc.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe -
resource yara_rule behavioral2/files/0x000100000000934f-215.dat upx behavioral2/files/0x00010000000093de-219.dat upx behavioral2/files/0x0001000000009952-223.dat upx behavioral2/files/0x000100000001b93c-234.dat upx behavioral2/files/0x0001000000009cd6-239.dat upx behavioral2/files/0x0001000000009cfe-243.dat upx behavioral2/files/0x000300000001a194-247.dat upx behavioral2/files/0x000100000000b96b-251.dat upx behavioral2/files/0x000100000000df16-255.dat upx behavioral2/files/0x0001000000009fd4-259.dat upx behavioral2/files/0x0001000000009b92-263.dat upx behavioral2/files/0x0001000000006215-267.dat upx behavioral2/files/0x000100000000a050-271.dat upx behavioral2/files/0x000100000000ba34-275.dat upx behavioral2/files/0x000100000000a0ce-279.dat upx behavioral2/files/0x000100000000b945-283.dat upx behavioral2/files/0x000100000000a1d4-287.dat upx behavioral2/files/0x0001000000009396-291.dat upx behavioral2/files/0x000100000000a2c1-295.dat upx behavioral2/files/0x000100000000a304-299.dat upx behavioral2/files/0x000100000000a319-303.dat upx behavioral2/files/0x0001000000006223-307.dat upx behavioral2/files/0x000100000000bd44-311.dat upx behavioral2/files/0x000100000000627a-315.dat upx behavioral2/files/0x000100000000a02c-319.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\7-Zip\7zG.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\7-Zip\7z.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe Token: SeDebugPrivilege 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe Token: SeDebugPrivilege 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe Token: SeDebugPrivilege 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe Token: SeDebugPrivilege 4908 bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe"C:\Users\Admin\AppData\Local\Temp\bc94d7c5df5e0f2b874215ba5a7db21f59ef934c3661632a5c4aba2bc3bb2923.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 514c569e9e40fa6a6b526180473d4cc22c82a24a9048533620de54f06c2e2f65
- MD5 a08d1d42e99d009a5b39cf2feef8e13d
- SHA1 15ba4156b35b0916c4833ef59bcad198deff9d72
- SHA512 35255f875667b4def91ca1506291369994d3f76b6c46a8fdea72acfc5c8aae2c30e9ee3b40a99e1f67ccece8e516e521bbb662fbb7af710e67ac581f7817042b
- SSDEEP 49152:vb+632BuPkFKRrdE6oh7stBhuXjfS4LWxniarSj8RoTCCW:t3q6gjBZJTy
- TLSH T154E59D03F2D901E8E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 f7537889d94cf4bd2da962279fd2869b131d01e194eacf6476ca37d108214ed0
- MD5 a1036b9b35d19406d326ee698d3a82cd
- SHA1 41bad68a4b7c3248b4a7c2c1a9fb9d16f7140d24
- SHA512 e337a7e0e2013c1ff8fd128cef5722b246e972d44531b249da0193eba93136a778962fb4d95cb3122f39f2250ea6d09515656e6a893713293d0a67e41009b18a
- SSDEEP 24576:qXYVDtczAtaKngL2jdshRTdG1YxITqvfPkbIcbjLm:3tcwarSj8RoTCCW
- TLSH T16E250229A7D009F8EC6B827CCDA2C905EA7378554764E78F03E499691F233D85E3EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 0e04b697383da5870c134587742c2f1259b4f42fceff6eb0422bb3154c1925ec
- MD5 d50c9c6f43c2bc7e0946c614826c39ec
- SHA1 c54c6ea8e76bfb8d02f06f4ede78a8896b0f714d
