4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
Size

1.8MB
MD5

2bafc7711f4c97afa89435949461a273
SHA1

f843ac0ffa51d5fe9f4e6fb5dcf047412e6d2039
SHA256

4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9
SHA512

b397871f9beb4b180a19b56706cf1a37def7027b7cd7a8dd91bedf1cbef6f837a831696529e3d6a5d9daa81b08320b30c3c69b2e09d075bcaa75c941d6c78ca4
SSDEEP

49152:aKJ0WR7AFPyyiSruXKpk3WFDL9zxnSggFIDRRAubt5M:aKlBAFPydSS6W6X9ln6Uf

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

Processes:

alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exemsdtc.exeOSE.EXEPerceptionSimulationService.exeperfhost.exe

pid	process
4992	alg.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
1560	fxssvc.exe
1592	elevation_service.exe
4588	elevation_service.exe
4312	maintenanceservice.exe
3344	msdtc.exe
2400	OSE.EXE
4224	PerceptionSimulationService.exe
3944	perfhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 21 IoCs

Processes:

4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exeDiagnosticsHub.StandardCollector.Service.exemsdtc.exeelevation_service.exe

description	ioc	process
File opened for modification	C:\Windows\system32\dllhost.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\200a3d32b3e2edcd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

Processes:

4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exeDiagnosticsHub.StandardCollector.Service.exe

description	ioc	process
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_kn.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_gu.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_de.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_sr.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_da.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_ro.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_sl.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_fr.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_ml.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_te.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdate.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_el.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_vi.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM1DC4.tmp\goopdateres_iw.dll	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exemsdtc.exeelevation_service.exe4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

fxssvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exe

pid	process
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe
2416	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

676
676

pid	process
676
676

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exefxssvc.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2332	4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
Token: SeAuditPrivilege	1560	fxssvc.exe
Token: SeDebugPrivilege	2416	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1592	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe
"C:\Users\Admin\AppData\Local\Temp\4c386cb1e3d6f0fbbceac694f9658f2efdbd2ef751175042ae349b71ba75b2a9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2340

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1532

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2228

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:1124

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:1340

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:4840

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:2216

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4816

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2464

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:4540

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2004

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:3076

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4856

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:4348

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
PID:528

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
2⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
Filesize
2.2MB

MD5
b641b1d10a026071218f96f70bb3882a

SHA1
4b6b48d633a0851bc4a0765ce1cbf3ff0bdb86df

SHA256
6c0de91bff4e1349a78015f80b2e8a9b67fdc2c0c08afabf5e8f3decdc8a3181

SHA512
e2e1ea165d446d04f4fe995e36bc01fe811206f2cb863dc1d1987afbdda134563fd1c58eafab6cfa0ef80ad286c28536ca0241485aa281261d6f89454ac2e7d8

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Filesize
1.6MB

MD5
0b669c5b6a500c84d294488018f43d5e

SHA1
806a7ee8c7784ab5aaf8a486905453a701b14aca

SHA256
7870fe0058a66b4edad57d0ef85d09c517ed55dbf2601bfa4243993bc5f879cc

SHA512
e5e4b3eb69335b9e4eb64628b5fb614ffaa4174e271c21c0d571ad6fc09626d063b60d6bd53d28b1918e543c22e2be97aacb798d9f1b3b9a52d5f3bfe3bbab1a

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
1.4MB

MD5
21b18e6a7d19054fffa4b533661ea864

SHA1
112f6bfda8ad6bdd572aa6e99e882e71edcdb46a

SHA256
ff504a24834b9bc85549995213e021c8ba79934a87677c9b26f4c4b44e156709

SHA512
cde3ac30938af67d7923e2336c27228a01212d1256c6247cbb29b2c04d1d4e2272870ced34ff1c898f60233c2315708651903c921e38aec1978125ebe2d1034f

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
1.5MB

MD5
bf215f037b615a86a2e265f14211ba51

SHA1
a968dea5a6d71c5535d93d09d9731db808ca647c

SHA256
06e5ed0c58a4af6f8f968c7a066df8772714fe9eb8819f1803a9e823a01261a2

SHA512
26a99c43a8c29f0c018664a859f58946b39a0e07ef6c65a8b49d2a90b606256746c8bdcd24f00db413a07e219d25c10f58452e6f3280f8ce8bd3cab3f62f130e

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
1.2MB

MD5
303238e3e7d336473e2597458933ba02

SHA1
1a9f930356872e4b3485bb88fc1befdc09bba122

SHA256
48f7c10434d2fb8d9e2060b8d70bf5277923945589b9ec47eb9b9f7329b6d19e

SHA512
35e53eae196c7635141663c2469cdd10a1063fb7951da7f607ed338ccbd204ab1b70fea7bd0fdb722e3ba3aa3e689c210fd38180ebb1caeba04f8c9caef80c31

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
1.4MB

MD5
4615ff7a12945032c75fc31fcb14d7e5

SHA1
556b0f5be5b7c542ce2ebcfd4db39ce3f656e3e8

SHA256
54630551d24ef758ca2d7e6642844a092faac57c1e8884ace78e566555f59cd5

SHA512
2ecd6d261e04c74b2e9775065ba3838d2a5176c332a6d33de7f7ea95e2a2551b484bc9b666699263219987f79b478d231a04153549fa415e0b2e23396c04f278

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Filesize
1.7MB

MD5
75b5bc0bf808afddefd09e8705f4872a

SHA1
35497d177fb2941d902dbd00071f4240b9e73c21

SHA256
d8050ec1b0704f3056ec4f84011608ffe1b56cc9aa4551f7d0a190407e177c23

SHA512
30ba225d9b735a77de9bb3d3f4191995610f1b8dc015323f79a46b7939702b1149a126681e067b9f6481e8680bb419868aa2a2a5c7404bc3e05e46d1530e91c6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Filesize
1.9MB

MD5
6fa81fe05b9a014ba1d315d1360d5d45

SHA1
8f1015358c08813925030703fac171ccb01771df

SHA256
6f82a80d9776b06d1c985692a948db0b946c28b681f52ee996b980bb45846a3b

SHA512
59a8b16221f712c731f6382135bf85df211ee4d003a4c1832a4f35e4e7d7a77a6c8126c3230254a5b815e66d2cde909429669fa44d3beeb350ce5a7930530579

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Filesize
1.8MB

MD5
5f599cfc22be0b887a5fab9874436986

SHA1
fb7f9a09261702fda853b0221aa1153be6282b68

SHA256
e2daa95aa86943b60fb1ea0fe51788cacdf883227528b673b44491355683afe8

SHA512
c7fc58b2d3d014391e13320b76c90d83764e58954a6ad0afc77c46b953f1e61e37158844927063540b5ec36341def32a3646430b79126c83037f911377c209f6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Filesize
1.9MB

MD5
534e37133ea87bc6ac5ce294cb5488bc

SHA1
3ba01ed2a8692a895cd3529973dc12c7667ad818

SHA256
7db106b191e05c6490c377460c3646486fea70425c10b949d71724770dfeb4fa

SHA512
3343a3c6f72d091f3e5782ac48bf7557b26ece5c4b2df9b69a042347142a0c21bf9f2b0832fdb49ac1264766128a90cc45104b2b89fe6d5c31f0127cd41846e0

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Filesize
1.4MB

MD5
bf062a2de68271a605d5c7cf387ad6fc

SHA1
ed83215d99214eb200efb0e0a09ea79957bd90ec

SHA256
b30b130a680f54c4584d6c6d2dc0942ee755ffa2008697613e56ec8edaa80e36

SHA512
016be70b3688612cad72cf343ff926ee6655fff652e2eafb6753c18d93ab0ccfd66d82d681d811b150f9ab942608b3daaf0002f73eb6d6086c1e2713cf053ff2

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Filesize
1.1MB

MD5
e02fa6978f0a222db64c29df361dacab

SHA1
2230d8bbd5b558f0c510986847c4c287f54f2019

SHA256
a157db5c0abcae8af2b3c461084cb6e17dc2c2d4bb6dae7abccf270ab604d93c

SHA512
56f40e604121de17d039076e875d9ae5489fc17448d24893906b613ae2eeb63d065270d650f5550490d9df07f6f52563cde97f6a1bd1505037d77f99fd5c9925

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Filesize
1.7MB

MD5
c46bfc9d4d2e9743d97430bc7241a42c

SHA1
589c97ae0338dcfddf2c0a2957438925763f6945

SHA256
7d32a743d870fc0369d942bd9a6e57eff201f33a3b4b06c4b49fc099051f36e3

SHA512
307b1d8adddd6f41f34494ed98ee194ed21a697f407432232eb298000469e1c6fa05a61c7b18c030f23fbc8efc7fc45d48cfe3baeb5a787c00e9a5845da89696

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Filesize
1.5MB

MD5
1dac02331563061d015601fa47e3f9a9

SHA1
43af7f3f20ab5caa4ad14026034113778e380ae4

SHA256
6e7698f95f358ff9db63121b58ad7e53c77b1bd9e38160eeb7f7f100d47bf50f

SHA512
95d28e3e6ba55c426acdf9cce17254e0289217cdc1939357145a3b4b451a3275128453b29d07b7d5f03989dd291891841304486026a28f7aad514ab7f26a615d

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Filesize
1.9MB

MD5
0a1651090ad384561a37f87132d09865

SHA1
814cd95c5877fdfef4773d22d06b89435fe01b6c

SHA256
40afeb307eef39eebe5435d201d6725e1b69549877aa066df65262f920fd31a2

SHA512
10aff54e6e46d2384fc7378ae0bc570c3a094896e5e79c2efdb15abe64b53b6b7444709a7403dde87e5535e22ed659467a5e401376a3f50941a7b1f3da9171d8

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Filesize
2.1MB

MD5
b1a3b512b2301dfa6448726ec0ad7ed7

SHA1
d9cfde6b9d3c8fc17576b1e96b34efa6983f6228

SHA256
9025ff82161ece597f535d0014d57395458b0fa8aeed16f424557727cdc2745b

SHA512
8b669801dc3536f8538220a5bd2dca3515f34b977fbe6498a98e9abb585758ec4db0c42ff759eaf38343ad90ba2f665ed5104d1b856e5c76c8ebc65e88cf1b51

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Filesize
1.8MB

MD5
eb54e8ea6610d0c4d666a7f9a60fdc4d

SHA1
56b3a9c9b088aa843f068735e44909efe55d59b6

SHA256
707005b28c2c92e76e3c82c8683a92f5322d8eea53088162634a94abfd9dc34d

SHA512
17555127e629cbeab151ab8119c67214c4675134f7ef4bbbc4b384be4bb568baea8ca8626cc79de040a327de4f8000ec04af08ef7d587924508da3882c8e274e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Filesize
2.1MB

MD5
64b2b605284c672d18a238c13f0e67c9

SHA1
a7da36b291340f4a6a33cd03a3987e2d4ec9e4d9

SHA256
3a1cdbff70a6407b3ce1c39b8f961ddfe68e6a39446497f2cd8001cc7ab8f11a

SHA512
3362e3e4ee3ac7d4c75d47287598fcefbac609aa275c3051c49180e47df45e06088fb80555d6da10967b4815a89288c411c349baf69b4176de85c2273c80a28e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Filesize
1.7MB

MD5
59d8ff3fb6227ff44ffe640182f238e5

SHA1
702a1987f6b718bfc9460d72bc7170ab38b5f4e4

SHA256
3741ab9f47cf4411f87479c860aae6b607e06e9891cbef45cfd46e16ec554c93

SHA512
ddf30a28f5757a975a0d0aa50e6d89291b56d552016e0d0517bd55631f70921c56aeb071cd1738c2e1f6a6be632d934118992f299a46f0e4ad93eb05187e6ee8

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Filesize
1.5MB

MD5
565fea02c4566a3a9a8a958d42f7f316

SHA1
149fe4459bc52a7023932af36f73be35e6213e6e

SHA256
11444f2923012c61f394e80a604e8023a8a2e8122063efeee02e5de0895527c6

SHA512
7155907149c873b30f6c0adc98a751718d5e6308b47580e96db99323f35edf64c4f7299680c619cb4d9f80313c39b3cd8ef1a849cc9790f4cd34e7b326c5d08a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Filesize
1.4MB

MD5
c033be73109186ecbc874c275aa22816

SHA1
2280f4e2a49d4d1dd536b4569b40ebe215433ca7

SHA256
e1f2acbb045d3146a35ee80143368c80e0c89978e3aa2672599b1ac6e0490c18

SHA512
6a925ba2801e77dcb25637054fbcddccfd332a9133f5fb46e52fda7f4c6295355793eca270427d06aa82f3978e40398008b303c0b289da3e0877cf941a15d50d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Filesize
1.4MB

MD5
ffbed33ab4a619335b4f3affa5db9cc6

SHA1
fe50a3b30951d63f295707f71e076463aadace10

SHA256
45c8d35a14715a54a35a28f98cc8bd0fbfe057b2350c2106680d33fca068d3fb

SHA512
0b12abe439dc4a9646d3d4f69e5bf768d12d811ef7ddd3689b5c0ee942389dd80b9aa2fd61119d615eff5f3074cde08904f02c23d5aef20bfe6abc9a33b0ffa0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Filesize
1.1MB

MD5
990f5453d5f10433baff433c731753a0

SHA1
7ef18407f6e7a11fb2724ca5d287c295fc0a79fc

SHA256
0ea99a34a3538363ea9bc32c60d3f0ffe118129dd88734205737806d2f54a4a2

SHA512
13a5c1553cb284a530207b72ccd8066a2cb7e1530c62071aeafd66e8ba57ae31e1be655b01f4ef048b8b36c3fd43c0aecb804931fc5e2e35f38f05c8b4ff9a72

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Filesize
1.4MB

MD5
245797463d43adae0adb521facba9e2a

SHA1
8d17206881affd879c5749d01e4b3bbbfb6e2966

SHA256
7ae19dcdc46d49a6b0fb48943ab99b4ebc535453e324afce56e2906b061df144

SHA512
1947a86ea77c9fa7649bc0b6aec3045d38e3c173a1840446934bb8ad0bf26c3920e9a392f2fb1c6717b84e7dff7a14e1e21edf034b94e5cbb216ddf7ab088a05

