agenttesla | 4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21

Analysis

max time kernel
117s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe
Size

1.0MB
MD5

a7b12afe35112ee82d4bff29c6ccd3b0
SHA1

a47503ae304dda6ffa4439e61379b6f75d5d6ff5
SHA256

4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21
SHA512

148d9e7c46557866f2e9417beba2a27ec5996fe20da5c606a9824d234c78565beef6988ae63cdac6414a9aab5c458a5afbea83947417a193f2b14aa607672a19
SSDEEP

24576:P7rl+4eybvhO0kERedWIUwF42P17sLXcP7AIe5ocVVTNPYjxJ/WbBfU:P7xhqhWIbF4gKKeWcVVTNPYqfU

Score

10^/10

agenttesla modiloader credential_access discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
s82.gocheapweb.com
Port:
587
Username:
[email protected]
Password:
london@1759

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
s82.gocheapweb.com
Port:
587
Username:
[email protected]
Password:
london@1759
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1288-2-0x0000000002DF0000-0x0000000003DF0000-memory.dmp	modiloader_stage2

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3808	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	server_BTC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	lxsyrsiW.pif

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk	server_BTC.exe

Executes dropped EXE 19 IoCs

pid	Process
2312	alpha.pif
4756	alpha.pif
4160	alpha.pif
4348	xpha.pif
4952	per.exe
4820	pha.pif
440	alpha.pif
4172	alpha.pif
5080	alpha.pif
4476	lxsyrsiW.pif
1568	alg.exe
2696	neworigin.exe
4896	DiagnosticsHub.StandardCollector.Service.exe
4336	server_BTC.exe
4748	elevation_service.exe
3004	elevation_service.exe
4740	maintenanceservice.exe
3732	OSE.EXE
536	TrojanAIbot.exe

Loads dropped DLL 1 IoCs

pid	Process
4952	per.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wisrysxl = "C:\\Users\\Public\\Wisrysxl.url"	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	drive.google.com
16	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	api.ipify.org
46	api.ipify.org

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	lxsyrsiW.pif
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	lxsyrsiW.pif
File opened for modification	C:\Windows\system32\dllhost.exe	lxsyrsiW.pif
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	lxsyrsiW.pif
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	lxsyrsiW.pif
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2dadaf8d20b56551.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1288 set thread context of 4476	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	109

