1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a

Analysis

max time kernel
111s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
Size

7.9MB
MD5

5a47f3e31a6e7efbfced67748fd9839a
SHA1

85481b261ec14962ae51b4dea3529bd576e4038e
SHA256

1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a
SHA512

6116b7f8ac3987e47294b9444d1644d938af08da458c4bdc3d20affa8a0dbafc3a627e4a39aa855fa5fa35661d078b72d8b82c8c95add405103bade3f7845651
SSDEEP

98304:eFXh+OBAjDPzILhCKmzdPGmSut1xfUHUxTXtTcriCrVAa/dtqDwLEVCt4yGzXb0F:er+QAnPzILkKOd5vUHcRkLEV84bYz

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3304	alg.exe
2308	DiagnosticsHub.StandardCollector.Service.exe
4152	elevation_service.exe
3544	elevation_service.exe
2336	maintenanceservice.exe
4984	OSE.EXE
2352	fxssvc.exe
4668	msdtc.exe
4876	PerceptionSimulationService.exe
4724	perfhost.exe
4464	locator.exe
3084	SensorDataService.exe
1120	snmptrap.exe
4180	spectrum.exe
2492	ssh-agent.exe
4396	TieringEngineService.exe
1112	AgentService.exe
2788	vds.exe
2088	vssvc.exe
832	wbengine.exe
3248	WmiApSrv.exe
5092	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\14700ed9ac07e206.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{6E6044FF-6EEC-4043-9795-F9B1393BB24E}\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1984	1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
1984	1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
2308	DiagnosticsHub.StandardCollector.Service.exe
2308	DiagnosticsHub.StandardCollector.Service.exe
2308	DiagnosticsHub.StandardCollector.Service.exe
2308	DiagnosticsHub.StandardCollector.Service.exe
2308	DiagnosticsHub.StandardCollector.Service.exe
2308	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1984	1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
Token: SeDebugPrivilege	2308	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4152	elevation_service.exe
Token: SeAuditPrivilege	2352	fxssvc.exe
Token: SeRestorePrivilege	4396	TieringEngineService.exe
Token: SeManageVolumePrivilege	4396	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1112	AgentService.exe
Token: SeBackupPrivilege	2088	vssvc.exe
Token: SeRestorePrivilege	2088	vssvc.exe
Token: SeAuditPrivilege	2088	vssvc.exe
Token: SeBackupPrivilege	832	wbengine.exe
Token: SeRestorePrivilege	832	wbengine.exe
Token: SeSecurityPrivilege	832	wbengine.exe
Token: 33	5092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5092	SearchIndexer.exe

C:\Users\Admin\AppData\Local\Temp\1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe
"C:\Users\Admin\AppData\Local\Temp\1dc8f172813ca763c8e2f539d2cde993b36ce994cd09f8f9788482d009af3c3a.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:220

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:3084

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1120

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3408

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4328
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
160660ada69aa51ff22de7af3934bc77

SHA1
fd87cab1337d46ac0eed3a6f2b0881e154890922

SHA256
8e839ee4b9d655c73452c215141780ab577cfcf63b4b6470e1002e21557fde83

SHA512
ff2c0ee9ad4c22894a4974a0c6c1b5c226f834c8b8087c82c211abc67eeafd9156fbc22d7a0f716302e65fef459db408059e5c99b90093fbd5bf8f1c6c4ae1cb

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
98a614623a1b56d0c53814117b783593

SHA1
c855c7b0881a9c1a7a243ea6aef8d66a904390da

SHA256
d4d0f402ad3b4500fb8bab911af0f95ac59b3d1228e1a9ec316620a9c4baaf46

SHA512
ca7c5613c864271faf55a1c696e583cc38aa6ece45d2a58708fbb009fa9d2ceba5180437dafc5f3a01651b902638450a1731856d8307d9801d77eeacdbf96874

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
98a614623a1b56d0c53814117b783593

SHA1
c855c7b0881a9c1a7a243ea6aef8d66a904390da

SHA256
d4d0f402ad3b4500fb8bab911af0f95ac59b3d1228e1a9ec316620a9c4baaf46

SHA512
ca7c5613c864271faf55a1c696e583cc38aa6ece45d2a58708fbb009fa9d2ceba5180437dafc5f3a01651b902638450a1731856d8307d9801d77eeacdbf96874

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.6MB

MD5
292d0c27d9e40df8e20bd58658380f71

SHA1
c2b1f5b48d57f07e4a51d913b368907a10477039

SHA256
272bb24d761024348cd228f71901fa7e53e4d8f00a29ab29b35a3dde5546ac61

SHA512
242335be02979a96c8ff27acccc8657ac4c4db0777966d60dc9ce659393ff2cdea20183bbcca9f5a76e66e604a55d97d37633379285eae44c2d2a4fc39e904c5

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.4MB

MD5
00a8ec10afc695d76a31d9164b528aab

SHA1
5851c3089c8c4454f58d3c01d171ac2b6df5fff8

SHA256
9ac3557de2ca87b5939e6e25bd277483123ffa0d864b9709f24b9a7ae2e0a5b5

SHA512
2c6f6751f9a51847e272fef07598724a53236275d575e212811db19515bfbbbc4fbd1b98e720525667c93e401ca1f059fd9d256eed5908e1aa03d830203a6366

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
5b880da7f773ee214c95069264706218

SHA1
ed07c5c01001779ff4ceebda251c3f84202c799c

SHA256
aecbf27a8762967b15f824c4df101fdfa636bdf8217f7024fafc1082a381796c

SHA512
d6845543afce9ad1fe738862558b869952ff395c4eb14401f766623f8eaab8a4ce7287b2d08af63feeb75a210217a1cbe2be463cf06198f51e43a860a0635131

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
8da3088209b6b4f26d8fe61e1550bd6b

SHA1
5c77b6399edf869a4c96f79c8ddf0423d7e10abd

SHA256
ad68d6954e063d635a6735bf234b654ad1e49d405cd24fdb374512d34451cece

SHA512
c72dc50ad36a751eccf710c4861ab0ac917d4ec7ea8d9cea436347eb36cde960e397dfc288cd0936499c39485a1b42907173185740f5279299fa4fb803f84553

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.4MB

MD5
85c26b14d07a191dc5faa7ed3eafd07c

SHA1
3de053351ff3383ab0e2db0b326db8fb38b360d8

SHA256
237986772a702cfbf57ac14c53cbf85a05b350f5e3c7ca1a8d55c9d92104cf78

SHA512
31fb5578591bbe9d196b8b402b38b21e98c3a391d983363c1c557ef77807649ced630aeb68a26cb9a7d0deab0596e1a8280d2e1b219160a985452c9bc342a13b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
66247903e77f844beb9fc7be901e5b16

SHA1
a1a2494aeb2706c1773003aad821f2e99c242c70

SHA256
955d9a6c1986305600cfefc091ce4570d4873069898336653eb2be3438e622b6

SHA512
bb3e08e470fdafd43c379d1b1a4e47f823dc0296309d59e76a5f1bf8e270af3fcddb47346110e3b5bf58b8fb5a4cad3c27c95debd1e26e13b52ae59a347b2c16

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.5MB

MD5
4f81d2501ea26c9284c25e0c2aa8cad9

SHA1
12536c924a15e64384ea6ad6315323f61eb39bd2

SHA256
98e124192764cb706adaa84d9ff8e9729734aa02a721ee6cb0d661f3c962a556

SHA512
9e48613629e3aab968bd3ff46f0cdf51f9b2d38788f2f52987e237c4916983e2ab9465b928cc093d0ac2423484865824ea461997c4f6f6ef66db0bb7f0ca8da5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
e4f35aa66a6578f117de8bfcec76c639

SHA1
94c74111417e539e33692933995462efd2aeb0b6

SHA256
eaee43e91ec0eaa4346bdc5995773cbeb8490a45dded531b06370cc198c980c0

SHA512
92d98392136a715216b77594c499cd7266d7085d038ad756fff6081810fb862ff44ab7c1cfe93c382e521823bca133f3da9ac6e4ea7b3baf1d3213efb3351d16

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
e48d51f87f5dc939fb36dc709fe53ebd

SHA1
d174650393472742d5d7dafc19008fed9e70bf1f

SHA256
21c463ed2060d8d2a975194d685a1cc460dcc3b1258edc74bf6817f9795d38d0

SHA512
c448d646a3e31d0868a62762ec39e481ea1a499a018e845d9c453df4a4ca3678f146f6aad814b74867c1ca3547276ffb7460c06709d63fad83962a51dfa58811

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
2cb3fe5687858483be97c8cd6d38dc24

SHA1
b0a0e6e8435cbc6436884a1eca539e0cf8a9be0c

SHA256
796914868f35d20452114babc8f63fa80a445010c64bcc9ff0b23b258f134e99

SHA512
491309c0ce32d225b80c63b9ec636d11caf532d626843676720236d158c65af481f8a537f8ba5e990c8467c28254dbe25bffc5ad726129fd8d8b7ba2162f824e

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
09a226ba8a9c3bdc5832c1c0c6925398

SHA1
a4b49f78187e2be821fc2255f5599e2ed961da18

SHA256
f97fa33a906b9e38754abef67c3a31bb6796193809657d94eaea0e8db7e90485

SHA512
8f3d4eeab8c2a8e6030a740eb2cbaabbb2516cca2b78af6e0d7fc70fa2f92f18f10d07846a8965f2940dd9c6fe580e3bf4ba8717b34acb3591a55f553d625850

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.3MB

MD5
90b518bb335bc4e993bc368490834474

SHA1
88d856f99154ad2a01f69fa04ea74372fbe13f94

SHA256
cf24c5b49628769dce7f9c2ae3f64eac979a83ef081f55a146645d7470988c88

SHA512
436cedcc4e7a7893c3594aed5b77a46bd1aaeb590fcc947815a98de4e948f235f65fdb25d3df5aa0b18cd3323c183d51bbbf356ad788163b81fc652bcb1bd979

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
d64c620204d3b487df7353b06bca15c1

SHA1
a842383727438df44896de1dbeeb4a37828a60c9

SHA256
1b251acb44527aac192dfb9b44129dadd5f9f3bb1691c69627a6aa407fe82f77

SHA512
01258e597da8d8686dc3a6a7cdb9dc0e3cc70698fa0af96bd65d122b6789c77dab66593d7824965547b60562d14eb102a54c55ab179c118181bd38745ed1582f

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
23cdf74b2fce5222c1e2cd4e01399290

SHA1
1c62bcdbd793cbd739a43d608d9a605bca72a047

SHA256
11f4facd75039505078c883f2626eb76c49ef92a344889ebde880dccc23bf0cd

SHA512
1ccf536583bd4721a1d86c9a757fe12c8638cd8dee04d9e84f847d87cfe3222adcb35461d54388534f0a91f531cbd08b16b5522e8ccd3c1f9c95cb100e02fcf0

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
da05fa255102fa0aeb524f6bf3608b92

SHA1
1893f5e7f2c52ae543fd0c27c1903e503bef01c2

SHA256
157cfaca53a5d1f2f52d8b8391ee58571610654816be26160798ba12f28fe13e

SHA512
998d6b60b2334589d77f9f3d85207522a419b0248eedfc5b8999231cd14dbf6d83c449dab86fe7436d8744115396076f7b385774860ee5f102677bb26162ad81

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
fc2e53b0f3f9f057d1e0bb4281a32b63

SHA1
ca78ec3a3060db14452c81db8a355440e6da9069

SHA256
6595fe7cd9008dbaf80517be0c9e1398ee6c41a7bf52543c6a413d7377cf178e

SHA512
dd6cf123b70c9f527d013c6b9e08cc9ee580207240138216a2e111b0ed572927adbebed63337904a62087a034f16b76471010a98f4638d64621752c03952082f

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
90d969a76abe5e48bcfb0b4f98d1d95b

SHA1
85b6c9e5a68637b264ef41989ffa07c8e95e3421

SHA256
1edc9410498f724dbd58a1e543020d02c83ba66e9214de8cc428d1e3a70d9a53

SHA512
002c257ac077f4f6436869cb6a5488dd5fb5cb34d1118cdee44d2cac4d4eafde558eea34a1c667d022a57c9db79a286f17daf1cce3795dc083efaa8225bb6eac

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
038383b02eca87141c1340f3092ea9c3

SHA1
2ef2b6655cfcd5e8ace2d9f8e2e5317bfc14999a

SHA256
1121c437e49074e234cd00aadb2aac60b6cbd0f202e78fe7e1f1417675b0b3d0

SHA512
7422bf2db4a6aa77d20c816e83da4018faafa3231c1b18af2d0571afb31771896da843f94b8a5c2bb5ead765ab3a68b2f2383489e517d2ce709354c137b58aa3

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

Filesize
1.2MB

MD5
6cd81bccd13c245c664c905600f9e670

SHA1
1c1adc432814f25eb52d0c30c2d6467c2837dbf9

SHA256
d0063ac5877f705c76c5929f821247a88c02e24a8adfc41384d00aba21e0c624

SHA512
ec952a7fbc3a786bd501e43b4bb584fa39ae9333d8c7d88e3366c57c89a6469f61d8d72b6f63a4219c9d765e6b722a0a3e96d2386ace404e756442e9efa89cb9

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

Filesize
1.2MB

MD5
1c89864cfce174d0955dd236eafb1ba1

SHA1
c4f854053ff54e6a301ba71c5b57cad76f98c617

SHA256
c9048bc8c49527818958570a62a8daf816df8399c6a14c087b45d07e9b98ffd6

SHA512
34737ea64c0fbb13a3543c99ac097c7383227c67d3b168f82e8f5d67d55878d877c966f36fcc395dae54ceaeb1756f0fd0b2fc9dd62a796574de8b1823a46b14

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

Filesize
1.2MB

MD5
e28d80003f42d435c2a2e7f31bf430ce

SHA1
299e4e7a191a745ce3ff11d3e92f9db465ac04f3

SHA256
a2261471217d37b40f5ab10825ecb95b09fed2c0db0e0b3f36809952cd90334d

SHA512
e991d0ae329a36938b2b436df3619688c3cb48e03f9fd5b5b41fc936462dca1c94b27919d79809706869500c2f799b0e50fee783edb1a3da16cd150dd5b76052

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

Filesize
1.2MB

MD5
3ccb33fb088fb0f7f585ea62d807ae79

SHA1
2d369711b0049622b87858defdc5683a9370d4f2

SHA256
4a55ab7858f8663ccbe6a779e1d8ceeee4cf6c7294dec7482b106ef1fe291da0

SHA512
8b123adfd8c56738a95704dd743223a38a170c4a7a252d205dd36cc48f6d0a76a545c09f60726c29f76ad2bddd7562769b2135d1198874df41449816dcbcdd76

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

Filesize
1.2MB

MD5
cd657b0cf790ffb2c6cbb10ec880d3f9

SHA1
998196a65d7ead1cbd048a241a49caf45424a320

SHA256
dc924ef2f9e2584b858233c132f20567ac0d89ac875bd9bb2eb98ff120f754ad

SHA512
6176272ff83cb22c1af25cfbf8448941fba79b22901f5192645e1314a361b9aeb5cea0187ad25eb5217ba17551ecf397061d0a724bc0c3c2bf1731cbc1f59ec1

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

Filesize
1.2MB

MD5
da6f9f767d43f579200587d08fe3b7cf

SHA1
07f800f22f5b3ea3146ed7c7b9f743f81d07928e

SHA256
1ad8f71e883e2852df382889e1fa4fd4fe2d70e82538e1c57f08cb1404656736

SHA512
5483631d65155b7548bc7d066a1b82d40a7db713499fc7c2b74726c667d4d14c989f5231ea2c250022dfb3097103b1b2adb858414cb1aaaf52eaec263a57bb2c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

Filesize
1.2MB

MD5
c16ba9c31663f481de564565dd86275f

SHA1
9cdb0f298572a45850e3f30e82fb6d79290e1c25

SHA256
d995de08e179937742025ddce67f806f30e7acfdd919c019c351b7a4cc2e0de2

SHA512
4a188c28125c150d06371f7c30e8d15cfbf2c59d90197671c2b54e90b1f4cef1c2890597ffc0fb6645ae70ad0c484bb3e09f5e8b3514049b0e8d579c52806469

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

Filesize
1.4MB

MD5
08646c3178e20792eda783bb5c2318b6

SHA1
f63703c826eaedf36c1c6ef2a4250040fa87bed9

SHA256
c965e1aaf4a0d4c5947a616f5f4e072dd4c22f87d43170045ac236572f841497

SHA512
680139aac234f468324dc06494e8c5f4d8696e90904b231e5a0920816422d7b9774b0502d8ff03d7d798ce6a5030e81d99bb2a112236cf10905f5c5c37b9e0ff

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

Filesize
1.2MB

MD5
75858817ba7b0c150ce635b20decedd0

SHA1
45166e9523f16d1f54189fccc560fcb433e73fbf

SHA256
5624dbdc128df4a411f8dc70471c0744370ce2196d0d9544f440605136d678ac

SHA512
3ba4cc87bce22a8644de02d35561f7da65500feacc0f0c69856e6bb9a4b3a1cf41cd253793a21705764f98a3ef6a4e63867e8671b9925852c1065f1ec7354a4e

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

Filesize
1.2MB

MD5
a860904116b8d50f24319d5a9862e9d7

SHA1
23512608ea3e4510e6bfef2a219791538ceb5a2d

SHA256
af46cce3505fa948dce19aa12433fe3db698d73b6de343dcc16e3bd4f32ad2f7

SHA512
d06639af010f7aa7e65c18068f2caebeb5058afc7d70429f7ec9f92cc6e50a4bea72ea7f5d600f4b3a114a64b37ece5cb2f24b412db69575e78810a80c6ca77c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

Filesize
1.3MB

MD5
72b53de58e354d033ca4bdf5384ad1ee

SHA1
6554d8d1c6375a6497271e4cc40a3c1861f2450b

SHA256
94ab9eff37c1117718aaff72492b1fa1854b219d26fcc4eb550957d4f462eb92

SHA512
416bbd0ee8b11390fe2dacf4b8fb99859bf2979c7f18fdefa15577bf3c696d37ae231358cf4f5dfa91276173776a47fc418a0b8f3b5d07e8e4405d17f22b914c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

Filesize
1.2MB

MD5
ba5caa82aba2570c54773ad32b6809f5

SHA1
f80ee72d31fab822ed2d4de66dc2b31537c6773f

SHA256
45c94c9537ad6f9ba777cc432f0fbc47d44a50ec61d6f078e695b8194e6f12e9

SHA512
3ca346d6741ce09d9f733efc20b1b99ac7cf04f96d5226a15f2061026e6b902132966afde2f8234eb29795a223d0e2ae795db348008059a167b32a9b590a544d

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

Filesize
1.2MB

MD5
4302ca660618b5bd97de274ab957dbd5

SHA1
003ed935063f991f5f9454574b537fade86bfdca

SHA256
1a5cb94873c6380ed498d9845ee2866a12458b52721a4b655bff0c8a5ecc45d7

SHA512
d21b27619f7d0aa5c23f4be70711802a1866314f50678bfdfcb560bbf3435d0435a1427fb644ad7e2dda3f579680db47cea63256fae968b6b1787558c32d300e

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

Filesize
1.3MB

MD5
982e4a603c69dae9000a514bfb38e4d7

SHA1
5b167ef102a2395457fad4ad408d0b8f33aa2a9e

SHA256
f95db665557ab9a78cedc9b3ae77a120afff8b69679b213c1ca68e5a89989ad6

SHA512
dcd9a3c839606b36414ff876115c71b75f0d7b81ad15e498e443e6d37fe65a562ccad8f0efe21db81f6dfd946e33931385a01d67f3f79b60cb4fb601e88f60cb

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

Filesize
1.4MB

MD5
8fabb9dd3856997eab87d3093203f0ce

SHA1
7eaf938f14c09e75cf5fe3433badf1d4686fd6ae

SHA256
02fff403e525bec31eb9eeac8f0841f395b4e4434f395fc37906d413a1586bba

SHA512
585525025140d543e029260747528ed246f77f33661a8ecd19b6674cc1ac18476f61dec60f2d1d94258010955555923841383390c481c092057877c1abb67cf0

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

Filesize
1.5MB

MD5
4cc594a2733c2d0cd477ec4c410ee495

SHA1
47f994ee14da2ce50af03007ef94668d595b26cc

SHA256
87997883cd71608c3ed62f8ced4db8626fe95a0f172f80f811f894df155ac8b1

SHA512
5ea317e9876fbdba8c73112f006c4f47ba88706b6a70e8d21d5d10b5ffc6a69a1e81e8a80bff94003022378543f1f82422f737ce5c0c6b00c7b984fc7e5771a5

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe

Filesize
1.2MB

MD5
484f491627894108ee4893489d93877c

SHA1
4e5a1356ba05b11372b196994fbf6cd133d82fc9

SHA256
19fef2efc53c1e7e9496a32f819dca9c302536ff52b9344ff3e1af60229c220d

SHA512
f2be350c7df68aab1ef82a4d3ed92b317ba6eaf57a97844488c8f216d209aa1c2266d0a9dfe1dbac8202ac9ac12b6fdf6e74cd901b01536d1594f925a4a46a6a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe

Filesize
1.2MB

MD5
9df699d083215a90a9c886eb9b1ec958

SHA1
35dcdd0310e2481f1c257052b2dfa221b2d8b6eb

SHA256
44cf68036f5f3629968005328ec171277c3678893391383e7f6b7c3235c52e13

SHA512
ac1cc185d7132e4d3754cc9abb882dc03243ecf2d0b2e5a65ab099e95d3353da457b44d4cbfda946e21b72b69e68e38d703f252afc5bb6f76b520a26a939b2e1

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe

Filesize
1.2MB

MD5
c832aa0ad0ceb7262715cd61e6d22689

SHA1
59ec322a8ffa4fecaf4a6b402e52feff6ad2b268

SHA256
8cf36e37d63b3eded47e7002a2950e51e4b1d7d3f356c2b3ab4a969476a2fd1d

SHA512
f7eb2d750819eb14fe35a3a629bc6125341b24d4cdf76ec43bb3d432a6ae2360001b4fc79eea7f3b6e4ac60dc1938b9102e63db0dd753aeac77d77790c41f916

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe

Filesize
1.2MB

MD5
fad30c330270babd455ece80ae49ec58

SHA1
81815886490cc1da9242b5ddd32d93df50d416ea

SHA256
ddd749a0a235c7b9b5798aa0914740353a408a0d61f7b542ffd5e64f40180301

SHA512
e2232a6c9cc70aa3a5ea536cbe27ce09fe6301a7ec07682cb8da7ac1ed9643227c9e2409c56e6da7ea109abd1903e4b224c280e16dac26f74bdfe9753d708016

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe

Filesize
1.2MB

MD5
4630c8b53af5fe091bab8f0f0b46b0c4

SHA1
12b3162d3e72abfc3a271b1d35a50d62f8d0b020

SHA256
e226403ba816affdc0616e8a6f62baf100682fbe1dbdb1d8e07845e4b8d3954e

SHA512
df94b44e7cb985ecd46398e9fe90ac7138ea25e1183bde1707a8f436463b5e4cb520d9ba4165c6bba357cade4abb15cb6086cec322cf038d0b09bbc47a10dcee

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
4fc99a4c28b0a54fb3b5f796cf6c79ae

SHA1
d98ab582a990f76dafde82c0ca79b88de4de9135

SHA256
6fc05d9a692d3846615426c37777bdf794faa29fbd3174613025f7a9c73ecb9c

SHA512
3bee822ffc480ee90c3a2f90c33ab81111dfe1eb010bd9e7e9d1ec6bf81ddf313ea57efe846ce155764df6e6e074c73ad3328a5449468566f6ba469110305495

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
42cc5eacc3acde3f2131c75d81c7180e

SHA1
ded5de8d4e18327ab1925bf4261e835a832e8298

SHA256
14909cc3e0fb4107808c5605c8d8265e670cc375c792425469ac60b6de23758e

SHA512
382758a6954c6c708907fe13265e41401b6af2580f8e880c603830aa908d9c7f11ee800ada4689623c8bac7c840446c08daff3e2b829b4cec1e5c0eb2f14fcca

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
0fe360b7eb759f45f742f1fd04b8c735

SHA1
265e6e312922985194bce4b1d29219534c02265a

SHA256
dd3997e7b4f53e284609180b0e548d41c1586f6b01c5c5f79eed3ce340b54e2c

SHA512
1d79ed747d913281763aa148a732d2333a18bdb0c3d3ed9b03ebdaa303a44aa8a2ced55dc3071dff1531bab71f66dce2e0485b27d4738b17112c4b3ab976c6ca

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
2a8be2dc3116c16d8dd23e5434efaa1c

SHA1
99d92d562d1c102bb340e82fb53fddd66e5e03a4

SHA256
5b9a57cac4c7d8f4743a1134800887d9dba2ad72f6a6908bebaccb89c326a8fb

SHA512
08319815d2e1f3f6ea52453032fbe47154cc306a5bb1572e1f4d8eb7b394ea46a84b9a916717834ce4309436bf2a89ec26b7a1198bcdb44fe4b0676385f207ab

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
649363c311b622f0eb82d41b1b88205e

SHA1
b2f7ea72cd248c1cacd499f07744665b007ff519

SHA256
e090b4c52bfc1c4e97260da81c89c326505a25a07c3b50ba4f93071676459fc7

SHA512
ade1467cb2e4a008baae8ae9cfaa9d2f1f953409188fcf6b7c18f8dd4b232461d0e201a3ee96b6733d051f46ebf46e21810d169b405cf4191990acc64fd66994

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
b43b15bfc2fcc0ad4cf642f7ece9da77

SHA1
1e11d1f010d160d129e7c76b0960f8e320e3c23f

SHA256
c132ee3452f15a7ffd6676f6f73b6af34d736df046d88a09d0afe145bdfc9550

SHA512
88d00cef9d83d45d7a202a597799a2c89f30a02ae825b5261d485fd37f7879206d9dac9a27174d82a5d0707ce5ba1820fae4865543f00cc9ed1d93d4c2eefa18

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
b43b15bfc2fcc0ad4cf642f7ece9da77

SHA1
1e11d1f010d160d129e7c76b0960f8e320e3c23f

SHA256
c132ee3452f15a7ffd6676f6f73b6af34d736df046d88a09d0afe145bdfc9550

SHA512
88d00cef9d83d45d7a202a597799a2c89f30a02ae825b5261d485fd37f7879206d9dac9a27174d82a5d0707ce5ba1820fae4865543f00cc9ed1d93d4c2eefa18

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
0ac66920e8db406e497839937291ada3

SHA1
538477e1f4226b278b48dd9ec51f59994d7ee80a

SHA256
84c3c5b5938d77383624aff23734581ca7e8f0924538d2afee3a326198399aa9

SHA512
4458c7abc1fdabb56159b28422a31dcea664cd1b1c9ece9262e7e41c9eeab5d4f239f1247f6fd4d270f9d66d484c6500fafe4ae8e633e033ec7e99ffc02e156d

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
b5c970a642c45d36a21dd1770ae2f159

SHA1
dd78f624b09198263367551c43b464807735e2b3

SHA256
fff806a53d5c7d9bc1f51dd2c9225b28148594a0e41287cf92aa7cbe5c59b2f3

SHA512
bf98cd9645696e8831b3929753fa637e0ef58ba365549340619232f7db0e219f9f527762dcec86c639303d5604eec9155de0e85c4ce5ca0e383d490a3341d0c3

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
8b6977235fcf9f15c0c822427865fa8e

SHA1
8a89fb9494affe902fce8b5953e68a7d77d3bd46

SHA256
823e965bfb3c397a6e32098fcbe45c11b409d505c9c467f8794ec8dfd5a467fa

SHA512
29264da3d20add20fc5fb1af47693fbf95f7f600ad460c375d99ef2597ed85028c2e5b940137f572a0e5cd2786728914fbce1814de60dba796fb51177e61818c

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
a7cbf5b7eaaac7c94ae92e68e3f9735e

SHA1
6d95fd91226bca80cf4321b13595ee4c5212f839

SHA256
8887e1edbb3a60ac86c02d8bf8aecbeeaa3f9506e1147971e530f788ec23de89

SHA512
de55e5dd9e67f4238ab6bd08be362168b18dff6cc0f8bf774a3a4268dca92878f85912367af6efe1dac7aaf6818e37499c89bb20a7056808b87129bf354a093b

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
aa2ca5cfb39123652534d282e40cf8f1

SHA1
eef3f2cd9b9007e84192367a01982781e494dbe7

SHA256
64716f311440c8069bd35a25160a30940b077f39651cb86f6694b5a7c7df51dd

SHA512
d228c268ee154d206b3a019f731a3a4b36b8a2d35e2bb39bdd899e5a5116cfd878969dbe0d7f1a0e7188982603c20e4b4b23a59debf961d93f0cf7c3473ebf29

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
13361bbc207f1841d31c56166847f307

SHA1
629b5d4c904bf56a2b1c36161aa875d7298350a3

SHA256
803ccaf5caf69a991ab6216941deb77a8fb2bd543a361e89f534fe07c493b0e9

SHA512
866c6b0576f2a899519212f52d547dfb1bdd61d407c7b4ba4eab42ca8f8b643f6f0e33e3af72d78e57b845b646ee01fb89938cf14aac4188d4d7ca149131fabc

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
597bd9f8a3049d2cece1efe58c4f4c74

SHA1
013b8ab576557a33539e00f3fff20a68aca2a591

SHA256
4cdd9ae7fe792265cfc1bc0cd8a12a46c2c6809ae9797eda1d195466c2eee241

SHA512
44bca5dfbdc53f06f71a3aa557865fa4facefdc152573df79c3df3dd24d000cc55664369174abe827d21b22c364bdcd9e17f9118022315e038092a257579e1ca

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
ae5afd69fef0b39d9c6893ba256bcafc

SHA1
81c8f68068ae85657b3c609f062e37f093fe0440

SHA256
d97e137a330a8797ffa8c99882013b3cf4fba817733f8e2d1302e08e6059ccbe

SHA512
e675f0af9c26099a1528d41fcfc991cc94ea61f17cbf579e833a4e21b31f2daf4b0eb100fb5bfa1abe7bf5b1909cb2647988310e8236a92d6aa52a28ea9ae893

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
403d742470e787383c7da6747e24fe76

SHA1
0bf5ded35fc24eff93195bd81a5015107fd43e7d

SHA256
e09a796e28452bc4597aa3c9612c74dcf9a1cd31dcbc53bdc5ba4d765efbdeb7

SHA512
df375ac303bec3175fdbb7f158c29c9636121b5eb7244e8fb155f3c219cad8cdc3b2e311f5ce4ffcb9a7e7384c22e1b3cc02352b83cf48f49ea456367cf59d2a

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
2500c266706fa7581f03355c46233feb

SHA1
514b6a2fc09b87119fbb82d36026d0c5936666dc

SHA256
c35da44115e362965f0f5bf21f9d012934fb0a15477b5307e9ceb848258ffe80

SHA512
a4284f15a9c0b4ddce8cd2d2f5333b0e4fe41a93814e2f922506b7290e7ebcc54e058e8dae0392cabfcd053cef45606a46b1d970479ca239f033787ca9022a23

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
0152ec8495de1022628547987766f580

SHA1
26a4249ff7b36ca1c7b68c45dcf1b4b7f5049546

SHA256
b00f595b69a5fbf00c23a690194e0066a8802a6944b1de4ff04654ecd628d75b

SHA512
e45d152062a523b9df3afe0bf91f394474f7199b05277535b50836e043aea1b716bf3051181f3f6d7f2cb21440b4bed919b06e8d12ee930ca5f691b94033b888

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
ac41798390bcc4b72084c626c85d243e

SHA1
fcdd3d1a63b9268b65e5df598a7346679e7fc254

SHA256
a35e9cf72a17a263d7669f96654de299d3d3081bcc96d8272ac35427dd7a68fb

SHA512
82c81d276954469e2712863b74e87013ab349df5d1bc3b70cf6f2f5f5df4132c1134974f38ee315ddf9ea4e1a10a28052861eca511551d85306a602907dae5be

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
151457ba04607a5afc732447aa92294c

SHA1
013a771b7428e7407b1844d418ef2e0074577d39

SHA256
347fbcc6cf73471a145a70ebd39fb1d7557d551d5a1cf36fb47eead87f9705a3

SHA512
1ec5a1b44c1fcb707d1af1cedf1967c74e08d9af7ff5edf7eb132fce248f3d85f200b5bfbf361d60659224c91f8c1204f9f969411f9085bdd9070c76b7488b48

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
196b358042f0e9068e69505d54aa61b4

SHA1
a42fd0bdd39cbaed44c540b7f48638d3ff9aaa8f

SHA256
69e3315eeea8d91b10edd37c505e386ef9e475be9314cf037bdb0220f7b84119

SHA512
1875afedbb9ebaa4543a0c5fe22029c8395c1db267a8288fb2ab1f8ddf933e42f35d4cc5a1a817e937d9e36cf967bb570fa23ef25a581bfddbbe622d0e956972

Download Submit
memory/832-478-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/832-576-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/1112-465-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1112-467-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1120-431-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/1120-481-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/1984-167-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1984-135-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1984-133-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/1984-141-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/1984-163-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2088-474-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2088-569-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2308-220-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2308-162-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/2308-153-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2308-154-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/2336-201-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/2336-202-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/2336-206-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/2336-195-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/2336-194-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2336-209-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2352-589-0x00000143F6AC0000-0x00000143F6AD0000-memory.dmp

Filesize
64KB

Download
memory/2352-577-0x00000143F6AF0000-0x00000143F6AF1000-memory.dmp

Filesize
4KB

Download
memory/2352-575-0x00000143F6AC0000-0x00000143F6AD0000-memory.dmp

Filesize
64KB

Download
memory/2352-578-0x00000143F6AD0000-0x00000143F6AE0000-memory.dmp

Filesize
64KB

Download
memory/2352-389-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2352-623-0x00000143F6B10000-0x00000143F6B20000-memory.dmp

Filesize
64KB

Download
memory/2352-624-0x00000143F6AC0000-0x00000143F6AD0000-memory.dmp

Filesize
64KB

Download
memory/2352-625-0x00000143F6B10000-0x00000143F6B20000-memory.dmp

Filesize
64KB

Download
memory/2352-626-0x00000143F6B10000-0x00000143F6B20000-memory.dmp

Filesize
64KB

Download
memory/2352-627-0x00000143F6B10000-0x00000143F6B20000-memory.dmp

Filesize
64KB

Download
memory/2352-392-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2492-563-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/2492-458-0x0000000000900000-0x0000000000960000-memory.dmp

Filesize
384KB

Download
memory/2492-448-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/2788-471-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2788-567-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3084-477-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3084-562-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3084-427-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3248-590-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/3248-482-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/3304-150-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/3304-204-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/3544-359-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3544-190-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3544-184-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3544-183-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4152-173-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4152-310-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4152-179-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/4180-486-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4180-442-0x00000000006A0000-0x0000000000700000-memory.dmp

Filesize
384KB

Download
memory/4180-435-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4396-564-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/4396-461-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/4464-473-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/4464-424-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/4668-446-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/4668-394-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/4724-413-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/4724-469-0x0000000000750000-0x00000000007B7000-memory.dmp

Filesize
412KB

Download
memory/4724-464-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/4724-414-0x0000000000750000-0x00000000007B7000-memory.dmp

Filesize
412KB

Download
memory/4724-419-0x0000000000750000-0x00000000007B7000-memory.dmp

Filesize
412KB

Download
memory/4876-399-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Filesize
384KB

Download
memory/4876-405-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Filesize
384KB

Download
memory/4876-398-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/4876-406-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Filesize
384KB

Download
memory/4876-456-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/4984-382-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/4984-218-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/4984-211-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/4984-212-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/5092-487-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download