4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
Size

1.8MB
MD5

4dfe3940008c9f6e2094db61799626fa
SHA1

b4489816a5a942b62f842156bb30394e20abffdb
SHA256

4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f
SHA512

ac5710357c65501cd0b6fd56f127dc50baa1cfd1a67dc63b20ee633c0fc886a8f2fff74d676246c21bcc5f7856a14c888840dc7c2ba2c1175c025b5e3a3fb98f
SSDEEP

49152:Gx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAi/rAfTcZVWUXkfn/V:GvbjVkjjCAzJN/rAfTKVWUUfnN

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4648	alg.exe
772	DiagnosticsHub.StandardCollector.Service.exe
3692	fxssvc.exe
5052	elevation_service.exe
3140	elevation_service.exe
4612	maintenanceservice.exe
492	msdtc.exe
4436	OSE.EXE
400	PerceptionSimulationService.exe
5104	perfhost.exe
4800	locator.exe
4672	SensorDataService.exe
4296	snmptrap.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Windows\System32\msdtc.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d4598d4eb3e2edcd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_te.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\GoogleUpdateSetup.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_bg.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_pt-BR.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_uk.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_ko.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_sr.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_ru.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_et.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_nl.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File created	C:\Program Files (x86)\Google\Temp\GUM13B2.tmp\goopdateres_zh-TW.dll	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
772	DiagnosticsHub.StandardCollector.Service.exe
772	DiagnosticsHub.StandardCollector.Service.exe
772	DiagnosticsHub.StandardCollector.Service.exe
772	DiagnosticsHub.StandardCollector.Service.exe
772	DiagnosticsHub.StandardCollector.Service.exe
772	DiagnosticsHub.StandardCollector.Service.exe
772	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	956	4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
Token: SeAuditPrivilege	3692	fxssvc.exe
Token: SeDebugPrivilege	772	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5052	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe
"C:\Users\Admin\AppData\Local\Temp\4b8f228bb879f35ee342e149ddea3fba7d8ab2910b6d57db66a837ec7da6b55f.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3264

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4612

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:492

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:748

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:4672

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:2176

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:872

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2944

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1764

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2548

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3420

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:2340
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3708
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe

Filesize
2.2MB

MD5
c3644204d8a9a59dc79d69f810b4f72c

SHA1
a585d318f89542990c03fe3b923b08879632520f

SHA256
67eec563fbff66ef1ab5ad52b090d6554ef7843c260cceac5e2b2b15937050c2

SHA512
ec224cc08c18c44f59f4dab6d9f1302660b6e2f1170a8f7c6b37c225671dbd4dd2dea5e7574276fb95847e2edb81d1ccb6527fc09f56b7b35828ff71744b5ebd

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
96515a56017dfea85fcaf112a0bc0e8e

SHA1
a37867fc858e478117c8c08fc48147059f54367d

SHA256
5fc0a8544097e52ef19d9f3576143548c40c45fa92f9482b77c14520aabe339d

SHA512
f79c5720ccf1b1e2bb412ed95bc3f02112dd355368153eb1271cd669f9881cbdb38a4d3648fadaac50d59b130bb60f10ab74f74dc740604b8fe64c2b4370f675

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.7MB

MD5
96967e16ec57a67990b11cfc5f908886

SHA1
50775c6ab3bf0db5b137fa2a2bcb382a152b5293

SHA256
f5aad66459e670d766a5deef8baf3d5d19806444fd9ecd83a77e349a6ca96e02

SHA512
6074d40eddd5f520d391fd48949f7ed9bfd55f9551c7f7dcd64f5af8412273259118096a1a8a48de1c17f5a7d5dda89ef08f078d1e0a1d8d57bd0f4d56625a33

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
f40bb6cb9eaf779c3aa94465072f4dfb

SHA1
4945c62b71ed5b959f52a0565f7e7e96b5db6436

SHA256
24e5547f516431246f87a2a83cc1be215105af907c482bae357409eb7b0e4296

SHA512
5da684829e315dd8ff67f4ad251eef718b89250e47a5262dcd4f31b2f57769581ee2b02987b400aaf3be04c0be064fc5b2893100bcd638124cf8b015bc6f65a2

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
d31b482d56c3b09eb5e2c040a8d004fe

SHA1
62e5bc34e0f08b681be9e8d4d6165cb255f5e01a

SHA256
e3595562be77d8263c2c3bbfa6ea89f1f690e1db0dec6df27d6edfb391bde01a

SHA512
46c90ccf2d41f049cfbc0e1008e0e78806fd32690a182bf1bed192b4ac4aac4892308ad2c6764cedd04023e325b462af624bd422f533d3fa207253a843283eef

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
dffe287f7314cbf11b587ddfdfacb8ef

SHA1
77cc8ec3a473d239b6ee836ee4960e63194e0aa5

SHA256
aa91c9daaed5cea52d5a786001f539d48505e67e4293d43229377612cc71cb49

SHA512
0a901b9e92144f6d69a4306ca45e22691ccd39dca5cfedd1556f3ae8f36488a5739e2fd5b4b6d72b16f69f6da08bb7295bbd2c1d37792092dda4bbe474280f43

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.4MB

MD5
1d9876171ceabb8df4f8e4b182bfb66d

SHA1
c5d66a73fe2bcd8585aa751f95dea8a94ffabe50

SHA256
5efe5a2083b861441d8c76afd0416c27d77f48fe892ec62b61a89b30faf0f355

SHA512
1d6bba239eb136b2e4e0357f514cb665bc8421f61e8a120eac121dda94de852e68c283c7807fb6fe9b3e8f8154bf04485a0dff53263b821d18c0765678fed4d7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
6acaafb540216d7cd8cb35519a25eca7

SHA1
836ce522c45e92e07b5acdc85ec94e156b1625b0

SHA256
e7f926c2b6247090926b2720164b8b6590aa34ba09c12bb4081b7c37de03d64b

SHA512
8eca4e19991aa39664f49f04cf3b40e24d649218fa4491cb69b442bde4f46dbe0e9193e39619227cdd4fa875669c7145e6207772e39c7e1e19140ec61debb5d9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.5MB

MD5
774975491ea6a6a198efa48276b65ba7

SHA1
33903dfbc5dee30b09be8a6ecf9877aceeac6f5b

SHA256
6159278026a252d1640792cbb8d2ae2bbf3cf099a38e0f881b3aaebb3520d941

SHA512
8e84642e3f3c6cf8e6dbe2e824c47743398ba96ab4221d08466d84dd8291af0c4c29a3b400136cd32caa3cf074ecd2d34aaeda441d7052415c0ccb4df85d11e1

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
13.9MB

MD5
46877dd2532e214d20497efb13beea38

SHA1
632c31e21c1f0ee2ec48696514bc489c8a49bfa8

SHA256
f78d3b4c18008e55166fa2214e46787624c34990575fcda5ab5c283ae9d50a8b

SHA512
3ea28c880988673b8bc675784ba56bcbb1909b2b90e7648cbc3cd5275b4a311058a384efbb7e2b89e9f11277acc24fd25af381d77024c8fdf539548228010938

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
1f3fc8f2a9c32b97cad133e0c9adb093

SHA1
a363746fea3e5749382ce92bbcc099596570ced6

SHA256
8e04e69dc48e6c279b1dbff4033b0408b8c410edcf075689cbdb52496325bebb

SHA512
818453164249c19f53ae600b199a1ecf3e06b9c712fc38ad32f22327fc5b17b364eeda611ffa076dfe5abc685029bffaecce66d8badae0e9d025acc17c77e369

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
d19c570d73b221f29ea87dd017e6316f

SHA1
4457470d276934e23e504966343e6260a48c9482

SHA256
1f2ca0a3c9fda8d2ac4b0996c568dc6dd93ca539ad249c6d5eb8b56c1be8dabe

SHA512
fe98a2fd8f192b592e53adcc945019f89a03890f4bda867f3ca04cc5779f2677bfae58b200ec4eab36650dc522526e4ef7df54dd7a66337d6dd7e72cfad00cfd

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
0a809327b23a72f85d4a5c4a83d745a3

SHA1
5215019820eacbc935c36beb27018a92d4adc779

SHA256
126003d69df7fe828581aba775ecb0759b92356666eb26a3f476e585adf83bdf

SHA512
577ef28e940414d2ac39d11e020618b7253388ed87381af0a2ca370dcd2e42991a439049953b8d31c891841d39fe32ebf0b2257630b120a66b543885309bbaaf

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.3MB

MD5
79318ef6080dee25e4f451feb0fd8d94

SHA1
b8606e47e622b0d7012fe33bcc2c79a5d6f0eec3

SHA256
fa2840afb7518e8bd4695d1382d63aa204f35ae017d0c4b8aae1cb9bd341f228

SHA512
1cc12afc535267a466475c632d7b59fcf0ab8113c1fe288752e303030171f312d086d735d899a3d2a04bba5c28856787e6a915285b2b2a9623b55bf3f036def6

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
76bd0611ff3a29c45f756a1d11bf3506

SHA1
20cbc0a77330a2b973a5753f5ce01aaad0c2052e

SHA256
0397fb0aba0956bec83e06f1b063aab21945181e7a1a7feafd0e5797a5c52e43

SHA512
d7b8d963600dd5ff846e50c4de5129232b66fe3e56d3ef8f1943a94cd52da06c84386fc1d2579a9c5ed101ef4ef72c5417627ec0b385d5f6a07c3c9e8acb1232

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
b6f682b5a9500e7769130bce7a53f587

SHA1
bef173827cdf7251f9ff731580a83eb8bf0a2081

SHA256
2c2eafd2405ebb5a53d198432813284bfbfe0ef909ea7e33e75ec1109d80becb

SHA512
2a9b9ebe46552507826de3d230de96da2c05236d117119cbd60cc160d77cc42a36e7940bbf8de57e31407964fc44aa5f03a822cd9fa2762af63eb6aaa817cf90

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
3e8632190600816d892092eb3c906cbc

SHA1
c797d8596fef5185dbe3b877d8e278ba859c20e1

SHA256
c35ae09e20d7cb9e7ce71d5deecb6f3ad941c27cb02c2da393ead19587f22319

SHA512
24e32426fb6e73e686aeec523dd8fb5331551bbde9fb7cf532d820f1b3af8fc4d076c6dadb92ad348d7600212a6a118e83a44ec71b77fdd9add29853a6fd7f78

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
29743cf353e94ada555be7718b168031

SHA1
d25ad9a89f09446c1ac1afa7e81e791f9a588780

SHA256
4e3e089b348f17aea4af2f4070ebd747add522f8d108575c21db1065a9e57373

SHA512
cf77c236325e6d88319fb7eae7f3d4dd92d8e88a265e556fe81d74ae7d1b84382a75d4ed2ec86dfe0790a413686eb395105a01649ebe8c08aba33c685ae6afc9

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
f819a4c44132bba0c2df4c63d2c13416

SHA1
29c4d068f4ee39543b91298f83bc0b1d8099d115

SHA256
20a558c55c13bbfb733d49d4f075de770ae866454a9be55157d04b5241b4a49f

SHA512
9350857dde6296056696503a12554ce8969d3a7b3d2b9bcaf240615c160140c074e539181532cdf07c0933bf04f3493a5c388d371a611c58add7795b7782068b

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
f2d66b3a40037148d499812bc17d3fe8

SHA1
b4cefb9599c1a5614a3ce8c83b1093904d010ee2

SHA256
5b97b0da68724d5028ef100a21cdab8bb16a96c7021bce700c7eb779249c9431

SHA512
d81f2e30b50c3f5150d37c4203c4aeb68e4b90c15e6c1d007762e9d11c3c92e0fbc6ad01628f04f24179cd88cfc2942f2224a9273e1148cd36be1b4dd9a4766a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
1.2MB

MD5
625b5474f55d267cbedf0cb8c5195ba9

SHA1
1e44e5abb7bfd666b15727ed408b247148d612b8

SHA256
404d97517d214a76cc64cd36a145fd337a713324c329eebdaa9fcbf21cd5ed14

SHA512
849e146992026d27344c067d6c962d881d6bbc1cc95b08a5aacbb865805e94ad6d177ab63344b516fac95e3b65d324a113599065efac7798cbbc6659b6a40cd6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
1.2MB

MD5
0b905ffdccf800c06809493449a77657

SHA1
62b53195b0f65a6f90e42fac958b4c82a4c3acc6

SHA256
e3656847d6e9762275b38211997b28f13bf960352a336e92ccd9af933cc80e9e

SHA512
64ee86bd0277b0c4dd8c0737eed4652e302c61c6f0bab9bde129fc129a9f535cc35a2f8e65b4e6ed364f303179ae1c31436118085387e86fa622b7686daeb715

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
1.2MB

MD5
40331dd5d08bd58c0922eb05dc4d5365

SHA1
54d4c1c92041f107af8b9db15aa362768180ae30

SHA256
e869308b6e9079695ff8a97da5327d0f375e2dcd3ca6e69e95d4517624be0aca

SHA512
ea2343c97144f88d4f400c48ee57a09b70f9dad3d0e3fe2e7df45a78ea224038ce71c9a03a9c1e81c2e794df2997e3827148de56cfdeed7ccd2e873959fe8d7d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
1.2MB

MD5
05d1f11db439685de8b8c4ff05af69bf

SHA1
611aedcfc39365f8171f986db94f6f3485a795ce

SHA256
4574d4dcaf94562c4157202e50ed0ca28114d9908a9bb360180e13d83ca8c638

SHA512
d8cfc0c256870ee3fb2420e85637ff609e52cc8dfccdf294bf65c876509712a7b23a0cb805ac45e645e99382c30770cb093e0fccd096a4c3462250ec0be4d3c6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
1.2MB

MD5
1d7614c16acdb5ea183ad59a8b2247fa

SHA1
09983b88c90414711ab3fcbe0ab5b817af3566a2

SHA256
cba71f82a2a8d0a93243bea967b3d00358acd0faf67bcf52c7c67898c9eceec3

SHA512
2f3a9be67734b02d9e5191818c28763ff865e5defde3036ef636c335367901653ab535e8e13e405830d5ee5c3a49f2067e487a8882651765398dce75980eda04

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
1.2MB

MD5
6b5b8091c571ce37a459fefdfe824f12

SHA1
faf3d61d59e4b22bff7af35a0a69bf2f2988dba1

SHA256
a76fa085f2f9ed65e8aae0b053f7cdebbb3ca68f11a1a673b3004fd3dbc98762

SHA512
d94b6853d80fdf8db85f02db0d164779740a3576c8e2809fc208d34f1fc92cd396b2eb77a0a3d4e2a3e460465939467cd0c33c213529dc2ddfa05f218b87041c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
1.2MB

MD5
0d9bce43ba0c82272055925fdb03e8c3

SHA1
507832208f1b24e763b438a434bba44756eb699b

SHA256
ad4508662d116639aec6cd69b7011f9c316bd1c42a9bbb6b394a0927f6bd3c1d

SHA512
fdb9041d7b702229b44db34e1011f206a8961564ab97994af4f64f08353952b2fcf4b4574f9deab7cd31128210ad206108a1d9c9add6bd16209108960eb8494c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
1.4MB

MD5
69067ed3bceabf3c03c89f35a93292f1

SHA1
fe51ad3c220c80ebdc7590a86909043ddeaa7a3d

SHA256
d722747bf79ed5338277107abd0c4a0e054848e7cbd80120b777d3a48a22b309

SHA512
87cb80a41caa387ab19a1df44644ace7a6ae2cbde269983ac574ab52573e3f0d7618b5d8554091fd3857a97f67fd81c4732e6984e11e1bed615f171720dfeadc

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
1.2MB

MD5
c06eae0af2c7e87cc76db6a7933ec46f

SHA1
552cd1ff963df65af3141d3d5739b96ef241f229

SHA256
7651c6057fee14dd7b5605ec38784936a021f037175a3ce855cba43d6652bacc

SHA512
9f9669319fe393be11bbcac8c4235bd9ea3177431b1fe0d24d1187ab27c472b991c8e700664966fa805cef0e5a0ba5730a3b644e66b624078695b2f493390f53

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
1.2MB

MD5
93709e14e052cad9ee3606f1a15608e3

SHA1
67d19182f7b091da575d7ae4920ecd9e690e8ab0

SHA256
6e34aa8e5185e5dba94f5cad78f1f8f60b032c5dc935c407d835c78331a83042

SHA512
3fa82cf8981d88a9bbba82f734c62283cc48c6500f0bea9aca4846f12167a1215ba6af331e6bcc30fcd9cadf8bf567dd5852ae7b7a49c84ece6e50e735328e5d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
1.3MB

MD5
36787a4bbeb851762ec9135b3fbd5878

SHA1
e17754ea6603451f4aeff3be01c783d2d276a5bf

SHA256
2530eb66f655b8347006237fa324cfc9be669bc24734af0946f4344fbbb5a389

SHA512
37e37489086cb661e2b063f93647e8247b77ed9558cdd4d3f2c16aa29dd27a94187f1cd515f1a13af13b258e73073eff5977677a2efda8cf7948da2b2d3af8e9

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
1.2MB

MD5
871cdc21630e074cf86097a63ec0de9a

SHA1
79c2e6acb564da5f00fccf60c846988fd1b75210

SHA256
d040772b27f004a7e0c11efb1fc184709fba05642141ce92fbaa7f622c70b03d

SHA512
d7518cc8c4cda7b2b24ef2815f9a6b6116f72a5a5183e798e42acaef4907f10a7129b540b2188b8f663841a322bb86aee34f49d27a4100799bd5ee016bf7675f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
1.2MB

MD5
743c6872bc9999cbabe9a8cc87dfa366

SHA1
41c33f6aba589d25db7cbf9632e23ed863ee5ac7

SHA256
1ff94e2c4ecf2b241f46bef90b10b8b960e65a3edb223735a3be9dce2cf15e0e

SHA512
8ab41308d5f33272b1059210954e08ce6b68e80bbff6aee03f9c83ac735776a2ddd381a07f29da28b362bbcb85391553ebde760c6c0e00f7da2bea019fae4036

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
1.3MB

MD5
6621c868673eb76ab51dc3ce48810b19

SHA1
c942091c74c75f9521f8af59714005ba06c24d73

SHA256
985f10122a94f84cc56f8c2d1e8e693616bd1d83b1050c6545be0f9f00965814

SHA512
7505cfb93839c32d03ec358f39694e24a1aca6c97cb25a100fb84ae8a990062a6cb1b8e74347446bc461e39317bcd869382c56559bcacba4c21448f7ff589bf7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
1.4MB

MD5
716193ca8ed0648a320be8acb44d2362

SHA1
6aec4f1fac4e7ae20f8b7b0ce4fc3d7b345b932e

SHA256
41865cee2e1e54d9d894551b32c68add97a802cd000c346891f524ccc95ae143

SHA512
bc9bb5e4922081396734a7700e3f744125015ffaf4490ac57e0771c1a0f0ec9c0bc619dd962e336bcde923100eaba6bc1f1ec2f08654036851f48fd6aed296b6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1.6MB

MD5
a7df62a0699dddb0f2cf557800c80b11

SHA1
4572ace5ca354f036279041158697a83e6c6ccab

SHA256
51ea58cff8ea8707463154ad1560f6c1d383a1a437290ff6e32ac5cd820fe6e6

SHA512
8022f036918acaf34525d9d6145b8ea501175705bb1aef2e88c097d3d4092cfa3b5f8419443411f94a88c780c0b0b3588d7a979df568a12b53b9649d40bc8ed0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
1.2MB

MD5
8115fe249db6af82f4ffc02471ab8508

SHA1
c7564c41ff217f7936dc9fa5bbc56652801a4513

SHA256
ad5ec00f66ebe6af78630983c066b6462820e18feb1a06a9590a51b7cc1c18c7

SHA512
3fc70bc9e8bcc47e5f1df0fa3d18db4ecd7b6eff9225321c79b27bd0691e8ea7ad4d5138e5a1584d38edaaf7e2d9e608c2d36f229a7b610c4d03635412f50322

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

Filesize
1.2MB

MD5
108a9337b03ee3a97faadaee24e5db32

SHA1
984fbf7aa6569acb4b0568eef38d11c9ad931f8b

SHA256
d30c81fd877b22cbeff79fae6198cfd13d291101df2101f808aba8f0f92d5de3

SHA512
99553a4a2e14fffcee6358cf2910d0b4819ecce07a06821129239cf3d9b965cab791c2a58ce53681fee8eb29c40e34cf4e197a63fcbf35a039dec7f4eb45e5ee

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe

Filesize
1.2MB

MD5
ffe211dff943c164187f80027e580faf

SHA1
13ce7c5eccc8b8e580803aef1a612c9f38bbcf78

SHA256
a7c46c706de0018907c1f6207676b6757721fd59cc24cc8813745321a063b6d8

SHA512
59501b7e0d45f24ee776972a8bbf2e655f3015b9382f36aa5a9837767a89a72eb9a86b9aa0c131951142246b5194a3f91d34786d1f4f4f668e83294396dd60ab

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

Filesize
1.2MB

MD5
21891a71c42ab17ead8ba80a4da7a1e7

SHA1
f6f884b6f07a4ceda0ddb1bf91099756142bff5b

SHA256
eade601c88051e5d83db448dabd7bf66b936609eb9c660dbd61ac17522e374ef

SHA512
ff5bcda55248a5b242be2e9b82c6d03f87e8e812d0affb43edbcf3f07cad14dd8856a0fa4cf2f1186d270d2e4c00f9927bc4daf2320116ac190d87b64c38da28

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
1.3MB

MD5
c90b8db2f9dafef5cc9c5770cb995fe9

SHA1
85380c30693ba48a255e3573e72e5dbe31b7de27

SHA256
28d7fe38d446309345a1d8765bc5c6d6335db6d40aaccac2c69dccd0cd945598

SHA512
30ab3282fa85fa53b7e1ca7c1e684de0e07cd2f4e422a01f4cc692b12b8bd7519334e380a7f774f722241968113f5c24d735c6395ce75f3b3c8c7afbd2796730

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
f6ba303db5bf5f4aa17fe115b8e4ddff

SHA1
0109781e5f641c4df7ffe09743d084574dd5a0ca

SHA256
80c41ff6ad6adb52e316d9e4d8fc6f58c789fb8af99b72149bfcc036c9203ac1

SHA512
1f1d89d5a81843ce7edeb66f307e84201d3c88606c7247aca837577777fc97be4bb9d17a4fb955d9405a7e8882b7d6a2c0cdd3a63b6f1db1ecad16a2fc59d777

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
35b77b5df9874c02d10399191bb337b0

SHA1
6ba06f91e5fb4f7161a0c5e3821348fc5d9dfd6a

SHA256
c6a13c65e705effe4a12bd270528faf5d99f00f1812e848058af0e633bc1772f

SHA512
bf1f608538c929f18843a3b70f5d3f4e60bdfeff52914a0c4382c3a293230714de27354884b88cd4a559d92a80d641c1bfb8eab8f9d140a2f803314d47c6510c

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
5dc396084e69bd3d0e7ac02cf33d8e62

SHA1
068e24e802e8d4adbb977e6b773795ae2ff63943

SHA256
aa70f07f4443bbf3e3eb526acd509b17b2f6a9b608d60c5ee747e98f57fc022c

SHA512
53afd041337d37bee89bc5e858ab1f4aecf42f196b3e8310cf74d4bc808a2dade1ebbf3ab014403fc42dd90a8fa72288746aa89d06333151d4bf0443cd933321

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
7a076f116026bf713307d1bb4517f8cd

SHA1
fc4988e83374006d05bed479f53e30a0ba8a98fb

SHA256
48791d6be4bdef3fd724e7e8f4141d645f59cdcd30a4994becdb39f8e2eb3518

SHA512
67d672f5b04427341fdd0ffde82e79caade01cb13c9803c9a1103b3f8a7d6df00b56e03adafc1a8d976267f716f72022033c127cfdaddb4bc5d0621a78cb570d

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
baaed3eaf8e70f6bc72badff8a5a6f04

SHA1
289f93d11b75acffd0f03c465b78186dfeeb8ce8

SHA256
ca91abeccd44f316f1b73d600af42dc00e8102dfcc15bdb91b405eded55be85c

SHA512
165810e0b1b37d894cf439e50912530e07256d6850ddaf4810a6a5d75d53133b6908dfd4642bc8bc024f6caa5c768cdb8229587fc4260abe184610564b730026

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
9f5378367a2ebbf93c7ba7e9dcf8a6a3

SHA1
f841bdbc978b8d5e78dd756a5303d694945ca43e

SHA256
722d73ebfc6cde72e6fa45ddd0981a29f3dc2eef7c60278ff143b4eea57829cd

SHA512
0e379a6b5b9e40e7ed36f857c9b3ce88531055a8ff230c10c2ee7f9597076215db5fb9b43ae4580ed3022c1d9d6de788cf996c834fbb8d569283863f7f89caea

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
db7d15b9921cf7b1964b31acb446c819

SHA1
2f01dfb47a33a29455fb7fac6fff82a14fee68ea

SHA256
1bf56acfe613f99c08ed4f483265983b7903999a127cbb36cc0ee61984b8cf76

SHA512
be55e317224b12c4b1dc4e49a2d17ba658236cefe3501c0e91a9e54b06da1763c2f86b2f0815f039a36a725f39e1fa30ce9f365c3dcff7f8324f93c694b8ba8e

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
3960de83dfbb11a835ce3e168b67f9df

SHA1
838086af4a8c8b8584dee88b4d0369998a24333f

SHA256
fadd04193bafbf032e103822b4d262b7b112449e20b172a5709c1e62b0435ba1

SHA512
e86292d7362fdcc5d9d6f9adb81bd8b72f36dff1a5abd2f1e62ed8baa52a800a329e1992a13f7d889c501ee2b855c57db2e56d113507c509d0f7f5693b3ab233

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
dfd06095cb40baa9462d57bf4f198522

SHA1
c173fd0fcfa9b85f20d2f88669ae5f07a314c952

SHA256
c2ac97771966bb125bec6786c0fee2b463e098464d6239788fc6abdf93c2c939

SHA512
5b84f879ed25d5ab8b16a6c2cff12d47778da9d63a4486e46bafb32a1a9ad5ce8bd3a88ca9dfe3a4fc33c7f4533e692337a28826b634f88a6f145a3989697863

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
45b6f57cf766b973a383327f121d1a28

SHA1
ae20986446fed3d0bd1265936da504027b220dd0

SHA256
839097d28f4ffe4b370c2b46b318f89b093f39489ab64a72427b785604437b19

SHA512
3bacd8e03c3a812420a989c4bee1d48705d0fd2636174adc5c780ffafe84ac86a9d6ee34935c510baa4ad1ef436eb09d4064254163af8e87a5ecaec1b94feabb

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
66fdff14601925568e5f15cb78e9768f

SHA1
5b3f5dafc2f8c5d23518a8e15a983b914c9e61bd

SHA256
1db4fc3d66119b34a8fa3874816e59ebf094a0148a8a6002cff719d5b3158fd0

SHA512
be53aea283ff5f6eda81e4ea0c7af42ba746640edbe37ea141ba0c038964cac724bc071ba4a91f5785ae826ca3dacfd655e31092c179ffbca1980bdf86a01900

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
7af58e74a98c0195fcef662cb3efc78e

SHA1
309e121a67fa88a87aa19a40e6dc5370bd4cef0c

SHA256
0459c6cd4d04858eb1f28166ba18a35627423c3de0b55c985c69d4b356bf778f

SHA512
5cd164abe3277f5e76e69b22373ab6f16c3c0e04600a313ed10f4cfa72476deb4a04692185778e5843779229a7fed4b9a7322699edda286cdc63b8790e5dfb3d

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
ca8ae9eec3522d9784be63a05ca32dfe

SHA1
9a5ba43453172bd60f9f2b6d302fddf9290a6c37

SHA256
c2e4367d07d61e6b7b0adf4b9d9c544c319c1d3bef4a6c1711bfc4258de39b67

SHA512
d259e22c8b5786e9843a900002d2881671ed4f379d36d6cf11c4907bec009cd72612339c1440737ccf8d67d260fdde5b2d5c325f53b65bdd00bea5573a5b304b

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
a4437815fa957b700c0ecfdb622f0e2f

SHA1
984b681ad4446628526b22d4e19629a0ec2e1435

SHA256
f81538eb41c4c929e8b554b4371a409285fff9836407f709af700c66f8ed7234

SHA512
2ede425391cdf90348aca5cb059fd31ec4121c8a3b9efe69840e7135e76bfb1dcd747723d37566bbdb96fc05644afe997551b0f9029d8504568b5809c63ec615

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
8cce4671199e0b2605040cddefb47818

SHA1
a0929bf904f0f151066316f69932b1a26619f6d2

SHA256
5de99a3b10971b8b0729b078928313d5f03ce58bdf5983824b8fe5bfa4256338

SHA512
61151d5722983e5161ab8fefeaa5e306cf345c15b7c5696c39361f9b6579b7aa10b1eda4cd3b8ec22e48d974e57240819f99969acc7f6124ad817eb7b9f4f384

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
e46513bbef77e52588d2cb538dcba223

SHA1
8f6e5c7bc88b5b202e24bba4f2030a115b05d52e

SHA256
abed84e5b712e1886ec3e94645f3880f96cad1d83d058a07cc0f819f24c8cd1e

SHA512
12eca2dbbe0ba8fc38316322a420388f343fedd7aa9afcec03234ebab7bd1b13606dc4d973d890abeb44118fe1d9dd9fb5810109d7670ace80ef4ab15973e1c0

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
b6c097756cd6de13dd332ef8f970c9d0

SHA1
38c56690e870b9e3df164ae4729d7b3ecefd56f1

SHA256
fb6d2afa2c0e55c7c3af2d6431e13b236e53e1fc7b58f777b70f7c37847c1592

SHA512
591a5e2d86a8b586a9a683462530c61feca96f6fb7f52f7eba8bf198f51968a8531a86af99a3f6c161150ae3fee6cfd546909f96e33f11f0bf4b6387e060f45e

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
a6c2e19a56a2818c15b5f57d92553ad9

SHA1
2d1502246b37813b0415090c1dca21fcc7779cc2

SHA256
adfb49f1479c81353239b63b073ca43f30eae2f03d40407726dbec6c68acc34b

SHA512
67071ebdadfe5eed485dfb41dfd30fba42243cb56ee57cbc8f764db22eacaf91612f40366181e2c9a424f0dfeac9ab140740c9811e5d96967db74f610a65f76a

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
d507f4891a7a29b6b43fdddfcd1ee23b

SHA1
e664c2a911dfa99750658df36b81de1a16f91f0d

SHA256
4dbbac5505e50b67f101decd16098d1f584375fb73d519165dc8bbdd9900e9d6

SHA512
5cef01dfe34972721c21a1ffd7aa131ecc871a317a1755dcf3e25687f691f8de446ab63680f2ded9834b43d89e5d71a66ae453ddd6f8a5536504575ae3622831

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
9c53a014ade3b4e85a4444c4f9bbeda5

SHA1
71ec13fcd330888a7aa2cdf13a2a9551f765630d

SHA256
860a60acda5b8cad0751fd7d7a82d72539dbec6886c0c53b05f6bb361b694785

SHA512
03d5c96f182e525ecf251a6d1f5791576f8d1a2f658809041495f31cc85e7f230e342fe890f79975f202b8ac29c88b4a2f138846fedde82a3602d1fae85ab646

Download Submit
memory/400-411-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/400-405-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/400-404-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/400-456-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/492-141-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/492-370-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/772-17-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/772-24-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/772-221-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/772-16-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/956-6-0x0000000000C30000-0x0000000000C97000-memory.dmp

Filesize
412KB

Download
memory/956-102-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/956-7-0x0000000000C30000-0x0000000000C97000-memory.dmp

Filesize
412KB

Download
memory/956-1-0x0000000000C30000-0x0000000000C97000-memory.dmp

Filesize
412KB

Download
memory/956-219-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/956-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/1764-474-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1864-469-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1864-465-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/2176-443-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/2176-435-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2176-486-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2340-487-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2548-478-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/2944-461-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/3004-470-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3140-114-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/3140-113-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/3140-120-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/3140-328-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/3420-483-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/3692-47-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3692-99-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3716-458-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Filesize
384KB

Download
memory/3716-448-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/4296-432-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/4296-481-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/4436-228-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/4436-229-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/4436-372-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/4436-220-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/4436-223-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/4612-132-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Filesize
384KB

Download
memory/4612-125-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/4612-124-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Filesize
384KB

Download
memory/4612-135-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Filesize
384KB

Download
memory/4612-138-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/4648-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/4648-140-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/4672-428-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4672-477-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4672-562-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4800-425-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/4800-473-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/5052-104-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/5052-101-0x0000000000800000-0x0000000000860000-memory.dmp

Filesize
384KB

Download
memory/5052-109-0x0000000000800000-0x0000000000860000-memory.dmp

Filesize
384KB

Download
memory/5052-297-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/5104-464-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/5104-416-0x00000000008D0000-0x0000000000937000-memory.dmp

Filesize
412KB

Download
memory/5104-468-0x00000000008D0000-0x0000000000937000-memory.dmp

Filesize
412KB

Download
memory/5104-415-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download