Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/11/2026, 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe
- Size 4.1MB
- Sample261101-3ftv4ady5w
- SHA256 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35
- MD5 3057579a119bd44daa64816c0690b50f
- SHA1 84bbd8450bdfd561692f76c6621205e62615bc08
- SHA512 b3698cd7bc2c6dc64fc7366ef2b2e9490d16d707601ac94cda12e67a5baadc5200eed4821f416855a2a995d8e884eec88e859d815bba5e032ad5a74d428e6b67
- SSDEEP 98304:FQbRxm9ve+OMVMCdfFbUZjlzbwjNo8V/BsFrwT254zNsCAbEXy00u4:FQ1xm75XFbUZjlzbwjNo8V/BsFrwTP6r
- TLSH T161169D89A3ED41D8D6B2D17CC907860BDBB2F4154330D7CF02658A5BAF776A24F3A261
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4500-75-0x0000000003010000-0x000000000308B000-memory.dmp family_gh0strat - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4832 powershell.exe 4832 powershell.exe - Executes dropped EXE 1 IoCs
pid Process 4500 21EC2020.exe - Loads dropped DLL 8 IoCs
pid Process 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 21EC2020.exe File opened (read-only) \??\X: 21EC2020.exe File opened (read-only) \??\Z: 21EC2020.exe File opened (read-only) \??\I: 21EC2020.exe File opened (read-only) \??\M: 21EC2020.exe File opened (read-only) \??\O: 21EC2020.exe File opened (read-only) \??\Q: 21EC2020.exe File opened (read-only) \??\Y: 21EC2020.exe File opened (read-only) \??\B: 21EC2020.exe File opened (read-only) \??\D: 21EC2020.exe File opened (read-only) \??\H: 21EC2020.exe File opened (read-only) \??\V: 21EC2020.exe File opened (read-only) \??\W: 21EC2020.exe File opened (read-only) \??\G: 21EC2020.exe File opened (read-only) \??\J: 21EC2020.exe File opened (read-only) \??\K: 21EC2020.exe File opened (read-only) \??\L: 21EC2020.exe File opened (read-only) \??\U: 21EC2020.exe File opened (read-only) \??\N: 21EC2020.exe File opened (read-only) \??\P: 21EC2020.exe File opened (read-only) \??\R: 21EC2020.exe File opened (read-only) \??\S: 21EC2020.exe - Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\vssvc.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\wbengine.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\System32\msdtc.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\System32\snmptrap.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\msiexec.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\AgentService.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\System32\vds.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\System32\alg.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\AppVClient.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\locator.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\System32\SensorDataService.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe -
resource yara_rule behavioral2/files/0x0001000000009337-304.dat upx behavioral2/files/0x00010000000093af-308.dat upx behavioral2/files/0x0001000000009952-312.dat upx behavioral2/files/0x000100000001b952-324.dat upx behavioral2/files/0x0001000000009cd6-328.dat upx behavioral2/files/0x0001000000009cfe-332.dat upx behavioral2/files/0x000300000001a192-336.dat upx behavioral2/files/0x000100000000b974-340.dat upx behavioral2/files/0x000100000000df21-344.dat upx behavioral2/files/0x0001000000009fd4-348.dat upx behavioral2/files/0x0001000000009b92-352.dat upx behavioral2/files/0x0001000000006215-356.dat upx behavioral2/files/0x000100000000a050-360.dat upx