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neworigin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server_BTC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrojanAIbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lxsyrsiW.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3128	esentutl.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5060	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4296	schtasks.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	16	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
536	TrojanAIbot.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4820	pha.pif
4820	pha.pif
2696	neworigin.exe
2696	neworigin.exe
3808	powershell.exe
3808	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	pha.pif
Token: SeTakeOwnershipPrivilege	4476	lxsyrsiW.pif
Token: SeDebugPrivilege	2696	neworigin.exe
Token: SeDebugPrivilege	4336	server_BTC.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	536	TrojanAIbot.exe
Token: SeDebugPrivilege	1568	alg.exe
Token: SeDebugPrivilege	1568	alg.exe
Token: SeDebugPrivilege	1568	alg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2696	neworigin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2596	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	89
PID 1288 wrote to memory of 2596	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	89
PID 1288 wrote to memory of 2596	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	89
PID 2596 wrote to memory of 4788	2596	cmd.exe	91
PID 2596 wrote to memory of 4788	2596	cmd.exe	91
PID 2596 wrote to memory of 4788	2596	cmd.exe	91
PID 2596 wrote to memory of 3128	2596	cmd.exe	92
PID 2596 wrote to memory of 3128	2596	cmd.exe	92
PID 2596 wrote to memory of 3128	2596	cmd.exe	92
PID 2596 wrote to memory of 2312	2596	cmd.exe	93
PID 2596 wrote to memory of 2312	2596	cmd.exe	93
PID 2596 wrote to memory of 2312	2596	cmd.exe	93
PID 2596 wrote to memory of 4756	2596	cmd.exe	94
PID 2596 wrote to memory of 4756	2596	cmd.exe	94
PID 2596 wrote to memory of 4756	2596	cmd.exe	94
PID 2596 wrote to memory of 4160	2596	cmd.exe	95
PID 2596 wrote to memory of 4160	2596	cmd.exe	95
PID 2596 wrote to memory of 4160	2596	cmd.exe	95
PID 4160 wrote to memory of 4348	4160	alpha.pif	96
PID 4160 wrote to memory of 4348	4160	alpha.pif	96
PID 4160 wrote to memory of 4348	4160	alpha.pif	96
PID 2596 wrote to memory of 4952	2596	cmd.exe	97
PID 2596 wrote to memory of 4952	2596	cmd.exe	97
PID 4952 wrote to memory of 2732	4952	per.exe	98
PID 4952 wrote to memory of 2732	4952	per.exe	98
PID 4952 wrote to memory of 4820	4952	per.exe	101
PID 4952 wrote to memory of 4820	4952	per.exe	101
PID 2596 wrote to memory of 440	2596	cmd.exe	103
PID 2596 wrote to memory of 440	2596	cmd.exe	103
PID 2596 wrote to memory of 440	2596	cmd.exe	103
PID 2596 wrote to memory of 4172	2596	cmd.exe	104
PID 2596 wrote to memory of 4172	2596	cmd.exe	104
PID 2596 wrote to memory of 4172	2596	cmd.exe	104
PID 2596 wrote to memory of 5080	2596	cmd.exe	105
PID 2596 wrote to memory of 5080	2596	cmd.exe	105
PID 2596 wrote to memory of 5080	2596	cmd.exe	105
PID 1288 wrote to memory of 4832	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	107
PID 1288 wrote to memory of 4832	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	107
PID 1288 wrote to memory of 4832	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	107
PID 1288 wrote to memory of 4476	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	109
PID 1288 wrote to memory of 4476	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	109
PID 1288 wrote to memory of 4476	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	109
PID 1288 wrote to memory of 4476	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	109
PID 1288 wrote to memory of 4476	1288	4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe	109
PID 4476 wrote to memory of 2696	4476	lxsyrsiW.pif	111
PID 4476 wrote to memory of 2696	4476	lxsyrsiW.pif	111
PID 4476 wrote to memory of 2696	4476	lxsyrsiW.pif	111
PID 4476 wrote to memory of 4336	4476	lxsyrsiW.pif	113
PID 4476 wrote to memory of 4336	4476	lxsyrsiW.pif	113
PID 4476 wrote to memory of 4336	4476	lxsyrsiW.pif	113
PID 4336 wrote to memory of 3808	4336	server_BTC.exe	118
PID 4336 wrote to memory of 3808	4336	server_BTC.exe	118
PID 4336 wrote to memory of 3808	4336	server_BTC.exe	118
PID 4336 wrote to memory of 4296	4336	server_BTC.exe	119
PID 4336 wrote to memory of 4296	4336	server_BTC.exe	119
PID 4336 wrote to memory of 4296	4336	server_BTC.exe	119
PID 4336 wrote to memory of 536	4336	server_BTC.exe	122
PID 4336 wrote to memory of 536	4336	server_BTC.exe	122
PID 4336 wrote to memory of 536	4336	server_BTC.exe	122
PID 4336 wrote to memory of 5112	4336	server_BTC.exe	123
PID 4336 wrote to memory of 5112	4336	server_BTC.exe	123
PID 4336 wrote to memory of 5112	4336	server_BTC.exe	123
PID 5112 wrote to memory of 5060	5112	cmd.exe	125
PID 5112 wrote to memory of 5060	5112	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe
"C:\Users\Admin\AppData\Local\Temp\4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\esentutl.exe
    C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\esentutl.exe
    C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3128
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2312
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4756
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Users\Public\xpha.pif
      C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4348
- - C:\Windows \SysWOW64\per.exe
    "C:\\Windows \\SysWOW64\\per.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\SYSTEM32\esentutl.exe
      esentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o
      4⤵
      PID:2732
  - - C:\Users\Public\pha.pif
      C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4820
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:440
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4172
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5080
- C:\Windows\SysWOW64\esentutl.exe
  C:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\4a6b2eba43c5f42d0192fa2a618f2e3f27bf145421f58e2b146c6a4b6a5a3f21N.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o
  2⤵
  PID:4832
- C:\Users\Public\Libraries\lxsyrsiW.pif
  C:\Users\Public\Libraries\lxsyrsiW.pif
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\neworigin.exe
    "C:\Users\Admin\AppData\Local\Temp\neworigin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\server_BTC.exe
    "C:\Users\Admin\AppData\Local\Temp\server_BTC.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3808
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 23:17 /du 23:59 /sc daily /ri 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4296
  - - C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe
      "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of AdjustPrivilegeToken
      PID:536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp32B3.tmp.cmd""
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 6
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5060

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4896

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3004

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
ef769a6073ff96060f16a66f70a0203e

SHA1
56aeb61973ea6027569debc78a07b8ae9f6b7039

SHA256
850d69ab63f39eaf91cb4726526bd8ac6d0ee0733ddc1250b59bacf5b1c9f469

SHA512
2275efbe05cd6136a3d1a49301abc0238fa252af449ac2d1c1e690dd809d52e33fa0daba547b5e9d4b4479360e966f5479cf62d1ad970e3c6ff8c37c4261a5da

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.3MB

MD5
b83bbe94d49909374b513e01e87af2ba

SHA1
bbf1523b8b3165bf68c8503766b1eb8ff65917c3

SHA256
bcc50f6ff28a37fcb4651cc8fdf65d00d28346fb20a37538433ac1ddb02243d2

SHA512
bd3dff6c37d4f9ab3b201359c25256ae97f70289b9e2e148d662a18fb2615744a234ae580d4a6087e71ad74bd1a74673bfb5391fae3a181f1398b2c5b081544a

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.6MB

MD5
f7b3ca163260828ce3c5ade1e508b10b

SHA1
b1f6dbdb3f92b2d1622279d04a69ed1a908dc9c5

SHA256
e45101766561c3fdcb61223749e2202e4e548e07d84a9ed2fdf89bfaba4be6ac

SHA512
a7dbe4b8abd723ca3a404fe81ff8f83ce8a3ca416f993bd4c47458a2ec4b1e99c7380562a1b871438e7f71fc57019787fcc569287b9cb10755c0f88d3d0ee122

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
32dec9e5430254ffef0a6d65872dea1b

SHA1
73083293caa87983337b15a5a8771dc9fd712117

SHA256
d1e9f67489548aa73a78e6cf8309a7c09a46ac9ec3b117c323a839b1b312723a

SHA512
0aa4618a44b95537b99ddb1caa24a7b37890b522c1de824e577a1e6423d9ef2db71843e3844c18c4de37f89c44b1f4c015feac14c680692ee48bf39f0bbb54a5

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
bc9e39cf0922e6a2e96dba91b913ac7d

SHA1
4b36e2a4ea2d75687797f9edc21a24454e41e452

SHA256
4bd005cc18b5907f5fbc67131c0e3d928a0310d8cd79b3127c8a7c4e410a6d56

SHA512
31028dc1d37f70a1371ca458065898da8c41ee8314c8cde2bd6293112db98c9948e7580aba35177372a54d8dc8d1dcf03502f75577d95b5472bab12ceadcba40

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.1MB

MD5
65ee079462e867868d1e8cb014faee1e

SHA1
dbcaf61ade4a40e1c72d914efbf5b154f7ffc2ce

SHA256
cb3537d6f68220d6177e857808418f1470a49fd8100989da1459e58dbbd9def1

SHA512
5778baa989e65ee2d16c0e2974843369d0f8413b641a96a757a5624b92c152ebfd4c1f7a4aad539a08ae89bf657f5846af10cfa4056ece86ee233abc721d8880

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.3MB

MD5
63a45465df301f588b00ee914f86db69

SHA1
c5b3b9ba41a006a4d012e547bcce229329d0845b

SHA256
faa8488a1513f93550601eef0e887834e8470b364a8305cee0ee308e52a65642

SHA512
d794f7d73cfc0d15d18cb8faf86d270dd636d1123fbeaabc1066330813c7f90d6bfcc850117581c6f18bde9f16b9f249d8b818422c9bb624127f7e74f5d612cf

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
3bbe3afb6aeec5b37a844b0018b3f05e

SHA1
87c5c597d7ace912bfa9736d4f19273b7eefb8f0

SHA256
0293be46598d755e9944855b196889f6f7460730cbc3585b34b0630b98a72e5f

SHA512
9f49fdcfc50a2a970fe3f731a75fbcd950525db2d86ebe40afe87c6711ef9172a5d378dfff2e0d84438e35b9f5fac6d3a7af03f8ce300953e245a36dd196de43

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.4MB

MD5
083d52176ab1fa7c3c53c0c6beaabe3b

SHA1
c3ad655b299e477d0611852043c58c8c73cd108d

SHA256
9fcb66e800eeaa76f49cd15e689309a36728058862becd1775c217fed5d6ad88

SHA512
5df647e5a95c0da0bbbbb88b52df1636a30370358f458ee508ad4810c7dcbb7c264fb59305e4752227b0765f5367c95e14116dbbb2eb0e7676226e9d84111dce

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
88f308d40013f98880dcec8263956eff

SHA1
7a7b2340192668a2a946c7fcb362d6a31cb12b87

SHA256
098e65b81c6d5fd32370525db5d2b148e363053898c98857f7b9b9d01e3c8d09

SHA512
8821acca07578dad26b2d114c88f0557a45b838c6c5bbcdcb37e0b8260d4b75585f67261884ad793e821b2edd5712b3b3d224cf49e12d478df9bd2b364d4ff7b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
724711787217e43a784e2f7f18df572d

SHA1
ca799328fb8ac66ed5d613c8ac332e6ca57895b0

SHA256
7f6ce57665961be320ac299f9d5482d53e4af0619597b226fe88554d70bed998

SHA512
65b815c13a3b6f53e372af8c6b00ca4726c88fb1d666ce51c705ff8dbcfe894242dda376d3f208edf5ae7fc25a7d9bf543b205c6a1d17875396ace71437b3490

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
35273d496d39194d1de4716eeb487598

SHA1
219c5145f9ca49e339b40e01f20b63ba201844c1

SHA256
dfaa0eeafe983f2cc792b3736626969e413a6fb138b21fe218cf2fc0025f9d1b

SHA512
8563b9856402ffcfb02031dfd472d8169921354776b1ccdca8659caad6210ff02b3c5a5c96bfd315ab62c5720d323f7a41b466dbc7e60848172972c4ce5524ed

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.3MB

MD5
a0fca4dd233dadc842172146aa1b06a0

SHA1
98e6f52b3ac9173579a2dc7b76a2e637ae40ee05

SHA256
84132a2b6bb0c08c87ec762a6f962ff1d356981aa68cddf86e909805292b9013

SHA512
9a4b78c4cb9113483e46df74dc0a472818a8887c47643574f07ba82bec8d55f37bb78aa5797900773000965bb38b9995718c40c2197058a8f5a13a6cc42ef07c

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.2MB

MD5
3bad6ad5bd8d12992f47b9a0e7f1d432

SHA1
958f1e4b4de989c61f1c74aca3c8d2fcf475c024

SHA256
1d7a86437555e3eaf65c4909b6bdcf78996dbd61d44a06a8345d6334c311be3c

SHA512
8b03fa6926a2f425ad7e419bd297940c1c0d12b2bc3843669da4d08de88a483649edf777666c8f9f5d06e58d6fe521798f652e6a157d29b6677348a6b390c86a

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

Filesize
4.6MB

MD5
dc9f59db2d5ce8b3e742b3e99e3608b4

SHA1
d900bf2290e59d71b4e6ff0838af5a9d4dd89340

SHA256
c0b22e3d987804d8c39b5adcc16f45335eccd1fbd36fe68f9e83f744b337c6e7

SHA512
a70c37c4fd29493ee225e9561cbddf812811246b1dda36502d1087bcc26f52a57676027562392f35acbdf46c5e41807487dde9e8e556a21c5c99d1653975dd14

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

Filesize
4.6MB

MD5
35f9fee98e7ea3a1a2b998557dd90e0c

SHA1
d87270ffa117038c8e9a51fff9062dafb51cf8ea

SHA256
e29813fe80e9d8a93170a5372bec81d5895c8e358597ece6b26f40d5fbee1283

SHA512
c81de7a5a4b519816fa739957c94a02d6899b060c79d47ee682d00b5f79dc079742cac79f17e8ced2c17ab4b6bbadb3e9e312f26d415d4d8c26fcee275f51333

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

Filesize
1.9MB

MD5
b86e479fbd689f187581b6c21352a616

SHA1
d654a18a6f61d319fb11ba4217ad584947d18fb4

SHA256
a1d2a8e5753eb72639dcd8a37e0b6a70287b7868387364f3581d48cd3e7245df

SHA512
783d5d05077fdd9e1695f39f0d9b2b63929da09eb6850db03754c4f8b9c8168ba3a753f80654a8c730b559a94aff5f639ea483f5facb3acffaa89059ecd6a60b

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.1MB

MD5
e44ac3ce59bf9863e90a60c8f6cd753d

SHA1
af1db1068f61701806f984a9c01e89d78b99f521

SHA256
52b57d7cf0132b919c41f8af62a1d0ea3f1539d745ff9dfac6aff353e829a26b

SHA512
939e68cf59a78682253286ffa701eb25687bbdaea965738c113f95c0da6b8aee97c9ffaf6718fc6545069797a506203da8cab922931235a6eddc6996ae1e30d6

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

Filesize
1.8MB

MD5
973abba8361a6e07b1530f72ede9662d

SHA1
e420282949c6ab4018827bd7f79a99442b104c03

SHA256
88dfd0f072946325437ed74ffeae089bbde9a5794db6d617435333e6d5dc0eb5

SHA512
716910397608e2ecbec4a625971075bd51ff3c7ad56b4022e2ac7b335f9a691e7c9f6525a26acc3d9245bcf787071a34d5e0c307bb639cc69aa5c61e15dc94af

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.6MB

MD5
dcd577cc39ac12b2d658fe978f06129e

SHA1
ba6117d977e18a69fb19d2f3d446bba46c507afe

SHA256
a7cc7d7d378d9a97f1992b20d9f3e707f6b1b1bebd5dd019f0d77f268d838842

SHA512
8a108c9ab0d46a48cb88c20ddcda642c9f02038d5a6e62e4ab76cee3f86533ab467c680deb130a1424a2b6a67f1a91538653e1cf560857b14ca23aef8626e583

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
1.1MB

MD5
21f04c39b2400f2cfb47809b5a613362

SHA1
3a3960e2ed49568f45a216f5a61ad23269588034

SHA256
8dad27942ec61fc73e47adfb553811bcdcde773b0e16415a564ccc06c355d93e

SHA512
5192a17a55b3754a1d346956cc9fd5f0d0b2f2ceef53ee2d5bc5bd550af6ffdb4a55be26b8189651158d9845b58673b0aaae4d873f04b90903d10b41a74efcf8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
1.1MB

MD5
0eaa9dd682593a9ffd02d86c19f54225

SHA1
caeefa475eb83030422c1fd6e2cfdc368a7408d5

SHA256
6bd21477d3c39ad0b507e597e8d6cd1d4e45d7ff0a08ab4b2bbeb8feb0b2e573

SHA512
61375c4bdbef88a42c165c7af55ebebfaaabe1544d96fd4680a9ea04c6167df8a58aac2ae3237dab6c1f7c4fd2e0251b223dbd917427c37355e972091937ac76

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
1.1MB

MD5
f405d6bee21fbb093e991896bd68f171

SHA1
0f282292f5d5e446c49885a646073386a2dd5a25

SHA256
271cf91d2e9ec5e79b16ccec2a95da9c148fefe68ce9dc1abed783e369972198

SHA512
187e26948f8d28c05ff172b3b9a86adb2eecc05520170359fd64431324000a07a5d2ce1bf6b5518b6284fb86d24d9741625af7036bf12709079830784b273914

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
1.1MB

MD5
e49f4abad7451c200584995010fedbd9

SHA1
fb2cd83927cfbec962096010f020ef8b5226f283

SHA256
0dbf6b1db5c084a2c1e337dcd3227a56296d409274471d0767f6035e2cf3bcad

SHA512
c2da63be9f05501150d10b840da98a842f60d96d6f5f257936ec34882fae711b2bd684294c1c5951603fa9196a224d54a66dbd6e37c479c9ad376d0fc57699d6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
1.1MB

MD5
d04c99bdf41fed999134e197f956bf86

SHA1
342a519733c4bb4220e5935ddba88fa34d2a7ad9

SHA256
3ffad40b3ae804cfa6f709077db3bc69e7022b8132ee147d67e3c34016177141

SHA512
c607a5331afb0f8f31ffecbbd37273865711f220dfbeef4ad7253a10db35b5d93b3f50f68810efcd4a36190e486912467f3a5978754c7eda75ff95af80996ceb

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
1.1MB

MD5
ce2c2dffa0fa6827d507fe998df018d4

SHA1
ed38a3b905fcb53da0f1cda6b7c6493f1b89dffb

SHA256
6845356178fef386306549ef4da25cb6c8e15b9e3b3ed7da2d2ea9b55cecdb7e

SHA512
e9d9918d223ec0ccf5c321b3bda875e0aecd33cc44fabf4c5791fa1dd05793af694bbea436269a4da31dcb044ce9a054846e6396d8b300c3a027f0d5446043b5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
1.1MB

MD5
3932a01794bc992466e9ba6925b90692

SHA1
1e4168f1565dcededc6e196339d377a253710bf9

SHA256
40ff7e379b217687965faf151d486094de54d571600a90a7212e3a0d9996f0ed

SHA512
6028fa07472326e35608cd8c4b8bdb68d909a8738f79158e0d545443a49d005c74f3f94ff536560f71d4cb60217e3300c4d6af349bdd2c1c812187fc6834d16f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
1.3MB

MD5
8d18cf8506ef86767e94e40a0685d066

SHA1
0a54bfd40191e2c4c19d2deb5295d3092b4d073b

SHA256
837a02cf01a569a7f849bbf2380c57b801763f1a807b7914c426491a8a1f530e

SHA512
963d51de5803ef84e9a602ec0c5f1a5cbb4397605928bc735b7553a4475f35a2156c60e84425d0063092353c18095b7a182018c899260a0718cb6e2013cbf337

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
1.1MB

MD5
bac5b5306836181ece042f97f05e3b7b

SHA1
ee90fb8ac581078981ea53fb735adec2cab6a16e

SHA256
80439a39191090081efed5f2286a7d5f6be3d52fdae6f8fb8cd4c13ecfb71258

SHA512
e95045515f774639152b85336c8cb941be486de86b152e75027310e6064c98f3f42b5d18286e89f6c8b55e7e4116bed625490a8cb2367431d1db3a7492a18f54

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
1.1MB

MD5
3713c24834ea5a729cd68ab77ff0faf6

SHA1
27f6ac13762783e17cfcb138dd4ff887f7ac87b4

SHA256
df023d6e6cab28af1841e5cf8698b80574822331d4f1bbdad439f791d5de95c2

SHA512
a314e0d6c47a783718a8a4ef8e244ad46da7fe3c8f030167f6be885f157061217dca81bcc2e0da76b8b0285da26e8911a097b793c3d2171ea5af6bc5e5c8a909

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
1.2MB

MD5
a9ef45f3704af1f46ac63f2aee39e1fd

SHA1
2663b22b481fe21d723cbba3acf6a661606fcebf

SHA256
43fb1d8f49041a48b705b499bd1aeb9d18ec0c1c5538523950497095bbdc7534

SHA512
a31493f59797414437f72175b186dd07ec258b884e92fd49f89ddc5c9531f26b67c9845aa76234c08559e2ebfe97f5b3ea1e6b07d3f6feefae2a897e541f31fe

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
1.1MB

MD5
e38bc1a54b032f38b717c8d72d71e201

SHA1
f114796b1d2740982ef7b31301830582713a7b24

SHA256
9c1582416c8e2fd0b29128de332479a75abc9c576975d453db4eb0f7b56bbb7d

SHA512
de29a7d45f89489f2a46107aee6b49b971deceec5587a30c3716a3e2fed2917d9c8b78662a22df65f49827c65c3b7733c199abfb8e43fb5d0a69fd433813c5e3

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
1.1MB

MD5
83d20b32fe03b46f8dee847c8592860b

SHA1
26225735815e4b9388b8254cc9645fdc0441bc6d

SHA256
6e0f9396a0845d89952e4540d4832aa52be247b3e1ae23aaf4ec260bad199104

SHA512
d4b46208a45ec090e8bbdaea88dc35e82a555125cb1838135d6df6ed43fabecdbcc17700228476cd21776f440bf432aa805448c9618553f29f60b18d7fca5502

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
1.2MB

MD5
0343046db224d2ca4191b34879ecd98f

SHA1
c64699a208ffa7b07657c1efed849ae42e948319

SHA256
1559b8ce92573ce44980359040f4b4c5d974520d344821ca352ae6d5f4cfedbf

SHA512
2dcfb12539cf6bb866bf86fe05274ca310dfbddb23f725bf35f72eda253a616fca33998feb86fc6c30067d389eef949d8682243b50bf3790e6b57f25a78cd1b9

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
1.2MB

MD5
c593d1df34aa46fa917c813e72c3e869

SHA1
03696a5f0c73253cc51df2363d31a7545a4cca16

SHA256
300530ded27747d0243e17c6beccc9f20c54ed423557f74df801a7a6da122773

SHA512
9d4d7d895f97fed90d64ca363ea3159cb15873c46e9170ff59d0abdfddcb533c9de7ce5c427e44b0d873a30d8704a4e1638f49f89502a1802267c8ee5d74b3d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yxz1hrzx.zkb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\neworigin.exe

Filesize
244KB

MD5
d6a4cf0966d24c1ea836ba9a899751e5

SHA1
392d68c000137b8039155df6bb331d643909e7e7

SHA256
dc441006cb45c2cfac6c521f6cd4c16860615d21081563bd9e368de6f7e8ab6b

SHA512
9fa7aa65b4a0414596d8fd3e7d75a09740a5a6c3db8262f00cb66cd4c8b43d17658c42179422ae0127913deb854db7ed02621d0eeb8ddff1fac221a8e0d1ca35

Download Submit
C:\Users\Admin\AppData\Local\Temp\server_BTC.exe

Filesize
226KB

MD5
50d015016f20da0905fd5b37d7834823

SHA1
6c39c84acf3616a12ae179715a3369c4e3543541

SHA256
36fe89b3218d2d0bbf865967cdc01b9004e3ba13269909e3d24d7ff209f28fc5

SHA512
55f639006a137732b2fa0527cd1be24b58f5df387ce6aa6b8dd47d1419566f87c95fc1a6b99383e8bd0bcba06cc39ad7b32556496e46d7220c6a7b6d8390f7fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp32B3.tmp.cmd

Filesize
162B

MD5
730ef2308e12a8fc0a9777970ad7524c

SHA1
373a6857739f306aff15b20d35f82c4883883a4b

SHA256
a0fbbc98995ab8ca7a2aacb79705549c56e61a6d375a5e0c4cb20e33ed017f6a

SHA512
93e5cf0738766ccf668a91cff1fb2c346f334f1150559a9142826422c21a47b4b70a3cffb8ed9ca60df4198b83cacb7a4173009b8f801fc4356e9530ac616dcc

Download Submit
C:\Users\Public\Libraries\lxsyrsiW.cmd

Filesize
60KB

MD5
b87f096cbc25570329e2bb59fee57580

SHA1
d281d1bf37b4fb46f90973afc65eece3908532b2

SHA256
d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e

SHA512
72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

Download Submit
C:\Users\Public\Libraries\lxsyrsiW.pif

Filesize
66KB

MD5
c116d3604ceafe7057d77ff27552c215

SHA1
452b14432fb5758b46f2897aeccd89f7c82a727d

SHA256
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

SHA512
9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

Download Submit
C:\Users\Public\alpha.pif

Filesize
231KB

MD5
d0fce3afa6aa1d58ce9fa336cc2b675b

SHA1
4048488de6ba4bfef9edf103755519f1f762668f

SHA256
4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

SHA512
80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

Download Submit
C:\Users\Public\pha.pif

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Public\xpha.pif

Filesize
18KB

MD5
b3624dd758ccecf93a1226cef252ca12

SHA1
fcf4dad8c4ad101504b1bf47cbbddbac36b558a7

SHA256
4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

SHA512
c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

Download Submit
C:\Windows \SysWOW64\NETUTILS.dll

Filesize
115KB

MD5
ae9f2fe85cd42e75655b466e788736b7

SHA1
0eda849180f06af9edc107b7ee03c617b7631f10

SHA256
e36d4dd90b833745f161d5875cdcf13160d4fdd3ed9cecf36b2a4cb45b79996c

SHA512
e38c812bf2697d0d841b2b703a04361dc40a85780a5486b3ba50be5a23936d908024c1cff67abb1e26a63795f1d31e3e96ea3e890545a41be8ebd66bc7f40d12

Download Submit
C:\Windows \SysWOW64\per.exe

Filesize
94KB

MD5
869640d0a3f838694ab4dfea9e2f544d

SHA1
bdc42b280446ba53624ff23f314aadb861566832

SHA256
0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

SHA512
6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.2MB

MD5
732c9643455e94754baacfc6ec39a9ba

SHA1
e01d1cab791fdd939e90d8473d223eb2d759f437

SHA256
424c878eea119ca03e2929a8f77ca12ddc299bd55282f35f69ec0b7dfaa5429b

SHA512
68540829f0c7558ace13c15256631501428b4ce7aee064812a52e8fe1ce2c7eae4e1c9699f039427425961a356c978354f90cec47f4399088c2205208f1b8608

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.2MB

MD5
4dc675d12fa7969057ab48cbb08d4f12

SHA1
af1b5bd5c92a3ce23aa69ebcf285a26594493c18

SHA256
fad795e61b8cbf0e4c1b9f42010909046e39ea745564b8c0c264159c5b2334ef

SHA512
9c5cb0879cdf0eaf51eb5acbf85ee0439d5660e67e9d7a9b6a564e1880e50c684e570050717097f6c3260b8b7cba580a5aa4d585eb9cbaa7fed4b96effe667d5

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
6710408b48b47f3310e5c45b42d03368

SHA1
e78915acf08e929733a3ef9ff2763de89cf80947

SHA256
1b93cab00655201975c10fa91e7d3afeb6cb1fc3aa9f50e581c7e9167c35d35f

SHA512
4f4db514e5cadcecd5f8b41cd6f842231e1321a01739aab69d04817e141fd09ebc255c8af1499fcc2c65407350b262f827efa2bdeeb18b31974c00025a2a4d9b

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
5a89d4f6120ce13d20bc6f41fef518e8

SHA1
714688fc5fef599a8dbf2a2ae8ba08623787b7af

SHA256
843b4b32ac1161a8286c5e238a0759585de2c340839a3765886a39becc7b89d7

SHA512
77be3c4605f0e81df69e2e62eb21b6f208c5dcbac81e4cd5f1f41b48321814f0d295e56a66a4962f104b9817fbb9e153206bb2e81c40b6961ee578949e4edda2

Download Submit
memory/536-504-0x0000000006510000-0x000000000651A000-memory.dmp

Filesize
40KB

Download
memory/1288-4-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1288-0-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/1288-5-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/1288-2-0x0000000002DF0000-0x0000000003DF0000-memory.dmp

Filesize
16.0MB

Download
memory/1288-1-0x0000000002DF0000-0x0000000003DF0000-memory.dmp

Filesize
16.0MB

Download
memory/1568-188-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1568-514-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/2696-252-0x0000000000CB0000-0x0000000000CF4000-memory.dmp

Filesize
272KB

Download
memory/2696-258-0x0000000005C50000-0x00000000061F4000-memory.dmp

Filesize
5.6MB

Download
memory/2696-262-0x00000000056A0000-0x0000000005706000-memory.dmp

Filesize
408KB

Download
memory/2696-466-0x0000000006E40000-0x0000000006EDC000-memory.dmp

Filesize
624KB

Download
memory/2696-465-0x0000000006D50000-0x0000000006DA0000-memory.dmp

Filesize
320KB

Download
memory/3004-517-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3004-261-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3732-296-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/3732-518-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/3808-501-0x0000000007140000-0x000000000714A000-memory.dmp

Filesize
40KB

Download
memory/3808-505-0x0000000007300000-0x000000000730E000-memory.dmp

Filesize
56KB

Download
memory/3808-503-0x00000000072D0000-0x00000000072E1000-memory.dmp

Filesize
68KB

Download
memory/3808-499-0x00000000070D0000-0x00000000070EA000-memory.dmp

Filesize
104KB

Download
memory/3808-498-0x0000000007710000-0x0000000007D8A000-memory.dmp

Filesize
6.5MB

Download
memory/3808-497-0x0000000006FB0000-0x0000000007053000-memory.dmp

Filesize
652KB

Download
memory/3808-496-0x0000000006360000-0x000000000637E000-memory.dmp

Filesize
120KB

Download
memory/3808-486-0x0000000072BA0000-0x0000000072BEC000-memory.dmp

Filesize
304KB

Download
memory/3808-485-0x0000000006D70000-0x0000000006DA2000-memory.dmp

Filesize
200KB

Download
memory/3808-509-0x0000000007410000-0x000000000742A000-memory.dmp

Filesize
104KB

Download
memory/3808-502-0x0000000007350000-0x00000000073E6000-memory.dmp

Filesize
600KB

Download
memory/3808-464-0x0000000005DC0000-0x0000000005E0C000-memory.dmp

Filesize
304KB

Download
memory/3808-463-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

Filesize
120KB

Download
memory/3808-442-0x00000000056B0000-0x0000000005A04000-memory.dmp

Filesize
3.3MB

Download
memory/3808-437-0x0000000004E70000-0x0000000004ED6000-memory.dmp

Filesize
408KB

Download
memory/3808-436-0x0000000004CD0000-0x0000000004CF2000-memory.dmp

Filesize
136KB

Download
memory/3808-432-0x0000000004FD0000-0x00000000055F8000-memory.dmp

Filesize
6.2MB

Download
memory/3808-427-0x00000000024A0000-0x00000000024D6000-memory.dmp

Filesize
216KB

Download
memory/3808-510-0x00000000073F0000-0x00000000073F8000-memory.dmp

Filesize
32KB

Download
memory/3808-507-0x0000000007310000-0x0000000007324000-memory.dmp

Filesize
80KB

Download
memory/4336-253-0x0000000000410000-0x000000000044E000-memory.dmp

Filesize
248KB

Download
memory/4336-259-0x0000000004CF0000-0x0000000004D82000-memory.dmp

Filesize
584KB

Download
memory/4476-242-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/4476-169-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/4740-273-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/4740-286-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/4748-516-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/4748-256-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/4788-35-0x00000000011A0000-0x00000000011B0000-memory.dmp

Filesize
64KB

Download
memory/4788-12-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

Filesize
64KB

Download
memory/4820-128-0x0000021AF3C50000-0x0000021AF3C72000-memory.dmp

Filesize
136KB

Download
memory/4896-515-0x0000000140000000-0x000000014012F000-memory.dmp

Filesize
1.2MB

Download
memory/4896-233-0x0000000140000000-0x000000014012F000-memory.dmp

Filesize
1.2MB

Download