755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Size 3.6MB
Sample261022-tyttdavz7m
SHA256 755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49
MD5 7cfceed7109c2fadb2201a9bab6ffb69
SHA1 23ca65056865836d06eef76621541d7b9396dfcd
SHA512 5d95a0069500356a8d93408b28ed9d8ea7f12ca5d3eb3e64ddb19abe71de9d32cd6a988bb5dcb7524c7791544876a4064aed8a489b242d15c5b9ae582c9fd0f9
SSDEEP 49152:J3E67R6STN//xbyBPmEv37+z8Wmk14aPRnx1VOnWBIJwf1HUEPCoG44agx8EaKU:Rb7R6SX2BPmE/6oLkGKoEqNajsU
TLSH
T1D706CF11B693C533E99301719A7DAB7F443DE7211B2986C3D3D41EA80D70AD22B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\spectrum.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\System32\alg.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\System32\msdtc.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\locator.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\vssvc.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\msiexec.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\AgentService.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\System32\vds.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Windows\system32\wbengine.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017011-223.dat	upx
behavioral1/files/0x0001000000017057-227.dat	upx
behavioral1/files/0x0001000000017bd3-231.dat	upx
behavioral1/files/0x000100000001742f-235.dat	upx
behavioral1/files/0x00010000000233b0-247.dat	upx
behavioral1/files/0x000100000000c51e-251.dat	upx
behavioral1/files/0x000100000000c53f-255.dat	upx
behavioral1/files/0x0002000000021ae8-259.dat	upx
behavioral1/files/0x0001000000017ec7-263.dat	upx
behavioral1/files/0x000100000000fa68-267.dat	upx
behavioral1/files/0x000100000000c405-271.dat	upx
behavioral1/files/0x00010000000177ee-275.dat	upx
behavioral1/files/0x0001000000017814-279.dat	upx
behavioral1/files/0x000100000000c8e7-282.dat	upx
behavioral1/files/0x0001000000017853-287.dat	upx
behavioral1/files/0x0001000000017ec1-291.dat	upx
behavioral1/files/0x00010000000178cd-295.dat	upx
behavioral1/files/0x0001000000017042-299.dat	upx
behavioral1/files/0x000100000001797c-303.dat	upx
behavioral1/files/0x000100000001799b-307.dat	upx
behavioral1/files/0x00010000000179a1-311.dat	upx
behavioral1/files/0x00010000000180b1-315.dat	upx
behavioral1/files/0x0001000000016793-319.dat	upx
behavioral1/files/0x00010000000177c8-323.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\java.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\.caj	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\.caj\ = "MasterPDF.caj"	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\.ofd	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\.ofd\ = "MasterPDF.ofd"	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Token: SeDebugPrivilege	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Token: SeDebugPrivilege	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Token: SeDebugPrivilege	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Token: SeDebugPrivilege	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
Token: SeDebugPrivilege	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 5748	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe	89