behavioral2/files/0x000100000000ba3d-364.dat upx behavioral2/files/0x000100000000a0ce-368.dat upx behavioral2/files/0x000100000000b94e-372.dat upx behavioral2/files/0x000100000000a1d4-376.dat upx behavioral2/files/0x0001000000009371-380.dat upx behavioral2/files/0x000100000000a2c1-384.dat upx behavioral2/files/0x000100000000a304-388.dat upx behavioral2/files/0x000100000000a319-392.dat upx behavioral2/files/0x0001000000006223-396.dat upx behavioral2/files/0x000100000000bd4d-400.dat upx behavioral2/files/0x000100000000627a-404.dat upx behavioral2/files/0x000100000000a02c-408.dat upx behavioral2/files/0x000100000001b956-567.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 21EC2020.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 21EC2020.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 21EC2020.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21EC2020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 21EC2020.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 21EC2020.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4832 powershell.exe 4832 powershell.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe 4500 21EC2020.exe - Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe Token: SeDebugPrivilege 4832 powershell.exe Token: SeIncreaseQuotaPrivilege 4832 powershell.exe Token: SeSecurityPrivilege 4832 powershell.exe Token: SeTakeOwnershipPrivilege 4832 powershell.exe Token: SeLoadDriverPrivilege 4832 powershell.exe Token: SeSystemProfilePrivilege 4832 powershell.exe Token: SeSystemtimePrivilege 4832 powershell.exe Token: SeProfSingleProcessPrivilege 4832 powershell.exe Token: SeIncBasePriorityPrivilege 4832 powershell.exe Token: SeCreatePagefilePrivilege 4832 powershell.exe Token: SeBackupPrivilege 4832 powershell.exe Token: SeRestorePrivilege 4832 powershell.exe Token: SeShutdownPrivilege 4832 powershell.exe Token: SeDebugPrivilege 4832 powershell.exe Token: SeSystemEnvironmentPrivilege 4832 powershell.exe Token: SeRemoteShutdownPrivilege 4832 powershell.exe Token: SeUndockPrivilege 4832 powershell.exe Token: SeManageVolumePrivilege 4832 powershell.exe Token: 33 4832 powershell.exe Token: 34 4832 powershell.exe Token: 35 4832 powershell.exe Token: 36 4832 powershell.exe Token: SeDebugPrivilege 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe Token: SeDebugPrivilege 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe Token: SeDebugPrivilege 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe Token: SeDebugPrivilege 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4052 wrote to memory of 4500 4052 132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe 88 PID 4500 wrote to memory of 4832 4500 21EC2020.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe"C:\Users\Admin\AppData\Local\Temp\132d0c5cb10a60b39e48e82450d443fea0c328a105095e379c7bcb3edd563c35.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Public\0800B30309D\21EC2020.exe"C:\Users\Public\0800B30309D\21EC2020.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\0800B30309D'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 6.4MB
- SHA256 96df62e29603041841bbbdf33e19ca7605ddbe9e156edb071fa019074d91c134
- MD5 fd1c14a121038fc17eb6d21e9e488d34
- SHA1 2799f666f177a8e85e89031324f33bd891780bab
- SHA512 ec63dbb0b5835808a2c0a2e7a11851f68beefa2dba5067d282338f1281cad592abb889222f3aabb4996780869797e9a590d6657f2b138f68c52600862e84134d
