86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233

Analysis

max time kernel
118s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
Size

1.8MB
MD5

6d5c9335dbada3d9e812fd08d9c0b150
SHA1

b3992e939d046acc377ac792311a80149a6b96eb
SHA256

86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233
SHA512

6d1a6e9d4f5cf050876116b730dd54d1a0d3f2736b6580969684281d3cab8634542204d1db4d697fb4d5b24f4536a7fafa23eb3234b3508ac70e84973a76c7bd
SSDEEP

49152:yKJ0WR7AFPyyiSruXKpk3WFDL9zxnSrmgiTd8DsMcDKGfWbYCGE:yKlBAFPydSS6W6X9lnQBiTLMiKGu8CP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
5004	alg.exe
5012	DiagnosticsHub.StandardCollector.Service.exe
5072	fxssvc.exe
4560	elevation_service.exe
4056	elevation_service.exe
5044	maintenanceservice.exe
1796	msdtc.exe
5016	OSE.EXE
3612	PerceptionSimulationService.exe
4900	perfhost.exe
228	locator.exe
3912	SensorDataService.exe
2792	snmptrap.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\system32\msiexec.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f4c8ef4b3e2edcd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_lv.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_sw.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_en-GB.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_ja.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_sk.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_fr.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_cs.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\GoogleUpdate.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_sl.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdate.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_en.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_id.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_sr.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\psmachine.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_bg.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\GoogleUpdateBroker.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_et.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_gu.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_ms.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\goopdateres_te.dll	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM10F3.tmp\GoogleCrashHandler.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5012	DiagnosticsHub.StandardCollector.Service.exe
5012	DiagnosticsHub.StandardCollector.Service.exe
5012	DiagnosticsHub.StandardCollector.Service.exe
5012	DiagnosticsHub.StandardCollector.Service.exe
5012	DiagnosticsHub.StandardCollector.Service.exe
5012	DiagnosticsHub.StandardCollector.Service.exe
5012	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	864	86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
Token: SeAuditPrivilege	5072	fxssvc.exe
Token: SeDebugPrivilege	5012	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4560	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe
"C:\Users\Admin\AppData\Local\Temp\86b0ab0c2d3cde12d6d067fc005280149e8d22114c5ef41a27010f9529ffa233.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4780

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4056

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1796

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:228

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2792

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:2648

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1060

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4920

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4240

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4168

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2992

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:4396
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4620
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe

Filesize
2.2MB

MD5
6972d7c92dcf4aff4d1517aff559899f

SHA1
e2995b0ba562c1e7c877857bd4dfdfcbb2f1139d

SHA256
91458be8b10a0f4da26b8ce20fd2c253a36ce555fadc02c3fd052467331f401b

SHA512
07d6c70d072890cb8c6ecce8f77eb01fb7bfc50f4ec4347841e5f43dde18e08795a500b35159d9660979ea6fd062d342d9061e5a21e5396586431461d6aac2e3

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
781KB

MD5
d9ba25be27634776a02650073e38901b

SHA1
eb1376186a8837a04ae23a9c1298479b44f53715

SHA256
d07411fd66585588010ce385de8cff39646f8349f3c6688910f373af79402ef2

SHA512
d31cf8ef0516bf5c17085006803242ad9a7580eb7eb42efac194ddafd9727c9fccd6070666989409f595579dc5870ad4855d311ed538b8b4da10833995ba0b72

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
4f2b2c6f9d977c085f575b247e0e1e67

SHA1
f237b9ec9cdcb65a50ad52afd8f99ebf2254cb2d

SHA256
c847b70a57c2a65f04469e03d49d4015286518406242e632f981819f8c45b130

SHA512
f5d0c4e978876e02843c934554d7c798b7916183ec9785af8326b59eeb5c7ad48b6b4de7a0cebb9a92d45609636166349675439c50a8d274710962114b898960

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1015KB

MD5
d59267fa05bb4412ed849c3f40c29e7b

SHA1
a9868aea057131cdd34d3032811179f185163ca8

SHA256
4bf35fa86b1f42b47caea000508f0dd940ce30ea00e922cdb875425187dee03c

SHA512
ceb4dbc7d7036dfb4c1ddefe656b870f054d16cf249f4ba5b9ccdcef91f3d8dd11da8dbb362a5075f622027c666ad98a7fa7a62528bff6f24742610a2f38c014

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.0MB

MD5
a51054a5a3a769275023a4b165a57a55

SHA1
967586771bfd8fc6a0beb14fbb03003ad238bd2a

SHA256
c54b7c760acf919b41bef591e35ee6aaaf9ed31e701ce1d38b17a951572271c8

SHA512
83ac4e1104b48909ac59095f1e8ff6bd56e03a1fe43337c5753c29cd8c91cbca6759d60e085fb08d20fa8f49ab0d07b1e2d60736c7593163a9cf260aa39e323d

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
955cf818be451fdaeac2b61dd0126b0b

SHA1
a5cff4eb4be05539322d914d3a06ccd75cbd013f

SHA256
49d20120e4b73db1bfb26cde8b8f53788f76f541b9a06101eced2ec4719b50ee

SHA512
def3f767270504c1e827af88eae03b0006a5eaee252bd0afcb1c4335ab6507c6473083c3ee84619acccbaba5fdef5148bce68a31d25874f308a3fc19256f1026

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
708KB

MD5
564e8cf4763e50b6932a5154f23408f8

SHA1
f824f5c3bca086b8f33fd4f1ca9d1ddad6eec7d4

SHA256
3411fc978d69f7b44fce92495b6a735b2882f3d3573a2db26147a378a44d1f81

SHA512
86dc5b3908721154fea62684bdc5b0fd22501039d4143f50a842d5079373818af8a72a15a799d2b779f902ee212e9739012a1c357c5ce6cd1057d2590a24c1d3

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
1.5MB

MD5
2603097e61216aa8be7dcd496a0ef26b

SHA1
1abb4f80101bc2ba5d8c428e61c3028f8d14c2b6

SHA256
2281ea271190b88a9316573f40a8b8f216476a77610d3895b4c192ea8e8b51f3

SHA512
b9bf4c819ca00ff062a1eef595959cd701fe7b013f27ef1dde07ac3fadb11665f97fcf6503600ccf99a680173aeeffad423e746da69bdaf160f2e978b2eb0755

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
816KB

MD5
e051d25987be5bece396a0a7fd4fa47c

SHA1
b9cf1b81a5bc7c52d374afb70440ce3e42a6f6ad

SHA256
32d537e6b4ea639a7d09aa0f37339286cb42381eea0d739d935b40c7fb94e15e

SHA512
a8c979608df9fb0b4e15c1fda3c82f3e376e76a06631d7111841ad669ef6f2487d5d030c4fb3a039eba237fa71427cfbb383387144270cda3541d244fdac06da

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
855KB

MD5
f6041b3e4845161de827fbc5d8ea3888

SHA1
408062b1f20d26fb0c4466941d9edc8367c6588d

SHA256
1021810905e91b97cd7555e6ef980502984af6f34c9d0432f0b40f303af7a817

SHA512
5ec9f3a7166017639ef24b1dbb2430bffdec9cda615a59236c63a35acc1379dda0601997b5f9553247e5cf024f05128aa1f57b9d8275b6a3eb720ca8b7813d4e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
1.1MB

MD5
c84e801c6104ea5dbd8af5dc8c559ea4

SHA1
6ad4c504509be84c8fba85f4e1cba9018cdbcc0f

SHA256
d82ecc6a35c8193ba4af2bb56212e00745c685ec5c4a7ecba7ac6fcbcca2ef05

SHA512
07882f115a2c06553943f6675d959968c4a874ec4c62e985960a925e8e1953968e759a859a2923db27875f8bd2a59307d49bffca36170ee61c6a21a72101e9fd

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
769KB

MD5
2b39669fb80309d496b59ed2a9941cf5

SHA1
d2f1ddd047fde16986a5391ed96608e56670a91c

SHA256
3a83eada708de912160ae26507b1cc43378237998e7c5bcef5d745ed0b78527d

SHA512
8f5114b6c17f56b07ee4f5dfdf8c9777c3df93106bac864e6e7acb49ed1ec90a6f0b58703663f48c1a7d37ffd6fd220d35d7609b42c0af122dc86e7d24b7383a

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
aae404e258f42f9b6f236f66a236836c

SHA1
5fe726611300916a08b063506960539920d69c88

SHA256
f0ea2265e728b75fb2f8cb711980f0393b9b40a2cc6f48872986d5496283fdb0

SHA512
47d29622e6828c0938acda2141876d77b3815aeb839fc2fd5ef8da2ce6462c0ff5ebadfb2364cf1d55dde5d1d51cdee9f731e58770bfd9f92c0f8db83fbba524

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
324563a926e4a004c4bacb9b9af9ff9a

SHA1
cd50973dbf1254b585379dc54cc97423c49ee9e0

SHA256
78f838a0050cf1ffbd095f27aeec2ca478cf60b3151834fe70e12609b9a1af3d

SHA512
671304f59ce6ef26e987cb5840826bdaafe976b7f03c44bafa32876aad96d08c17f96c4300b2d4e093f06b8be02c8196e8f497508492764489791d6839711de6

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
820KB

MD5
bc11382c2ff88799ffeed01c52dce57a

SHA1
2a5214f628fc6118cf21b59604fa315076c6ca2d

SHA256
fdba62d6ec0a1250cc953f953bc451e0a3085962b5b6d2763fae1cd93e8a1899

SHA512
417a1d0e267ce35e6ae51912596d80f8b1daaa2449a0154e9f5e7f7d0b4bf22b93cb67ee760c2c9a647046070e54ad61908d9ca288cf76d887c8bc633d7deddb

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
932KB

MD5
dd560096aa7adffd7e0d8a48e00f3815

SHA1
ed76d0ad23b9372aa4c5c83c9ce407e139c3e250

SHA256
5d3bc4adfa9badc9bce433265174850094a55b9fbaa44e44ffe91f62760cfb57

SHA512
dab608f0399c144bf721fb087bc1ed179bb770de5c09d359388840db66a3ce00e1a47a8a796417e1f8ba274cba92b84ca706bbde0bdc4fd545e426e2a6e2aeb1

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
884KB

MD5
8afa42999935bb28c9ff44c0aece5329

SHA1
eb592ad0c0c294b3b610fddad2ebeff14444802f

SHA256
9015a4f98fee05b48caf7068f9c3b92b9f2717515694813fb2ea23551bfea9f9

SHA512
3ed0dae26646f84a15fd9aa6def4a893b7ae94d532215e16d25ee3c4d75f8df2f9b27a825536b2f26d126b86f90741f07b7e646b5b295217b69fd318f44fbacd

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
449c7bf39d735fd8d912406238cdf9eb

SHA1
a3d1144dfd27ef91743a263bd1c7257422df378f

SHA256
95027f3fccede8de81420b880997a78247f4f0a0af7dee4f4c62778a08e6b3d0

SHA512
b5c9c05b93774658f90d2d25f09f2b775a333e6b981ad80026193f4b9b43c44cfcd0899a7f63d6a873dd6424f5394fc416b10eb64d3ec3d7d434e155ae689e56

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
979KB

MD5
9986ce9c4f753760004c86ee19c6bcc3

SHA1
ad6ed095f919423701982850b8efce471de17b2f

SHA256
591cb5505785e2a821dc002d391ad08754dab72f28d53cb90a1d7a2ac1a31521

SHA512
10c159351c9883a4e56844c2e677742d49e02de27531e0b44c33700c9ce93d986b8c1af66fcedf41d40c080719c25487a2def88d28304ef29d2d8bbe85200e17

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.4MB

MD5
f4b3b6d8e6f82de62650dd756729ceb8

SHA1
ec94f6296c14014582c896185756a241df2588d9

SHA256
1b5af917c088e1cb63c95f6ebf3537a5d6223ca08555df872f516d9cccb83e83

SHA512
5afc1f80576febb56218517964720c526f6aaecd6959adfc2440748451182a3f28dbc4d69698575e023b799295b4d04f1239744df30e6179d1c545bbfc81120f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
8a6256e5ef10e524f6f68e18eec7532d

SHA1
a2bdba35bc4975cd02f9e30faef797f332ba9297

SHA256
fbfac3219f5dbb1987ec2e836cd0e6c1d967c330733b4169601e44c3e53b6747

SHA512
17b55b6476cd2c0ec29d4f968bc17c6a61cf5ef3a174c2cccc593d0db6f05e2a9a497e709642569116011a57fc4871a7de27211fc5be1981695599d702ac7741

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
4b438861ea2720cd43ed52c21d8d8978

SHA1
7a14c5125ca1d2b79c1832202550e53aabcec014

SHA256
79fdad63be67239b937fb3075d9790c9e3b7f955ec38a5b330ad10200b352ffb

SHA512
693f2eddc5315d1919970f8ff2b7582bcca1cf1a29d9b871b06d1c4b911e937eaf0eb55e79bf2c7b7d6de70f7f4b1fe0aae31ff3f6f6737698be239e6d1f3fc3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
74f044cad727690bec689bd43e45cf2b

SHA1
3ef92b220816a794407f9eac7ed0a0d0bbbd5c0c

SHA256
ad6a0032eccc055cc6227e37f52f5886f88c7834e0043da20158f5f1be61590f

SHA512
43763556f9e447a10b4093deccdb2e6e105f385142978b0295949896737c2222b168f871d822c37996d18a19cddd1be559eee7e0949a86b42d091f0fe77113ae

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
b1f364e39141920004557051e9211099

SHA1
aec2bb17e4351dc3d7e68f589f2b62c5451d0ffe

SHA256
0715265b9464bf54188fe2464ae54fd5fb183bc3465a31116b5913480a788813

SHA512
bd26d750c35c7158c44e2506b18ae8f69486cb7181582f93730e055d455d8220f4d50610692e2b9b76d29a45ce6bd7cd7d11a9d08e3d79d86cd9358b0a2e00cf

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
b4ed7da133ce9dc15ff7e90ac5494187

SHA1
40f2e9cdd669fc78a8ccfa9fa77812a64b601660

SHA256
b7a6c41330d1c529cbf6468264b22411982c0c22989caf7a650d9294b93a06ac

SHA512
d710e78cd4499d6c098e00a70e9497c7cf5d5cf3907668b8408f385e7a8dd0eca43ffea6687b77f4bc86a272714f1c422479a753a521643222f129cc70089463

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
8975c21dabadb84e58da13fa077ce41e

SHA1
4cc20d261158db772c1d2f086aafefa376d7da8f

SHA256
b10a66619963b7ce6634d46adc83abebd02abfe22a1dea1e475dc3f5a3aafb01

SHA512
424e4199616ccb0fec5778413c7d07d1ba53afd863de988518029b360942e2ba5354f26d7b652d0968a5c8806711d6d376abe8caa854a3c78f022cd69e1651a0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
581KB

MD5
1982d0cc15ebfddff7c38c9224e09dc0

SHA1
5eb4672f2a6e3736e8f4686e66974c4d442c9665

SHA256
4601af591b92ca3176d1d15fc316356ab205186163f33a9e66b6443d34f5d240

SHA512
d4fcf4629b258c22c4ab6ffbdb6e1dabf7ed67013f97287a1f3f961d80ba9765d725c8f55600dfa31421b89e27ac3bf1ab8b2266706d197b796235b8d9f793ec

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
810KB

MD5
6cb1142a332a2e26bf3c927af2e9f52c

SHA1
d110f6ff969ca4739f6924b24e8c3eca79f0e9d9

SHA256
ec1cf2a6508606f787b73cd3f0a77c4cd4499c74d8113cdaaf9b14c9aad8e658

SHA512
f30581cc8bcde31e829e972439a45b05917f720ceaaf8720045060488d728c68a7d32c081524aa3a2327724e1685966c1bc8e83a96680fe66f90838c5f14899e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
581KB

MD5
0e4bc864c3058ad6104ab4d93265ace2

SHA1
326cdd4e64d84a007c340e3587637681e09e4c02

SHA256
286a8ab84623029c7fca388c3d5b4dd58dcf7f6dfc2e1e62a49d1de8bdfc78ab

SHA512
985cff15803c20da43d4a44b533bae9b07826b00774fd831ac7a6f2f6df1f7650826c188673b5e522b19f644eb629fc339be7879c6b34c0709e3fa6c39af9746

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
581KB

MD5
72fcf1053ac62e9c554dc43c8b80551e

SHA1
f56c65bc20313c0812d057029677a3102d829842

SHA256
8e435b819cfedda291e9c473952ad484cc8a2f98759f557d005a485599aed205

SHA512
784d0c3e40e141f4eff86dc37da9bdbe53abb86bb9d86cfc7d019cb8ee51b1cf64d16bc2ca0da677cc134c161c80390638d41d21741441ccfaf6457520dba2d9

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
717KB

MD5
c6de831e9d3874827908660d9ab3f4a5

SHA1
8c907bdc97ce18477bfe8e9d3960e2c9da953308

SHA256
8b90f5dc237417a20c4b23a5e89a07f4283568cb4ec586a99a9ca1296c0dacf3

SHA512
290713dc8c4ca5c9a784b6c1956c3741483fa9f17cd7c3a472887de910f18ecd6e5b8d0f35b92d80f5a2aa0ba4933b91906a72edc815984ad91ce050dfbdb0ed