PID 5968 wrote to memory of 2432	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe	99
PID 5968 wrote to memory of 2232	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe	100
PID 5968 wrote to memory of 3940	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe	102
PID 5968 wrote to memory of 5504	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe	103
PID 5968 wrote to memory of 536	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe	104
PID 5968 wrote to memory of 2248	5968	755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe	106

C:\Users\Admin\AppData\Local\Temp\755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe
"C:\Users\Admin\AppData\Local\Temp\755e049b275e2e2ed46a24831b4a21b68e8dc6970594c0c348dc12cd289a7f49.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Windows\SysWOW64\openwith.exe
  C:\Windows\SysWOW64\openwith.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5748
- C:\Windows\SysWOW64\openwith.exe
  C:\Windows\SysWOW64\openwith.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- C:\Windows\SysWOW64\openwith.exe
  C:\Windows\SysWOW64\openwith.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- C:\Windows\SysWOW64\openwith.exe
  C:\Windows\SysWOW64\openwith.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3940
- C:\Windows\SysWOW64\openwith.exe
  C:\Windows\SysWOW64\openwith.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5504
- C:\Windows\SysWOW64\openwith.exe
  C:\Windows\SysWOW64\openwith.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:536
- C:\Windows\SysWOW64\openwith.exe
  C:\Windows\SysWOW64\openwith.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.9MB
SHA256 dd95d23f05e0472d276f0de7311f5bead09e9afac792839f2a20b6e62422d60b
MD5 0a9fb7aee86eb9b77c4f08313fee2236
SHA1 4ed2e2bea8df1c49744ab53fec1cca84801742a1
SHA512 075ecea15ba994c41c5d66a8d4babba0cc49100a28d34d06a102c65bd26819d877ebd273eb3d6cd00bbdf96b2b0e6dd517bfea4b2ab44f67fadeeef7d0f6aeac
SSDEEP 49152:3U0632BuPkFKRrdE6oh7stBhuXjfS4LWxnHPCoG44agx8EaKU:Q3q6gjBmqNajsU
TLSH
T18CE5AD03F2D900E8E06AD178D7469533EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 e103175d8e9c4bb9c9507620758d2ae750c86d7ce8a36fe31283c9361d9f07e1
MD5 2276129c29aad93b2d9c118b1640528a
SHA1 9d130c48bc3cc6234afd6dec46f8fe55134c12dc
SHA512 387edddd0e11115a78ab37540ae41b0f1ce82ad5d87d3166855ac3a9a5548a7db79c921a9e51a39b96f2d54d6ccd316b7538c3252c1a835765c577eb60d79d8a
SSDEEP 24576:3XYCDwczASKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:pwc8PCoG44agx8EaKU
TLSH
T101250124B3E408F9EDA78239C872C816E673789647A0E78B03A4C5791F237D85E3E755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 997KB
SHA256 91560e562bd6ed174e8b94fa470891f60d5687cb480f4883360d23dace9ccf83
MD5 a7a94d691d275a46e3adda760579ce10
SHA1 47a865777d0130c69dae57475fb4fbcb982308dc
SHA512 b68c2477198ee65d61c8ac6a8ca333e7e76b949abd47b3905a1e4361eb281b4db6d1437b513bbe7148c6d1562d323e59be5f0055113360aa7bdb6254f08eaac2
SSDEEP 24576:3wutOWrKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:3w2OXPCoG44agx8EaKU
TLSH