- SSDEEP 196608:Hog1P9fIlOuz6IgF+I3m2MXP6HG8Ez+OoqG:HognqO86IgF+qbM/6HG8Etop
- TLSH T167669C23A4E08031E5F732756D2CA7395A327BA29F3145CB86946C946FB43D3293936F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 2c6c98190b623b268818971c189b2c20c14973b6003a825a788197a743098633
- MD5 b45cded1bf91704fdd390078396e8884
- SHA1 a4e9adb98fcddda0547db755f8364d7b5ba2cbad
- SHA512 739c8be1f75337a78f9ad5d167aa1f42acf410a517e05f3a5c9864a6cc431fb7aa3d474af5d1dac1c1077ff737f623382aeb1307ff732c0927e6160204c38691
- SSDEEP 49152:nb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnnpXoRn0PMuTF1Ad:V3q6gjBQXy00u4
- TLSH T168E59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 820KB
- SHA256 0b16d9a7651870cfe46ef07ec23f748a62f7208a876389a170752a201fdb3bed
- MD5 aee3356bbbf4cc9c3dde4344a2d52981
- SHA1 134bce1eb553d937268762ee0737b0c602fa716c
- SHA512 2982c9ab9d60bec0d774aa0a579658509666083b820cad0d5c7d2a2255d00e81762e63443cf1dd4fd9d4341d129dc70d5a29eb951af9fd3fdaefe96c91327995
- SSDEEP 24576:LT8l+hd4q9Ev1Jol8ED4ziAAEFAkJMAq/5pZYAG:LTD4q9EboOED46a7GAqxM
- TLSH T1AE0523037F44E2A2DEF70975611FAB9B87E29D7301A87E53A3697B33E432161C41A94C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 c856c507b9fd6a0b3692a18ecd0bf8def9b78125a1ee308aa79af1dfae546283
- MD5 060cec8411ca958a8aa3d6f482a786f1
- SHA1 3ce4880cccbfa6940f3cbd9ee9bf7e348314aee7
- SHA512 1f0d16000fc0f3495b5fbb07c084a4a62ae2a235893e78ff8c4a9e1561cd87abd39aee6dac7ae8624b9f449071515447c46fc39ec744c7bc68426ff9f95e7c0d
- SSDEEP 24576:zXYDZtczAKpXoRn0PMq/DBTPNoIcIQDxD:0tcTpXoRn0PMuTF1Ad
- TLSH T15425022877D408F9ED67817DC9628901EA3378458764FB9B03B495265F233D89E3EF82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 a209cb1c5028a3e81ed1675a7dfdc8f2bac4f9e4343fabd92a6c6bd7d8758bfc
- MD5 645879f1124d0d6a313bd57bf2f10f63
- SHA1 b2ef140f6608179b293b4a12d8a447cecdca847c
- SHA512 c0722a2fe16f8ecd3f2e222a2a064128cee4588a154f080c5d22ed547f75f6b0cddf04ae3207b2f2e87d2aae2efc1c18dceee744e9da3c84454fbbbd847fc8fe
- SSDEEP 12288:Amw5HEjsChNiBFgl0WDm+CNonSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2j:dwu7OWipXoRn0PMq/DBTPNoIcIQDx
- TLSH T14625014A37E81CF9E9A751398643C535F7B2BC022A25DB1F1760C65B5F33361AD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 151db5911331d3837952a2c6242dce7922b146631a28be27e26ff465da8e4758
- MD5 43b37ff2fff470b44ffc236dfd3f5676
- SHA1 43d107934cca6c478f48da2fcf5e717b34fd711c
- SHA512 9574a9b3529eff6dbfd6679c7a59f95b773622eab6ebbe99ee8da1af82ea14ae2ce291e579ef8f5c397facce1142b6797df350e2cd7e50afbf1cc078875c6946
- SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ui:IQRQyi36YOcP8Lvw2gAf+PN39Xy00u4
- TLSH T1C3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 97dcbf5adee71c2d74a33aafe5a6a75c31f46d9cdcbfc52185968f1a866995c2
- MD5 ba0e078f9de9b76bc80bca14510a292b
- SHA1 27bd7ce3caaba4baaaf56badefb459bc62d49879
- SHA512 be6dd3cd01b4df3c3e64c044b4782081a2d3faecdde1d4b1e468750d2f7c6c5bda20b494c9d9a5e992da300020abed9ae91f3c727923972d6e350f3bb1cb8248
- SSDEEP 49152:EB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl6pXoRn0PMuTF1Ad:eu6JmTxd2deXy00u4
- TLSH T1A6E5AE13F1DA01E8D06AD478974A9233F962BC490B34B6DF0A9073562E77EE4AB3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 4d8f42c268ad182711ab6610defb670bc7bc877b0fe6bd337aea9c9a843d07d0
- MD5 8298bed50038868a5af3c43c5e77b680
- SHA1 187b6118d5e26cd09f6c0eba0355994972eece5b
- SHA512 c5da388eb03c18b29df3c19f56f6f4cd340c398d5afffa29c4b7c6d85a0aa2df3fdc19a76b0093d3cbb36992756d0bd505da594ec3df8a21282672e1c465fe70
- SSDEEP 24576:Y9wvtk9RX6wkyAIqpXoRn0PMq/DBTPNoIcIQDxD:LMnYIqpXoRn0PMuTF1Ad
- TLSH T19A45E029EFDC08E5E1B7913C89A3464AF6B178191B31C6CF129A536E0E33ED49D3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 a1ec6b6020e43e77be1756c61af20dd56508fd5c6499e5ceea930ad9107704dc
- MD5 137ea538a020288dd3c1927ff6a66c6e
- SHA1 913d2c3655272508f00003a0a0d8f1c7ce1ed03d
- SHA512 a733d9f208530d0f55be837f0a6d81548fdd2e0ecb217d15bf7a39bb5afd799967327b81edaf63fc620cb23734497b22bb4fe94eb665d31b49ea41108c05e56c
- SSDEEP 49152:iYoFNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00pXoRn0PMuTFq:8ySzPEXy00u4
- TLSH T125067D96A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 4af1dd16dc0459e38763a1dd6337ec24b710a2413749dbb219af02caff5337da
- MD5 5c341e17dbb19dd91b84407f128a5133
- SHA1 7df67ae4c0341f537c5108ed1e166c3f092c7b51
- SHA512 f91cbaf4edf0983e219e2a0682684bedc2bbe53962e0c58d25680492b494cb182fd30723b9eb06f4865adedc1947ed2e202e0f3b693e6290b48ca4a383003e1f
- SSDEEP 49152:HD7JUQjXirIhCnDHUPfF/oApXoRn0PMuTF1Ad:fJtglD0PbXy00u4
- TLSH T16C75BF1DA3EC01E5E1BA927885154A5AEA71782E1B31CACF2270437D6F23ED49F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yfrs21ly.35s.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\0800B30309D\21EC2020.dat
- Size 61B
- SHA256 cb59c7a1e35da6f7b497ba1d88ef9f3a345c4e4c3b3adb2105989d161fd0453b
- MD5 e653342531425a2a902a463c1aa1d07c
- SHA1 f7e1ac75060b3e5db51b3063817fef7b9053ad1d
- SHA512 b85473d07c7abb53e8ec3094dde1bd2d141e4182158277704a86400e41c9ff16ae7dcb5517bae83d534a2046cd02c03ad3d6cb4a6f417b32be0b4244634297f4
- TLSH T1D7A022800080000002008C00383C0803A00308C80AC02028A2E3C88808002CA0008B00
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\0800B30309D\21EC2020.exe
- Size 2.9MB
- SHA256 729d22ef6f8765e79f76209d19822a08e0f696ae26b8396beadf47207931d9e9
- MD5 e18fbaa50258345c5310b16ada166c36
- SHA1 ac157426d2a105ac08ee86214a515b4c916ae87c
- SHA512 4d8e640ceac78c8b4ad63669e90f68dc95ddde16c6552c14937002289b94053979bbc3fbb772b6eb8c211885cac6ee8834e7d07c3d6e76584b68e6f6924eebfe
- SSDEEP 24576:vnyQDOqwc4/claXufUhdEI8fUhdEIPgSgs:vyvqw5UlaXufUnEI8fUnEIPjgs
- TLSH T1BFD58D21F700E43AE5B718F6CD7DAB5C461D6E62070101E7B3CC3A5E6AB56D22E3192B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\0800B30309D\LIBEAY32.dll
- Size 1.0MB
- SHA256 95a9bf1f13ef61c063b3705dbc457a2891ef35947f09bc8360d6e439e05d77b5
- MD5 220c1b7e726e840a98267ed1cd152de2
- SHA1 b0f723b900c427489cc246f590dd27c05842f372
- SHA512 d0c5e6da4d296f2e9864d4bf8136db32c83065fd38fc943ab047830827fa7a9d8e39457135363dedbb4634c2ab940dc20ea946df09f571ae237266cd681b3f92
- SSDEEP 24576:U3TJLu0xAoU/Ifu+ks8dbWmuIBnLPAMfApVzPXJrIBN64c:01dFfBks8dbWUYMYpVjXJGNvc
- TLSH T1D1359D07F78589B2E88E867D25B7567F5A339A024329C6C38BA039419D701E17BBF3C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\0800B30309D\libSWASync.dll
- Size 104KB
- SHA256 694a94215e721f718aec8dbe9a4b4ce4e276d83e93fc3e150b03e312b04c6ae5
- MD5 847357fe2bea1cd74e8b339f8b799faa
- SHA1 d8d18215a3a632354f2cb574ac102426f9e0eb12
- SHA512 a8db5018e1a54e161843ccbac2a875ed0fc8489f87c12669f0438c6e72583439c88e20e7d1bd7f8a9d7cace491f3c6e842e472902a4fbc3960130c5ebfbec3b5
- SSDEEP 3072:tBI8vOeo2PqB5iIeO0gq38X1lE4aBXEjo8:t68vS5SO3CKYSo8
- TLSH T134A32951B6EBC130DCAE573D892D8A20473B6891CB14BCD7636C15E90E383D2BE3695B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\0800B30309D\libcurl.dll
- Size 390KB
- SHA256 45da86a8059f9a4dc6bb6b0eff1e7f48d9eabf71bb05900b0b37433275c245a3
- MD5 7ece26f933b8d3a6b4dfcf9edc77f8f9
- SHA1 86714fbd36122941fbf83313e427d466c9e9a69b
- SHA512 2d8edbb19ed8d03591ac31d690ce1c95640c0fbbbb6d4da0db2dff9b90ee1869dee71ce7b5a20dca7771d2e13db9cc9e227174ced6df9df0664ffabf016e351a
- SSDEEP 12288:VsGA+UxNPvOm986MhjfC5SCD2L5qGsU+m5O4S5GuO7gKTUzsG8:bUveGGqm5O4vTT
- TLSH T1AD84AF96FF8080F1E8C25379316A27BB1D39A2441329C5D3EF945EA55E126E1B73C3CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\0800B30309D\liboauth.dll
- Size 21KB
- SHA256 231a753658d8bff56419783f68dfc7b9ce295bb72dd2ccd8cfbe0a1d67674074
- MD5 16ed6eb567c0bc183198016920de7cef
- SHA1 fa0b41adf8e178e5e60b7251b29eeeaf2079b677
- SHA512 8ffd9d4dd4ef705b8ca7b17dccf4a7b1279ccf2b77af9b6bf2169aa3259f74694a2df17836bbeb1a568047d307e59b525e5b04c84bb31e979b8fc8f28ae5ef93
- SSDEEP 192:ER+QGHW3XvHBa8PxR6+oMRgoXMcdUBSZDYl+z0rcecnQCX7SR3giMb1lRMdm53XV:KqW3XvH45iFgS3kcecn/SRkREmFuhl
- TLSH T195A23B86ADAD40A1ED542CB870A33F23173C6377677708C7D7A34A994E50EF36A72216
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\0800B30309D\original_libSWASync.DLL
- Size 599KB
- SHA256 b7697f1c734bb64176c09ebe9b1a16eee5e14eae58a7bd5d6ba02695ec732056
- MD5 97f30e4475857222e155a7c3c3269d7c
- SHA1 4d38a5a5915d709ed25aeea8f7ed77f91f48b41a
- SHA512 f17b97e1273de0f1fc2530d1435758b47c3db7286036ef441984af0d7317a684a77117adacb944f6ce2cdd690d3ccd3250bd870988d85e4282974755c4537df8
- SSDEEP 12288:vduh+K+iCybCKZjy17RRdqyoNYbRuGfaVKCB:vDKTy1tRdqPSPyz
- TLSH T16CD44A93BBAAC2B6DD5D31BC00199F3E876C7A45132055E3A78C4F0A4A725E37D3B246
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\0800B30309D\sqlite3.dll
- Size 508KB
- SHA256 de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f
- MD5 0f66e8e2340569fb17e774dac2010e31
- SHA1 406bb6854e7384ff77c0b847bf2f24f3315874a3
- SHA512 39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05
- SSDEEP 6144:RgEF6lmEVKtkDCQ/kUrc7dBLhuKgrQCjBXPTnrKcCxcfKvrLJLqgx5YMk4HJ0yPF:GEEdkUrc7RuKcQCdGVtT0MkCwwV/Hn
- TLSH T100B45C53A452DC39E8D202B481720737966CDAA0DD63EB43A5D1F93B6EF35C1B62930B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\0800B30309D\task.dat
- Size 114B
- SHA256 1f58b562491071aba811ef75491ab372d1b88632964d49f7b2281cb71dc5ee18
- MD5 1cada2504a645239f5eb4668bbdd9eb8
- SHA1 2f5ad9b2a69a750275684327642a6bbb5b1cea51
- SHA512 25da333be20f0682efcfd324463441e4b367c20b3605ed5e24200be839415ba44bb1537aeb65a309494a13023921cc00547b43ec14d66ffb91a03ccc4d5bebcb
- TLSH T1A9B012C006B14FC91D03A307583E013F28B28B6B16B96D59F2187C9946496422436834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\0800B30309D\uEYYJqJOwXXJ.xcp
- Size 583KB
- SHA256 bc3072097cfbbce9181d5b7cf5e7d22fd8beed5607ea30c7cf3224d578bf9c1c
- MD5 ded547a46a13fadd00133c49d07be461
- SHA1 46419d4f564e36adf65859c3692e76905cc2b9c2
- SHA512 d68704af8d785272434c19222a33ea178f13f803aa07aec01d13d7fa49d916924ad5e91c67e06a9d2b4ff047ccecfa301ee9e5e09599a1b447d5e59f7abe643d
- SSDEEP 12288:pfU9iPLH4+GuxJ5aKNTA+RNsrmKEcOckon9JDQkPay27BgG/:dU9qY+NxJ5aKPTsrPEcO9yXNg9gw
- TLSH T1C8D4237EC0B5BBDDAB1D3E787A4951AFB6121752CF2F151382208284D971C0BC99A4EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 796c32e97c0a6b1b82270e66af524fb54c3f3a93f2b43855465e842f743c2327
- MD5 f3b85d3069a9c2a90e0d8744982f0b66
- SHA1 06985aabbf1953bf56ed7a2d0ce12fd6b7001e6a
- SHA512 16af0f577370b2c0ef4f573c3ec95858e0d4a0a1db481d6e50ecba41c29c3b4bca3f74c7ae36b8d71f071a4a9aee672ba45c2e5e14721322221b07c49f62caa1
- SSDEEP 12288:Vo71onSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLynr1qAHMKU4:K1pXoRn0PMq/DBTPNoIcIQDxD
- TLSH T1C70523596BCC7C19F6B534724201AB90341A5D0ECB44EE5AFC22524BCE22BADD973F4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 5ef9db9b18203590eed64482cab2e4d38bdf3277170cbac9adeede6e5036f584
- MD5 b4002d66e4959c6db177152a8eff18cb
- SHA1 f3e2cccc27bbcee7ffc3433cbf566be53ef1bbb7
- SHA512 9cf8e3ae0453da685c3f8716793366bbc7af4a024c648fb4871bf8831b051dfccb3d9487998c68cccb3d6310a8f8d2f249c2f13775935d923e8ecdc71c322e24
- SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYrpXoRn0PMq/DBTPNoIcIQDxD:fgb4mBIBhGFwpXoRn0PMuTF1Ad
- TLSH T19A75BF1E22EC02F5E0FAE2B8CDA64417D6B278164731D6DF1151422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 6c6c574b6876a3d1cac8d9ccd5176d3d11fd4a41d53171bb3f8a7ebbe2fe7b1c
- MD5 c0de359e9e481f612151c3ba98466faf
- SHA1 cd8f25f8efafe2033b2927d611a7cb7153d78f00
- SHA512 9e2a91d188dbdc4b487c05f1c5f969a273b3ddd0162b65dd5c0bd15dfe061f41cb38e684628a7ec26a092e0ca7234213f5ea6bad584d9072affab58bc681ebea
- SSDEEP 24576:zTkNvNnaFeYhJNtmZBmWpXoRn0PMq/DBTPNoIcIQDxD:zTMwBtOmWpXoRn0PMuTF1Ad
- TLSH T1E675BF6EBAF806E4D1FAC6B58E238512FA727451073293CB5290C13F4E279D89D76F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 828KB
- SHA256 b280e1d52bee89ba30ecd598b9b56baf371f05c9ee75325266c5b764e72ab9bf
- MD5 3ae3e776a7287791220da6d61ce9580c
- SHA1 08213de20f362928ac4fec07bb97f80e90f38f98
- SHA512 9a3da492e0c0f855e5513026af9b65fe5b324687f928358aa3e4a3da6e1f4359b21d200205c5348faa6560d992e3daf105f72c7e534ff4b552ee19fc495106f1
- SSDEEP 12288:KBGLonSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLynr1qAHMKU4:uGLpXoRn0PMq/DBTPNoIcIQDxD
- TLSH T18805236D3AD938A8C576527685016AD138313815C7187EFF5CF19136CF22BF9E232E8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 792KB
- SHA256 8aaae289ed54892c4c1c0591d5a7525f8fb513b16189261d6300e0745c600043
- MD5 a5799d2ce35a2703e0a15cc1192157fe
- SHA1 544ed17c41f639f957c23c404626c5dd8bbe4ae0
- SHA512 b46719b7e54fc7e7f3b90e95fcefc13afff5ade518a8b5096093566e5d39270288af2108377a9d3b8056a9115977b8f4f9fb2f2cb0bcdd71cdd925ea3ee07e7a
- SSDEEP 12288:e2onSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLynr1qAHMKU4:e2pXoRn0PMq/DBTPNoIcIQDxD
- TLSH T1BF0523996A887C6DE29224774201AFC438150D0ED349AFE7BC665107CE53BEED173E8B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 0c576b29dbcb4e97e6ef55d8b1bd64cfc0e0440bab591bb6af83b1390b03f068
- MD5 95e9d0ea5c26964dd17cbd835eb86b89
- SHA1 f5d219018bf4cdc0019253c80f95e46bf99e8637
- SHA512 0bf91600f35fb3476af326db15975d7934cb7a45318c411dfc342beb6c6895089bb2151c60c04be950bd0f4e833bdbcdfe90edcf11c5b91e0b22a61237702a69
- SSDEEP 24576:FbW8/8FpJqH1Dzria7/mhpXoRn0PMq/DBTPNoIcIQDxD:x1UFPqVWa7/CpXoRn0PMuTF1Ad
- TLSH T12E55016576E101F4D477D1388A424AA3F6B2B8150364EFDF0AA88A521F23BE54B7FF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 996KB
- SHA256 a177b812b4c765ddf0b39edb0181ad19931ff7840e26f600e3a182179d58c849
- MD5 970fc737e89af47d2d1b5badecb85482
- SHA1 fc175ea7f2bd82320f493ac078ce7a7c2593d2bf
- SHA512 7796e8efac8e61076de43bc49ad83547336429c9c0a5b8bfed95cf007c8b398cbd0d080623a63d907f70316c68744b752255ff0ab2bf4955a56ef13e5a247f30
- SSDEEP 12288:rHvUrBFrEjwaQa9onSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLw:rPUr+NQEpXoRn0PMq/DBTPNoIcIQDxD
- TLSH T19A25F22F26DC1CE5E676A17D86428709F77178160312E6CF06A1817E4F63EE8BD3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 358bfed92409d92ebf58d3f12cebe3f2c1decb6d487ad573e568349e2e840176
- MD5 5d2455dbc355cb83d37114e30395b179
- SHA1 a6beef9d70b418fbd0271d5d8ed10a9e974527f2
- SHA512 907d3ff18b591854cc54b86c0c05c493897f5def9fd0bef5dbb2118bd3b008eebd00a01c80fb7d07fa505e4e5506145663f1d4b50c90fe5c424dabd553f4a453
- SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0pXoRn0PMuTF1Ad:rG05lO43bfXy00u4
- TLSH T1CED5C06E62EC11F9D1BBD17CCA864A0BEBB23415033556CF02A486A91F27FF4957E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 9a317e1a5b1129a2fa6a42271de0b8c5db2ad61147e10a1ca852bf453786358a
- MD5 9edd9e8ef4e9d101f5de0c68da911335
- SHA1 7ad96f797a8fa3c682fe88f90395ed8d646f10f2
- SHA512 2660f9c43eb44003f0486ee7cd2a9991cf9d4e32a660aaf83a396ed5d27c7ed921cce20b02987ac305ad5e38a6e31a668512a10fbb6661b8252e2a9d20ba47f1
- SSDEEP 49152:Ra5POZ3wJt2pasx2+mOpXoRn0PMuTF1Ad:1UUXy00u4
- TLSH T1E275CF5EA6FC00D5D1B9D17DC5834A1AF5B1342653319BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 9439234f19afb70b8aa7f9675fc7e12938489f3170a1b27458190b0019f6425b
- MD5 93b720c5f1fea72be75953af3e57d146
- SHA1 ad0f37243060617847be1aaa7b7b9f462d56ac16
- SHA512 906892652ac550ca978458e4c1ac156921c082e78f1393d91554fe3158973b7446e9cb8ac985237fc14f340ad67d5f6264dd4168dbd78083f6bcacaba2e8233d
- SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkDpXoRn0PMq/DBTPNoIcIQDxD:pNc/zEOVHFEpXoRn0PMuTF1Ad
- TLSH T1DD959D1623E901E4F1BBE1BE89679546FA71786953348ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 df8e1c235e469c39ca0c09a8e1caaac6d080742b2ad7d51f98c3f9fafad7a312
- MD5 0cb044cbf0a6c94b37e3a5106a5fc2fa
- SHA1 df8eef1fc51db9e7a339c60d84c3022ddb2f125e
- SHA512 0339731a874906ba942aa58c6b31e88f6ea64f6b3a2d4915c008117bd2206379f9dafa6a611dfa57929b2be360a626f5792fbb0b9ee0a0c80a5e86dc40269a44
- SSDEEP 24576:TD3FHshBIYQgAYApXoRn0PMq/DBTPNoIcIQDxD:TDVHeBIAAYApXoRn0PMuTF1Ad
- TLSH T1EC45F27DEA9C04E4E57BD1BCC6538A06E671386D03226ACB059481BA5F67FE47D3AF00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 1b828b6eebf255b190833d77a27bf5f3162c48549a7834f993c5f85c34faa745
- MD5 21a6ab380330a5c6e2047e503088f7e9
- SHA1 78bba98688fdf3b8c1bc45a2b0e58c4fcfe55d8e
- SHA512 83f077bb5f89f7bdacfe549a33592a666af20d2e1ed0a8769ea47d9b1d0600284ef2bfb4b8293920a87fa2b6118b91af41893dfdcc5653ef67ab4ec6f3947172
- SSDEEP 24576:QJnJPbzB4S9pXoRn0PMq/DBTPNoIcIQDxD:QJnJv6S9pXoRn0PMuTF1Ad
- TLSH T10035F13DD2A810E8E4B7C2B481161B99FE31382D2F2569CB59B4D5353F12FE0A939F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 25b80fc383ba3b0a5b7948c15ebbe44024eeedd3ce08cff0fdda5c06dcf23da9
- MD5 aa770cfd3f2fd8440a3856742c308edd
- SHA1 036bc415130bf8aea1fc0cfd36a78f4458700b2b
- SHA512 8be315f64bdec78abc791b61411a2ce3e6513b46fbfebe10475a42f8ad477eeffdff90f41e6fef08976f7d16fe075c99182f9689cee5ab533936e30403fcfd48
- SSDEEP 49152:WCLHGeeV5ijCmlDWDkzpXoRn0PMuTF1Ad:dnXy00u4
- TLSH T1EBA57C05A7EB5184E8F3CAF5CA2294169A327C449B34F7EF4E80C96A1E32FD5D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 8874c02e2428f13b2a8d5fd7214738e5d9a4d11f1322f5476a62e45d6896554b
- MD5 119a894dab4d5960680ba373eef1dd4f
- SHA1 e6eedc6316b0e91267f9b63c467563831b7d3b12
- SHA512 de128b8c8957e2bb292aff3df0b6b3ed581e174ebe46f79c326d433d9fa0d139398b808319490dd8a2ff9fdb209e1ea5771cad0301c3530a5cefabf603be3325
- SSDEEP 12288:k6Hck6j5ZI70onSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLynrn:36DIApXoRn0PMq/DBTPNoIcIQDxD
