agenttesla | 17e830b83777a992e960ef8c25d2df1c22f52dcd393d99a2307ad2c2377f2db8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ_PO_BQG7983972_ORDER_DETAILS.scr
Size

3.4MB
MD5

af498abc4ddaa9750675a9a60038b973
SHA1

e67ad73234839334ed89f8615e5786739a0a340d
SHA256

17e830b83777a992e960ef8c25d2df1c22f52dcd393d99a2307ad2c2377f2db8
SHA512

a27f0fcb79cc3d195c381d25bce1c4544c4f961e41dc59c2e54e4eef1fb6b13db82d9a6a67b6d049d40b5127b773b072ba49c8e093d6828b1b22364b116b13e9
SSDEEP

98304:7trbTA1dfGgdxRj86BjvE0uroNpuTRdyf7p:hc1d+gdxlVTED6uTryfN

Score

10^/10

agenttesla redline foz credential_access discovery execution infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
s82.gocheapweb.com
Port:
587
Username:
[email protected]
Password:
london@1759

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
s82.gocheapweb.com
Port:
587
Username:
[email protected]
Password:
london@1759
Email To:
[email protected]

Extracted

Family

redline

Botnet

FOZ

212.162.149.53:2049

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000002341e-75.dat	family_redline
behavioral2/memory/5096-89-0x0000000000DA0000-0x0000000000DF2000-memory.dmp	family_redline

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2272	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	server_BTC.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk	server_BTC.exe

Executes dropped EXE 11 IoCs

pid	Process
4864	alg.exe
4660	DiagnosticsHub.StandardCollector.Service.exe
4468	server_BTC.exe
1916	neworigin.exe
5096	build.exe
3664	elevation_service.exe
4972	fxssvc.exe
1320	elevation_service.exe
808	maintenanceservice.exe
452	OSE.EXE
4192	TrojanAIbot.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.ipify.org
23	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/968-2-0x0000000004300000-0x0000000004700000-memory.dmp	autoit_exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a29b8b422dbdc151.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	svchost.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	svchost.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	svchost.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	svchost.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	svchost.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 968 set thread context of 4084	968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr	82

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{4896B57A-BA2E-425E-ACC6-3260D1FD1C27}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1392	968	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrojanAIbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RFQ_PO_BQG7983972_ORDER_DETAILS.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server_BTC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neworigin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3408	timeout.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3592	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4192	TrojanAIbot.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1916	neworigin.exe
1916	neworigin.exe
2272	powershell.exe
2272	powershell.exe
5096	build.exe
5096	build.exe
5096	build.exe
5096	build.exe
5096	build.exe
4660	DiagnosticsHub.StandardCollector.Service.exe
4660	DiagnosticsHub.StandardCollector.Service.exe
4660	DiagnosticsHub.StandardCollector.Service.exe
4660	DiagnosticsHub.StandardCollector.Service.exe
4660	DiagnosticsHub.StandardCollector.Service.exe
4660	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4084	svchost.exe
Token: SeDebugPrivilege	1916	neworigin.exe
Token: SeAuditPrivilege	4972	fxssvc.exe
Token: SeDebugPrivilege	4468	server_BTC.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	4192	TrojanAIbot.exe
Token: SeDebugPrivilege	5096	build.exe
Token: SeDebugPrivilege	4864	alg.exe
Token: SeDebugPrivilege	4864	alg.exe
Token: SeDebugPrivilege	4864	alg.exe
Token: SeDebugPrivilege	4660	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr
968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr
968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1916	neworigin.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4084	968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr	82
PID 968 wrote to memory of 4084	968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr	82
PID 968 wrote to memory of 4084	968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr	82
PID 968 wrote to memory of 4084	968	RFQ_PO_BQG7983972_ORDER_DETAILS.scr	82
PID 4084 wrote to memory of 4468	4084	svchost.exe	88
PID 4084 wrote to memory of 4468	4084	svchost.exe	88
PID 4084 wrote to memory of 4468	4084	svchost.exe	88
PID 4084 wrote to memory of 1916	4084	svchost.exe	89
PID 4084 wrote to memory of 1916	4084	svchost.exe	89
PID 4084 wrote to memory of 1916	4084	svchost.exe	89
PID 4084 wrote to memory of 5096	4084	svchost.exe	91
PID 4084 wrote to memory of 5096	4084	svchost.exe	91
PID 4084 wrote to memory of 5096	4084	svchost.exe	91
PID 4468 wrote to memory of 2272	4468	server_BTC.exe	98
PID 4468 wrote to memory of 2272	4468	server_BTC.exe	98
PID 4468 wrote to memory of 2272	4468	server_BTC.exe	98
PID 4468 wrote to memory of 3592	4468	server_BTC.exe	99
PID 4468 wrote to memory of 3592	4468	server_BTC.exe	99
PID 4468 wrote to memory of 3592	4468	server_BTC.exe	99
PID 4468 wrote to memory of 4192	4468	server_BTC.exe	102
PID 4468 wrote to memory of 4192	4468	server_BTC.exe	102
PID 4468 wrote to memory of 4192	4468	server_BTC.exe	102
PID 4468 wrote to memory of 4032	4468	server_BTC.exe	103
PID 4468 wrote to memory of 4032	4468	server_BTC.exe	103
PID 4468 wrote to memory of 4032	4468	server_BTC.exe	103
PID 4032 wrote to memory of 3408	4032	cmd.exe	105
PID 4032 wrote to memory of 3408	4032	cmd.exe	105
PID 4032 wrote to memory of 3408	4032	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\RFQ_PO_BQG7983972_ORDER_DETAILS.scr
"C:\Users\Admin\AppData\Local\Temp\RFQ_PO_BQG7983972_ORDER_DETAILS.scr" /S
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ_PO_BQG7983972_ORDER_DETAILS.scr" /S
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Users\Admin\AppData\Local\Temp\server_BTC.exe
    "C:\Users\Admin\AppData\Local\Temp\server_BTC.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2272
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 13:23 /du 23:59 /sc daily /ri 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3592
  - - C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe
      "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of AdjustPrivilegeToken
      PID:4192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6FA2.tmp.cmd""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 6
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3408
- - C:\Users\Admin\AppData\Local\Temp\neworigin.exe
    "C:\Users\Admin\AppData\Local\Temp\neworigin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 732
  2⤵
  - Program crash
  PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 968 -ip 968
1⤵
PID:100