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe
Filesize
1.1MB

MD5
e8250cd0db0e2bbac5a9dc0dcb7a111a

SHA1
28c0cb9e0bce976d8ebde01faf9aeb8cc71e789f

SHA256
31ea9f06ca81fd171b854fb56d365b9c2c2356d789356fde87129a7b1a1003bd

SHA512
8473625c43b8495a4e9ddf408637a91c081cae5c6669dd87a8bd25466c1b09fe6502c6128c03d077c9524822dcaf34d291c9412d968df2d64095cfceb7ed8e13

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Filesize
1.4MB

MD5
3e643415cf61e57c5725ec10e83d2d0a

SHA1
277a21cdbd722993baed816c06bc41b526ef6786

SHA256
17d5f31d7c3d4a7e6dda2bbe3a9af85c5ffb8a13fa8517747f0f8a63d962932e

SHA512
8487114ab2378bda20f30e82aa8060ce08c0dba84d0ea24aed771c73919afbf9697aedf8f1e39fed48fdc1d4e39e0797f7bf53d1dbf161b5e03d65c5842d6578

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Filesize
1.4MB

MD5
d5afc854495320b7520aaaf44534f9af

SHA1
979adcb37e6a5836b21032b479db6f919d683c45

SHA256
9a5f7dc0f6c08d265a512fca4be49a8458c2ea16de28cbee1d36a2f41de1ca26

SHA512
9e2d7fd159bdf5d4c2990e772b38b26f04071728fb8db405d9777aa20ec23db0e0e506db888d167a3d68fa9aad71e406d15f9c1a8722909e1eed43110689237f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe
Filesize
1.7MB

MD5
cfb45d6d2d60d6cde2c639c306e31952

SHA1
28a9b1c40532b636c75773281691620f65178cc2

SHA256
3b824d057b19dbee4c9968e4a995b294716f5467ec111cc0e833bb402518084b

SHA512
c8dc1b7c1775f780460f1c61514ea48c47aa87b3b9a2b143ebe5e7e8ca1c240bbde93f3ea4f50b111ff3b73e31edbb7e0ba5ea393bf2b498bcf753ea9fc1892e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe
Filesize
1.4MB

MD5
77bd27466bbac6704f820035bf0ffd75

SHA1
cc9d459379653c7da6b205b7c0f414d878c59993

SHA256
ddd197886e390a1ac113ebbaeec64544085e012b6d1bccf22505fc08dc55d267

SHA512
9e579926632fb611a31005881233c9b16b10c36ced593b2965daa1c5bbe2cf4aa2ce9858c7f249e2bd5179f6d4c94004f14bcca93ad5d8cb05006b52887d2d35

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Filesize
1.4MB

MD5
b4b90587073928eb5f5b5ef873f68970

SHA1
8611dd767b5f8a01c1196faa3426380328a1b9ea

SHA256
2f7e24319ec850f79913acbbf58899bf427b3ae94c52b579e1e145292852a429

SHA512
6bcb068af1fc71affe9c017fd0f01a03181e435f6c08a6b870353217569cdc0b279ffdb46e8c540e89fe9f1a9260c6cb891a62f86d9665931fb25519ffff89e3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Filesize
1.6MB

MD5
dad792212787b3056062fa34cdbfed5f

SHA1
d0b3e36329e9d0cd0bb463764890a99e14fde25c

SHA256
30cb96832db590e44062e63f91e6d08a1c82f2cbc4db2b73924f0545f10a723f

SHA512
ea93390266defc89e140e5ba4d120364233b0b0acf58c0adfb5c16258f0ce07ceb7056623b27f0b257239e63a9d1b5a4c0574fc404713d8d7236825bbe9ad51a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe
Filesize
1.4MB

MD5
c9ab3d32b4520ed6b3df8ee15ed2f5fb

SHA1
f2da0777526d79ddb1bf3253a6ae6d62817527df

SHA256
fcbcdf193b51df6edf11f108b9a973f39673c15417b37b3b3a8089d208935a08

SHA512
99e7a79db325d33cdaa13519fe45a2ae0a09305ad4994937489fd5657f5d4839601e790c1293cede4f2f826d2c34117697a774739bab99a1636c44661c90357e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe
Filesize
1.4MB

MD5
5e761134ab596f43120f9a5b2cb60e93

SHA1
1aa5a591fc1d4f4e00a39baaba55984713770420

SHA256
8bd3151a91e993651ecfea0caf8988085bc40ac58cc2376805e8da8ba82471e8

SHA512
49ee33fb3c1690cd4adf6473e413ae38d5b8a1a976964672bfce9f4741a8eca99b5fc2255b2c33ce0c1844518f7fc598bc8c432983679ff14920aa0d671b07c7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Filesize
1.5MB

MD5
44cd806a09892d53268a72d3b2a39b96

SHA1
3bfca8183d4b68ad9d24b194b9b4b250e8f78d8d

SHA256
b73d97cd8ac3e6b2a882212b4af92547d1b26740cbfe86c8765a0dc081c40872

SHA512
4bdddc714e8058d3ab35194cdceca4e39132affdf54edbb26624ff9e1120bd9d39eb0f097d5c31c2481d77e68d7d586235ccbc23c131082e900b25209ff6b223

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Filesize
1.7MB

MD5
801c3e4e571db063811a823e2793cab4

SHA1
7e4e80f0192044994ba511aa2f20c700b02d6a07

SHA256
ea5ea080ed28fabf73bca9b9034b799f5320a26db2961ac56e6e935ac4ebc05e

SHA512
e719ea38b6c706aed27cc56bc1a3bba9f1aacdcadb1ce28f10a5f8d56ff578082515c89f49c407a83f9f10e70ed7c23b98104a2f80c193a726b0c62c65e30797

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Filesize
1.6MB

MD5
e33dfb64451e18de1875f508948d6f9d

SHA1
e7267e5d904c203eda17b42dc74e86fa7ecc3331

SHA256
dfb463ae60592057411fda04ea44de8b5978e74588e86073c8825042df0c73e8

SHA512
4d1be7189ecdd7c88d111bf5c88c8cb60148a6822717e7ce6743350383226056f129d1f38a1fddb3fba0280e8a9ae512744ce945a8808d457ae38e7dabf986ac

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Filesize
1.4MB

MD5
a8ef15a26004833173e6032cea4915f3

SHA1
1819a1d7748124d1a7a719051c57e158fa5d93c7

SHA256
e844682cfc5013f1b2c5f96570fc03f85e016a0f2aae26f478e062da816b3901

SHA512
7feba496b9cb3bea43c7ecae864d7d5e528ef15c154ebe56d4170d56402793630a79f084550c45e8b526113445e265dfadf5a2727080df53313ca57fbd654d5d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Filesize
1.4MB

MD5
a55c20e85dc1bdf558d4a29a67483b7a

SHA1
fb0cf0bb110e5eca0722609df06f3742567c5cab

SHA256
a1a51a370fafc2650c996c914d20a046c309026116de09607e90905d43bd83c1

SHA512
a70580c925a24bd8b7912563083e997860263b982e95027a213ea1d279acf32b08626496e3c23c7b5996fa97c414afc6b89d955172083054c321dc9beeba620f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Filesize
1.4MB

MD5
afe3b8a23c0ce429433128b984e34fa3

SHA1
3ff7293ef7f7f8a47e6ea64c10aeca54ff742621

SHA256
099cde397e6b00f33b58c9a85e7021594b2d9310939768c7c64b8c13cdd2c103

SHA512
8da1e0f16015d65cd9a9ee80bfcca9a93081fc6628231d10ac35fdd0005dfec3755f7edadbce5ce537e2b6e655a661f1adc8b9f712af617b54202a9000e9014d

Download Submit
C:\Program Files\dotnet\dotnet.exe
Filesize
1.6MB

MD5
43c009ed25df9603c6426d424cb05790

SHA1
c15ce9f406a3c575fc5dd53d3ba7dfffb330184e

SHA256
36cc6658ca77626cce678ce40dae6d9ab9b89cabae45093965a5865ab1ae83ef

SHA512
5143da5e37783a6a6e7220d8af16be6a46c4428d309500b546ea157f1b31c1c454968f0727b9d730dba3cd9cafc4d3c89a116aa8fe4b4c002fb4f300f5b0715d

Download Submit
C:\Windows\SysWOW64\perfhost.exe
Filesize
1.4MB

MD5
51584937d2e7b53dbeb48920badbe714

SHA1
f9da686e529154ec8d9668784a96da864c71da3a

SHA256
a1f3e71bbfb736057c6a9141c9cd4dedc0639540a78b626ff1409a3044c1a9e3

SHA512
8da22831c5abc089eff20dddf5ab86cfb4f6fffd0f9173f479956c8663b853a841ca9c6726393636ff19e06b0761a8836be375baeaff0abaffeb4b4289a83488

Download Submit
C:\Windows\System32\AgentService.exe
Filesize
1.7MB

MD5
4ab462c63637f85b4f81095ff81b22d5

SHA1
488b8e8c0cfbace0b8fb326bada89303777368b8

SHA256
0dc72068de0f261e25b416d01d2b54c72df4669f5f76eae005b27eacf4cff176

SHA512
9f01224c507e0432fca2910f13ae5f7ad8e32d21e1c634230a59dbcad63addb81414e64ccac094c2d1d75133f1c63d7291044de5be3bb40a4bbbbdcd92ad9d9d

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Filesize
1.5MB

MD5
4e6537817fa54853ac20e30be34551a2

SHA1
d5e5c0bca48afee74dd04ee1a7b20d0a768eb165

SHA256
9ecf0bdd4d8ec90b9141bb8508fbc45b1c795989b68f946852b117175ea901f7

SHA512
7a7e13ed031a09d0cd37b64ff826e40332c00cfed9dbf458c893981439f35b7e23e55e06847c56982a9a978b4b9187e549d3ac49ba6c3e03f0a2d2447ba66716

Download Submit
C:\Windows\System32\FXSSVC.exe
Filesize
1.2MB

MD5
c6da2c540d6bec9a2fba70bbb933552a

SHA1
beca7df30edcd0c47604b97995aa6bded66085c2

SHA256
e290b57dd57da471d857635ad3d6be757497e91c2dd67bc4fd313b36676649c8

SHA512
576f56a524fad57eb568111b035b748d2c913d0f87454f414e29991156f492d6c294bcb367b753ee65661cf792ae3d120d295effa40218f7abc12b711f5b9125

Download Submit
C:\Windows\System32\Locator.exe
Filesize
1.4MB

MD5
fc0b22ff0be2131e709a9cc96bd33cc5

SHA1
5067685c43128e7d50b6583713ad324331e1827c

SHA256
00d4b46da1032c5c61d1f1cdabe7c146c2f4b0e1331b4fb2d979441764857bc6

SHA512
b79ea63aef608216046981ad44219dc4a1316996d3769534ca5235e7a2ac86e4d6353cc227b16f63c09b7427e570969268b75bf7d89d6970a5ab455115da3ce6

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe
Filesize
1.8MB

MD5
75e16cba7bb8827b2b6a3d4e2ac11262

SHA1
66fd9a33fba08f5aa968ff91a25b80f5f2dafc45

SHA256
2f0c3c5f437b4e09034bba45f8fbdd52ffcf94b09e78fe4e0db8a2926c450fb3

SHA512
91c12dfde056586717120b00eab84bf6fb3aab1e0ba9c504fb81e5c84055fe465071bdae4df8072e726c2dd63d809edaf4b2d8f5dcca38480736e9249fc055da

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Filesize
1.5MB

MD5
3cd44497f1ba6f18794c5435e4ae9af1

SHA1
ec015baf62e204234c9a72c8a1a4192b18672c7e

SHA256
82718541ed356a491ca76943235aa9cc74fea26280e12e4c1bb7e5bdb767dd19

SHA512
a88971f847c00e3bf51fdbe5647c2269beb679e2afa1c63f6643313e076a20de17c05b562204ea7191b5aa46f865fa0c85c32d2c53b3ab14a5a2cfc87bb24478

Download Submit
C:\Windows\System32\SearchIndexer.exe
Filesize
1.4MB

MD5
556b848c5d49b55a7015b283247aca73

SHA1
0d6d8f4f0bb2543f4ac7957230946538953d043b

SHA256
d19f4f76cd0a7a2f13e475a9a30e21046ac2743a2a343355b5045f8172c014b3

SHA512
4debf9e85bed8c92c7cac648558f08e9653f1562c3de703e66e056f27689f2326940b5c7ab93faa96aeac7e5cf54dd959677202ebe8e89dad47a1e771a4a9adf

Download Submit
C:\Windows\System32\SensorDataService.exe
Filesize
1.8MB

MD5
0900a7d02496d5067545ec53ae42abf8

SHA1
15e13dfb1662b98b4e2ec68724b24fd1f68211f3

SHA256
95491b0bce76f69a932045b2e49a2e2383667d55f56a90bfda90f26c3f052270

SHA512
f9099dc4aedb30a00ced4113452d5941bc5fe7fa7a062fe5e9410f4b4126e3b38f86b28a733a02ba305c3aacf3fc76dabeaa0a04ab45581dd64bc9031c2acc30

Download Submit
C:\Windows\System32\Spectrum.exe
Filesize
1.4MB

MD5
a0e634cd91b168026da1df8486b3f8f0

SHA1
ea93087cfa4886fc0718f73ce4f84a7c7cf935f2

SHA256
fb338a7a6ada1fe42040b3e61e583b633a3b01e758082581ce08b95f6a1e002d

SHA512
8f2ec5bdbd35788b478b3c3e9cf95c59c5592ef679076a145a44a4f3b83a49672e0fe14a676d9ddf39b4c8a03b32a695271b29ec1f9e73ed163adb893e1e4d95

Download Submit
C:\Windows\System32\TieringEngineService.exe
Filesize
1.7MB

MD5
d92a7866549c841787640331f632787c

SHA1
d887021761b8a0ed3bde66cb4c170bd72bd27160

SHA256
114b498cee950b70ee55bdf14e8c72f6974eadd1d9f8d6e32f73ba64ce641f8b

SHA512
24b0f77b5d44296a082f8a90bb40e8f7eeb6529eb46968e4d0cdf963b1383b58cd13b5657599d21e7a6af41fb12f705db7b38e3f6868ca0b323158d395f917af

Download Submit
C:\Windows\System32\VSSVC.exe
Filesize
2.0MB

MD5
db9631cce84c063eaadb51e1f4aac03c

SHA1
f0fa1b6e486d61e781cd1faed51a6cc1ecd1a2f0

SHA256
a7ebccfa0a08d25549aa7cc983db3105f2820ec671835bb2444656613ac1b2b3

SHA512
43ec4dbccfee0a304701a11bbeaa984296da92911a7c4b5aad4b7a179c13e1c375b724e8906946a7142e83c41db7dbb8bf8f5c75c9f6146c11311c5f680d84b8

Download Submit
C:\Windows\System32\alg.exe
Filesize
1.5MB

MD5
96d343a2e12ac32776d2f73aed81d891

SHA1
a6b88a8d98a5b47a510a71c8d5ff9352ce815439

SHA256
4daa1fe9eb6039db4dcb40e262dc0793ad76e8b6222bf7b501082b97423572bb

SHA512
15e3ad56d4366b65c773e3646adf6a3682079937ff7d2c944c8a06b87090f6d732f4a61857570dfa85f0680fb7ca88471733e420067461b3e667aeb1fb62b7ae

Download Submit
C:\Windows\System32\msdtc.exe
Filesize
1.6MB

MD5
3c7fae1aace2b6933dcbcc9466180b65

SHA1
44b48b5ed1e56c57de6db182c5f42686f1d2b384

SHA256
d0b61e45765fff4852ba984f563191ce2f106896daff87c7dbb2fb8dddb1c204

SHA512
3a61f80ee7021d20dc698ad482e79fce0df675037d6e7649fb9b1b80965a42ee0b19af03e669a4700cc0d55a3eb666eb4236ce60c2957bab97d99078390dd52e

Download Submit
C:\Windows\System32\snmptrap.exe
Filesize
1.4MB

MD5
12f9149b58d055660f1771da8dfb904d

SHA1
2c1047274942861e86c009e3d62ad280c988f838

SHA256
06c8421409ecdd88d3e676eab5821b0f09952605523aec6f40102c0baccbde2b

SHA512
3f1cda7ee5f8a6f1cbcc76b6c1ce6aa03cef34c3807cbcbe18eafeb989b2de83ee2d82bb3bf2ff29b5e1ce97ec257ba48fa4ef82f37e73b1db20d9bef3059720

Download Submit
C:\Windows\System32\vds.exe
Filesize
1.3MB

MD5
0e3fdef216ec6ba0c7aca3278bf17e5f

SHA1
1ed2b8378d2e41fd633a5d65b7e616809b73c19a

SHA256
fc2616a0cb30c4346cfee8ec960bfd3bd20f7b553d960fc4b0d367cb7e0eb348

SHA512
adccf4b191ab71672fc7cd8a52a0e8c72bcf37fb7e4418a4a9a03f16267b5d9fc94870268d73167277a6bb1b98d8712b04b9e507597f5af1823048c64ce42db2

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe
Filesize
1.6MB

MD5
4804369e29dde3329339acccbcecda1d

SHA1
122a0394592db9d4fa91421f7a320b300e70d9be

SHA256
db457041e349631a6b4d2a4f1bc3929aacd5418b6fb55691f1a433ae500bf3d8

SHA512
1f49925e8eb433fd5304632fcf7f49306e9e1485677d608051dd3f337a1340d37b3970d5adf9b67833555b04339958dc7d7fa93c1086e0d03b36d2bec6dd571c

Download Submit
C:\Windows\System32\wbengine.exe
Filesize
2.1MB

MD5
26dc9934e1cc5a74ec677ee2d68ee446

SHA1
2bb8e3db65acaffefebadd092c5c908c46ac9150

SHA256
ad16113a1e83440cb4207ca9808864a6f1963c5e6c1c483a770c1e2a1a9d00f6

SHA512
7a26a5d554fd5cb92b0efae4d1b8bf7a2c27c045e9eb1883d338e5c0fbc610f831c731761670ea252d49f2c251a118d0f0a7509b0e9b44ec7aac0b1994001d3c

Download Submit
C:\Windows\system32\AppVClient.exe
Filesize
1.3MB

MD5
9ce206845e966df45ffccf6c25888535

SHA1
d13437a7d61bd8e7fc54da2665fad3672efc2d38

SHA256
53196a6d0d9232ec31f4e294a703ed4c16ce774960d51d5ebc33892c69125dc0

SHA512
a891f00ce97c64521750be98c42ed20da8ae9dc7857678562785d081bcc5856ddb96ad7384e36f739ee24a221c675dda8c33fcb4d99b2fe4f64cf4423371e285

Download Submit
C:\Windows\system32\msiexec.exe
Filesize
1.5MB

MD5
86dbd9a7bbd28791d481fc6e55e7dd2e

SHA1
fd76f1bccb7041cc8f224357a66883e5ab82774b

SHA256
096a89d4fcefc06ce8630925db33153f533b62c57f4e9e904970562cdd123a71

SHA512
bdc5d4bf9211c755e47ffa00d7b3143ef63941485a8678cd9936458f05eb17e451be6b5d97e4f665cb4773961293c861b20dc5eb8d6367d846cec60c40dfac84

Download Submit
C:\odt\office2016setup.exe
Filesize
1.6MB

MD5
727fc0096d505e5ab560eef967ffd11c

SHA1
3d5bd5bae659ea0bb0771fe1c023b83d95b265af

SHA256
053f87fb6347b36d3c21c64f05043516837ba71cc276d72c9b5163b8bdeb2b7b

SHA512
4bd2ae6c8a64c10e28ee0b73f474642e7bc081c96b183538a10e54bb3cc2538cf34881a2a9b098aae05fe908ec9845840cca5305d1d4be91fa769710aa057b81

Download Submit
memory/1124-424-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1124-550-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1124-477-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1340-428-0x0000000140000000-0x0000000140176000-memory.dmp

Filesize
1.5MB

Download
memory/1340-552-0x0000000140000000-0x0000000140176000-memory.dmp

Filesize
1.5MB

Download
memory/1560-48-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1560-28-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1592-100-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1592-107-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/1592-352-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1592-101-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/2004-465-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2216-443-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2228-421-0x0000000140000000-0x0000000140175000-memory.dmp

Filesize
1.5MB

Download
memory/2228-472-0x0000000140000000-0x0000000140175000-memory.dmp

Filesize
1.5MB

Download
memory/2332-6-0x0000000002490000-0x00000000024F7000-memory.dmp

Filesize
412KB

Download
memory/2332-7-0x0000000002490000-0x00000000024F7000-memory.dmp

Filesize
412KB

Download
memory/2332-234-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2332-1-0x0000000002490000-0x00000000024F7000-memory.dmp

Filesize
412KB

Download
memory/2332-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2400-217-0x0000000000700000-0x0000000000760000-memory.dmp

Filesize
384KB

Download
memory/2400-211-0x0000000000700000-0x0000000000760000-memory.dmp

Filesize
384KB

Download
memory/2400-219-0x0000000140000000-0x00000001401AF000-memory.dmp

Filesize
1.7MB

Download
memory/2400-387-0x0000000140000000-0x00000001401AF000-memory.dmp

Filesize
1.7MB

Download
memory/2416-24-0x0000000140000000-0x0000000140189000-memory.dmp

Filesize
1.5MB

Download
memory/2416-16-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/2416-22-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/2464-457-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/2464-459-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3000-454-0x0000000140000000-0x00000001401C2000-memory.dmp

Filesize
1.8MB

Download
memory/3076-469-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3344-386-0x0000000140000000-0x0000000140199000-memory.dmp

Filesize
1.6MB

Download
memory/3344-137-0x0000000140000000-0x0000000140199000-memory.dmp

Filesize
1.6MB

Download
memory/3944-468-0x0000000000400000-0x0000000000577000-memory.dmp

Filesize
1.5MB

Download
memory/3944-412-0x0000000000840000-0x00000000008A7000-memory.dmp

Filesize
412KB

Download
memory/3944-411-0x0000000000400000-0x0000000000577000-memory.dmp

Filesize
1.5MB

Download
memory/4224-400-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/4224-407-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Filesize
384KB

Download
memory/4224-401-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Filesize
384KB

Download
memory/4224-464-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/4312-134-0x0000000140000000-0x00000001401AA000-memory.dmp

Filesize
1.7MB

Download
memory/4312-128-0x0000000140000000-0x00000001401AA000-memory.dmp

Filesize
1.7MB

Download
memory/4312-129-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Filesize
384KB

Download
memory/4312-132-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Filesize
384KB

Download
memory/4312-122-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Filesize
384KB

Download
memory/4348-479-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4540-461-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4588-119-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/4588-117-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/4588-366-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/4588-111-0x0000000000990000-0x00000000009F0000-memory.dmp

Filesize
384KB

Download
memory/4840-431-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4840-553-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4856-473-0x0000000140000000-0x00000001401A6000-memory.dmp

Filesize
1.6MB

Download
memory/4992-294-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/4992-12-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download