- SHA512 62235703728c2e44041b2865c8fb8170f16d80b1f2371d942104f89fcfef1fdaaf012d952d10a41c54d31a83d62128b3e5346fea0e46a95808cf15fe9124b684
- SSDEEP 24576:dwu7OWZaKngL2jdshRTdG1YxITqvfPkbIcbjL:dwIOaarSj8RoTCC
- TLSH T19425014A67D40CF8E96756388A97C536FBF3B8052A26C70F07A0C65A5F37361AD2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 72b1ff27967008961f2838a71c0256f6e78f8ce695fd02ff7b041f8f34b8c8f2
- MD5 0a120306404aba180d06fae0ffb911b2
- SHA1 ff1cb311d97b6a7ae245b828350cf1f47091f72f
- SHA512 0fcfa81fcab2dd13c50717932cda5a7e7e93f8f81faf02f095c5aa6fdcc57b9bdd6112614046e0e11d54bd1df6a10cd49affe34ea6fc8de79982a28c4377fa7a
- SSDEEP 49152:EOB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glEarSj8RoTCCW:Nu6JmTxd2dEJTy
- TLSH T181E5AD13F2DA01E8D06ED178974A9233E962BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 b76c4f966997f8d656f1cb176e942b1730df015457933defb043701242b63afe
- MD5 761b3599180dde4d43efc854edd29b05
- SHA1 57936f46c634dd8e8ffff53e4657c6463b6d117d
- SHA512 bfad0a41dbd059983b3c53d9428ca95f4bdb4341cc377e457a2faac3d5a2e6970ad61e712a37e2e1e4aa43815ade7d08ad090af0b69537060c75578c2c55c219
- SSDEEP 24576:Cfwvtk9RX6wkyAIFaKngL2jdshRTdG1YxITqvfPkbIcbjLm:vMnYIFarSj8RoTCCW
- TLSH T1D845E029EBCC44E5E177923C99B7460AF6B278691B32C2CF029953AD0E37ED45D39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 7befd19c58012e4604bf3e79daae3c17a04062d480a7e8e89debc87f96a53a77
- MD5 6c2dd3daa48e2217ed8ff8e221e34665
- SHA1 1c583ca6056517cf347dc9792b543b874c98697f
- SHA512 91e049186846dce2b2bf43d972507979576555a7c2a0ab1045ea5ea3816f8bfe5c4cfe533b9980d7865312c09a17c37de70e3567d8354f36eb4fa45af02ed36b
- SSDEEP 49152:kYoJNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02arSj8RoTCCW:yySzPuJTy
- TLSH T156067D56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 9e8044d86f5a745b4e5c9dc0fa7e6a2eb35fef8911e845d4382016239b3de704
- MD5 0a7af2ca3b95131b9513aa15f8afbe8b
- SHA1 c7551f4b010d7f869384355cfebd98e4006be78e
- SHA512 4e57a474ddb33ee717fdef281f0634c23abce430bb12cc39a0c7a32d00f2d837f54cbcf3a4cace7fb130a6fa6c3284de92def3f9464c61300b1861f7fecfc3d1
- SSDEEP 49152:LF7JUQjXirIhCnDHUPfF/DarSj8RoTCCW:VJtglD0P9JTy
- TLSH T1FD75BF1EA3DC02E5E1BA927885158A5AEA71742D1F32CACF12B0437D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 330ae43b2cd0bc173fe08cb1bf20d9dd419ae0db6e5f51f3b5c559bf472dd805
- MD5 f3cf0dd17fe283917489ca6c4530f110
- SHA1 4508150672ca112a87e5ddea23435e85c6f9b602
- SHA512 774e64e4f6da2a34d78382c14e837afc009d1fc307eb8f6225a94edf8fb1ce02f6f65e4ac5c5d786122e7c2c0bdc06a9e1c33a4f8e15c683498e2e23072af1bc
- SSDEEP 24576:fEaKngL2jdshRTdG1YxITqvfPkbIcbjLm:fEarSj8RoTCCW
- TLSH T12005237BDBC88F50E57A3B743AAAE94C3CA33B5D8B0B864EC9A0159C197A7D05D3C504
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 d5f2a7acbf0348a9c4584190f32b801890b7e1540fa959b1262d9921287c0a70
- MD5 159b7a448db9613651ad2386f2630f11
- SHA1 d35dd79f5c7a6cf738ac9971aab4e7dfc3b0bf92
- SHA512 fb7ba9c8148ca93041c0d4e7a381de2318756a2524eb3e7f4ec935be101d97ab8f65bfc1c57cb63eaf5f419e2e30d76b575bc775973d81f6e812572f38c0f8a4
- SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYAaKngL2jdshRTdG1YxITqvfPkbIcbjLm:bgb4mBIBhGFnarSj8RoTCCW
- TLSH T10775BF1E22EC02F5E0FAE2B89DA64407D6B378164732D2DF1151426D2F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 25eb5ca8c1de55a60da55566e075374f84dd0f6b88ea92d63cd6fb00becf9724
- MD5 cd539061ab8e16f1c5938bfe5112ff17
- SHA1 5a1077d74d57872dffe7c1370f02171fb75285e2
- SHA512 6fd965000065c5819049da79a236292528745842aa8823c7bf5236516f5f92333b2abf5744718b714ebe3a17093806602e43dd4ffa7677118800a8d615858466
- SSDEEP 24576:dTkNvNnaFeYhJNtmZBmBaKngL2jdshRTdG1YxITqvfPkbIcbjLm:dTMwBtOmBarSj8RoTCCW
- TLSH T1FD75BF6EBBE846E4D1FEC6B49D238516EA727461073293CF4290C13E0E679D89D39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 828KB
- SHA256 fdb06b7adf929f07d8a027c22504dfb3efdb2b2dbaaeca1eff2308333b705839
- MD5 30bb702080f9834f084e20836364dabb
- SHA1 622e27c15d22ae99ea0bda87e26e1602836d29df
- SHA512 b36f11c07680def3a519c552bf885c5163544b4c59a7fbd55299d1ef915c6272a68fabcdec97e7d0ee73f302a6b09aadc80cbb0fcea55939c022a22baa98b3cb
- SSDEEP 24576:uGcaKngL2jdshRTdG1YxITqvfPkbIcbjLm:uGcarSj8RoTCCW
- TLSH T1D605237EA7C56694C43B977829B6A84A3CF23768870A46DF48E0957C4F7A7E0763CC40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 792KB
- SHA256 5c71dbd3f52b9150e4aced8d800a3d69759be934e85460b22eeeaa977d37ba16
- MD5 c7de272c1cfca7aeab67f8fce9766427
- SHA1 2391137e41398dbf5f5c05d35be42ca5fc7611a0
- SHA512 8af33d255e11dfcedccdc6de2a83dd03ffed69af050b36dd6efad8de633ee58147b04ab3ec3f9f3ab69ea602091af46469ffb12cfee3bca949b318fc2f66e0eb
- SSDEEP 24576:G3aKngL2jdshRTdG1YxITqvfPkbIcbjLm:G3arSj8RoTCCW
- TLSH T11D0523AFDBC48B94D55A3B743AA7A84D3CE33B5C974B46CFC8E0159C19AA7E1253C440
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 95f325c69cc48cb3f78b387cd65bf37c8a01584f6392934c8666162809de7e11
- MD5 5538f4a182a9440d057b7af3440564f4
- SHA1 e9deea021a9f5dbdec57c5751b99e0f367ac35b7
- SHA512 a71a422ec06a89d65fab3046a469be01b1e90b366064a28396d10b61f54054f1d543685cb6433d6566fee1454dec9818123a476740de16058eabbf654b516f7c
- SSDEEP 24576:/MK8l8FpJqH1Mzria7/mKaKngL2jdshRTdG1YxITqvfPkbIcbjLm:05WFPqVra7/NarSj8RoTCCW
- TLSH T1C2550265B7D102F0D47BE2388A964657F6B2B4250365EBDF07A88B551F23BE10B3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 996KB
- SHA256 069c773bf7a146162aa91ace91e004221f6bf7755b2797fd542488bbc4592e0d
- MD5 45dc60a997371f9d756f87a9439b886b
- SHA1 a01fabd2d811b033aaf7c8e256eb289d47241a06
- SHA512 e0ff13d7167a0ba486b890ae6729ca5187fede4e4ba1820982950d7f3edc1499a52364f32c50ebd29a44ba365c753973c3e335d6794c456ed84a9f44d68d5f85
- SSDEEP 24576:JPUr+NQdaKngL2jdshRTdG1YxITqvfPkbIcbjLm:JJQdarSj8RoTCCW
- TLSH T14725F22F66D81CE4E676A27C9986860DF67274660702D2CF02E0817E5F67EE87D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 11947505c0ac851fac8510e7150100b42380c5b5360ce78264d91970d678cedf
- MD5 0f7bcab9b45cddf53a88a300e40bf6d1
- SHA1 1d50ebe30b4911f8edbcf262512cdbadbca8839f
- SHA512 7cbf1585942867e3273ee069d4cecb21d5fbb328fc442c511d8fdd22f12020b85297588afbeb747c147483c938fd1cca6fec54252fae3a847b28c6025ef5102d
- SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZarSj8RoTCCW:WG05lO43bwJTy
- TLSH T10AD5C06E62EC11F8D1BBD17CDAC68A0BEBB23815032556CF02A486A91F27FF4557E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 48b572791e19115cc337d0daa2e2f3ca5a6e5619b8f9ce57057074b719e54c46
- MD5 a0f563cb6c77b89e37901dd4933a60e3
- SHA1 ebfe44b6c1edd38691cf956ca306ba0a6eb71bcb
- SHA512 682945def07e3063392230f9605a9f79953885d8b66aeeb81c42c7ec80ee089f470ec2b04257d9d6738a3cbd78be8818c63f825a5458b667b8f3654331eb5e2b
- SSDEEP 24576:jla5POZ3dpbWVM50JicR2hG0lasx2+47eidnEaKngL2jdshRTdG1YxITqvfPkbIp:xa5POZ3wJt2pasx2+m2arSj8RoTCCW
- TLSH T17C75BF5EA7E801D5D579D17DC583860AF5B2342553329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 cdaa5bb63feef8b041cb8e1b0b7baffc6a004f8e971d03a646cc19db483f4f1b
- MD5 56b8bb92b4a7a092e3500c159ba47668
- SHA1 e2bce6594a1d1a5b2ca33bb18c46aad6e28e7942
- SHA512 89f3980a6f09ead1e47e711752301b9e96c27b8d53d3d60587f7ed359840aceabdbb866b89bcd416497fb5217dea75c2a4581324c78cea7536a055639a44093c
- SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7Fk8aKngL2jdshRTdG1YxITqvfPkbIcbjLm:0Nc/zEOVHF7arSj8RoTCCW
- TLSH T1CF959C2623E901E4E1BBE1BE89779546FAB17869133486CF0291851F1E73BF45C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 34dbf311bfd08310efc0f450b04a8f4f1a7b3983f17375f65d5915976cea040c
- MD5 432108c9271231ca073d810c14a919be
- SHA1 b196d93060f24de2082b77449c8ee34442738e8f
- SHA512 bc5feabdffafd2f2ebf9dcb262edb007866a03c48d4d720a1dd89dc88938b2c71393d49dbd0161105de81ebdbd25f738f9b9bb523e4bdf3a29307d144297b8bf
- SSDEEP 24576:1D3FHshBIYQgAlaKngL2jdshRTdG1YxITqvfPkbIcbjLm:1DVHeBIAAlarSj8RoTCCW
- TLSH T11245F17EE79C04E4D57BD2BC9A638906E67238AD032256CB05D481B91F6BEE46D3DF00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 21880dfee1f9b439d5a4a4ed795702bdfe9801b529a4d3624071188b9f93e851
- MD5 06b6ad45ff2267a1273a6a7ed6dfb96c
- SHA1 c4b45d079e96ab5f78e2978a40d098c1f963b347
- SHA512 0576e8cb35401ed3cfac130b060731fb198aacb537f409b5b370c16c6f98cc91039b5523530dc3d7af8e8bd438f7c41a3154a2d4aefd6f65f9a01e370bec373d
- SSDEEP 24576:TJnJPbzB4SDaKngL2jdshRTdG1YxITqvfPkbIcbjLm:TJnJv6SDarSj8RoTCCW
- TLSH T1AE35F13DD29810E8E4B7C2B4815A1B5ABE71387D2F1669CB59B4D4343F12FE0A939F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 6ec7c1a14afeb42191e6cd04d520414e321694f28aec36476133efd925f3a860
- MD5 29a8e5cb5c5fd652dd05a2c1e52d82cb
- SHA1 be1726523ea0c7327f2fdf4a2a71cae1e33d7ca4
- SHA512 8a7041c2b2ea8faf38dd76a6f1258fdc8f1e06216c831edb26324d6ac7ddeefa1577de295f5296a06076f963ec735d704da7c19827c6405c93bf2cf8f7b59b2a
- SSDEEP 24576:bCLHGL0MoeVtFumTijCmlKQWDk9aKngL2jdshRTdG1YxITqvfPkbIcbjLm:bCLHGeeV5ijCmlDWDk9arSj8RoTCCW
- TLSH T1C3A57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 76d015340bebe72a2a521e4f1c734b861f39cedca0e77a84cddd8093a6d9ae36
- MD5 9a42a7eadc873d3b734ba7d83f6528f8
- SHA1 bfb41cc9a54f031b9c24dd68dd64222826c0b615
- SHA512 ab4c621ae6ac09fc239a7eaf8c37eb552ee36959dd3f1d56fa1d767057c577d6d8b5621c2e7b6381d14c182c646995bf92bc6294f7bf7d7a4dfcad31ed98051c
- SSDEEP 24576:j6DIDxaKngL2jdshRTdG1YxITqvfPkbIcbjLm:j6DINarSj8RoTCCW