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
581KB

MD5
047ae58a7ec1c053c86d04abb5643de2

SHA1
e15e60787ea971c78ad89c3effd111ff7dbaaab6

SHA256
50f46718da0a5dc2252879c45f6f1b043e2a73f6d21f3db527178257e466e55d

SHA512
1711e7fcc938a438ca26c2893d08563d085b83a4fa6c517130524dabc39e537c27aae91148e6e9681493b11cf772af34c3895226d251163ce68fb9ac5f072d78

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
581KB

MD5
e90584b763b708066abff5212bc2664c

SHA1
87d2f45fb1330217a305a8f94d8712cadf9faf8a

SHA256
078e5a1cc6059d63cfb7af9a233a8661cf450da08a9c6d6834bffe6272a89675

SHA512
6842934eb970c1567af15ec519d171387b8a8ac708bedc4869b3834474bbcc65ebcb1642870679ec1af683ca9c8f1e06861743b1cd5aa132093f1a0f01e32fc7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
717KB

MD5
f8b14df2238c9a33a7a86a979a003446

SHA1
6f561b3ccc27b8c1d325ca793b1d367ae13ea756

SHA256
5e7c8a2f1476d04deec80d4c2a32e9af0db8a2980f8ede0b09c5678754cd80e5

SHA512
bbf4484c19fc133f277e72685d75bf134c688fccde44c0c8969c748fe90b9e5aca93796f5f38e95e8c209de926fe0664a1226d48e8fe868a7ad23815b52dd7a9

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
841KB

MD5
49b7e89343c6263398f697c0dbb79695

SHA1
27eac455c5670a827b7dcaa91e5e5ce81ea07515

SHA256
dbde102511ba8d188226f836abf2427d786d3e217a41ac21f38dcc714a5635b8

SHA512
3094d4b89918766ad028146aee5e35fed70d9033c0597782a1db2896aeeb3b28768db39b3f19120ccb5d3af1db3687966b898f9f058ea2f404358cbd47609264

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1020KB

MD5
e21e7111e51eae3e796c61a539489a7f

SHA1
0283f3327fd1acfd20b3b5c646883edbb2155a98

SHA256
7c630a189b665535c12875b306eaf7887021a15bf55f8f579cc6bcb6803dafc5

SHA512
807ebcdc902819043ea04d3043b9d9d1e54e94be558dcd6842d36c0ba083020c638cb2e983c60bf6ee042ba220d4e0bbda59e9191cea0b383113b29f6bf46510

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
581KB

MD5
6dafe54009dbf12c896806cb8815e230

SHA1
251250527c15781ffeb37cb8d6b744c5ca2c2b0d

SHA256
fd456fd52605f1ada775adc529201a53d3c689118e94845925353ca768a3f153

SHA512
96dd81cfc48e88a7ab19036e90a0da4ef749d3fd64d196165f39c744ea9668fa0c41bf8240bae23607fb40a967f71a96cabe5826af6d8276fc4e53e2fbdef459

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

Filesize
581KB

MD5
1061cee00cb55ed2c058a3930388f55b

SHA1
e2d18462030108158baddd300ecb356d952059cc

SHA256
5543dd2e03aac4571d7f28d89ffd835743b110d1f9694dcf5a1932909f971767

SHA512
9b8fe110bc4eb236b3884d2b7b36ad7c523b84f2af6dc9233978bc89acd43ebc2c6610e0e55641be10618c2d0aaac024dbcf02763a779227e7621132429634fa

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe

Filesize
581KB

MD5
aacd1bdcf478f547961f02dc77ae7e6e

SHA1
fba3a8e06485b8fe783d793617e0e3c4511308e4

SHA256
f7f38e566159baa0b6414e0833896690b216dae1820acc58eecf3ec174475804

SHA512
c96e2abf2dd29326b49763f636574f6770cd985d5b2aab084e7c75189dc082a9853bc70ee8f49fa776a13906284919ee1b812234f727473badf8789186d9bfc5

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
696KB

MD5
898a828a570ef358e39a53947b3db728

SHA1
2b45e3b5ec99b527d887e8a06dea9b485a6b92df

SHA256
8d3c85753ea277c28aabe3e03b1a0c26f593b5a331160776c9a0f5ce3deb9911

SHA512
2cb3fd8072e57fef3fc1d79df23a4da0c3a89bdc3c08c7e445460ae7728db50eec5f18def5107a0d240b263f10ff500b1f337f3723f278c1ec2963a036414dfb

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
5dd0fcd8850822886a4ced2e3902a4af

SHA1
132310161f75e6fcb9f3f1dbadf6cc614a761751

SHA256
66747d023b2a8db02821b6ad6a17c0cce29530c5e2ab1693754d33b8cb6093e3

SHA512
fb38ca9034ee46ff0cfcd0a255b8f8cce8b3111ba2420c8d8a06378b9c9f79483cb69a2a63720f2314edfb12adb2f50003e591de68af234d9c4a6e46204f776d

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.3MB

MD5
4ed12ba4fa0f5f1ac6a4d95cb6e5f4df

SHA1
bccf75c558333837b0f71d05a864f6471dab812e

SHA256
318dfe48f6b06940290621f2bf338cc0776459481cdd4e1b5e5256980727d484

SHA512
b5f063a0c0061162e7ebdb910e274b90b6077960699f2bd53f58318013598d7fa923ce1a1daffa8d5da6a49025c7313a98668555f80b755e33cdd3e7a6026cdc

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
fcb5cf8b4fbf311c5c41f849253cfe74

SHA1
bce260564998b46573a729830d6bff02dc90d146

SHA256
860389ec8f15bb4f5bc20d4b09826d8e0bbe0884c122412758edf9082aa56be7

SHA512
b4f7b8421c5bab56b522f1542c44b7499375005116c57b64307b87edd195d7fad7b7ca17d38ca47c5e25563b89d6e5704a4a1c3052121dda8498f19b1a1c662a

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
00cfb68f7993b46835f027b5f8316491

SHA1
60a1359826196d941fe6a9925cc1666cd9f038d7

SHA256
f84364204d04c14d0d4bd9012eaf2e921d9669b66ef46d88d5bbbae2ece7bfc7

SHA512
20432aa0003ccefcdc2db7012cbc032a5dddde3f633502610bf0e17081b290e8b4db6f1d85f89b5d195ec6a561b6c6cdb2bb0f56b23693c4740cdaa7680f2f0f

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
9e95ac692179a8fc202a3821a7870a61

SHA1
18860a8989d6165176f01356fb5fea87b4012b9c

SHA256
eab316d8b0fb65c3af6ca5fa7305381caed63d5aa247009fdf252867417bbb2c

SHA512
ffdc8400fc56b708dfd869f2bae957044281b804819ed320e694e7363e7e3bf68b0d8124b0176f857242d1c3254d108e5db37687251afd089003f50fbc08a50a

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
2fba2d4f7b37fd12f96bfaba234b5b01

SHA1
d908631f8743e3faca55b801201334fc6868b09f

SHA256
ed34b87f0d5410ab46beda5f30dfc9747de55edddb4815c38e9c95791070675b

SHA512
671982359080b536e26dde31e96bfa213a1d74e401b2d39c226df955a49a86f681877c8f3394e0774fe329bd1d971009d9aff6fdfd33b76f50b230a2d1ca43da

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
913KB

MD5
df5c01714b8f48f16ef2ecb821f8ad2f

SHA1
869ae7908f2239491787e5b7a0190756405b67d6

SHA256
ced4ef308264b27f5084c356f5889ae6abb182f547c2c5f554579aa451d64955

SHA512
081d9b0a20077a26dcc3f8ecb0e8ba6acacd4e7266a546b76591b2869d8c3f94a78914cfb66eaf86089a7ed2fc77016da64ef19cdd17c9027d40332b8ac37823

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
cd014f9575f7669f3b34dfa27c5472be

SHA1
737f149b6bfc8fd4619987e7b8bdefc475ff765f

SHA256
1f4af65bf2a3c527d8ca97351884ff37cff0d3ac52ec61632d2515e3a7d5db0f

SHA512
4647fb162c5d8c8f22f329dfe88b0fd2fcde44979b38b08fb0bbb2b7ff21d45ac4e47227508254e16c1ea1e98f201f446b45338b7ac07368e7b9f8b8abeccfd2

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.3MB

MD5
9f552813d2a7bbd51a3b76114e19d2cd

SHA1
41b9e89634d39da63bd6524e38d36f568909f89d

SHA256
b36dc1c146036e23cd6f2a72e86397cae4f03c3b7c434e70c16b8e4f981c86f3

SHA512
cf7c4ce6f2bf0913301d2e6bdea1dc51c69601a5683ae06658cd723d4551f7681f4908f78c6c28a648a64030fd6f706d0c66f1a83e0bf02a30460d87d5db44f3

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.3MB

MD5
646656166fb75bd3aad546738c344cc8

SHA1
87b3689118a57a0564c493d75a024e7dc290d74a

SHA256
252f01c9a1f6716afbbf32b955007b6391a35228ad8dadfe3f03f5093669c84e

SHA512
e0b63f1aa9f040beee8a1663b77cc175a24a0649eee55bea17ca0174f87c9a9f8f8df2429e662177ae0aacb21e4bdc07f84a6194ef9436a79648a581f8042e26

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
097483bb9f42de3d64f6945102fd4ee2

SHA1
0047282a14f99f63113ba90ae9afa6881fa89fd5

SHA256
f43e287955490b980d642a6b71232c26e5edd1ad0ccbb7263cec0205bdce053d

SHA512
f128a228e98b3557d266bf3e10ac50ac908e897642a60bcfc39b67191a7657fc534f7ee3c7c15cb6c09d5ca796727a7728ce663ba53c936f5d0e6580a85cad10

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
511caa4cce419b691e4f2c6fa9a22d32

SHA1
312b3443e3641655c63a41bbb34d548dc7e4fe55

SHA256
4ece44a45b47a0e87e88df03f80f474eff521c12320afa5481bc095c64d6e39a

SHA512
90e296cbfd6380a6b50400e59965e28e57f3312f0e3652717723b0dbb65e947484998fcfbdce00213ed1603ab5d58ba9d406b125e137a66b44d0d7b7297841bb

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
1.1MB

MD5
24cae36330617135a0e07b65ee39afc3

SHA1
e003f70b68edf1cc2e04faadb78d25066768e719

SHA256
d3d29eaff44d7c210ffa8d00715a5521d7044272cafead61108219cd8a1dfe13

SHA512
1f6218379fb2397d33974bcea476d0246206834ab1bac37c7428d567c712dbb02d499492f2757c77657aca44c0e699a7e0a0ec46af53b634c66aa91d129888a2

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
a91bac44ca0e725fbb368e0a92df0b66

SHA1
e0f5721cdcb9a3a0ebac5ccabf829b0836ebbdd2

SHA256
fa18642fbee76d1e1c292963a7cf81d37d7848effbe47cda50e2701db3803f72

SHA512
0a89796b1ffdca4fe3c754a842014d312bc9756c69f4c2f8f65f420b0eb7e97de6246451daccc3a05e0866d40cf42fe5670d280e6fb4168163e382a849f1e049

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
8c9e78fa905988cee85d7a25e204d7b5

SHA1
08442cd144aa29b0c6c6fe7389758162453eccd6

SHA256
1ea2fd30d6c5cc782ab45f5a942e9809299e5c0ca794bcf3f5b35201a2c1384c

SHA512
cac302fd788debd732545dae642eaf1b0b1e860b6392a1e0ce2ea1ccb954316d040bcbe64f172ce4e446fde08ac35f2d6b513d964eab32e3015a0efab8461b29

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
5b20d9185f88e52532aec5b9da3bc103

SHA1
08573c52c760280fbf92d6aa1bf3b7d0ecbc75d9

SHA256
06e3a78a4bdc22aa3c35214b1d72fdd1dd1c2eaa7f00381415cad6eea0e7ed49

SHA512
79c9fc2ec6d07c4119801ade192f488b080746d4fcc8c9702e22ee77323689f35d53ab4c08c043154e672cb3354df664a2c1ff7130adc1c802ac7801cfb9727e

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.1MB

MD5
b412791665a6e8e9cea71fb13dd30971

SHA1
de9b7357d4bc352739e4fcf36e90d9add3c954b6

SHA256
07703ecdb2d3600881230869a20cf18f76f172c6e2efe8b5435eb7598d87d8f9

SHA512
6d79d31e8a61ba9fc8865339812e83f32f8a1494f1a4d09ab286625488cd652a5c11436a2025cfc2d60dd3da5193a854cb94a61b9c328a48038ebaafa07d10d3

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
67c5f1a3726644dd36cb9b9abaa4afcb

SHA1
96c72c231a736257a12d62199390442c13cc7817

SHA256
6175ea77905fc44910438ef51302cc91ec20a517b944ef8955106f7c8809e8ea

SHA512
20fd3da90999af32a6ccf21d8e55fc3200233dcf92cd6c874410fa99953adf6309bf1bab9bdc8948af72269095f77523c574b5f2f3f02375230fedb6aa3bd0c9

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
1.0MB

MD5
e05d955d44bebaabe4eb409fe7eb948c

SHA1
1c67834b13a8d1bac8a4d3e1a707510c9818c6ce

SHA256
2e090ce83b9942eec9314044136c24c52b352f3ce86c92d13bb42febc964f164

SHA512
00bb3a5950ca8700ea0c0b0782a35c04f7a83dace343a0a0928a088a2c0f7b13e92ba04fff14be0828d3e75d7e3c7272902f8dd52e624ae9ed638dc6a1239069

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
0606c25dfa7f77364384355d670a8e65

SHA1
74486166683a41e039d8a6b7ecfdc1aa82cdbba0

SHA256
9100322e4e3bfdcdf6805f5940907322c2add0b60b784d1b004684b709373208

SHA512
79a502a05ca13a4ffebb741c40a01859cafde2704207fff73ebf50892ca3fbd8d7c47e0f63c574389ccc848f268be6b1093f9534b717af847df02979f66e391a

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
635KB

MD5
feab16f4c31fa59aafd485c7936d4cda

SHA1
4129ed52c16c082b01d50ada9a33c847b31807b7

SHA256
e647811d829749f3a1aa34303ac3563ae9efbcb781842b7a139fa12a1884c45a

SHA512
496e2e1fbf0b4827f055bbd09ae79322c4419e7a8bb1f5f7d05f63ba0e0b853fb9b30fef3ece0f49bd6af3bd2fb33b76eba08619d3ede5ba4330b1e41142743d

Download Submit
C:\odt\office2016setup.exe

Filesize
1.2MB

MD5
5935bfefbf5f7d92c42e9bdb666252e8

SHA1
bcb2e268c7b6572d449541a2c02f9dc46ef8ed99

SHA256
5b3d6122973f9494afc15a35975eb1842187366a31827337c67058d89bc98588

SHA512
0dfe1820689fa1ea2c3fe866732befec15b5f382d0b3e26982829b8e8dcde2b2a41c8da64cd617da338f0be567815d1663c6beff0dcbacc079e397d456654dbd

Download Submit
memory/228-425-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/864-1-0x0000000000C80000-0x0000000000CE7000-memory.dmp

Filesize
412KB

Download
memory/864-7-0x0000000000C80000-0x0000000000CE7000-memory.dmp

Filesize
412KB

Download
memory/864-6-0x0000000000C80000-0x0000000000CE7000-memory.dmp

Filesize
412KB

Download
memory/864-245-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/864-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/864-120-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/1796-140-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/1796-402-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2352-566-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-614-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-586-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-616-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-604-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-582-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-619-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-592-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-610-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-615-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-569-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-587-0x000002F1BDFF0000-0x000002F1BE000000-memory.dmp

Filesize
64KB

Download
memory/2352-567-0x000002F1BE000000-0x000002F1BE010000-memory.dmp

Filesize
64KB

Download
memory/2648-444-0x0000000000740000-0x00000000007A0000-memory.dmp

Filesize
384KB

Download
memory/2648-435-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2648-484-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2716-559-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/2716-448-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/2716-457-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/2792-432-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/2792-479-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/2992-480-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2992-591-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3612-159-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/3612-407-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/3612-160-0x0000000000750000-0x00000000007B0000-memory.dmp

Filesize
384KB

Download
memory/3612-238-0x0000000000750000-0x00000000007B0000-memory.dmp

Filesize
384KB

Download
memory/3644-469-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3644-580-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3912-558-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3912-476-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3912-428-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4056-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/4056-113-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/4056-364-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/4056-112-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/4168-477-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4240-472-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4240-581-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4396-603-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4396-488-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4560-108-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/4560-102-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4560-101-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/4560-244-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4752-568-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4752-460-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4900-468-0x0000000000620000-0x0000000000687000-memory.dmp

Filesize
412KB

Download
memory/4900-463-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4900-416-0x0000000000620000-0x0000000000687000-memory.dmp

Filesize
412KB

Download
memory/4900-415-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4920-466-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4920-464-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5004-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/5004-133-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/5012-17-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/5012-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/5012-144-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/5012-16-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/5016-155-0x00000000007F0000-0x0000000000850000-memory.dmp

Filesize
384KB

Download
memory/5016-145-0x00000000007F0000-0x0000000000850000-memory.dmp

Filesize
384KB

Download
memory/5016-147-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/5016-403-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/5044-137-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/5044-125-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/5044-124-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/5044-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/5044-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/5072-98-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/5072-96-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download