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1284

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1320

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:808

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
fbc0906dbaaf7ec3c1d2065fd0181b89

SHA1
aa1a904b89de2a70f980ce2321787d8a1fd94f39

SHA256
1980aaae239f138d5229c96967e8bb74b0f530304fb6db91fc201426c319313b

SHA512
521d9cd61b9ffb733d772695b51828acba127b38e038fab5f8b7dc221f8a43d2d70c3959e59e4354494c1fa892c02830ed6fe109c90919722fffea9be431985f

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.3MB

MD5
e4d2efdf46dae4c8b3cbd4325f55e87e

SHA1
80e577b6ccc53ac4320c1e44bb0a1e8f0a691b33

SHA256
ec5628969169e9ac823f7f2343815c6234c728492b54727248d9ed823295d388

SHA512
b67646aece5abb0c63752054bf65b7f46bd5dbd87c8d0e156e06de3716138e14a515eaab4a21ef7af16929858c46680aef5c721554f6a256ebd0d19ebb3bc4a4

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.6MB

MD5
c3cd39cc5dded1a1e3f7e71744875ea3

SHA1
af63ab46d7a35eed0771a17fa4280b993346aef8

SHA256
88ae04fa38100d20242e69f25595f771f438e938d6b642af711389e7c9bdc463

SHA512
496f4b975b9571371996f6945ac467e6f9e4664c7344b4945213194b6e5665a61f396727ada6cf3214d4f624d24e1badecaee77802a26eecb1bc9fdf62663af5

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
c122573da5a1c8097042dc02babc82f1

SHA1
853e4a9c662edc57b21f5fa53af82ab7dd98e87d

SHA256
9b41a71b96b9d38f3ed32aa8bb541ef5be8815b25cbb22c5a6a4d3ccf561f82c

SHA512
b3fe55f64d6a632515d17b24f4f9c5430b76522b2a696ec8cdfc7b01da905a9d78c1cbeaea09fc79392ff31a48f57aa88a59ba2d2f1854f3062ae2d062badaa4

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
e68fb42614d7c98af119b598b6482480

SHA1
83105bf66f638f47e6fb0100173652927a4de7ca

SHA256
a4b28a7abe9190216269f2cad14a4ed70559e241462b63f1bd7a782286386a8f

SHA512
305377502098f341f695e5877ef63e865fd8ec7f33e4ed325b011e48265a52d9d6f30e7209aa2b360d842e8b4c71e972b5911d10e2c21e1e5d431eabdc1d78a7

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.1MB

MD5
776d3dab9db45aff8cd3380550278b29

SHA1
093b86f0dfa9b6d60c1c4a042af62d1c1e876f7e

SHA256
0c9bf415379964fd4357e3b3c974a66353f26764995135e31f332eddb3ee0f27

SHA512
826f0fcb8e260303600c00e31d8c8766bdd7787f9533d4ec4388d3f777bbdff75283f307526ecd67ba85e5262a849589101167d0054c0c4b4d353af5c3d89dca

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.3MB

MD5
8b45f796f9877f3c7c21be380505e058

SHA1
b71d2ebdb8ccb3b9671c8aec2688be10316e80c3

SHA256
4a3b90dbd0283b2274e0c6b4cacc23fe8fe26da80e3d6b947f0df5ba600cb584

SHA512
4180d2dbc7149743510355f5d4929cf1df62183d58f6c4b77c9c1827eac57374035bda5f95406148666d7bd58ed2d8be5d9a9c20041868528e2f1542364fea00

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
b159c5dc82b326e282dca8487e42e24c

SHA1
fce9d74a1800c55f00313189731705352b86a7ba

SHA256
add03ce892999b448306395797c0a53ffffc74b6125a3e1de1baf4aff3735de4

SHA512
c7732f35d25505423766089d7111b5544ac49d16f1b6e813a12b8d27f411357652a0b9adae94b2dc1498080196402f4468d42dff37e0ccf56d1ee86c8916e0e7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.4MB

MD5
d468ee0fba7463c6e47e7c40e17bc6a6

SHA1
b3380ae41a15bf8c9a14598a92aa1ccc30c57486

SHA256
9c508bffae2d4a9aac4c6169d377a1a9a60ef948f69b937555d0b9fa622b6153

SHA512
867792d2a7d9129212b95217cc8c16de6c3fee05b07ec3922bc1bfad3e32f120e12fc98d579f673c9cada86edd08807ac75baf77b1d3b8741ca01f30c9f14286

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
b1599c015a61b254df013af02c90d3b8

SHA1
3201eb0f1aded70b041a06a316ac2267837d915a

SHA256
40afb35dfb51abc73e73c5123817c7f3f87629dee51a0e9befd30764352334fd

SHA512
efd8d3e7a381c080e0d0a8b62b087f073d86ee838c9dbca6c773bdc8842ef486bc234356754b124848066fd32870bfc78c228c78f7586b8718e19a2a43f88341

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
1b4fe45f08c956dd606c4573cc2ff9ad

SHA1
1a817cd0ee7b0e3b9d6a2a1400156b0aea741b9e

SHA256
5638c15cca189e24289c1b379a02fa031310bf5d33e4b44e3d303ec1b6d0a34a

SHA512
9d88966cf9830eda9108bae10b5e4da382dfab5a2548a2dd46548893984027519af7b7c98d5392d3f40cd0e07b6ed7347ec313ea1aa04cb7ed9614865556d14d

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
09e55d971ec53f1e59810cbb5456e456

SHA1
621a36e70d6cad2e796e65d94a7dc772df1fba9a

SHA256
86b54bf8e500d4e32518413cf121d40519e484f96403a2be3da8427d0428836e

SHA512
63907a65a2de9c8098479ac5521bb69c7254ac53d0addaaf4d3adb5041124dcf2f6f757aa849f6a3d3bc4f56753f89722267236bd4c9fa407b32681da99a32d4

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.3MB

MD5
596043ec87ad6d9e92dfeeb5fbfd3309

SHA1
fb2274c07c138c39bcf4069cb5c5e57b7e593e78

SHA256
1150a8694433065e0d78b3c8de16874bad782321395e619d3acdd3e6de172de8

SHA512
addd0e3b37e89638c160013cd783de33cc0b541b6d5f9f45e2586ff4c5c25d658ac5d321a7b5c386a011b34a233c7bedbd73cf073767ce12cd6233a05bb926ff

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.2MB

MD5
6063ac75e1ffe31ff8c3a9b7055777a7

SHA1
bfa7b592ab3d1ad3c89b54abf2a6dd5a0803b86a

SHA256
9b6383aa50fd407a8e285afc99ed92a6d95b12210b245f72ae747d9402f78ee5

SHA512
9f3641c32c6dbdcc7ce4df2492cbe6cad89a80700edf8e028242e41887d26cb51b02e4802404e4c3fd735ac74a506a2ef24f8bf9374f62f83abd32d5d0e1de06

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

Filesize
4.6MB

MD5
40c098b5e56c8ad8d099930c58003c92

SHA1
2593b780e62ece91885628b661569f839257d21b

SHA256
34e08d385676b71c99d1df30ff5d33662adfabbd71c6cd68c0b213ac6b87a7e4

SHA512
cb22e1783149fb5e2851948ce33cd838275f2ed6a9200636052471cc456c81e2101d38837244e91c52e4e9e183139040048ee04b812987ef589822d7c52c2aa6

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

Filesize
4.6MB

MD5
06872abb0499b519da0db55dee04e58e

SHA1
af1d010ef23a9c60bedc633727a1c3311ec10b51

SHA256
96f71170267b7dec4e23de855f2653a0e7a931f573fe59edeb6d48de321caa52

SHA512
2f1a24c293d6eae1cd79a3286fb449de4e9c1a337ea6c2d82bc2fd9e2d56ac1cf7ceb4cdb1cca6113225ffe4374241a37a6784c569f2a896f1014255682e0f55

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

Filesize
1.9MB

MD5
7a4f77d74970b10131a19190a01977e9

SHA1
e1c402b686958fddb043ac18a91f74ce32789b73

SHA256
59e5674c9ad47fec6eeb9ab605d69dd51695e811a044d2ac07afa93922d0aaae

SHA512
e98f7da4ce065432c422a54e867b58d24431147552a55644626a6dfed482a76d8d76e7293f63dd9c5406f015f229cec41817c8e06172c70b6899e25f0efa4b4c

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.1MB

MD5
ba948672f4764cd7c836d74c7bdb4696

SHA1
9ebcee0716bd93a8f1a16538a14f24794c1756b8

SHA256
9959e3386a233156bf3430df8601947891b4f1101da5a4ba10fc1f84cc0f43b6

SHA512
2e5c025a6805dfac3439513b90610e918b471eb123f337a408371c730b32a40c2d0e7875256f452107d4d65bcb041317af25fcd77d22992f8dc8939bce4f3197

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

Filesize
1.8MB

MD5
941e45a75ef1a0c00f1882c912eb286d

SHA1
445536b0190fbd9aa849f249d60fd2ec92b142c6

SHA256
479c5a17c091f23666222ddb4d2dcaf6724e002a3d8da39d5864f5caa7364c3b

SHA512
8adc7ea04a95a067f186c3664127dad394d546a04985e655e324b17f953d624b868a3e03be6ff9f5084462fe5680ea17e660a735a597de1556d3c985376491f9

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.6MB

MD5
632ca0770b5a31e149858c540afb9ce7

SHA1
a289b8aa3ed1fa5600d9632b03705eea02b2a463

SHA256
0dcec8557707ae1cabd57d544ffb4a29a7deb9c57802f659aac184e97c3fed50

SHA512
6c9f2831ea15698c839984ec701ada9e3c1fa69916ecbe1d6f5dc13f7a48f5a174b1150b6c1fa9f3c6c9b8f77694a0132970b3dd65a61d999b839a3d15b8b6d7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
1.1MB

MD5
e05f6d55e88ef02e8fa8ae9d6319db2b

SHA1
e2f845465f0fb3cd99e16730392e0bc9841d3404

SHA256
48f2b7cb685eac2ca8668ef60f930fcf36661040122186f11c44b757c042b1ea

SHA512
9e770778542e4e6abf13714f46c9899a48631687cdbe5d140fc1698051dd3df041736320a44aa6a68d62c84ff0cf9707caeda1a753dc9b9433399d9014d5e027

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
1.1MB

MD5
d5011141072c6875aacfafe266860535

SHA1
c033c50cb938cfe859286d6f7400ff1b0d0f9147

SHA256
41ac4942f06496b0945e8c51e20c9ca01bfa96800133bf9a964edaf069fe1bf5

SHA512
7d755ea3393f1d4e895aee932c3584ccd4441094b3dcf8fddcfe541912a4f4f7b7a933528c11c450b15254fb32106c6bd30464f677d8b9c579a26af634886443

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
1.1MB

MD5
46df88b27a3cc527a60203fb68b7ad9b

SHA1
8a09b889ca3efeecb69337d7d82522cdfc160d85

SHA256
606ee543a5f8d32dbf1e0339f6fc40f89a13d98992a93008fa9ce6f5e84788d7

SHA512
dded2ef7d7c1bf1d4768d982a1935791aca99c5c3ac9f1ade81a58a2fac812424055d0b904541ae0dd8bf4deddde15174b8071fcd713aa67f7130b122aa1d845

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
1.1MB

MD5
ef3ef4587debacc4f3180e45c57d0cbd

SHA1
2192e984bd40a9f2b4820139774cd6f992eb37e3

SHA256
aad67b52b25c5e6d6d3eecd67e00ed99d177cbf43f0ed17c1f4cf3c15a81fa98

SHA512
807e61396043d6e7eeee7060d24253945bc102c56ce69e3a68008c86ee163dbc249f455fd400df90aa8a41c0c0c12d64c6ea872238436ec6f357e043a6d86970

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
1.1MB

MD5
0459ca3d8c9bcb049ae2247a44b08f7e

SHA1
e704d940b26f3d436bb0fb4f71a4b8e4c245806b

SHA256
940d13ce09f228e2aa5e38a5cfc99ea53bdea92037032402f83731557ed10f1a

SHA512
38494818a18f65a2f7cf8d8942c6be1eeba8691f6cae1fcb4284199eba9c3ee7a751982f2b6d8efb91d119539f92bee1d08b07981e3b050f5858a2ccc0d90b1f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
1.1MB

MD5
d08e95b412c5bf5b097ff4b916905b93

SHA1
150af62881cf959102a6dc2d489eb0df25a3ef86

SHA256
30c237b6d946587f6be3b892aadc48111f581d0105a5112cc8b0dd305972948b

SHA512
f9c2fc0bfe6e8de98217013ce026e311d44da3ab3e66737d4090c2173a30e29dc7ec01ace80a1c5727ea828009778c6844251bf0370f63b60264ecfde4749754

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
1.1MB

MD5
5531f23ccf5b985f3cc0bb65596eedc2

SHA1
e16f7c2c28688afc6c0b5537bddbbe54037177ca

SHA256
9ea757b15e6293c0e295173b1eda4ab70ecaa17b6c3c4412f160a7801b366d03

SHA512
197a66e9d419799c4518febe7cc0ca41c84b5be16ceee658294d9485a80655a33150ecee2198086c80f84a0332d6e0c355599f3c9d39f568441dd607cc627f27

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
1.3MB

MD5
bf86c24d924bc3ee0e887b683db91616

SHA1
4d9abdc2d46225e971ab1cbc38268077e6b72387

SHA256
f60448b4c313041423c6486c113a0fd25e5431fa430a8c0d93d06318cc9211b0

SHA512
052873a82f6be8d3322c9eb2b9bd886c69239616267169083e63dcbedf7e7ea49de2d3d3b1ed7a214378b4168e5c14b919b7b062e3157946f165d3c2a3e5dc26

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
1.1MB

MD5
c463921be69c078cca4429cdffe44725

SHA1
6b5adc9e7674070aafaf51472eaa2d8a35dbc8a5

SHA256
102d7f049dcd85932d53c079d3599a77ba4c94938329d91a21035b6ad557de67

SHA512
583d6d2e0c99b7df01057260213fe4dc1c51932c8cb3ac51d3cbb9f376a2a3910b71e7f5d47e13121573449f36440b158afe2f5ea338a5b0adeffc9b221d3299

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
1.1MB

MD5
e00f24283838d45a2166d8b1e4728f56

SHA1
99a92e2212d2e659a7ebba421290436a9297e642

SHA256
8efea565007c718c54d37deba99fabc020907637c24e7262c69ee13371febf02

SHA512
2c80a090c2d8a861b66d0c85f932c60454d434dcaf473d1f03376ba654102a15043676464ba4159128da6ffed48c216c3801361f460f71b75f03eec45482aad0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
1.2MB

MD5
6b0ff25a1aab195bf40a2c16bb51a1b9

SHA1
d7dccd1d8a369be8833ce7019dede084e290b107

SHA256
aa3e88efafca014e26fcd4473ccde9c4634af0cd6c0df7a748f22b83a319e822

SHA512
e91839da1dc7b7f338dde969979469a49d4d02729dc740d07a7af860f7e7550bc77251711d4c343d128bc8787c34347d1b8ae3c38d3ab37332fb136caac6cdcb

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
1.1MB

MD5
11c49041f89e4a3b5c00094b14293343

SHA1
8fd3822076eb5b55d96ff35db984a039953cb4ef

SHA256
fc74ac5855d70ed1e44d3313329e5a548009013356dacd740157da8d13718ea2

SHA512
c1c37baa63ac5891720dc5abb47d46c81473be2b4f7f722ca30ad684171d54fcbe280dfba62e707f4ab803f8fcc1e149a0ba7011da1083c55970a0c02ba2d729

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
1.1MB

MD5
1fc4b02d16b76ede4ed125a579c25cd4

SHA1
c71f58ce1a93d85b6a6b39f8074a8ea11df07d09

SHA256
57a69c4169f113bd647d30c2fe78da32b53cdf40b8b2e73a0885208aade2db12

SHA512
b0e0212f3f00227cd380108c6f19dc313fe9bd67effd7f7f06ba8b25b857c9b10c35a29db847fee5c2f1beffd553a26cf066b253948301c3f3f1f099597eb955

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
1.2MB

MD5
85728b734fa4363b7ba8d35c177cf6f2

SHA1
d328a4625f394610c7cd9e1824ae0658309fdfdf

SHA256
10445a4b74dea19fbe1882755677f006872c0a4b850aae01db43041e4866d46d

SHA512
3d857a41f95672fab2f562964d9ca1769ccdd9d376844343b79bf04d6c72fa006d0d7786e134f53b5a397a2bf5c2eaa913b4e900884585fbe5d3e274781eb925

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
1.3MB

MD5
43a3d205a4cdabb894fba9ceff3e2634

SHA1
a2fed776373b0bece695b4a127c1cca080fc662a

SHA256
b9e728b76f236874a0a19f6c93ac230ae5aafe0394047eee052240b3e41f6621

SHA512
d3a1d58c94d64e2d49a3449098b06290eaea319d9ad8517c33f15f152f5e25de7eec1c2ab79b91c082099818cd479f2e68336e0703b9255f5ce0a89e3b8ac36c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1.5MB

MD5
b5a190e26e7c2cc25117ef33440db110

SHA1
41b3412a7b53f36b7b0f621f222335023ddcff93

SHA256
742d8a247020dc0e20f96ae43ec220b5f29862a901a41b6f3cd12c921f2abf72

SHA512
36e074b4360202657eef75ee7324969bb94abad69ee8786ce7c9656c5fe6a807b4f1618b1ff74a932ef131ad5db3e3748c47cd892b317311ee7c89225fb2fa2c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
1.1MB

MD5
aee7a508f7bb687d36b6a62c686afd30

SHA1
e1c6b8d1b52055940550c99fd052984daa7b11e5

SHA256
65541daacb5a0449e1947d5fef7375d7058d480939295bf5b0d13bdccb12e4cd

SHA512
d796d52d6440374c23e9b64654ebb372a4a68c3a884c9dcbba3536b947fb3c5e386c74317da14951cd82b696c2e1ece3c00bd4de599ac7ff32640580de28097e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

Filesize
1.1MB

MD5
9543addecac8e3585b80642b9be61365

SHA1
e8ffe2d4fdb54475e04404768f3140f5bc0a3632

SHA256
7a8b3b6ad80811372969a65acb7295087046f36157954f61d3a351f9d716839b

SHA512
0b4cb979e0b5577071bedb7e37d4c10dbcbaa7cc23b5e657568128d306641ab4a46a9787ad59d0f414a542dfb41c0d7a0b0d3b7cb3ce3d73943561226f494280

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe

Filesize
1.1MB

MD5
bc30fb3831834a6601bcd9215b21ae48

SHA1
53a64eb1e7a80931cfa4b8799ecb8c6194c9f01c

SHA256
f949f6eac1b1e9107bbec8fe5cbbe4e2aa9e2d6ce9627030892f125fa335fcc5

SHA512
6305c9064c9ac71f5ccb4f155cc5a66db3b67a4b13bbc274ad120440008ecd238ff8ff144ed830fc7d78fc2601fbd97a7d0dd6250d0f7836f5650b9c1e34aa9a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

Filesize
1.1MB

MD5
cecc69ab6dff75ffaeea44c320732f29

SHA1
287acee377590b2ecccf0dbcf7cfb1ae3b349308

SHA256
4237b3cb1e5f8302e06009d95ffe10f6b7e1623a11f2663216c93e336e99c19a

SHA512
73f5b378ff07b66585e92b73bf3fced8d56d876f6a0ae6fac7ad88aeaf9197f9b77e61300db6bcbe550981692bcc05cc0d1f12a901948801e19340b4fb5fc072

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jhat.exe

Filesize
1.1MB

MD5
247d3f9e4fd161f536ccd740c1ad96a9

SHA1
6bbc5cd30c466deff779f4ef2b54f28e0620cce8

SHA256
d20ff6664936b67d290f41279d79a3fa614c7fd90db01a2b5a5a3e61662286a5

SHA512
b2b8ae053864db88dc97d9b80c8087b1747c2c5a39a37a5c74f7795e43d7b6a73f3bd22f920a2490b58bb093f5682003136e5ee6351114337e9b73d178cbb432

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

Filesize
1.1MB

MD5
6a4505b5baaed0bf5c4c1f651c3fc01c

SHA1
93068081c05c2e734b2d34921af99107a3f792cb

SHA256
0c13a3b65f3369e55f8d8011e275b7fa9acf345d1afa8f5405b502a067f1e108

SHA512
f4115424b571b33aa81a8d8774514bb8bf1bebdb22f3a19104e4e90c86423517e3ba609ddff878222a17d46a201a8ac1ba18efce41c74f16180a5077fde4f2bc

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jjs.exe

Filesize
1.1MB

MD5
9173611bbbaa15df830ac89b93758bfe

SHA1
8b6ec8ef05b034ac19c7e7e252636c7d6d993751

SHA256
54c4f34ab08d5b7d01743e4c043988ce0665770571eadc3fe63ad441230aa448

SHA512
2fb74c4bf69e23b091ac1e5ecfc9b0b3219bddd4f957d0a33e236d3e7077c347d1dbdadf8ca7ae45e36c337b7b7198c769ed1230107d3f7eb3fa6cf8cc23ba3a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jmap.exe

Filesize
1.1MB

MD5
982b11c7b527884e3e82576dd3bf8ba5

SHA1
8d5aae22ae50b0412d9e9f9dfd115535326286eb

SHA256
62aade31e88f36af4f8d4481f28db551cf49a3051a7f0fd7038bfcc2345c2224

SHA512
cad3a254fa653aff20a0bd3195594c65d9b51290efd9d65b20977ac21a0d49063c7e886d9a14b21e88f03c8fb05352b6d4f1d6756f0228e372014f867a6b2d8a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jps.exe

Filesize
1.1MB

MD5
43c389b46c46b90683e944d4e18a590e

SHA1
0a85f6703f15ab64f04936c589eb6a0f5610bb13

SHA256
d46cd057d85e08888bab4eadf684209c082580262769d6e7e31a989e281bb9bd

SHA512
1bce9d2f4b8b44516ffe713e4754805ded47a025ea05948e9b664e1d14a86aaa2389e3f3814d8d94bf39f4ee47ee0582512cea16ea119ec7c6bad2734e49ef51

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe

Filesize
1.1MB

MD5
a3ba6368f62afbf4072675cdb08b9aca

SHA1
34b4e7fc34e7b6c499eb9332c17df211164e9209

SHA256
db0e47f3700292ad3808251b2c5c737844f089c4e00a049f766a37574d280762

SHA512
a64e06025fff954dd8a226445dffd6d7b06af0e3ede5040afe1d2044e321b93efc8f305a327c38eca273f19e04a6e2b75e3d4da787e93b3b85dcc53d3cf4a69d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe

Filesize
1.1MB

MD5
9e1f74bd8949d4fbb96991777ff13bf3

SHA1
946d564a8eb1cb2895917cbf968ab9d71afd0b94

SHA256
538b27495f76835e9d02299838cd7f9b639f6dc7268fe765274c8a6b7b66561d

SHA512
09df2b44876351c3230e3ee71b6af76bc3018350898a38840d9938070410bcee6d829c1a10d3a0a570ff1d318ac3b814dd47e327b1e85c4f06114c6d368927dc

Download Submit
C:\Program Files\Mozilla Firefox\firefox.exe

Filesize
1.2MB

MD5
9712bcb6d60f46d4013874540cc078ab

SHA1
4656cdecc8db651fc0ff114967ba81171e133ce3

SHA256
670fea227a010c83a31aec0df0c0a803547984c4c4c6e6fc2d4d0f7b80e6caa0

SHA512
e37f7415879f94e204920046279b85ea2c7778d8fcaca72d3352c43127d9412f9d8bceeb3b333f7937eaa72f778a6f240e977e3ac721b2cdaedbbf9278042155

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
1.2MB

MD5
39dfbd3bac44dbfb650adab3d6bd03b9

SHA1
9c8d8d838989175b850feb61c1b86f1c5c890696

SHA256
fcf01421176e9de9337e7ee14980c3162ec4e8df913a910dd8e7b01f91ec1d5b

SHA512
b812e4580d9b0031b1d79b718e8f1e572e01368ab462551fa414cf5c996f3e3386857955e39d01a6d21bf9404594830dd57d5f1bb60278da0cf834fbb6ecea8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rncjs0bv.vws.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
300KB

MD5
3b6501feef6196f24163313a9f27dbfd

SHA1
20d60478d3c161c3cacb870aac06be1b43719228

SHA256
0576191c50a1b6afbcaa5cb0512df5b6a8b9bef9739e5308f8e2e965bf9b0fc5

SHA512
338e2c450a0b1c5dfea3cd3662051ce231a53388bc2a6097347f14d3a59257ce3734d934db1992676882b5f4f6a102c7e15b142434575b8970658b4833d23676

Download Submit
C:\Users\Admin\AppData\Local\Temp\neworigin.exe

Filesize
244KB

MD5
d6a4cf0966d24c1ea836ba9a899751e5

SHA1
392d68c000137b8039155df6bb331d643909e7e7

SHA256
dc441006cb45c2cfac6c521f6cd4c16860615d21081563bd9e368de6f7e8ab6b

SHA512
9fa7aa65b4a0414596d8fd3e7d75a09740a5a6c3db8262f00cb66cd4c8b43d17658c42179422ae0127913deb854db7ed02621d0eeb8ddff1fac221a8e0d1ca35

Download Submit
C:\Users\Admin\AppData\Local\Temp\server_BTC.exe

Filesize
226KB

MD5
50d015016f20da0905fd5b37d7834823

SHA1
6c39c84acf3616a12ae179715a3369c4e3543541

SHA256
36fe89b3218d2d0bbf865967cdc01b9004e3ba13269909e3d24d7ff209f28fc5

SHA512
55f639006a137732b2fa0527cd1be24b58f5df387ce6aa6b8dd47d1419566f87c95fc1a6b99383e8bd0bcba06cc39ad7b32556496e46d7220c6a7b6d8390f7fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6FA2.tmp.cmd

Filesize
162B

MD5
54e5cb33fbfa104700b683109f00b414

SHA1
c2c660e76a5eb7d8a65cfecd3259ae7b5790ce56

SHA256
8415d68cbff9c8a36dc204397645bc11a065588c0c8cf662aedeaccece2826e8

SHA512
9fc1e982d0ffcb8f107c02858d0b9c2044b865afc8e7bc0a180d65a79e38bdb3cd8b9d2afd367dda9ef01f0965d8a33eb8563cdff43a918d1ea6b65f234a5285

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.2MB

MD5
a5bf6f7f4eec837ab98a2b0e5ba1c954

SHA1
1440390a521d5347e0f4708a4c4482050c8b625a

SHA256
7e9fa872228c291fc92264a237d0c6e77ceaacb257c8ab69d410bbc311700086

SHA512
f5642c409b3daa60b868e9445cf122d82ad7c140105ddb80f2c95564c466824bbeee51053d491c768230f2bb92256d356b798dea27542bce87f7383b8d2dae6b

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.2MB

MD5
c0538ca7f7ac1453ced630fcba96b002

SHA1
be79e9aac3108da1e4151512919d1a241603ed3b

SHA256
1c52be2e879c53e5212905968db181f5e1f10d4aecea437436c6d7d2a797643c

SHA512
901b839b2b7e9eacf412b02b619bc8e1992e7bb78c23aad21d7c71c2a1929f1817332a3204e2e03ed6287217af999c38c2cfac43cf5c087895f38566bdbd3161

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
00a1b2feae1e3c0cfe6ddf2df9594bdb

SHA1
ea67a0a85ddaa0994e725b981aea341a9557c389

SHA256
d258c12ea07ef15e1ee9793b199dec779e0905c3998d4f56b87c851dcf7f0ab4

SHA512
c5d424af0eac1d4aefcd7de825163d65f4c08e810f2f69c04bac107c6a5962df8dbc08bb06a17973506eeb5232d73d862ef4b1b107c7b9fa220a92514ae5f6e4

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
3072dde6aef6818a236d97be243659a5

SHA1
f72d8052e78b60dab8079a4cb163115203ee347e

SHA256
faff91c5378d00645a6e8dd1e0055eaa2bc793d672a6de7a7e673771f989b191

SHA512
e1a91e55d57c539ba08984eda1676285e5253029cbeaa660a109894d4633c0531a0c8629a1c408aa1a57a40b25b541450324d0ffc421ac44c3ac8807a287c2a2

Download Submit
memory/452-372-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/452-151-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/808-133-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/808-141-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/808-127-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/808-139-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/808-126-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/968-2-0x0000000004300000-0x0000000004700000-memory.dmp

Filesize
4.0MB

Download
memory/1320-120-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1320-124-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1320-114-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1320-371-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1916-108-0x0000000005090000-0x00000000050F6000-memory.dmp

Filesize
408KB

Download
memory/1916-357-0x0000000006860000-0x00000000068B0000-memory.dmp

Filesize
320KB

Download
memory/1916-358-0x0000000006950000-0x00000000069EC000-memory.dmp

Filesize
624KB

Download
memory/1916-93-0x00000000007B0000-0x00000000007F4000-memory.dmp

Filesize
272KB

Download
memory/2272-332-0x0000000006A80000-0x0000000006A9E000-memory.dmp

Filesize
120KB

Download
memory/2272-225-0x0000000005740000-0x0000000005D68000-memory.dmp

Filesize
6.2MB

Download
memory/2272-362-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

Filesize
104KB

Download
memory/2272-363-0x0000000007BB0000-0x0000000007BB8000-memory.dmp

Filesize
32KB

Download
memory/2272-361-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

Filesize
80KB

Download
memory/2272-360-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

Filesize
56KB

Download
memory/2272-203-0x0000000004FD0000-0x0000000005006000-memory.dmp

Filesize
216KB

Download
memory/2272-353-0x0000000007A90000-0x0000000007AA1000-memory.dmp

Filesize
68KB

Download
memory/2272-244-0x0000000005DE0000-0x0000000005E02000-memory.dmp

Filesize
136KB

Download
memory/2272-245-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Filesize
408KB

Download
memory/2272-343-0x0000000007B10000-0x0000000007BA6000-memory.dmp

Filesize
600KB

Download
memory/2272-336-0x0000000007900000-0x000000000790A000-memory.dmp

Filesize
40KB

Download
memory/2272-335-0x00000000078A0000-0x00000000078BA000-memory.dmp

Filesize
104KB

Download
memory/2272-334-0x0000000007F00000-0x000000000857A000-memory.dmp

Filesize
6.5MB

Download
memory/2272-333-0x00000000075D0000-0x0000000007673000-memory.dmp

Filesize
652KB

Download
memory/2272-321-0x0000000006AA0000-0x0000000006AD2000-memory.dmp

Filesize
200KB

Download
memory/2272-322-0x0000000074990000-0x00000000749DC000-memory.dmp

Filesize
304KB

Download
memory/2272-295-0x0000000006570000-0x000000000658E000-memory.dmp

Filesize
120KB

Download
memory/2272-259-0x0000000005F60000-0x00000000062B4000-memory.dmp

Filesize
3.3MB

Download
memory/3664-90-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/3664-83-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Filesize
384KB

Download
memory/3664-91-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/3664-370-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/4084-7-0x0000000001380000-0x00000000013E7000-memory.dmp

Filesize
412KB

Download
memory/4084-6-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4084-5-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4084-3-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4084-81-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4084-15-0x0000000001380000-0x00000000013E7000-memory.dmp

Filesize
412KB

Download
memory/4468-94-0x0000000000760000-0x000000000079E000-memory.dmp

Filesize
248KB

Download
memory/4660-49-0x00000000006A0000-0x0000000000700000-memory.dmp

Filesize
384KB

Download
memory/4660-359-0x0000000140000000-0x000000014012F000-memory.dmp

Filesize
1.2MB

Download
memory/4660-40-0x0000000140000000-0x000000014012F000-memory.dmp

Filesize
1.2MB

Download
memory/4660-41-0x00000000006A0000-0x0000000000700000-memory.dmp

Filesize
384KB

Download
memory/4864-281-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/4864-28-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/4864-27-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/4864-19-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/4972-98-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4972-112-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4972-110-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/4972-105-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/4972-99-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/5096-155-0x0000000005A20000-0x0000000005A6C000-memory.dmp

Filesize
304KB

Download
memory/5096-135-0x0000000005AB0000-0x0000000005BBA000-memory.dmp

Filesize
1.0MB

Download
memory/5096-96-0x00000000056E0000-0x0000000005772000-memory.dmp

Filesize
584KB

Download
memory/5096-95-0x0000000005C90000-0x0000000006234000-memory.dmp

Filesize
5.6MB

Download
memory/5096-153-0x00000000059E0000-0x0000000005A1C000-memory.dmp

Filesize
240KB

Download
memory/5096-109-0x00000000056C0000-0x00000000056CA000-memory.dmp

Filesize
40KB

Download
memory/5096-122-0x0000000006860000-0x0000000006E78000-memory.dmp

Filesize
6.1MB

Download
memory/5096-138-0x0000000005940000-0x0000000005952000-memory.dmp

Filesize
72KB

Download
memory/5096-375-0x0000000007BA0000-0x00000000080CC000-memory.dmp

Filesize
5.2MB

Download
memory/5096-374-0x00000000074A0000-0x0000000007662000-memory.dmp

Filesize
1.8MB

Download
memory/5096-89-0x0000000000DA0000-0x0000000000DF2000-memory.dmp

Filesize
328KB

Download