- TLSH T1FF25126D63AA01F4D06BE13D96934506E5B276B487034ACF4AE4C5BD4EA3FD8B93CE40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 928KB
- SHA256 fdfd3b72bbbfa378d90a96b64fd9ddbe1419ece35fed488cf58cd37948b8a1ce
- MD5 831dbc372a3981e235a361009ca6ef11
- SHA1 1e26562adfc6937e2e507eba777030e7a5b981e2
- SHA512 03cc5f5e683ac1bd964ad2e6afe945b24568960f4b504fd546bb5a46cc1aaab5c88f5d96a1592643b85adf2304071c5ae1807d7ea1605a48f063acdec2aa09a4
- SSDEEP 24576:gtymaKngL2jdshRTdG1YxITqvfPkbIcbjLm:gtlarSj8RoTCCW
- TLSH T1DF15235A97C456D4E57A27786EB385882D727E249B0783CF89E0E63D2F367D07934B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 936KB
- SHA256 6c05b47dfb1786dd343fefc2913c6670b72a4658a896041ae4048a2ca70ba69c
- MD5 a5fc5c97557d6e7998ccce92d29ab158
- SHA1 2bc7465acfbb93a0e7c3c27a9acd3c22e706c4e4
- SHA512 0f550b03d62cc0cb4d1b77aa958af59021d2f05f35306a517e093ddb1315117566ddb6bb8a8371db05885d2a0d872b1b24eaadacae81aaad65ec2870a2d6bfb8
- SSDEEP 24576:/6UqjpPHaKngL2jdshRTdG1YxITqvfPkbIcbjLm:/6UYHarSj8RoTCCW
- TLSH T10B15236F97C419E4E03A1330AAB6C10918B27E7A035B86DF65E4967E4F36BD0953EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 800KB
- SHA256 2de4ddb0488de77fe2f755247718783d23e75df1840f9e55ad494e6270e7fd4f
- MD5 380cfbdfa55ffaa1dba25623c6513e2e
- SHA1 497fc773b6172707ad93eeb39073f3dedf464fad
- SHA512 4759298951b743c87d2859d7577b78bec44367db1db29375592555bbc7c472961e79fee0a635b5918265905902ba94cff696d14c50240e10f6af4575ef65b9c2
- SSDEEP 24576:jMaKngL2jdshRTdG1YxITqvfPkbIcbjLm:jMarSj8RoTCCW
- TLSH T1850523BEDBC55BA0D41A7B743AA6A94D38A3376C970B46CF8CE0557C4E7A7D0263C900
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 79258c63ef1b8edbfddb79bdd45c2d8b8f650e939b773c326aa05e50c5dfebfd
- MD5 b8436508dd423ddd73780fcbdf046d6f
- SHA1 685157788ccf8c896dd99dded131f92e0ba46d74
- SHA512 cabb90f392118940df999b20fdda9e593af4fd7391b39c902e80c8f0f74e9f9aef19ae9fb7f4c2af5e9d0b5b45a771654d401e960775d43058d7cd8ac2bfce53
- SSDEEP 24576:6HgILoTfaidZ0aKngL2jdshRTdG1YxITqvfPkbIcbjLm:kgHTrZ0arSj8RoTCCW
- TLSH T19965AE1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 960KB
- SHA256 78a12fc04fd8f87c83200502c534ff73d6946ae1a928ab7b29146c447dcd95c3
- MD5 e70fbd9c659425dbb1bd6b84d9e6b716
- SHA1 cdda6a85d30a3410d5bdb76150656a62446501d1
- SHA512 c7794ed6de40d0094e9d1df9048b5911917fb35fd62fd1d71b1170f41656fe545c928ee85005307ec68b57326ee8032d378510ec03c0bbb3b75fc4b8f0f63562
- SSDEEP 24576:3rcmRQaKngL2jdshRTdG1YxITqvfPkbIcbjLm:bcmRQarSj8RoTCCW
- TLSH T1FD25015EB7AE00E5E1BB923C89828549FAB37534530257CF46E0877D4E67AE97D38B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 f7cc0cab73e03c8d1bb70cadff217c117b00b2d40d81691983a1a6d1793377bb
- MD5 92edb873040b33ccde14ec262ef838e5
- SHA1 153736e4828f93e79c890b4e1c58b1011fbf822d
- SHA512 5fd60009bd7f801c8dae64a5454673b47b870deab36ce7b459412830e9d87842e9f38ac7bc371a445ec7fa38d52e5da6341b43e2d46b4fd6c782ab2c6dfd9703
- SSDEEP 49152:8DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3varSj8RoTCCW:Z3Upow8sBqJTy
- TLSH T169B59C3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH