b48c9b34aa1c02dbf9baf571326db9e1c9393a6390bc74cad68f78d6002a241d

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AP_SEB_3.10.2.9999.msi
Size 185.6MB
Sample261102-j78c1sav8k
SHA256 b48c9b34aa1c02dbf9baf571326db9e1c9393a6390bc74cad68f78d6002a241d
MD5 6f98e1f90f13b86e8527fb4c2536578c
SHA1 ec27c14cfe18365c3efc57ddf392c9e24870fb25
SHA512 1f4113c83769056847d10a5e83d3ea666bbb1abafebb0f22089d80e5f74c988614e6db2e9e1e873e3b916c17eb4ab787b2d09d63876f7e34c20d8e8079a885f9
SSDEEP 3145728:vNTHzjSOvGyRdSwbtBOhxt/OLRsWx7evwzYc3YD6eCZOYoIB63ZnUYm/wM2NG0kI:v9HGBwbsxtWFsWYCYD6eC8DIB63F/qa9
TLSH
T1479833A2C3E1419FE8F6A8FE9F21F9349726BD310471481F5B45B14915B3AC8B4B6F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1564	msiexec.exe
8	1564	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\SafeExamBrowser\Logs\2026-11-02_08h21m06s_Service.log	SafeExamBrowser.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\SafeExamBrowser\Application\locales\it_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\pt-BR.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.UserInterface.Contracts.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Configuration\System.Numerics.Vectors.xml	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Configuration.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\lt_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Configuration\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\CefSharp.BrowserSubprocess.exe	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\lt_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\de.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\uk.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\hr_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\af_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\sr_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ca_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\es.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Communication.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Settings.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\af_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\th.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\hi_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Logging.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Reset\NAudio.Core.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Applications.Contracts.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\tr_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.exe.config	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\el_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.SystemComponents.dll.config	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Reset\SafeExamBrowser.Logging.Contracts.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\et_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Settings.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\kn_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\CefSharp.BrowserSubprocess.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Configuration.Contracts.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\dxil.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Server.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\snapshot_blob.bin	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\sk.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\hr_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ja_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Configuration\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\mr_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\nb.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ml.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ms_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\lt_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\bn_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Core.Contracts.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\zh-TW_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ro_MASCULINE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\fr_FEMININE.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Lockdown.Contracts.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.UserInterface.Shared.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.UserInterface.Shared.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\sk_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Monitoring.Contracts.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Configuration\de\SEBConfigTool.resources.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\CefSharp.Core.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\el_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Monitoring.Contracts.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\locales\ca_NEUTER.pak	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.I18n.pdb	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\SafeExamBrowser.Communication.Contracts.dll	msiexec.exe
File created	C:\Program Files\SafeExamBrowser\Application\vulkan-1.dll	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a0f15.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE9E1578FF6583734.TMP	msiexec.exe
File created	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ApplicationIcon	msiexec.exe
File created	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ConfigurationToolIcon	msiexec.exe
File created	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ResetUtilityIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ResetUtilityIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ConfigurationToolIcon	msiexec.exe
File created	C:\Windows\Installer\e5a0f17.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD84E7739942F7558.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC36F214A5B912614.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI276F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\ApplicationIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1365E4B8A105931A.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a0f15.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1532	SafeExamBrowser.Service.exe
5356	SEBConfigTool.exe

Loads dropped DLL 22 IoCs

pid	Process
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe
1532	SafeExamBrowser.Service.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1564	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SafeExamBrowser.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SafeExamBrowser.Service.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0d977edac71670e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b0d977ed0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b0d977ed000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b0d977ed00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b0d977ed00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 61 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension\DefaultIcon\ = "\"C:\\Program Files\\SafeExamBrowser\\Application\\ConfigurationFile.ico\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\ProductIcon = "C:\\Windows\\Installer\\{C6B57C4B-72B8-438E-A904-EB55A4FBE2F1}\\ApplicationIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.seb\ = "ConfigurationFileExtension"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ConfigurationFileExtension	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sebs	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E31B8A79BF841EB47A2CDD81369FC5BC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.seb\Content Type = "application/seb"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4C75B6C8B27E8349A40BE554ABF2E1F\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\PackageCode = "54DBE5F4A6701D94F88808552D3738B7"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ConfigurationFileExtension\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension\ = "SEB Configuration File"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\seb\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs\ = "URL:Safe Exam Browser Secure Protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\seb\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\Version = "50987010"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension\shell\open\ = "Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.seb	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B4C75B6C8B27E8349A40BE554ABF2E1F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\Media\2 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\shell\open\command\ = "\"C:\\Program Files\\SafeExamBrowser\\Application\\SafeExamBrowser.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\PackageName = "AP_SEB_3.10.2.9999.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\Media\3 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\DefaultIcon\ = "C:\\Program Files\\SafeExamBrowser\\Application\\Application.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seb	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs\shell\open\command\ = "\"C:\\Program Files\\SafeExamBrowser\\Application\\SafeExamBrowser.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ConfigurationFileExtension\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sebs\DefaultIcon	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E31B8A79BF841EB47A2CDD81369FC5BC\B4C75B6C8B27E8349A40BE554ABF2E1F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs\DefaultIcon\ = "C:\\Program Files\\SafeExamBrowser\\Application\\Application.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\ProductName = "Safe Exam Browser (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sebs\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\seb	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\ = "URL:Safe Exam Browser Protocol"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4C75B6C8B27E8349A40BE554ABF2E1F\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConfigurationFileExtension\shell\open\command\ = "\"C:\\Program Files\\SafeExamBrowser\\Application\\SafeExamBrowser.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\ConfigurationFileExtension\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seb\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sebs\shell\open\command	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4324	msiexec.exe
4324	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1564	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1564	msiexec.exe
Token: SeSecurityPrivilege	4324	msiexec.exe
Token: SeCreateTokenPrivilege	1564	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1564	msiexec.exe
Token: SeLockMemoryPrivilege	1564	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1564	msiexec.exe
Token: SeMachineAccountPrivilege	1564	msiexec.exe
Token: SeTcbPrivilege	1564	msiexec.exe
Token: SeSecurityPrivilege	1564	msiexec.exe
Token: SeTakeOwnershipPrivilege	1564	msiexec.exe
Token: SeLoadDriverPrivilege	1564	msiexec.exe
Token: SeSystemProfilePrivilege	1564	msiexec.exe
Token: SeSystemtimePrivilege	1564	msiexec.exe
Token: SeProfSingleProcessPrivilege	1564	msiexec.exe
Token: SeIncBasePriorityPrivilege	1564	msiexec.exe
Token: SeCreatePagefilePrivilege	1564	msiexec.exe
Token: SeCreatePermanentPrivilege	1564	msiexec.exe
Token: SeBackupPrivilege	1564	msiexec.exe
Token: SeRestorePrivilege	1564	msiexec.exe
Token: SeShutdownPrivilege	1564	msiexec.exe
Token: SeDebugPrivilege	1564	msiexec.exe
Token: SeAuditPrivilege	1564	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1564	msiexec.exe
Token: SeChangeNotifyPrivilege	1564	msiexec.exe
Token: SeRemoteShutdownPrivilege	1564	msiexec.exe
Token: SeUndockPrivilege	1564	msiexec.exe
Token: SeSyncAgentPrivilege	1564	msiexec.exe
Token: SeEnableDelegationPrivilege	1564	msiexec.exe
Token: SeManageVolumePrivilege	1564	msiexec.exe
Token: SeImpersonatePrivilege	1564	msiexec.exe
Token: SeCreateGlobalPrivilege	1564	msiexec.exe
Token: SeBackupPrivilege	3004	vssvc.exe
Token: SeRestorePrivilege	3004	vssvc.exe
Token: SeAuditPrivilege	3004	vssvc.exe
Token: SeBackupPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeBackupPrivilege	4228	srtasks.exe
Token: SeRestorePrivilege	4228	srtasks.exe
Token: SeSecurityPrivilege	4228	srtasks.exe
Token: SeTakeOwnershipPrivilege	4228	srtasks.exe
Token: SeBackupPrivilege	4228	srtasks.exe
Token: SeRestorePrivilege	4228	srtasks.exe
Token: SeSecurityPrivilege	4228	srtasks.exe
Token: SeTakeOwnershipPrivilege	4228	srtasks.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe
Token: SeTakeOwnershipPrivilege	4324	msiexec.exe
Token: SeRestorePrivilege	4324	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1564	msiexec.exe
1564	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1564	msiexec.exe
4324	msiexec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4228	4324	msiexec.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AP_SEB_3.10.2.9999.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1564