T19825015676A41CF9E9A782398557D436F7F3BC062A70CB1F0360C66A6F37360AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 6979f2419e5b6ca8314af85e768eed5ea5d7f1ecbdfdbed0da76a8694b07a4b8
MD5 22f2290d422f61a6962dcb4704a5353f
SHA1 55a687be6d557e1aa05029291b09e6ae62a2be94
SHA512 58a82a60f5540c02ec1e0ef92fe097e2dccfcadbfa2160d9b6e2d0022e652eaf6a88a0b14cf36dc8f3c165a4787448206d9b56df84e6abae3fa8a3be3f33fe62
SSDEEP 49152:N8+taZ3usBWOBr4tEGp0bqx0z+n217aau1gloPCoG44agx8EaKU:iu6JmTxd2d0qNajsU
TLSH
T1CAE5AE13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.7MB
SHA256 1a7e6229fcb4fa40293ea9214833ea3b1299aa6b49596e8cc9839d9c193cda03
MD5 02c65bae6217dd2c5279020fe2811846
SHA1 a09ba72a742c9ae5a9e2f779aed459f4117de5eb
SHA512 5cff31faf0f8cc09f14ff75b34081a79edbfbb5f9ab4f2802ba5184e4b4fb008e4713a5513b3a7755492ed5e706dd6c319eac7dc41ffcf096541823bad45cf93
SSDEEP 24576:PcP4mcvIjkGOxhKP2l71zNKbrh/8KBuKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFZ:EP4m4IpOO6768KBPCoG44agx8EaKU
TLSH
T17985BE2DABDC0096D0BA917485668A4AFAB1742A1F3286CF1160933C3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppCfg.data

Path C:\Users\Admin\AppData\Roaming\MasterPDFData\UserData\AppCfg.data
Size 224B
SHA256 e515244c98a13cfd227630cc5bcf8dd8565e682bad7e684dac5de0dd82c37898
MD5 522068547884c3e9525e1905b860f59b
SHA1 fd6eab55b668f3fb6ccb70e0340d26d28811ddda
SHA512 9c418ca094f2bd0aab6714dea52fc6aa3ff1fbf8ea8ed052af14c6e0c70e0cc69bbf9c87ae248dd9f8b3d4f8d2c82feae6b25fbcf11e2c3c6493c85f2307dd36
TLSH
T154D023085BB135BE30F412C7DD3C0F93346CC76D40390A00A67D06394C8150C04C17C0
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 778KB
SHA256 6c2c827059d707d1cd034632a959a9b5e982494931e7aa29207cec271b652eac
MD5 5013e963c2a9728d6837ffda821c2655
SHA1 959f6fa1ce86a55408ed534e16a411f9fff14c57
SHA512 698c65b17ee00b933d4375c5f0ce4d521e073d72c849347ad648a3b748a3b407aee5d8b6f5461cce77a0533fbeac32c60ee681f5690fabc135661208ed954a55
SSDEEP 24576:LUKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:LpPCoG44agx8EaKU
TLSH
T170052321B5B9B861E9E95331003BEC7A62A77B5B4FA0C78F4355C1AC25B9FE8CD2011D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.9MB
SHA256 b09eaab7edee596a0dee96be622634898b5aa0ccd4cb2ddf57dcda693993adcf
MD5 f2e64c1267f670ba861013e6c24ca4e3
SHA1 dc6a67698ecad5816206a5e12806b75ab2f797e3
SHA512 523a851c3900957639453b69a6385c107cdb3d85ddfce81a4477640d3611500c9c98fe2e5c383b1f634105b9056fb82aca71c178c634ba22c42309ee58d05fe1
SSDEEP 49152:6a0h2GEkuAe73q3ppt6zwwQ4PCoG44agx8EaKU:6a0hNYGtJwpqNajsU
TLSH
T1B495BF1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE84D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.5MB
SHA256 eb09f52a47c804f0d12d7324c777718f4978df949044f7bfbd52516ee22ad278
MD5 9befe2fc06537296be088c1287b7d623
SHA1 0ff49bfc0121877831a5c8ca21802e5b02864efb
SHA512 25bdef4d272fc350b821541c5e940107301086e7a4dc5c5aa7a6c61d6c07a0cb22c9f2ceb6fa30b1d18cdc49d0d122a4026721bdb69355a7d7cd148afeedc5f6
SSDEEP 24576:gj1QT7EcpfxR+N5AWAz3ooiYhjMqbHKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIq:g+TDxR+N5YzTTjM5PCoG44agx8EaKU
TLSH
T17F75C12EA7F815E5D1BE85798A23C516FA727821033193CF43A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 849KB
SHA256 4ee8f98ae99ce4fd40b4e2f31a385b053bf3887d6fe33a1aefc625bc82ee4c8a
MD5 5fe2d38f770d45435a7a31d2ece06ced
SHA1 f9df449c240bcbc0baf5eb7fe48885930de3fa49
SHA512 842de1bebacc75ccba2955d829792e7e77d4aefb7da9deb0c1005e4b830d0e4aa7104ac149175ae32dfe1bb5de9320c3e6c61bda14953155540d69e7c6ba26f0
SSDEEP 24576:NhbHjPTKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:NhbHj2PCoG44agx8EaKU
TLSH
T18C05127A36AC20E4E5B1A2794127984BD372B92B0B6093DF1391C1BD1F3BEE88D35751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.4MB
SHA256 c022372d7156fb725ac5c6b9d420eb3a163aeaf90f094ff0b94af2946628b487
MD5 06fd033d2a115128c56c1dae2ca6d472
SHA1 3bc2589430f9187ddc20b0be4c0e035998b5dad2
SHA512 0e2db3611187b5532434e86739428dd68ef026d12948c63706394aabb9ae4bf5866aef55fa5ee4b4edf6de224f05714da157e600c1541c64aab8f856f9e570a2
SSDEEP 24576:6z+gOgcRTk4yti+R5dUR/SKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:6igOVTk46pUR/fPCoG44agx8EaKU
TLSH
T1D965C02DF2B910B9D8A6D136450247B5FB71782E1F209ACB0170C538AF1AEE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 768KB
SHA256 90068123f4850f733ae5c1396283a44aac0f3885280a75bbe7da51618bfed9a0
MD5 a21471b19798e66cfc0634741e1e71ed
SHA1 0ecf18e9a49fc8377cebece64c42e44b0ab0fcc9
SHA512 be752621c80388f96f3ac23eaae78ae2c842ddd3f216db548187c78e698d7072509ef0f3131a9bd1bb6a987082f313c0e835279e2a7da3a977e21bb8d8211051
SSDEEP 12288:f34KVDL79h8IUjZrF34/e4H4paLAhxaCeSmIb6/fng/21pExw8UW3wADRUC+6ZM7:fIKZ9CLZaG4H4paLA+ZIug/n3NDRgvdt
TLSH
T10BF42361B4B57861E9D55271003BEC7F62A33B4B4AB4878B0369D1BC26BAFECCE1015D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0453734c9224a2637e1f9300eecdbc9b23981caf7b1381b2e2e36ec6ae3524bd
MD5 3b9eb6f12491dbfbbe140a19917318f5
SHA1 b51c2a970966d30e392b7c6a99a9fab6b7975717
SHA512 70270d86a0876e46b0d490a575f64eb1aeaa741a563e12bddce39d294b6b5574b77d298b5838d16cfc171fd3b3591f6707578a847923ac25fbcd2b12cdb668ff
SSDEEP 24576:3f0yUTqKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:3f0yUrPCoG44agx8EaKU
TLSH
T156350251F6A410F5E96B813C8477D927E2B2785E0760E7DF03A88A691F637E58E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 861KB
SHA256 2ac9b4b868c399110b52a0f86b877eef1455861b90d9187242f65b788d40d01f
MD5 3cf915f3c2b964a2fc96d611552fdbc5
SHA1 7982cbbb189f65e157db4b0822da2ec65f692857
SHA512 55a78463e9e2789d391435cf2f420289ed16c010039631d41ac4e9db6cd374826294c928e5a73c27f7c7000706d656e9b102f3b0bb2a98783206a470df91e1a0
SSDEEP 24576:mOxcKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:mO3PCoG44agx8EaKU
TLSH
T19215122532ED20E0E5B5A2398567961ED3B2B8670B6087DF03A0C1BD1FA7FF89C35255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.6MB
SHA256 859cd32473421afdb2c93ab60507882243301c85c5c2304ba3e095b3e29c25db
MD5 0d9a8bf388cdae75219d7f3f2c464086
SHA1 53ba2d57c790eb4e17a0643339113a35b8c9433c
SHA512 95d8aa14411798dc5b7198527e8b99a6f07065c679b6030c8e4002ed490c6c795accdaaa58f4a42b0e1b2ee9f785dc6321142feb668799070ea3a6543ad9f4c6
SSDEEP 24576:h7NM9YeZqmWMUkPjZM48Mv6bEhsbKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:h7cBWMpPjN8DbEhFPCoG44agx8EaKU
TLSH
T19485AF2E6BAC81E5D576D13DC5A28606F2F2B4611B318ACF1252833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.9MB
SHA256 c2997e47c4babde5152b4ddca0f4f9e7ebfe99222c8ec54256500843a6c391e1
MD5 629e5ee87f9737d0364236e0bfb2959c
SHA1 010bbe1ff6fd42a1d9bd82a3295aeda3dd5a9145
SHA512 4cf8e552e043e7c755fd2352540b433b119a2c95b03c05dffca8f5fed1b479f0728a0523b7010c3a40bcbe7569e58765e0538fb1eff85748e860d41c5dfb1729
SSDEEP 49152:fF2YuHNETovIvNYf8kmJPCoG44agx8EaKU:m6ZCf8k8qNajsU
TLSH
T146959E2A27ED80A4E0BBD27D45B7D186FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 1.0MB
SHA256 5b7e48f518ab4dc6513270a0d6b05de1f487d122cd97754480bc6068cd46a128
MD5 e5755794c3035cd3dbac0d52ed200509
SHA1 1f7a657fb597c3de650891bb30a4f334273b9512
SHA512 01888a703a7fd5de5e6307a49b2078fea0fbfa9de807d4396dbffc78cca583c9b83897917dc73c4f787fec791daf73482915444c3f246e6bd6f2bdd3c173fb68
SSDEEP 24576:HTMdOz0FFS+HmSL6KZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:10K+HmSLXPCoG44agx8EaKU
TLSH
T1DD35F13EA3AD14E5E47AC27D9613D906E67334660321A6DB02A0C1BD3F5BFE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.6MB
SHA256 6b842bd889b22c1adc442466ac3342b1ec78b3c426c841dc1b427ed6c72e2ef2
MD5 50019e9a8c49d17270cd465da4e6e119
SHA1 f36c98c3308d2340a25718be1d2be153ec3cbaca
SHA512 b7c1fb467b2fa2e8d7d140211a6bd92910ab1002bfd6a7518798cdd1871da46fa15b56bf5c80c8b2c2f4ce079aab578d35d87655b53d7d48cc77127dcfbd7099
SSDEEP 24576:pAFs06+OmlfzNXEbToWKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:uFs060lBXuUPCoG44agx8EaKU
TLSH
T13875BF2F62AC00D5D07ED17E8997C91AF2B1746707215ACB0260C67E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.1MB
SHA256 a263149b869b8290849801bee8ff0257244f366bb8eb4055a28d21968af9f21c
MD5 6fca8a343464b207f0e60f9da2bb5df3
SHA1 751d8c76527c62cab327e4a97a17392869918d3d
SHA512 4591625ad5db4d2cddc8b9c63ab356434f31d931adc3e4bcd982075dd41f765c2074b43fad75d9e72beb3f14893d4c66f889b5db4aec2f511869312b2e36d382
SSDEEP 24576:iJnJ5D3W2xKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:iJnJ5DG20PCoG44agx8EaKU
TLSH
T19B35E13DD2A810F4D4B7C274815A6A96FF72382E2F216ACB14B4D5353F12FE09979B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.1MB
SHA256 7d356b6c00ee0f273531c8db271b79fe6b7a1e9045ef45e207966e7abd2ce525
MD5 164c0329dc956cbd3504ce545f078f7c
SHA1 bfe3f64573d79954baf20d7e98768792a38b6d90
SHA512 a6a41366bf116d358f18b8fea298bc358c7e4fda2507deed3f48c9a1fd246283116bf6ee4a849204fba69141f8c1a26c6a82843cd63fbc15fd1ce40efdfda4e0
SSDEEP 49152:tF06DIKdwc+eQnSt65aVVPCoG44agx8EaKU:3LqNajsU
TLSH
T14DA57D15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 50d57b1ffc05961a924ae42f5eb65cf3126144c6ec13cebe036779e0945a74c1
MD5 9cdf4b6b19c5939f8ceda032b1937b3a
SHA1 904e65c03706d48e6e63ebf2957d13b44a2072fb
SHA512 9f03ae74d9eb32973c3ba60a455bc3b03d6f80d566db987909e6cd8ec2b34edb38aa93ab18b9c1605b21efd6efdace0d960666a4479c549776f13762c7020b1a
SSDEEP 24576:FidKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:Fi4PCoG44agx8EaKU
TLSH
T12F05126D76AC70E5E56A91398063C85AD3B3F0661BA057DF03A1C27D4E7BAEC5E38210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 902KB
SHA256 292c939364e885299252fc18d304bd7b7ef7c3067556c7b66ca12951738f367a
MD5 2073eaf06da5a4572807e46afa582f2d
SHA1 97cb89b79aa978f86683aa7d3966cdd771ab5a0f
SHA512 6b268fefc7470d9a863d38d70d3118fc429cae776c91e6ee51d1fdab0069e2a16d1374f9aa756d9991c540ac59a05dad320a80fec77a3ba603c07d81d95edd95
SSDEEP 24576:9IyBKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:9IBPCoG44agx8EaKU
TLSH
T1C515231073A474A0E9F946348537D8AA96B2BD264F7087CF4290E27D6F7BBD89D30319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 825KB
SHA256 486629cba148acb72453ea67e23ff3a28f3afe4a70c3332d2544ee0d07ce353a
MD5 2b446569ecb1d5a165ddc702bc478a3e
SHA1 3bf141c766b31235f51a57ae47bf6f7ca5ee74ae
SHA512 a6effe9e89e42c4f00eed1183c606c7125e5a1a979806e0a1844b2106568738ee27019591ad37cc3ec8ea6e1f9612abb10eba236ba061f44ccc31c051a59b386
SSDEEP 24576:XaKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:X3PCoG44agx8EaKU
TLSH
T1A505121972E830E0F4A65231853B986A92B2B96B07709BEF12E4C1BD1F77BD8CD34315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 773KB
SHA256 0863eb9569a0acab0e7f93c63be661663e35d8c0cf1887195193da38bb783bbc
MD5 eb994d2f920278a3b9ad996a9c395a96
SHA1 0d2a69b994322393aef5ae9029e531bd0773ed0e
SHA512 564d550ecc9381dafe8b09086b15800325618e438d8ab134e47c5e988f441aac376d64d337e77159b5b3c089377f360e9341fbab58a65a9a5acbfc0cf78528a9
SSDEEP 24576:a3KZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:a6PCoG44agx8EaKU
TLSH
T1DEF4236070B574A1E9954271003BECBB52B37A5B0EB08BDF03E5D1BC6ABABD8CE5115C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 8dd931d95a273d2174f8b6fdd57209fced2f23859d65070914fdb92acffa1357
MD5 bb5efa1500c992cb11cff5ff6a6b9653
SHA1 8faa01c253dc04829d8bab89b93f23fdfee4b289
SHA512 b163d74f75bdde674c29d4c2ceff746d5b06d6781ee5f2d74054a181408f123ced79b7a21cc40197bc7704e00e273c160b22bbc883dd61739cee557e7e24c3ad
SSDEEP 24576:oQ9MxZKdcz9ew3NFKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:oVKiOPCoG44agx8EaKU
TLSH
T136659D2DABE9199AE177D23594A250C3A673B4311B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 962KB
SHA256 d815e5eb48593e7e83a9cb11035ef5c110480861e927bf30ba6fa16faeca5fe6
MD5 d8c30d96f69b95448c849ff3c7cead05
SHA1 41d8f56570ba3efe629ed8001ab01800700d388a
SHA512 04bdc505bb383b0b53a7b1e6be53cb980e8359a0d074d2ddfc6737cd46c9c27400280dd1deaf64114a51215f649865f07ef69d410f2e6d85aafddb6513660e83
SSDEEP 24576:4yoc8ApdKZ9CLZaG4H4paLA+ZIug/n3NDRgvdEaFIUf:Voc8Ap4PCoG44agx8EaKU
TLSH
T12525011FBBAE40A2E076823C88568656E3B3B0351B6197CB5291C33D4F67AECBD34751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.3MB
SHA256 2e39729060842e70886aea1216d84ed23bfa205161a53311e5ec81ab7719f188
MD5 f61ef828550f71ac45d44fbe6b1a4b40
SHA1 9f3d8b5226513a99ab97f53502d7db814a9c7da4
SHA512 860bc1c309eb72cf66a536887d6fd0aa473e8e69b561eefd1bf1f15f822d20c00d931bc50c0e6b652f12deb7766a8186118ce78d5ef52a0f0f40bc39c733916c
SSDEEP 49152:RzcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKbPCoG44agx8EaKU:m0zuNIrqNajsU
TLSH
T198B58C3DA2F800A8D8AAC375C5461766EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5968-0-0x0000000003380000-0x000000000351B000-memory.dmp

Download

memory/5968-7-0x00000000036A0000-0x0000000003725000-memory.dmp

Download

memory/5968-1-0x00000000036A0000-0x0000000003725000-memory.dmp

Download