- TLSH T1B325125C33BA10F9D167903E82430641E1B2B425C7166ADF5AA4C57E8FA3EDCF939E42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 928KB
- SHA256 a0e32629833d3d3a2da1e76f86c22ffb8b5e792c2d85310d6a4f18813ef3c9ab
- MD5 bd7e3b1526df8d7f7d8340ba9292462c
- SHA1 96cc862ec6c74efae9e9be8bb75982fd91c5807e
- SHA512 f148a44715b269d47e50b49eb54a3d64c86651afe6aa50a31416dcaf14e31700292e7243c5c4675e3da5c636cbd7d88b007fde7ce6de1f22e57bc74cbd0c8165
- SSDEEP 12288:PG6kyTonSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLynr1qAHMKD:+tyTpXoRn0PMq/DBTPNoIcIQDxD
- TLSH T19115230867C83498E6B61135861287D06E357C149B11ABDF69A1E23F9F33BE8E931F47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 936KB
- SHA256 0a608a369d86608e1a124b26a5ebeb82ece6e64056add606fc0a543f6ce699c8
- MD5 eb65a3565aef0342fecc74d0c6205b3f
- SHA1 6d6e81f7c7d7997e08c8d496bd4d88c2a8b8a34c
- SHA512 bdbf82a7a1185bcccf477de36b032feb8bb98388d8c31b1cc58035103335eb025427dde09ec488b6e84cc13b4d52581683454380593a83580281ab4f1111cd24
- SSDEEP 12288:myS6b3IkxjbBz4onSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLyj:w6Uqjp4pXoRn0PMq/DBTPNoIcIQDxD
- TLSH T1B415225E26C838E8E17A1130C611826554317C265369AAEF79E8923FCF33BD9D53BF12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 800KB
- SHA256 39f3620e0e72581cfef8c72fddc9eedeb70b82cc706eec12101599f0ebd9341d
- MD5 2a166b38642f0dfc6cfe6b87b04834a7
- SHA1 e56375bd53791e39d31b88b2b476541074c605f2
- SHA512 bee3bed2c504f275391ab4f69d871e29b9e5c2052542899f2c6b6ebb6f8e06b8f63b15658ec0006fe36c8846050077f08ba49554ed741b329286c0f28f045e91
- SSDEEP 12288:i15onSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLynr1qAHMKU4:M5pXoRn0PMq/DBTPNoIcIQDxD
- TLSH T17505239C6A883968D655357642016FC03425181E9749BEEFBCA29137CF237EED133E8B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 2e484aed5f4c47457dfade6478a3638a8b7d3fd3db85e60fd042923f9344490a
- MD5 1c484084b896ff156f773b40e3986a24
- SHA1 7a821b09e740a6cd87835aef4bb26dc3e8396afe
- SHA512 fb56a15652ce40fb6767b3aea3917987a1408cc9abd9bd6e120f59fa6ddeeab9afb0f91e617f14683968aaaf804dc52ffcdb003135f2bb5a727e11edd567c798
- SSDEEP 24576:dxg0LoTfaidZTpXoRn0PMq/DBTPNoIcIQDxD:XgTTrZTpXoRn0PMuTF1Ad
- TLSH T1D665AD1D67EA09CAE2B2D239D9221493D633B4315772D6DF2448C03A4DABEDCAE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 960KB
- SHA256 cd3b1b794e2f760a086a94a634dd95c0f805e25ef383018afb2f15c14f41d28a
- MD5 4f007160f298c07786c9d4b9d02183d3
- SHA1 a604ad60694a2ad59241c2835e88080bb754b185
- SHA512 cd22ae50a2a80c33929346f1faf10d4adce478c8c0c3cb78e601bcc616daf90e59b5c87af6213ed22c1b4647e90077bda0749de344dc53b9d9ee92b4d04d4261
- SSDEEP 12288:GpJcm8CN7onSh7Xv5GRn0PMqShAlIO4cBmoTX7R9N5HoxIBG2/CqboYLLynr1qA9:GrcmR7pXoRn0PMq/DBTPNoIcIQDxD
- TLSH T1E825014EB6AE00A5E2B7913C89414645F673743163126BDF06A1C37E8E23AEDBD35F42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 e7e80c05a118102379560c9ea92a81c9a732587e157c7d58c671d4e7cfe70f29
- MD5 a7864801e09d3cbdfeff9c68c00896ea
- SHA1 2e0507b070d4a9fc224808fdfbff51f4f762abe4
- SHA512 597aebbe190d8d3c861832df57a0742a71b02f0eb249bc694ee6073c33e70cc06c8d012ff1c9a30f0b07afa6a29b314592cd73eeebf7a92a2fa35ccc83ef66df
- SSDEEP 49152:HDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS35pXoRn0PMuTF1Ad:83Upow8sBQXy00u4
- TLSH T130B59D3DA2E810A8D9AAC379C54213A5EA71782E3F3015DB0174C178BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH