926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
Size

1.3MB
MD5

ccf9fbe9a76ebe5c976fbf6e055ee696
SHA1

3abc498e2b7356318aa6a738ff2885eab604c046
SHA256

926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c
SHA512

185cef7019f9e97ccc1775f2cb2b12540b9554e89ee2cc48c8e4a2b395f8dbd68f63a76af37d312e1c73176b5ee6f16197932efd284c6163c2e59d64995132ed
SSDEEP

24576:d4oTPkCgwCbae/Fk6OvgctX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:moTcwSFke4XvYMLprznyDSga9

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

Processes:

alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exemsdtc.exeOSE.EXEPerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exe

pid	process
1104	alg.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
2140	fxssvc.exe
1344	elevation_service.exe
5024	elevation_service.exe
3628	maintenanceservice.exe
2044	msdtc.exe
4276	OSE.EXE
3164	PerceptionSimulationService.exe
1244	perfhost.exe
4284	locator.exe
3112	SensorDataService.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 21 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exeelevation_service.exe926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\system32\locator.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8a7646b5b3e2edcd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\System32\msdtc.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Windows\system32\msiexec.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe

Drops file in Program Files directory 64 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exe926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

Processes:

msdtc.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exe926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe

description	ioc	process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

fxssvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exe

pid	process
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

668
668

pid	process
668
668

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exefxssvc.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	228	926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
Token: SeAuditPrivilege	2140	fxssvc.exe
Token: SeDebugPrivilege	3020	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1344	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe
"C:\Users\Admin\AppData\Local\Temp\926686165619f0d3af26ff0c8231fcee13bc94c0ecab726e2cb314099ac49c9c.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3952

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5024

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3628

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2044

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1244

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3816

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:3112

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:1776

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:4968

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:2484

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2884

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4804

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4144

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2364

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1348

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe

Filesize
2.2MB

MD5
0a4c926983f32c5200ba95ad20f8e4fa

SHA1
a1be0a54063ff35be9603680114239b9021e1659

SHA256
ee7a18c9e49c6b39af55f8ef807e5f0f1cfa4e81052878a978e5fa8d22cc8af0

SHA512
4bdd3509ec9acd313c34052cdcc11f14c7a4f29de41c9f686c9c02eb5f4b83ee7f39fec7f84a65090fbc548f60392ca3518e9adfc9f05937ec01967628ab1ffd

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
781KB

MD5
96bf7bc29d57884207899fffbb827760

SHA1
867d7aabef1f7528a9137d5f9faecf4073ef6968

SHA256
bf5f1a04f2b276dce00095bbe29044f525c238953e287bc6dea2f2227ac5cff3

SHA512
dccd1e793240efd913d1c6423604ac6007bc9f10037113b9f25ef4c7478ee3671217c7a8ddcd6592ba5e8845de81a169f83c1bcdb5ee8a10a1f0ba88b7bd78d9

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
405KB

MD5
89d432b0bbed4234354c85024c264e42

SHA1
1990ebcf31846ad681ac1201767f7e94e56883a5

SHA256
3e06cd0f2280e9490264139559dd43089032fbd739944271627f2a050bf0408e

SHA512
e91208d03ff88eef0e2315785a3ddd535ced7f7771ac29f605aa4d62d387344fea8334fd052911187f67e35e8cc9bf0fee05f403c1d7e3eabc02602a561af10a

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
448KB

MD5
d103d8c4e4b02b2bf11dc1399cd589a1

SHA1
84a01150405f831d3b0bd9ce05e6aeae2a685b95

SHA256
3682f464f527f3f642057b62c084836793fddf8ac14552c545bdc7d8718ff5eb

SHA512
583b76ed82a0f6f0d05640ae6374e354b3e4b9818f6fe88132140791f7e98e3917e40561755bceeb0ec9bb9eaee3cd4ca35279e78a7d9a05b49326fa4c3442cb

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
653KB

MD5
e07fe50bf1a61b7cac9e9ed53264113b

SHA1
f1fc72cf8bf6fbbdffcf01072665712599e6da5b

SHA256
8adf0d2a8a486a1cd59140c330d083809c84db611639bfac04cf3a3fe9fd9e3f

SHA512
60c400ab77c1a063f3e2b54b246b1bec216b0966baa9ac2e21e9d143b169c9c116ccd863a3af8ce7ebca21d4361052afd150dcb58196d08b6180a56d75d3d391

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
512KB

MD5
57dda5908df64e97ce2f37ef2d0cbd48

SHA1
c169a532d0f525b4ce6c2375bcd68922b0364a21

SHA256
3ef78383de0c2d84fd282ac3480c776f721a7711d7b02f72a247b7b0d90862c1

SHA512
86575be7343ef6f4993ffbc22f2040ed8cd1788609a8c3248e2c3262a87634302aa497c5041895d0ef33c06344654ef25e4760b12c0bc09c3186614bef141133

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
572KB

MD5
d33ccb5239aef56da12fb414ee602389

SHA1
5350ae21fecbbbc64bd1f966d7a0e42ebd075186

SHA256
ae2457d3a0dd521c9b0a50b492c9c604a0b9c6b0d7d2eb640a1deecc5a8ab3c0

SHA512
47624507262c86446ca87fd5fae74eb74644cda6b2a73a7041990f92a95f9ae8c4897afcd106f26d21f4311a62761472dad49671382ed338bb731608772c1a8a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
405KB

MD5
c2af6226feefc234180c0a1144cf91b9

SHA1
a5d5a890d47475535c37c021ccef19c4b1c5686f

SHA256
c9c47b1cce9f80234742bccbd7d3b861f8fde68ea953927ae9ecbf856b925eee

SHA512
93141a836c748051b4e10ba849b445ce2d907d5a015ff7ea426bb0b519ef7c70b1182156a3a8881d651e854d1d1ae82b5d276d95d64a2c64c7cdc0d7cfeb2141

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
466KB

MD5
b8dbb06a5ab16ee2990dab8ee3a4fee5

SHA1
a8ba442c7607b1947878fc11b7dd878085ef234f

SHA256
bb8e0accfcb82c635d500610097559601194203c6eca87a2480a2f1984662d4a

SHA512
b5927d75be90e4dff91e1cf930fd96c041e7cf38b03dea279c62b65a0d59e3a6d09718aabf230da15c3afeaaa019ef6a742eeea46f24b49922209a7fcd9e7573

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
491KB

MD5
9d25472be9179ef03c57ef725ea0ece2

SHA1
f2229608e4cdbac7eec21397a102932204342e07

SHA256
8fad87d1e6926b740ece97ab89e0711d0d9c8f5134abfdf9d19032a679c6ddd1

SHA512
56a36e172523920b12284596d79be08a19249cf27d8952736e34e0e727bfb5a5a0a1e924c6af0a2bc840f39f7f30c02cb6b29ff80eabac1d0a91e91d1203b579

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
574KB

MD5
cc8fbd291d9ab81601ff244dd646f5f9

SHA1
af2f4fb52b0cc47ae1ecb31c7a506923fbc709d4

SHA256
614ac1afd9103259c52d04038fe0985c8ad4727b5fd40af94abee75d0b2f8558

SHA512
6d708e0e71aaeb1a2810e910138435f9ed2b6c70fbf801cc56b7701b5ea31ecea41d3ed9ca60618736b7f6267880016b1a1324bb30efd6bd3f61e4dafb7ac093

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
458KB

MD5
ab39f018f9a9ae4cfc161f31ee78ae26

SHA1
53c6b4dd985034d69c269c4b8d87b483e1920020

SHA256
e30b7b38b5f731621d3c0e5f4c8c8f90dbdcff42fa8518527cfccffb869e9a20

SHA512
22f38f656e0ee857d8d00fbcdba9007fc664ddc48c9b0d4ab9335871974a59f50ff3fc16b8ca2ed782eb9bf83e09fababdeab0eb0a482b6a08952701205c7be7

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
2eb7a24dc49d1d56f34043b6205be1b9

SHA1
0fc59b6b03c58ab72930682988a75882e08a0ef8

SHA256
03d1172611c9a666c55bf79539a32734f63dec029a15499cc9f00a41b8ccfccf

SHA512
fb47532c57e815d0482b5beaaf20cf487737d60280c1eb6034466ca91c3cecec361c3db195239667d00f45ad032ef7e78456f1c7d30907dbf4a8c0aa8a8011bc

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
454KB

MD5
0dc28c3cb5c1b7dcf3f0c0093a6462c0

SHA1
5c4b2f2c8f8307e0095604316dd8cbe132eaa6dd

SHA256
212ca21bb089110f53deaf61e17b4cacea12135a85af6dbe86a894a01299a2d6

SHA512
e21550b9d2c4e5d02efab5cf7d1ca17be182b2a5e11e3cf02dae505bc954899dd5e6700d2cdc830a8fe24e999e329111751d75cd07f3d23a2621e127de517593

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
344KB

MD5
e36a22ef0e463d3e384376b37f7de43d

SHA1
f8699f9ff4e827cda1d7e36120cd76d312ec406d

SHA256
7d61cd7e3e0f942a024957e2656ce0b298f94ec660767d1d8ae0eb43cdaf2b51

SHA512
d3812d2f98803f35445b3985c063bf260537cb4edfff46e3afe663cd223fd64e5ed29dede3903453cc41206f037b055b4c1e276869815e76481e3edeb42ce039

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
317KB

MD5
9840550eaa91f42f2ce7bcd22cf80b77

SHA1
a8fb80e22ff235f7e68f77c4791e2873ba3faa01

SHA256
9253f85dc89b0f9d8fb2c2f1036686d247c9cc82c6c8bed04aa56b7c96e0d635

SHA512
5e44f2999462b8956dd9322c1c5ceaeb434cc191b636818996107dc1b0592db6a5831d9691ebf5359ca0f2350016dc7c6099f9c566f7d829521fecd938fefded

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
324KB

MD5
62b604b15cd2d87df45e1059aa5c269e

SHA1
d95feb971974f81196d84f34e4e2001674a09164

SHA256
6d951c1e0f419f02ea98ef333c07bd9307a6cb5ff7646830aa1bb5a9ee0a0137

SHA512
60abfcd530c971ddffeab7720b232a28c3c4f1cb76f004f02fce8e38a0f9eb6ab1f045fe9255f9e3f37e47db5a53f03d07d9b77b2b59c46b8c740034ef43e37e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
b82306b9a2a6dae5daf93847f14d43c1

SHA1
8b0472851522927ed0e8c08b6d6ad94a1854a180

SHA256
b4ffac68d01f67540d5dbf743848de6fc263f2e9248d66174d32e97e8e87e141

SHA512
1c5a57894ecf168bf412b29c9bebd2706175bc3d87aec32e1418f711b91cee6fe17db3455fd69d6ca6566810b772d7f6c709e78ca24800fd40e826cfe7953c82

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
538KB

MD5
36e50ab832d09b9b9943aade9c1f4f52

SHA1
f5b6b9b24a48c19784125bef0536182b36530292

SHA256
337479ee372fb755439d3bb1ad0da47e9e7c9ad2f697048607813e89d2904956

SHA512
9d4e3a71942b3a0ed189e178d3b9faf94ad6c014e5be738a97ba51fcf71e6ea63b0b53be310f28d07c43b4f61cd7406faa04f40fe4db8d97c78844e933a76246

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
326KB

MD5
2a2c95f4af6e4a983bb0ac5b54a62dec

SHA1
7215b9dd637db22efdb461329b22e4de8ab4c42c

SHA256
77519c3f8a5e172e1bb0a169bd4f22c084554d2f935ebbcd82f2652c2a20502c

SHA512
33a0bc7a3640393f0b0d32bbb1df8384279d716ab350617a41b82e13758fe55e7f194029e3a3a3385e1b03e44335f03c2fcafba51842a330a5ed48faf1ac0553

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
372KB

MD5
21cc9651e2bb0bd9b0e19cee09338ee0

SHA1
973176b0b463278d4b3c97b4f845b6d74db3236c

SHA256
5dcea9857a4f046679711ed2180d30a6ea4d6142cc0f40518acdf46d43d7f5c9

SHA512
ad3582f2e5f71efb77184aa4c5a74b6510e598506b9e33358e635b61af8d995bc567253b287bdfb34d8beee4a1230fb627f022c30ae8042b3c01186c3ca7a5e5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
320KB

MD5
bda58c877abc1106f63869ab4355e37b

SHA1
f368a5f29c79284dedcea530ccee4007b26457db

SHA256
2b081c096a3ff81308bc3fcea9d1a8aadba0bec2eb18596fa0a0968d96386f93

SHA512
823ed4168747e0144cb14d6f78b989232e775add28781fae7cfe1247ca1d08fecc94078793f6a36373d8188e8af2fe5dba61bfc7b0a2c1368bb5b2ee635b33df

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
419KB

MD5
592563539a388aead1850941e4b59181

SHA1
a1317df4ac5c641f226c1db49b3727ba2e6aaef7

SHA256
4976f0e95f7a5fcfd2b82a6fc995c9f44fb2272ef67d83809b1b04f2d0b83fca

SHA512
d6276329a7e798668c16e0fb4c33d49efe8f91fcf9b2e8f2df507af8f09d7b07b29916796acf32acace6ee2392c406c87782c36fd24b98ed74c7ddeb07dbd0dc

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
386KB

MD5
c26405c7f22a83b3fbde5cf2fe9f8455

SHA1
50895249e0fc821b9b636c6499c258b1a556e7ce

SHA256
485bc56f9e1339e70919b9f964999c8b93b14a65d05a481e9a09503e3f79534e

SHA512
fbc719b6024c2e35474f816cd63efd5d10e9dd75ff8102ea9b97c0b6b0609a2331dc62ea2736ef3814c1af3b5cac703aa33d12c212e45f14fc8687d13546e1cd

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
340KB

MD5
6eb8e08b9bcdb0b83f7f2dcc95adf254

SHA1
6fc59c67a212ecfc6459d4e23e47552af9b99e91

SHA256
5e2bc82176154a66815273f24e35bfe3b2027af8adc98e96f021f21309c48c12

SHA512
826bb552dfc5c93379344812093a6fbd4b7d6dac472e054a1de717ad79699de4f7fb89324c7ba8dbe071fa90f36409d2182042490580cc8791792c39432ed50e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
496KB

MD5
e10b79681ed02c518ec703fd48f5ac16

SHA1
7cdb0e4d2ed0fc52e08f14d0b2a84c4b42c9b701

SHA256
c17f48bdbd2ec160666a9d2375026068c7f6fb0b402c5cb5567122aee87d40b8

SHA512
da78697fa0cbe0f556f86ac82a9ad016e2093cc957a43707e939630500fc6df407e282fc1c8e986799fd1149fac347e4999c0a97654e39afb79ec51f6d5af517

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
448KB

MD5
6bf2eda78a6c756e63c44659ccf20a8c

SHA1
11edae3043edac3618c5411d753fcc09458ce722

SHA256
b0b7ab130ca3d09546cf36a849be8118c46638209778d865e81b762bf867f7da

SHA512
3fe934e24b23a3a1da382f1ed6fe632fee81d4e1c559c18e6f262653b577a374991e67edc1bb5bf77e6204beadbed5d9a83cacdd09ccac1a852d13b29bdcd811

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
384KB

MD5
a624121825f4d73f9f4570fcb5bf28fd

SHA1
fa8a90f0ace701f896cf0fbaa81a18c6bcf07387

SHA256
d8e49b95d1e423565f8dd18cef79018e864c0c88aa2561d987adc77905f5a708

SHA512
4079eed8ea9eb7c0b011e1df846f57c36bc3926ede5661aef0b69cc509dee64f9d45e7fbb14706e927be9fc24426bb141ac26682947b5e1563ced4fddcd3a5ac

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
438KB

MD5
a0c6c70a6f771285089447a8168ed82f

SHA1
e970a3d394b76c6068f825d55fe3576cc8c3d9da

SHA256
9746b868a6126b856ecd6f7e3e719b3567519f71d0ef7e63fb27592a9afc4a6f

SHA512
451f069cf2f172eb258e9f12c52343f978eba098e7383003b1bf5cd0d3b968bba80a8a8f3d437ec2be3172af38d20d71461dee42b6c42ecb3a9711bba10f8a2b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
581KB

MD5
00382854e611e69f4615ad06b49416a7

SHA1
1ba79f516c537c093ee69004bfed557d8fc095b4

SHA256
0f2765f40310ee142442669eb8960ca3767bc88be994b06dbcd4c2baa34ddede

SHA512
8c6f2f3c8ff438be2adbe814e506ffee2871846210f1bf2af78e9e3feb55b65c69277abc27a727f109f555b83f20e34c392485954203ca2198248915fc499a4e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
448KB

MD5
2dc32d5fb31e12b5507a45daf3ca0902

SHA1
fcaecf4f664203a03555388384ec6a9113ddcc99

SHA256
fa857382a9dce7ea1e2f9b29ba15583acda1f1cd0c6033a9612278f352f8e189

SHA512
6cc80e20facd5a93b0baccfb96b34fa69babc1b8903e4652a8e567476914568ec5d6067b64410b58b6ad2b657bf6bc1f76a27468b54d26e22e1566239634f6f7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
271KB

MD5
8cef965ffc0aab83db88c6b7ce7c36db

SHA1
d299101175ebc69f2445c169699283f53d7ce0f1

SHA256
d1dcf55e2c80ad928684727cdfc9dd30e7a300901032d8a1992019f916b669f6

SHA512
3057c308e78923d1022bc4c1be93738fb3a49aa0f2f29e553431e794b0c7f572fd89d48bd62fc56a0dd352fc855e8c604f71cb3368dd79851889bf59384765f5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
513KB

MD5
7834325dfe210ab492902b9f8d943b20

SHA1
0d7bcd49e041f56e34210d131e7c71f7ba2221ff

SHA256
24e43cd3912593107332d87b098cee2831474a069bd8b8ca6e07e2c58362acd2

SHA512
026ce9b330d1bd77c01d6cae5e8e5400e36d375373cb49e292a7bc33eeacb6dc61233b37004f0da14ca7b06d785c842c215083d148dfb60d2ab23ba17a82a70b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
374KB

MD5
979bba0f232eb9310667f6ade21f0ae9

SHA1
01003252d035150262b11965884d1f122d588b18

SHA256
377be68160a0bb7b74b8b33192d7b574fd0d4b8943d356677fe5e7f73bea310c

SHA512
e0e11ba3397a048ba9659b2ebd5af197ac827e5cf0ab29bb52926b602a92d53d8cc302006068e7d8ef691e3d1a349e6dd88891f229019523d57b7d83b8fd5a40

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
530KB

MD5
5effadd48c155cd32270f6a1ea58c701

SHA1
1356b23b7a9c93d84fdcdaee85ed555b679a1927

SHA256
68f930209e1c6408713c9b7168576f72143cc9f82163566e465e05f2db024859

SHA512
09dedb08086145e7fed9a80a426d635f2d97e7d0428bfbcbcb0a0b33626fc686173891fb4388b788921ea1c1302d2a74e84910e0852fd8dfb5ba0a91b54d56d6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
638KB

MD5
f3f59b9528026228001a320c7732bcdf

SHA1
c4ba2938cc6fe9cdbbadc91b01d140b42cb6b57c

SHA256
d5aaac1c87c8e6623680e129cb174579087190a73a5d997f6efd3dd70b42dec9

SHA512
f59d1c73b926547472a66fe8fc741d871325dccac73d231f7c31c4fe4e37961e70d49135aaccb6dc9ff447adf2e71150b8d3bb400761ade4047d4b99d392e4fd

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
418KB

MD5
6b745d00dd8f0252be90e2daa09c55ee

SHA1
b52db3af1950598f264fa22fd7f2b9d523f05245

SHA256
99357b1ac2f06eefd57f14ec463b47bdd2141df7e8cac35eb5193e9b2760fbbc

SHA512
4828ce1d47670f93447ec643fdddcb9be2dc0e96e9993f2446ac26b59270181d088102879c998993cdd5ccae01c6988bd44edac344d9d9c4aec26b220cee8ea3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

Filesize
323KB

MD5
20f8dbb9843983c47be76db4353ca40d

SHA1
a7312df863b02855334f506e2dcc8bd4ce5bfd9b

SHA256
81ab6a031935f1e510dcbfd4f29b80aa365a70933bd71aa843d2c8d3bbd1d3c3

SHA512
2ab011b91fea4e892d724f670efebf6debfd1ab57225a86f523036bc6bde40733464b3f06b91eee9c3b1b262cb3f22f9a8d788739ce0bac2fb1d9b68eb6eec2c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe

Filesize
469KB

MD5
3b8e9dc6edaf730774fd6288aaf1653a

SHA1
3f7cf687764cf3665098f9240799c18a15201a60

SHA256
b34ba55baa674350bf69c1db3a4d4894a105f6c6e2de43fcf23643bdabe43f70

SHA512
ada7e18b9cb3b66e59a852d55bf8d6470899084cfe40770b959e88d9c956188939869c91b80b8654c43805c68021f99e773c706851185d9ce6e61b68a5864da4

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
320KB

MD5
8323bbda6cdc4dfd163b4b02438e50a9

SHA1
51851eaca2e78db281ba6c1651a326eb651dfad1

SHA256
f43af24522cd2c40d805bd565d39c84178654645d8ddab5a25cf407e339bfefa

SHA512
7fe673972cb3327c2dbba97bba80b04c3f2e00502c680ad25fed0400ec218fc9f806c0bbe247f65ad380ec9b24feb8752ad789c059734733f7692650408ed463

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
346983f519850882800c534fd734bbc3

SHA1
ca0febacafdf3cb334067650d849197cb9003861

SHA256
5f1b411f7a8aa7c9741cbd85b554012687be3d0106c9c93ebd941b3b4d4b47fe

SHA512
ffbdef67a5ead4489458aedfb6f9f7a8c146f380a8710aca2b49e3f7c4ac76928f6bcc91de8ef5afa89b1983d610178f4a227e92ef33d2f93e9ea8f53559e529

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.0MB

MD5
06d6860d190260e3ecf85301b76422cb

SHA1
26d8d85c58ea312a54c6e8c213d46e060bcc67c5

SHA256
ed2bb58929fb95967668786dbaae01ddb5a9c0663530b94ef6f93a473962b1a1

SHA512
c3c5cbc78b1f61f9efb2dd9487277bcff2dc902ce84a2ff48375c740a06ef91a864d062408d185a8d31956737a9fd0a05feebe4e5b5c46ab2aa6de983348d01c

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
7d64dc22d15a95ca1bb4f02564e2bdf3

SHA1
db853c334d33965735551df5c7ca8a746b9d42df

SHA256
9c60b1e7ae80446084d07d6d8fac72df40aee0497235555ae379307defcf8cc6

SHA512
731b1f20179232c529c640772c8a6aead694683defe2832e9fc3ccdbf2faaea2af087b6ca62b50bd636ebe5727593948af0560564bfeeb1fa35cd0bd3bf9a946

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
bd5fd186eb39fb8599bd67459c635cd7

SHA1
a891e54212b6bb2ea03eba106ef78057b9ed5639

SHA256
214a0ab13f04244dbd56ccfbfab3428ae099d847f4bf4f3178acfc61861e3b30

SHA512
187acf955575ee8a1b0f1efd2b744e38e0e9981af1701bef4d676ab093ad6cd4f8e8740cfa9a145dbe444f5dddde8061a93a9878dbbea3fbb00fcc5460feb295

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
b504891a68d92aa73dbb15bbf8b970a3

SHA1
821046b3de8c5fab7ced7fb1b312bf7a7d8a24e1

SHA256
13bb3efa83d1d7600694ca11e77874ca9619bf4cac097f145cd7ea967bcfc0b5

SHA512
5453abba4a52c63af44033bd93ab7675f93c60760fe32378c4b4764b214ba8d3bcb9862a9ccc54ff317bbe8e83c2ea7d0e59278122175fbdc2833133abf62199

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
1119b641ff0304b0b4402c518b3bbcc5

SHA1
c50ed45f4b5da355e912c5f759d1573da9472f5a

SHA256
47e85828bb0518b887b292eae0b86501ac19a222fc0d96665aa98a7f78a41aee

SHA512
8e475fb7da396c7ff685a29bbe77880f01a93d6994d32f40b606d8eeaba146be7b7b411ec412845174dc9e5585c2526eaebb70a506bf0ad33ccc00331c4e850d

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
832KB

MD5
5aee65d0a0e3ac713793ef30eb0069b1

SHA1
cb19a478250c9f71ae86746db6467ebe8258100b

SHA256
58432331737bc1c7c904944ad2ef690930ced43c397be564323ff4387eca4826

SHA512
5727674a52abc3be50a62fb267a8cf75fce6e779e670e804f10c3434bd3af159259eea0a3cc8b2edac6b1662407b7c2a26590b3c401aed32acc490f2fe109e4e

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
0a278141d63d8be56de32ae3384995a6

SHA1
59922876c8f84b85ebf38dccb29d374c7a0ca968

SHA256
e350c090c37194b4b30bb169d791a71ed447ff83cbdb9d04f068e2feaa0bf441

SHA512
0da732517a67948e55241a6771dd81595bd9c17e4987fa697d8b6c73a556dadfae004d93dbbb2fe15df5ff09ef25a5eb522f711ff99e0298f29e7c2eb67392e1

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
584KB

MD5
da9c2204e145a5bdcd6d4f0c70df17b8

SHA1
8243e3f851a465a3f30e96b29d5b7fa29ebc6f74

SHA256
1bab8f06ec79685339a731626e2f74f473c73bea1ab2730f0822ac149fbc29e9

SHA512
51e65047c5fbd612dd56dca6b435e423fee3f2eae77eb46c554a529969cdd0b9366407d2d14dff2d0c3fc73e6396e2960d1f02e4ae9fb436d5204d11795fd0b3

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
14d8b59ce105264f7beff3fd8c377529

SHA1
f8b79e78bc5e4f968aa5a066bc06d0bb45ea8fa5

SHA256
4844c2e4e9d0c5f19ac0c0290b3880ddd41c356b054b0e7971617a82a46e1088

SHA512
fa820b18d72e0df353a1cc6c8db70c8423b39a43f2a84182df9daf994354f90d6d1ebd4fa2f97adaba35c87e1ae17b24d7f8c83588ec8f9667d7084c0369f6f2

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
3876e0f618d1f949db01103257a0f3e2

SHA1
7bedfef11074921c3f845cc9f5b4c5fe004ee24c

SHA256
f1db9c1452e873ab8f9d27b176048c2e560d9c47a767c9ac03dec4e00f7fd4c7

SHA512
8ef215c5819aee722c70911a90ad21ac5a5c463ce55ebdeb4a2a65d30c6ce6a28b006a80fc97c04d2e4396015fec4f82e6c4a7df50add904d402634027c307af

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
cc329b0e003d8fcdcb4a6dccd6cb6742

SHA1
1bcf0f11dc3703d5fba446b68c602932d577bfef

SHA256
9737a45542fae95ef58a4b870711e12f76fb6b22e92876936e3683097041c40e

SHA512
8ae38bba39848bf082a26fb842da5965ebc55bdc9385470d7096f6f100205818e37fda60cd8badb4180e919473cfe8526e4f59338d7d45a6944423f23307e365

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
565KB

MD5
1611eb8bb67d4db6508b7952b7be1815

SHA1
715783bf21ab220398109ce3a267dd064eb7ae39

SHA256
07d24e29df58937d3e45896dc6a85e7500039adb024b271134e3b62e5443b06c

SHA512
98a05e60392e45bd5a507221ff364ad2fbae99440778a146854e32f0c36d0c98e799943fe667203f88bd85d82951d9068aae2044fa22428595eaf944dc41b558

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
b02663f3d5aaff18223131078338aada

SHA1
ee1c3d1a94bc29628c0a53100e397ed5cb0ca719

SHA256
e0c242cf398aa7e0ce762967294c6cde4ddc1d553bf352235f5ec7e856e5b92f

SHA512
3de993229e2c89d5fb2ac3f4139590d9e2571540624fd45e777ecad6f9d2e2eabeb9b0555af84a3182c1779628b22e8cf6b282185df6857ea93313fa69078f05

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
ea258f1a8a2fe5c3a3f0623fdda093df

SHA1
f5c8f739e519a3a20b15eddfe202b07891212b1f

SHA256
7dd301abd6bab14952271c237b73032f3b7ad9428d8f822d6aea4857b6e6af6c

SHA512
9db379f63712721e3736c85fba5ef3663a0b80e59c1934d95d99620d9c8ce71cf4eb36d25e8b95ecc30b4b6beae8825f90f59734f27b986569d03444dde50e71

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
d4fd986418a35c7c8555a8e15f91a0d3

SHA1
84e3958929b61e8ed2e34a02730f96b26b8999ed

SHA256
5a234695a2bea106970cbe981c718eb97f8af819142ca32f114f934e061ce97b

SHA512
1eef0571dbc0682227ef192359528114a43d339551ca4ec3e768605fd85721b5f4f6a55826d4565f1e4e97f3b524ec56b9a56024fb86b804e0e23ea4d6955813

Download Submit
C:\Windows\System32\vds.exe

Filesize
640KB

MD5
69d40bb80fe0c9b6a472ecd914f5f9e8

SHA1
d4b3139671c07bd9a7ed6950adbb6644a311c6dd

SHA256
e5ae4bb027f30c3d38b768e3bd1dade47a869f3b9e21c8a1c8a837407844a460

SHA512
96070faf06292f623821d0745bce26e1c03760e2901644bef0511d1f2cfecf6d899cb98d0d25e403e7b5dcd1915c179fe32877fcb9b9adb046d9b30dbbc41fde

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
562KB

MD5
f3f0cfacfe7bb1134cbf920ff864a75f

SHA1
db03af3a4eb4f52136b9a308c2fff9f7851b8603

SHA256
f6d40a2adbd37ed73645540ba1555a3c008bf836333fec528860398e2d7485b1

SHA512
1e0a3f1e0fd8a78239dcc08a9de88e62bb125cd9f5f2c4408452eeaeae5d71b4ab2f917571f6970fc15b3882b979848976311300202fc910b7d8556b19e455e9

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
564KB

MD5
7823de56e0101a79fa38c372a50bece1

SHA1
ff547d01e62a171c550f5c6b8c90b9166bac8d5b

SHA256
ae4e9f4f1fabd52f04923f32bb622bd37f19ec99d158755a4661b02ed7999f36

SHA512
bf3ed137abdeb957b4ff1203001cb41d14924a8e461af010921e6bec6932338f966487c8d78b6372ffc69f5a5c466d3dc60c13a0cbd8401a4152f67fcfd363d2

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
e3cd40a17e65ab938b9b08380572d83e

SHA1
cdf88cf498659de35d26d283f5239427865b13e2

SHA256
d6087a502dc7a74abd0b7d9d5ea2d21d2c461f3af18e67137541e14bfa70005e

SHA512
095a4ade3d2d4aedd7ab314089aaa0e325cfa3527c7c9c1e687958495d5db45848df015a2db1cec7a8364319edbf6ac9bc00b95659ebb5dc5ff82041654aa59d

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
635KB

MD5
b9e385ee3761148d2a727fbb34938ada

SHA1
01ed12a31fb76e2c28dbc2952c83f8151d1f5932

SHA256
0d8e0c35cead7b5500caffdfef2fe3d61c5db15b668a0fcdb6fee4d293f05e03

SHA512
761644c727ebd4029fb3d33ba50d297b9a74c2661b67228078484d3e108d400e07ac0002fb5b03f94ccc25f89cfbec2f351e07dfa6241fdb45fc8845fc111260

Download Submit
C:\odt\office2016setup.exe

Filesize
571KB

MD5
cb6cdbd924b979c3dfdcbf5f528b65f8

SHA1
79841fcf71b603d50cdaa327a7b819ce44cc997c

SHA256
4ec02b2de3a4d513767594cac6d171b769c0b6673e4324d3c52198ae3e97444e

SHA512
82fbe4688e05c05449b8d5863d3a25a1dba9b2d023fc6f865d287a87e61f9e54532fd36dd4bab3e87961c718c4ce6cf1c0fb203e2c6148b797a4ed2900a06c17

Download Submit
memory/228-70-0x0000000030000000-0x000000003015D000-memory.dmp

Filesize
1.4MB

Download
memory/228-0-0x0000000030000000-0x000000003015D000-memory.dmp

Filesize
1.4MB

Download
memory/228-1-0x00000000009D0000-0x0000000000A37000-memory.dmp

Filesize
412KB

Download
memory/228-119-0x0000000030000000-0x000000003015D000-memory.dmp

Filesize
1.4MB

Download
memory/228-6-0x00000000009D0000-0x0000000000A37000-memory.dmp

Filesize
412KB

Download
memory/228-7-0x00000000009D0000-0x0000000000A37000-memory.dmp

Filesize
412KB

Download
memory/1104-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1104-111-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/1244-106-0x0000000000620000-0x0000000000687000-memory.dmp

Filesize
412KB

Download
memory/1244-101-0x0000000000620000-0x0000000000687000-memory.dmp

Filesize
412KB

Download
memory/1244-100-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/1244-259-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/1344-33-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1344-40-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Filesize
384KB

Download
memory/1344-34-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Filesize
384KB

Download
memory/1344-151-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1348-338-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1776-296-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/2044-242-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2044-71-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2112-322-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/2140-30-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2140-29-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2364-335-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/2408-329-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2484-311-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/3020-128-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3020-23-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/3020-25-0x0000000000670000-0x00000000006D0000-memory.dmp

Filesize
384KB

Download
memory/3020-16-0x0000000000670000-0x00000000006D0000-memory.dmp

Filesize
384KB

Download
memory/3112-342-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3112-292-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3164-258-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/3164-90-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/3164-96-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/3164-89-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/3628-55-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/3628-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/3628-56-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/3628-62-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/3628-67-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/4132-343-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4144-333-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4276-81-0x00000000008C0000-0x0000000000920000-memory.dmp

Filesize
384KB

Download
memory/4276-250-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4276-75-0x00000000008C0000-0x0000000000920000-memory.dmp

Filesize
384KB

Download
memory/4276-82-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4284-268-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4284-114-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4804-327-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4804-325-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4968-299-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/5024-44-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/5024-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/5024-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/5024-192-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download