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe
"C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe"
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:1532

C:\Program Files\SafeExamBrowser\Configuration\SEBConfigTool.exe
"C:\Program Files\SafeExamBrowser\Configuration\SEBConfigTool.exe"
1⤵
- Executes dropped EXE
PID:5356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a0f16.rbs

Path C:\Config.Msi\e5a0f16.rbs
Size 96KB
SHA256 8d7415b3ddb480f6f40a6e2edde1a57f62daee160b61cca29473895274cd8152
MD5 4cf1d7e6d6e9a7cbb4426abecb437ac3
SHA1 143ceb15b45934a683eb8a4d4fc34c126fcd4d52
SHA512 5b86de713d006388886342703b0790b98c9d04a72b5f2515d3969fa32500d8ebf56893291160dc38eaa03f6d6ad68216a59c4c5dbfa0311424a0961071daac79
SSDEEP 1536:7hrvFzkBiYgTYPjU2osVYsSTMff1MXNbm1r8xEqhYEiuxAQqV6qVkzVBSray7Y+s:UMMbmYcytGqEV
TLSH
T107A3C396D81DE1D4BEE379D11B41B888212ECC1C77AF841F43EE8A9B6D806D6067D8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta_MASCULINE.pak

Path C:\Program Files\SafeExamBrowser\Application\locales\ta_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

SEBConfigTool.exe

Path C:\Program Files\SafeExamBrowser\Configuration\SEBConfigTool.exe
Size 767KB
SHA256 62315bcd1a00259b3d58d240d2569283d43c55ea66a0fe47d104e40065b08f6f
MD5 fa226a21aef8b9e10cf582d783de7585
SHA1 8d43d78dd5ef32fa0f368629e21ee9bf0b38c874
SHA512 ca2b7d521562c1bf8739f42d4d3f1eeb87b814144ebe22919d35d004409d8f2fd3fbd1263ca644c9656e2619fb3e2e71f39a0a338ece924a498bc0d8677a8b60
SSDEEP 12288:u7j33Lsu+5vfnX6vY3utJVyWaoVUKMdrUND:qnI5vfnX6vLIWaooWD
TLSH
T1D9F4180233F86506E1BA9AF464B016904F727F5E9939C5FD1D8224DE15F0FC0A9A6BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SEBConfigTool.exe.config

Path C:\Program Files\SafeExamBrowser\Configuration\SEBConfigTool.exe.config
Size 1KB
SHA256 69a3a0d5a2c55f25007d4cbb358360c118ab21ea3f9eb4cc284f77a3b72a217a
MD5 4f7678dd66d630d975ef9fc202da366f
SHA1 a255cd04b3d16744299e37678bd357a39e5e1d7b
SHA512 271f3483aff1bd206498071ce3cc4079485b8faffb7f01a686c35eb8b66e3883793e6574713e160e8d0ef81db23cab688fb418761256e506b51804332978da4a
TLSH
T1FF21002195C87FA44F724A723E6F5458CBBD03B3388C154DB1EEAA878F2599E4303176
MD5 SHA1 SHA512 TLSH

Submit Download

SEBConfigTool.pdb

Path C:\Program Files\SafeExamBrowser\Configuration\SEBConfigTool.pdb
Size 461KB
SHA256 4e863bd7f1298e334a17d67ceb41437f7704be734cf5e89f2f1a006739e4b84e
MD5 ce3fcfa1f4eff5faab452fdecb9de5ca
SHA1 8334d678ee0f68f2bbd324e712b1cc5e1ee15007
SHA512 0b9d1ac1387f9e36337ffa551efb21f75ebd5aa1d255381140cf946e0b75dfeebb0220ac4ef248af70570f2d78bb6e68f964a96048243f707d49f0a29e657298
SSDEEP 6144:JWYSmIC+D76L7p6N6MdP3Z2Y8cn5zG8OrvAA4zKx5nVP5QKZn:4yLsquYvm
TLSH
T1FCA4A522FF84DA32D46A8538A6EF4F0D063DD1C45B43579F8789B06CBE923962D4B394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Communication.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Communication.Contracts.dll
Size 35KB
SHA256 40e788ab60b810f007f348bb7e48ba84421df9b9d6b2bc07c4db6baa33d41275
MD5 23827dd8b333c0a85a06d416aae6051e
SHA1 7abe88734fb43bece8afead1a7cd7533653c6583
SHA512 143e9d5976ea8bc757886460e159f3197874503bf7bf1f9b830837e4a0d8e8ecd7a36f6b124613a9726d45ce9d7373b1247a4160095d2a059b3bc791def26b49
SSDEEP 384:CQhkz9Kt9H3amR+lKgYaesZfwI+1rFGc8kYiaVjNAqZwVuIYiyH2JFWWiy8RbmLT:CwyCamoAavZfV+GiSNUjYiyWqWi5ALT
TLSH
T184F22BC6C74C8F3DCE6F0A71FCC252912BB0D24A3526E6A55758E8872F13BE112536AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Communication.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Communication.dll
Size 37KB
SHA256 e2a71dca19937e2c1bf5ce0e2d8563aa9ecbb983e617b5c1dd9ad7b2d21d2e0a
MD5 4d915ee3ce80233f344cfbed51e4e927
SHA1 c7afcb23ef28f55c07992f42869849542b80b19b
SHA512 7c24707f6e1953bfdd60127e16ae5a4f38a1d077d5bc921815a153ef797046e1f23e6dfc09883cf60a4275756fba14c50fd2f8f89c43deb1865daa1f16914784
SSDEEP 384:s1Vh9B75rYh/8JpscTQ4Tz+QIpY0eSD9Cgq4lRJwflnusIYiyH2zGoy8RbmL4nNy:sFHkXiE4SD0wf9YiyWKo5ALD
TLSH
T1E303E76653FC8E05F5FF5F7068B822215EB7FC466CB1E28E1598508E9861BD09EA0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Configuration.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Configuration.Contracts.dll
Size 27KB
SHA256 07db00bca51f64d3f29d907ab7578e1c8bc88ab9c73c53a891a4448bbea9225f
MD5 613ee50852aea1ab6f91f77c482c6de5
SHA1 62eac90fb9389bfe42c62942003e1abcd50eb0f2
SHA512 ee19f6b09125309b472e8cd22e8dea3e2dddd26699058177a66ce7df98466b7e5a78b11fa5b7c60b49e1ae2e48e7583084f0962b9e1cd26fa167a8b702ab5347
SSDEEP 384:Cx0mKYU59pz6U+9qhTqQIkLvdNAQDQ+8U2IYiyH2ke0y8RbmL4nNy6Msz:Cqt5fzF+ghT9LvdNAYrYiyWX05ALVsz
TLSH
T1C3C24B1787E8E76DDD320B31F4A0A12717B5E3893012D6EBCA14B44A3F6378A12799F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Core.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Core.Contracts.dll
Size 18KB
SHA256 80f4f66cee400de42cd3f315f870434506beb62c75856e43cab79ab02abf58e3
MD5 055a9a78fb6f50da7a7697f2a853082c
SHA1 c04d93cdf76a20be3d3c24998cddecaf2d1e094b
SHA512 958228f56bd4a08599328a7e4d17eec6bdeed4bb28292d7dba0f500eaebdccfe2ea82970e629d774a5ffcc1c32186d4257de43ec47fd6f487ce306c1f623e53b
SSDEEP 192:jACnTUbBLwpbWOh84QsiHlrIYiYF8mpPJj++w8V2eAFULc8pq8RuwdmL4pUQrNyQ:UczpJKnNZIYiyH2eXy8RbmL4nNywrN
TLSH
T1C6825D53CAE88C25DC378F30B9920A212F76F5C53DA2C3D71359D046AF963406AE92F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Core.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Core.dll
Size 21KB
SHA256 d782b6e7a498cc08704ab0e4fbddc670f5feb46c4ede8cdd6043655c2f9176b5
MD5 2c9f861247038d135b6d32f9f31e3cd3
SHA1 04ba569d9d80adcfb293e57640c02611a37fd21e
SHA512 ceb8cf255ebbf0be644d129be08f1161a04b5d3aeff8e352c097e6c765001c62f1ae899de80123a63650a87bbf1029963e069dfc026e5120f031de657a9df0df
SSDEEP 384:M2qe9Jg5ons3P2wqHm+0k4dIYiyH22ooy8RbmL4nNyKrNS:McQons35P+EKYiyWW5ALYo
TLSH
T1ADA24B51CBEC8D12EDBB9B70B4B152201F71FD4125A3D2CE2149C2D5AF923405E9A3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.I18n.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.I18n.Contracts.dll
Size 27KB
SHA256 6a3f6697cccec4e2c3267bdb2fb33c8106e8dee1e18ce4345d45133bf5b815a1
MD5 1b916d8295d2d88a5ef661a216bfcb12
SHA1 6cfb634d125705cf7a7970fb129715f09b05f8de
SHA512 7c35b3e37ee4573741a80fc0424e90519702d4d2bf1645376e751623cbf5a416e5dcaa31f773d64eb3d25e841400e8662adadcca6fe442b8418e4d00c2359d61
SSDEEP 384:WfME5mTypi6/M0B211DjUoG1hLElOqfw5BXfQ8oMhQAIYiyH2Aly8RbmL4nNyjPg:WdSypi6wmoLJYiyWQ5ALxw
TLSH
T11DD218D7C5643EA6CCC78B32BF93B1015E3129442C06B14A95AE81D3D7112C09F6FBEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Lockdown.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Lockdown.Contracts.dll
Size 16KB
SHA256 7056eeba4ad5374f626214183ec0082a185f2e2bf87c65393022217592207d59
MD5 5c18a8f228485f38c3c51f300ab66968
SHA1 021b6bee5ab3daf7c3c3817e63b7f50fced9906d
SHA512 911bedb9154744ca53bc060b64d16a31f1f3051e276ac2dffe374acee6a979bd192ac1e376efc02715a08d83e1139085ab33501cc92608f6a6f32b6c6c859a28
SSDEEP 192:NSwFtIwWHc3+si2uZiIYiYF8mpPJj++w8V20B9g2ULc8pq8RuwdmL4pUQrNy2nC:NhWHc3+58IYiyH20B94y8RbmL4nNy2C
TLSH
T12E725A53CBD08D22DC2B4E71FCD05A216FB2B65569D1C3D7201ED41A9F463801BEA7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Lockdown.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Lockdown.dll
Size 40KB
SHA256 68af7fed47dbbb790adf0a487d674345fbeb0397e38fae7c544bb6f7d7fbdd98
MD5 80b448a87136505c78a52d5845c2b798
SHA1 3425cedd642c14ae46e1129633b9323e18ac589e
SHA512 2f70635a11b27a296c9069a28fe8cb58a744d8d8ce79f5451cb85bbaa78cef39ad6846f0fcb2ffae19a98c6df2ac478d12f84d187aaacdf36077d9ea5827f34a
SSDEEP 768:DKdh1ZDMCCXnaZi05y8hcJmKw2B7QYiyWZeu5ALIr:DK/1uCCXaZF5bswgQ7yWZes
TLSH
T1C113084657E80B19FAFF9FB479F115010FB2FC527872D39D1988908E09633A19AA133B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Logging.Contracts.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Logging.Contracts.dll
Size 15KB
SHA256 59bbc2f35a43365de946dc18d5cad6cf730f1601cea13a9ecccfd12aaa5a4d9e
MD5 a4343ee1c94a7ee8c744ccdd9a7d7aae
SHA1 d2dcbcd05e64ca7497a637e7e19d72b04bbd4fbb
SHA512 b9cb3cb2e952763b8add1727dfe5756385893986d0352b425783517dc62dc5dfc457b80777c2380836e83084771a1fdf2aad142c81daa173696936467771945d
SSDEEP 384:9RXNsuH4bNJv4gIYiyH2mSP3ky8RbmL4nNy4T:9JNHANJv4pYiyWlk5AL2
TLSH
T172626C638BD48819EC7B4E30BCE856223F71F5555EE2C3CB2109D1569F823412FE9679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Logging.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Logging.dll
Size 21KB
SHA256 afeab7c442eec21dceb5d509f5d3a2e579caa1c0c1df47205f022f12fee2dd09
MD5 61ca5614001d4e266cc966fce79b3869
SHA1 77bb0100f53268f80a28908916154159d848ad8f
SHA512 f1a92f5e7fb3a1be984670679e0c2f7b573619efe6b6def4059f8aa9387ac90123fdbfdd56995dbc9db0baa2ee153d1d446e3b290b187539f74141fd9daaf5b2
SSDEEP 384:ncBXG2s4TdPWsl5x8VZClHp3rDxIYiyH2q1y8RbmL4nNyvPc:cjs4g6bmYiyWY5ALRc
TLSH
T16DA26D138BDC4915ED6F4E30B8F066212F72F9566C62C6D72288E0699F533852FD13BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Service.exe

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe
Size 395KB
SHA256 05e0f06ada206028e5597c58f5305b36ceb095417c8387d2cc2088fc452577d5
MD5 4ca9bfc8741a76a4b15d009c3b1e0ddc
SHA1 269aa5b216bfb5a157750f826bdeab9ed45bb5fa
SHA512 a1cc97bb65609cba4cc7dcf14ca9c39ae2cb204d9f28dcc53dceb021bb10b6c1469933c5c4c4a1287acfbc70c0e7a228e64d159a7128c1c4743f776d56116e8e
SSDEEP 3072:GFOet4snQt+OLsocBvEUodZRBiBIHmSwIu6wbEqBRnkud:pemsQt+OLsocREnY4w/qgH
TLSH
T16E847351DBEA448CE8F0B8FACC35F07063226D2A097545CF8A5879585535FCE18EBF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeExamBrowser.Service.exe.config

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Service.exe.config
Size 184B
SHA256 16286566d54d81c3721f7ecf7f426d965de364e9be2f9e628d7363b684b6fe6a
MD5 13ff21470b63470978e08e4933eb8e56
SHA1 3fa7077272c55e85141236d90d302975e3d14b2e
SHA512 56d0e52874744df091ba8421eeda9c37854ece32a826bd251f74b88b6334df69736b8cd97104e6e7b2279ef01d2144fee100392744cc1afb7025ebbad5c307a8
TLSH
T123C0124940A8BD269D338A279250C922FFB022A2A024140CF02FAA6A0B311AD464736A
MD5 SHA1 SHA512 TLSH

Submit Download

SafeExamBrowser.Settings.dll

Path C:\Program Files\SafeExamBrowser\Service\SafeExamBrowser.Settings.dll
Size 56KB
SHA256 3ba7d4ea5edd7a6937f3ac4eeabe91af67d98b3c2eb55b6d3933fec01965b883
MD5 a877cf2a5a5842a683aa3d288d54b3f7
SHA1 7dbdd0edea5d3171c1e837dfd0b933246204f7f3
SHA512 9a41b756fd6708b011fae054289c7045d2796150a3725ef31001115224c86f520fea35ae142dfe9d914f9b936a4998c9c89c416dba87a5793e05bee710d5413d
SSDEEP 768:q/2SbrCp1KWWezF5li327NBWaMccJeSy9pSaLz58NxFIF9YiyWI5ALy:q3CTKWWYwWga4eSy9pSaLz58CF97yWu
TLSH
T1D54394E24239D2AECA290671F475527A16B39DCA3161EEF39B30F84F7B1274753084E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 774203ea9ed53b626aa394ccbd3fe79aea2aa04b0682e81596a382656488252f
MD5 6dfe11c89bcf30daca1952a352ba4508
SHA1 dd58cd8ca0042b33e5b41ecaf3ef0186c36bb76c
SHA512 acb6318cbf073137646410a57d57f193f482d9ad84cb78485b660a378258a013e4d15a975e6ad329123cae61acc472fad19614ea940d0a2f307fa513e1c35af8
TLSH
T1DDF0D433747DB4B65811481C1EBED95021A5B46C06C6C9B6647425C88A9E3E2536611D
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_433F7DF124D6DBC620D75BD5D9026593

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_433F7DF124D6DBC620D75BD5D9026593
Size 727B
SHA256 0fbe0e5fd8d98fefaa5300c2f7fb36bc017cbe90042e0d37f4970e2fd88a5392
MD5 757d2364c383020fe4e15a8b1151dd54
SHA1 06b1c15249fc47bc9ee30469b7dde53704aab6b4
SHA512 7e31830eb291df21361b7af9d79569d2fe12a256b5109e1addd944e79e020ca80a68318ae846a6fb3d42a873ac9e1accee9f48c7c284564f61b397b6f1b2145f
TLSH
T16D0165E696ED91CD83564C6CB6981760771A10E128A714870D7C9710D84D3F75911ED9
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 5ed6e3278d522b55a451b979c6976812b6d4c8fe921b5fed6f8ebb57d5981a71
MD5 c880792578196140ee5130e5d05fe26e
SHA1 a2e4161da82d24031d3e124ac4b4433b7e93174c
SHA512 ed25c284aef43216b3332aacff1d5f3c7c6d575d41813e8fa263e5ef44c49f9a87263d05820ab1056428c75f6e53a2143256e45c8d8b0e92794b8b02ddab86ad
TLSH
T1E901154795E95D9238005813AA589B64FD6EA5CA10D412E6277E619F605D7BD4900144
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 ddf3ff593c343ef5f4700ca8e87b3ccfc6ccf72c5bd8ff6a6cb05d32072d1e46
MD5 ddb94e9d7c56f1fb2e63c2fe092fddca
SHA1 e903fdec4f91713bdfeba470920d664331d3b249
SHA512 4b93e2b404f21c95755ae2d79759f6af135b6e28f1aa6c0ef67694b98c1b3282455109e133493f867c1b158ed9909921aa7a3c55985f6d9967f93598797f8617
TLSH
T13DE0202017FA652FF5E45F7503D6D0965F26F1062C55527E4D91156DAD0BE004DD3D30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_433F7DF124D6DBC620D75BD5D9026593

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_433F7DF124D6DBC620D75BD5D9026593
Size 408B
SHA256 550ef5fea9a2befdd4745424fec67c6da03860e07026bf6b4b4832db406fa228
MD5 e0a7d18fa04d6b5823909744e253c246
SHA1 e9af88253ee9457ae107071eda54e94a529689df
SHA512 6273cfbb305d71058653a2cabca09533206811ac988b9b6d454311ee109c10dab7d4eea61defc326b5006e69daad8b9193489b4a1b35bdfd684e9c6e37edacb1
TLSH
T133E0C03473F9014EF8F8D83803EA54111D55F20B1549826505905B08AA20E009CE2724
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 28005384a9e80cd5840811844eef4632a96d8a96546a566d52931de4feb9786b
MD5 0b3c9b73fdad93c42fc2164bb999f77f
SHA1 731f8e5e1d926a8f30b173303c3fe04634f78e80
SHA512 4d359960c046836f1bf298919599a0b0fe3f9d7b0701103a9692557ad2c1e546c3180c3f4836e428764919d18ebf0ade248711c98e219a56a40445dca46924d8
TLSH
T1A8E0D83856AFA56EF1509C3546F9B1751D59E305640497B91AD04308BB1EF405D21EF4
MD5 SHA1 SHA512 TLSH

Submit Download

SebConfig.log

Path C:\Users\Admin\AppData\Roaming\SafeExamBrowser\SebConfig.log
Size 3KB
SHA256 d189af766b32d76f9ae8b29f671b3f23e14974fece26475f34e64ccf8dab9030
MD5 7a6e207befa6eb46997d658c835fc060
SHA1 66cf86ac39392318c3010083e06329f63d4bdfdf
SHA512 2a93605074e2947d7789e60d74e22f4463af8324ed379a5c7a92cd726e9f3917b3e1a63e3442cccf45d3d657c63707beb087c87c8ae4a0afa47a12b5283aa426
TLSH
T16871238BB5A02A6715C5F3838B5908611D7C459DA3793BF5FCA9B0AC104E2C2E7EF5C0
MD5 SHA1 SHA512 TLSH

Submit Download

SebConfig.log

Path C:\Users\Admin\AppData\Roaming\SafeExamBrowser\SebConfig.log
Size 3KB
SHA256 952da6ba9fbef978b37ca103105910365958b5321650af3d5b102f694cbcc74b
MD5 30df4527acd8b936038f55f2d9d2e199
SHA1 322897dd425b3d67c0560ee1ca2fabfc4b577629
SHA512 4627272d0d2e2c9ecf8a381a15d49a4769e1cab1bc343f95f1d6ef295da5cf71ad8f8cc78ab559bfbc73b7b95f36b8e4cbd316bd9004a14085446e8f4b91f1d1
TLSH
T16881258BB5A01A6315C5F3438B5909611D7C459CA3B93BF5FCE9B4AD108E2C1A7EF5C0
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 ff1c34edf893b82718539e7112a13048b8f4c84340961ff6610034ff1f95d3d1
MD5 fbac5e304552aadea13fbe704be33c30
SHA1 1e40d6e04d075aab4a9878232a5fa53ce8919478
SHA512 79da97cdfc4d29c97670f832a2d4e09de98f4c54666be57625fac5c39a61b03181d616f10a91797391b24fb6c4a370bcab13a24c8deb7cd1cb5fe153260f21ba
SSDEEP 24576:EFo3DMPIdoO/vvTL/yg00C1Q/Le+/7zHEpiW9p6ciBa6ZzFk8YRWk9O1g+y:5Hs
TLSH
T12757B42536F92210E7F79F3CA8F06A2749397D5B9C19DE8D05411B8E0821F71E8B2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{034679c7-fc48-4fe7-b5d8-1da7333fa5f0}_OnDiskSnapshotProp

Path \??\Volume{ed77d9b0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{034679c7-fc48-4fe7-b5d8-1da7333fa5f0}_OnDiskSnapshotProp
Size 6KB
SHA256 bd0110f4920845cf1cdf2a64a31a1ba4322db5df7d0e7bd35eb6fab1b3926a63
MD5 ea8ba6ace6a18ad469bed142a6f72731
SHA1 c357d3f198a50a57d731e467341325e788498ae7
SHA512 acc224ef98a4340c45e5fc80d1a34ba68d5a358459c36254c5ef6c6d0a86784212c45b07276d0bca32d846ea7e27cad188a98fe2e63b503938a100e9fbc37dbf
SSDEEP 96:FK6Rsvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:U3b++uVm
TLSH
T1D8D197185AF54711E2B3AB3128F18557A877B911FF33CB8E0198238E2630A10F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-464-0x0000016744B80000-0x0000016744B8C000-memory.dmp

Download

memory/1532-506-0x0000016744D40000-0x0000016744D48000-memory.dmp

Download

memory/1532-484-0x0000016744BD0000-0x0000016744BE0000-memory.dmp

Download

memory/1532-499-0x0000016744D50000-0x0000016744D58000-memory.dmp

Download

memory/1532-501-0x0000016744F10000-0x0000016744F4C000-memory.dmp

Download

memory/1532-502-0x0000016744ED0000-0x0000016744EE2000-memory.dmp

Download

memory/1532-488-0x0000016744D00000-0x0000016744D08000-memory.dmp

Download

memory/1532-480-0x0000016744BC0000-0x0000016744BC6000-memory.dmp

Download

memory/1532-508-0x000001675D810000-0x000001675D91A000-memory.dmp

Download

memory/1532-460-0x0000016744B70000-0x0000016744B76000-memory.dmp

Download

memory/1532-468-0x0000016744B90000-0x0000016744B9A000-memory.dmp

Download

memory/1532-472-0x0000016744BA0000-0x0000016744BA6000-memory.dmp

Download

memory/1532-452-0x0000016744220000-0x0000016744284000-memory.dmp

Download

memory/1532-476-0x0000016744BB0000-0x0000016744BB8000-memory.dmp

Download

memory/1532-456-0x0000016744B60000-0x0000016744B6C000-memory.dmp

Download

memory/5356-528-0x0000014934480000-0x0000014934540000-memory.dmp

Download