agenttesla | 3335d593c4a2f7ab94a35fd5a0991026d1800592a18cc842686d3bf6bb66503d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ -PO.20571-0001-QBMS-PRQ-0200140.js
Size

4.7MB
MD5

5e1cdaa87915b9b6e7d852c0b7ce272b
SHA1

978f40e995fe1fd0e10f73f8b7924dd31ffb6267
SHA256

3335d593c4a2f7ab94a35fd5a0991026d1800592a18cc842686d3bf6bb66503d
SHA512

94e1811a87af0165989d69732d20f1c00981eeeb15ed976b01ff9afcdd41a38ff201252f8e003bba92541757603c29b80c69c897fc41cab51ad88b7698754425
SSDEEP

49152:Dy0k7TbmSOqsmBdkQUUb/YnBxbb20HelA1mvpxVAm8Zp0v97quF8yAmhR/:2

Score

10^/10

agenttesla redline foz discovery execution infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
s82.gocheapweb.com
Port:
587
Username:
[email protected]
Password:
london@1759

Extracted

Family

redline

Botnet

FOZ

212.162.149.53:2049

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
s82.gocheapweb.com
Port:
587
Username:
[email protected]
Password:
london@1759
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000002348a-88.dat	family_redline
behavioral2/memory/4992-124-0x0000000000EA0000-0x0000000000EF2000-memory.dmp	family_redline

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
844	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	server_BTC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrojanAIbot.exe.lnk	server_BTC.exe

Executes dropped EXE 12 IoCs

pid	Process
1664	x.exe
2080	alg.exe
3916	DiagnosticsHub.StandardCollector.Service.exe
4048	server_BTC.exe
464	neworigin.exe
3512	fxssvc.exe
4992	build.exe
1516	elevation_service.exe
2360	elevation_service.exe
1732	maintenanceservice.exe
4572	OSE.EXE
4608	TrojanAIbot.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	api.ipify.org
29	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023481-4.dat	autoit_exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	svchost.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	svchost.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\56af75d32dbdc151.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	svchost.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	svchost.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 3620	1664	x.exe	83

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{4896B57A-BA2E-425E-ACC6-3260D1FD1C27}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	neworigin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server_BTC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrojanAIbot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2632	timeout.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4320	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4608	TrojanAIbot.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
464	neworigin.exe
464	neworigin.exe
844	powershell.exe
844	powershell.exe
4992	build.exe
4992	build.exe
4992	build.exe
4992	build.exe
4992	build.exe
3916	DiagnosticsHub.StandardCollector.Service.exe
3916	DiagnosticsHub.StandardCollector.Service.exe
3916	DiagnosticsHub.StandardCollector.Service.exe
3916	DiagnosticsHub.StandardCollector.Service.exe
3916	DiagnosticsHub.StandardCollector.Service.exe
3916	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1664	x.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3620	svchost.exe
Token: SeAuditPrivilege	3512	fxssvc.exe
Token: SeDebugPrivilege	464	neworigin.exe
Token: SeDebugPrivilege	4048	server_BTC.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	4608	TrojanAIbot.exe
Token: SeDebugPrivilege	2080	alg.exe
Token: SeDebugPrivilege	2080	alg.exe
Token: SeDebugPrivilege	2080	alg.exe
Token: SeDebugPrivilege	4992	build.exe
Token: SeDebugPrivilege	3916	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1664	x.exe
1664	x.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1664	x.exe
1664	x.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
464	neworigin.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1664	3304	wscript.exe	82
PID 3304 wrote to memory of 1664	3304	wscript.exe	82
PID 3304 wrote to memory of 1664	3304	wscript.exe	82
PID 1664 wrote to memory of 3620	1664	x.exe	83
PID 1664 wrote to memory of 3620	1664	x.exe	83
PID 1664 wrote to memory of 3620	1664	x.exe	83
PID 1664 wrote to memory of 3620	1664	x.exe	83
PID 3620 wrote to memory of 4048	3620	svchost.exe	87
PID 3620 wrote to memory of 4048	3620	svchost.exe	87
PID 3620 wrote to memory of 4048	3620	svchost.exe	87
PID 3620 wrote to memory of 464	3620	svchost.exe	88
PID 3620 wrote to memory of 464	3620	svchost.exe	88
PID 3620 wrote to memory of 464	3620	svchost.exe	88
PID 3620 wrote to memory of 4992	3620	svchost.exe	90
PID 3620 wrote to memory of 4992	3620	svchost.exe	90
PID 3620 wrote to memory of 4992	3620	svchost.exe	90
PID 4048 wrote to memory of 844	4048	server_BTC.exe	96
PID 4048 wrote to memory of 844	4048	server_BTC.exe	96
PID 4048 wrote to memory of 844	4048	server_BTC.exe	96
PID 4048 wrote to memory of 4320	4048	server_BTC.exe	97
PID 4048 wrote to memory of 4320	4048	server_BTC.exe	97
PID 4048 wrote to memory of 4320	4048	server_BTC.exe	97
PID 4048 wrote to memory of 4608	4048	server_BTC.exe	100
PID 4048 wrote to memory of 4608	4048	server_BTC.exe	100
PID 4048 wrote to memory of 4608	4048	server_BTC.exe	100
PID 4048 wrote to memory of 3084	4048	server_BTC.exe	101
PID 4048 wrote to memory of 3084	4048	server_BTC.exe	101
PID 4048 wrote to memory of 3084	4048	server_BTC.exe	101
PID 3084 wrote to memory of 2632	3084	cmd.exe	103
PID 3084 wrote to memory of 2632	3084	cmd.exe	103
PID 3084 wrote to memory of 2632	3084	cmd.exe	103

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ -PO.20571-0001-QBMS-PRQ-0200140.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\server_BTC.exe
      "C:\Users\Admin\AppData\Local\Temp\server_BTC.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:844
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 07:25 /du 23:59 /sc daily /ri 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4320
    - - C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe
        
        "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp99B0.tmp.cmd""
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3084
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 6
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\neworigin.exe
      "C:\Users\Admin\AppData\Local\Temp\neworigin.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:464
  - - C:\Users\Admin\AppData\Local\Temp\build.exe
      "C:\Users\Admin\AppData\Local\Temp\build.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4992

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4616

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2360

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1732

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
9e42ddfb098f62c2763486bf972bd4df

SHA1
11e15bf15e1545fb21d0387e921bddffcf8bd06e

SHA256
dbdb4b5cbac44c2f8269c0beb46c1c625c619ed427f6f631a5779cfb045559ea

SHA512
9e4fbb20ed61a0af1deddec004420198c062f0784930e7b8ca2e7e5564776ffa3ba6adf58ca3cdc7a11b6459b902d869f64aebafca35f54720b8724bc24bfaa7

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.3MB

MD5
f57ed104e2334cd8224c96fde98f8d36

SHA1
e7ca11b24b01394a0eef7b3d3f0fbc622fcf83d2

SHA256
7d6b50149ba289dbc92f1a885e5d8eaf1e51504dddf6c9329ced788fe913df07

SHA512
60ff71244135c88241f87643a2326590f0c1f46e9983acc846c84ae81e4a31f74b42cae65ecc961eee25bb97e8de8478e4a276ef864f830f5b3a258bae67ecda

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.6MB

MD5
4ee0c91a1276e3f03ae1e941a997c496

SHA1
bc826fbf6379f69b8c80ff270ff288ae946bba5a

SHA256
bdf309a2e1330eae3cf363a1b67bf83f6508d7c284b0a938552b6d2246ebf125

SHA512
91bdc3dea17798959586a33f64cf1c1407a89e51b762cb10835785c44752353e105b1877efc31caf256499f3eed0a412f5221c9182250c9ae607929fd60767cd

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
148f292c9316f2e6d5ebbacb8373d9f7

SHA1
643311c4ca2134674279badca4c17e1de09b540b

SHA256
a03afad71b04a3442633ef356f7c130191c1e4cc89fa0dd37020992686aa748c

SHA512
c817cb3812f47f28b11a6aa8d7d0e155e64a01c2486865a23acc4c64d9f69c6dda690df6a457edf995a7afe06c9b5b1d85007ea1ce4d88e14a2a43f18af4fea4

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
e1822c3f61a41841274f96cbc80deea6

SHA1
5db80eb8457b9b3bf49ed55f5743270c38d20ec8

SHA256
1e84e06772e5f0e0d02ca189a1bffe843e69e3e8f774e3d19223d7d8de46aa59

SHA512
f4a68edb7c8ebca12cd90d9aa8192c178b8e12604abeb45e33462e52640750deeeeef96a8e3365e4f0d384aac64a7c611d8096d2ef5dc91dab858290f4dc9562

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.1MB

MD5
32850df103175a181804cfb2793f9edb

SHA1
174828b40418b64a47cd95813126010d851bb518

SHA256
edb8906868a4d1cc4a1a543e1406e1cbf99f41d02fa6fcadbb4c3c85d5944f1a

SHA512
165beef04eb4f6313f2841afac2453de8ee5e1f82af523125bb8f67a9a24355d8ca5497acf215338f530137fcf578c40873da95eb82daf0f08ccb857f0f3d6df

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.3MB

MD5
15a5dc2ae44e315e89cc644240e55351

SHA1
b9fc6841a282131f96ea1c723d40cac657ceb9eb

SHA256
63b9b4a38d77a191c4cbc7bc15cb1c59d548661ed837bd12a52a131f450aa782

SHA512
2769ecd3a139991945f66149853d83f78717367832d3124f99aee59a6b642dd4f83d72d7283b22065a0a4293af15dd5ac709391cdd5eb384515204772a0bc25f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
e2c04cafe1cdfe940e758850f6c26d02

SHA1
560be5f35aa83a57dafe79e59132011c5398cc51

SHA256
662ba131bbb95d248984a96d94de30040fbf5f90d8cafb68d4bc501bda79e5d8

SHA512
0621842c794af702f2fa304581c8e59a42d509826d0dc4959a011927842f668d5e7efffb6dbb5948fecb2680407468f3e10f019fd242bb3975aa212c26740023

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.4MB

MD5
87fae81a12f45f036573155c42ee6376

SHA1
19f8b95c530568c7e3617dc7003b10db777d448a

SHA256
c348d5297432dd99fbed5583c7e6f4a9e2c9e8f2cc53feacadd967830023bbad

SHA512
a23eb1dde414b7505ee7573af1a59a37c5bf0f1c031f88ee1d95a5d54120cc308c4f922ab069f1a5f5a5235a569dc70eb328477762214b28872742de86fc86ef

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
e2cb2e714a5f122e148447a0b2abc038

SHA1
165c1fabd70314e5bc245258b64a1bfe87f5483a

SHA256
15b976d4073ee2d8b5e30a62cebc75b2ad940bea9290cb6f8d9a80df2dc79800

SHA512
6c2eb161a62a284af400fa143637c1b498e13b770f250ff9dda0e92ea9259973c327a057120c57847bb6ca06fef3e4de3a6f07e1ea78d5830fa06841d5a6c568

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
b9dbb82b0852f7c82deaef10b0e63015

SHA1
994d979234963163af8647256a3b7f46fd7977a6

SHA256
30fa140dfa69665ae20a9371ecea203944bc91f0e4ad23aac7723c0196404d01

SHA512
2220248781380c497d0bcfe77c5ca6c9c198fa86d22a158e527fcc0309283e3c7105f01c991ff8c4b410a4425395708a3a1a3a10127880fa1c0b1727b02a0efe

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
16135f77c57aa6ab35cb7094903fd3ae

SHA1
e8c706a5744d20da13c9473d504467affa050977

SHA256
d15e9a7cb4745190d1d4e612b4da484e7096acdfa0732c7850a07733306696af

SHA512
3c2a57b634b1ae3e3a32c98e2efd7980c1ebb3f65760e438597b9d36ef1fbfba129965345c08af4de6035f6c5a1d9817759364808d4d41065bc520f7b42b93a0

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.3MB

MD5
d5092061fe1b77ff61fc038933a73d2f

SHA1
7a8caf44d8d1294d5e8a4ee0084128cc897f3d0b

SHA256
03654ae403eb652ed9e067549ffeafe2002b6a2026074d2ed36087f951decd92

SHA512
842dbcff68aa509e758f19115edab3e42a3e52b7702250707cb032a975c7c580a97966691a1cf7bace837a35d4f0c2a5a1dfa7876d119bf39b419ff1e6627d98

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.2MB

MD5
b343e36f9ba016ae017068ac03f7cff0

SHA1
dae9d16805a14f1c5ca4f6c703aaa20948597fca

SHA256
7305c11d711dd9ed1a5fd7c8360c987b5c5f4f5f03f3719235b6849d3acfc041

SHA512
fedfa9a2f297d8e1a480be678d6d83050a3993d7fbcd07d1d8d725ee805ad699ef97b9411006aab254dd528c271c48e9419f5834fa284d2eb666c708e384cc64

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe

Filesize
4.6MB

MD5
bbe727d6f6e8c98b92ca934d661b4a09

SHA1
ed5b4744d67ad8160aec9f09f851e59c7654dad4

SHA256
c734eac30eeaacc9d811680032ee7776655383dcfa67353417aa9767a6bf34b5

SHA512
ce266ee54c5c9e350d34d4405c7aa81e5481681d503398d4ca1ec83bd7bedc08122b8107a464d926b0b255deb44180b5ae184a0fc4ad2ebf229dbc0f49f7812f

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

Filesize
4.6MB

MD5
f8e2b54e3f6a4e2c4cb58f6b959e509e

SHA1
efb08654833ef63eb531f7aaeb92048e25854688

SHA256
ecf5e51167e56a4ad725eb92631e5a3eb34f1f30d7480c8d2c2fc619a1abb7ba

SHA512
c4bb4e264911c4b6cc260ae2d8124e9a37e7ddf2691eb1e5bdce92e33931e65ca3f0480560b4a1f836dbdb355e00f51d62027e4fcb9a475e2065e2c6ec066daa

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe

Filesize
1.9MB

MD5
256d6fe8426aabb1a2f000282c157086

SHA1
9b3b00c227aaa7dc34b735db9de534b21b2570d5

SHA256
01ba3ea3afad07b375e443bbb6df6176f8fd1b93868314ce0dad8373dfc88f35

SHA512
a9654ff669a4d9332b7279385af49ba137cbdadfa28bbe3d680e67a61ecbec33668185aa954120a36f93ca152d97744772d9158c65dad3a046262d243679b889

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.1MB

MD5
b536398b64ad873bb7eb26bb6f4bf87b

SHA1
b3749d129f5461972e69ed08c60675d913919f45

SHA256
bc99d6e7553dfe7de888cfeabb7458861166ba47f202557c4ab577462d509d0e

SHA512
81203948e99d5208710daa20d30455bd778f4b912720785262e95c18acd77d2e624ae3f64ad3f6dfaedcafaec4e3b6b99bf4ae6a251018b662a860e41401d452

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe

Filesize
1.8MB

MD5
a3a776f743a2d3968d6c84e3f19a03f4

SHA1
556c710c5b731ee54ddc0ebda2dd753ea5d7a676

SHA256
55a791841ae401839dcf41e63c85a4397bfafae4ff94fc1ac71566edc4151815

SHA512
3d39fc1df4003dcde907aaa07cf77bf88d289d50b393ef21ee05e9c5c83f6ea09127ba526d1d7a7ebaef5dc6df6ca01867f2b57d5c8fe8f725a6b03d6933ee11

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.6MB

MD5
52e22327118a153687cfb606fe8bbeac

SHA1
28e394556c14e29ae0bca0e77270d280b1404a14

SHA256
afd607d38ff9167c7214c63d49224826fd66c67eaf7fb8c680b91c2c8d80ad10

SHA512
6fb6f27b1decee4513f09864a8e3e3d2a5fd497e34e869190cd2a06eef6e55a023f0024b5594d2f42a9fb7f4bc6837fa612f154c21867017e31cd8ea9c3b376e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
1.1MB

MD5
a2553a0878af18d909ce5dd3d54dce2e

SHA1
f11bf20bcd4569d3fc414954259d8f514247b888

SHA256
1e5600bcb5fa54af174124958dab2ddfd4ffec5f7f190ef35be0cd016834c4bc

SHA512
c151339e61311e5d6b9f8d5e50c555e7d6628db654826263b4942f9d7cb3765ec4bf75298a15af4ed4248a3a8d32fa26a04ff4ac16a162404db6eba37560d35e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
1.1MB

MD5
53ccea8b124b74604ce123ae90123f0e

SHA1
5ef9026587d6e55c8f3ef85c00f3f3bd3f1a5152

SHA256
5d65a8eb2b66d1b777545c38c90bb1db57d7245bd9c4174945b6ecadd1217a64

SHA512
132ef3f5116fe890685d600d27dba2c4a6a2457ad21ccfa5c9bfa0648e9e0916c3c21c9897dc301b1d4cf9fc41b0d5626b8b402bdde7edd919a5a6e3f93458a8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
1.1MB

MD5
a0d381866cef255996fa97fbc0dba364

SHA1
036e8ecc190c54b6dbb23802acdb165e3b43a924

SHA256
0b86cf9d01c491d494714ea95fcb239ec0ff0ef5828ccce20dde53c4e2cb6430

SHA512
0fdfaf9caa4cc704d16e766bc4b2ff32fee09b5e421a9e52ec8dc075a9974fdf13154a8a62484e393f213dca3bda5aa58b4163bba1d3ee2f8aa6a286e4742ff9

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
1.1MB

MD5
73eadf6c60b1aaa3ecef269044b6ee71

SHA1
a309d3f8af4643307813c4a1df2f3f6c757fd063

SHA256
d2dc0fbfcc510de2f3b699b670032bad684b6bf0e6941ed21bf1327b5d7096ba

SHA512
4dc0e953513ec13849dc72cab8b9563d153691dfb5de0747c0149553c32af0307fcad9578e09f77320fb90d09b4c96c0384e4e3a37e33636470f417e44ccfb98

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
1.1MB

MD5
af8557aac0231b8f0a6e3e3aea76e905

SHA1
7c909d46158096670e0bdfbbdbe10cea617bfa9e

SHA256
d264dbdcc63c3809cb369030e106e564431ce825a5cd9a0d006c02a5a1fc2070

SHA512
8b4e7bd7bba9492c00278085de51080845d675be8f62e5e670407ae513b8aec3d800395bf5caa4b0441097363ae0b25b0ec2c91970d49a4c81d3fe398f626972

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
1.1MB

MD5
5f283c389d94d720fd907ac6625f75b0

SHA1
f50430709eb15e8ad6971bc6caa09a6465f47434

SHA256
5ff39a52324d238b88be93b9f42410efe6059c20e52da04269d4fcc5fc83242a

SHA512
ef872716cb1e26362cf549c4f5a3d331c4e77625874a3886cd7f4c0deec74c89ac555db16e8b0c10f4e18e617de95aca32ba07aea2f854cdfa15a924e772290f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
1.1MB

MD5
36cf5d420623f75d36b5b1a4f9a03778

SHA1
3f5564c397340e99886c5df139ec8f61edbc3290

SHA256
670a7b9985a4ac5195860860bf50da757f2041c36e753b07b7fb9e94dd431000

SHA512
2b4ba97f93486b34aa371c39f64ae1cb2463aead06d9cbecb1562f7714d3da9f9bb843c5a8b610e018d728de9f99eca4ac946b6fd090bd29c9a788491b5a5e19

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
1.3MB

MD5
51f723842a7aa9a008621ede4d032d24

SHA1
aa9d5b6ae375d9566fb45c57a5b385d40845a424

SHA256
36338b17d7567ce5281fba36e665f217cab402eb1928847a8a7fcc65b140ae5e

SHA512
c6a56e6732ab283c2c05943bc3aca8b87679c4c346f5da4973644c7a00e158a942832c5d45cbfb4d0639e34df2459646d4c566ee85d29eced560173185763fe4

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
1.1MB

MD5
0adf706eabf1d6b2e80b51709876ed19

SHA1
a66afb9efd0fc6ceccef4a02229421f468ed5852

SHA256
aea5c138b21649cee7829c5587cd61bfd3b7fea8c72f7298f1b677ead8b959eb

SHA512
a8b2eba84e602ff15a16e6950891bfe4f3729a61b94569d23c24f319aaf0ae164bbe05ed3c29ca7e31341d86f496862650279f68b298d21bb577ed4c410522e2

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
1.1MB

MD5
71c6ea7760b0eadfeaeb732909fba724

SHA1
470ce1c0f4a5fb8feddf246742b7af140b35130e

SHA256
98714f8e26b27ab62993fd523e938f112af444259d3a5280902d9da5b78e9160

SHA512
79e4e3a2fb06181288fb7c8051f5baec4becaacb33038bca8db40e47005a6d402409c6b25e51e2866c9e02e07583c822058567b3ff26b8502c4e704bbcb54a60

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
1.2MB

MD5
cad7f40f78c9254873753aeda5e6a4bd

SHA1
0ce4053a340d7ba6c370f44cd09171329379c535

SHA256
9f0368fa5de41118a55ad92c00e916fa1bcece24810aa73be7adcc3de7b08ff6

SHA512
e4154cb33f620dc03d158bb1c8ea6bc46296ff9e1d274adc549ece055b406384d1e1fbb55a2255d12dbf07623cd12ee3bf37bd32c0017089cc652b915d2e7983

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
1.1MB

MD5
112f55d2e3881bd607eade5a5ebded45

SHA1
e7c77a42c4bbffe260c29d2e3e49e6c9a1706433

SHA256
1759c8a9d577d334aef0d01d1d467a610f791f9bb56d6629e4b2ec12d3c3452d

SHA512
918dfddcee8ae3a154b6ea69639fbd28b0d571f0efbb0086ac68aad35bdece3caae6390711c221ce3cee1a4bb95be273746155f28b0b30d8a55722e0c5abaa56

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
1.1MB

MD5
cc54ec7ec1247c14d4709e3ece649d7e

SHA1
6f36e0eb771cb39c9cf6db183d90d07ba105077f

SHA256
e0be88ca256a9c4654ebac124ea9f8bb0e5e8824d54d20af222a91886e02e420

SHA512
d880c391f6ed4ee5bab1d116858577c3c202191dd0a008dd75e864215e40c91365c2c65a07df323dbf12b4e46489523c77fa30a21bc3d9a8a09777a57e09797f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
1.2MB

MD5
5bfa1b9d14a67e186e649dc4a29afa3a

SHA1
0259f38d6b5413bc80b9bbdbadf2a89bd702a5b8

SHA256
409dfe0c80dd87aeff0eda09022773321bfbb67f163784f9eddb797e622d7783

SHA512
7f917ebc968bfcab8afece6a07ff0209011f8d2c43d9615b25f9e89a9df76e4b3a5d0830d86041286a6c025f48efdc0d5a35445a6d45cfbe121133ccfe9ee89f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
1.3MB

MD5
f225eaee0f0068a8001ac409b2804d0d

SHA1
0c3e17a36a40d83a3b15d8e269ac8bf579b68722

SHA256
d0384d5f8eb53cb1a20511d1ed44c16fc01b8825838045bc677e109d67a51c34

SHA512
a8bcf0ce04570f017aee9975cf74924cc9b49158d3d1ac590cec18598d104fba30867917219f3fc6f4ef422c5aa00a96cdfea7c28f243d229d68bb0f2e5a4e69

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1.5MB

MD5
d406bff02b6c28b4f465c51c6f05e9d9

SHA1
397817bce7b55df4f0dade18fbae71f40113860b

SHA256
9b3906088225918b948f19f3d41a5a8f405b57e8036f3768bb240b387eae1e97

SHA512
361cfde9459ed7420e34ed0dfd1c8877ac069f9dc551ec6059c4fdce38505b52cdf615446ac27e5785299936417ec04538e88bbaca5f0ee5c22da0b2b7b213cf

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
1.1MB

MD5
be29a779ed819cdade76482ec995f759

SHA1
590e0a6ce8bcc877ab7bb3733c6b8521cd3538fc

SHA256
14c784b364046e042cd329333da071f299340c8698722593c4fcdf70a74d444a

SHA512
2b6253f718ca1c6c5acdeef920dc00e58d70815400919ca084d139104fd0c422769dc3d162a45bdde264364524e3d717fb88b698e91fca63261f1191a2ad3a91

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe

Filesize
1.1MB

MD5
7066201776b3e85c97deb1cfc499cb9f

SHA1
0b954de2e9f6ea7e9a4d30e4876a17cd4d11bac6

SHA256
6c9bd660d9e4ec1a66e6c991fc9cf5aff2ec7ba50d6d9f00af8118fc8c189d95

SHA512
da7443d7bd310e332bb0463237c7ec9195ab37026199757b5a8ae1ec4f1d0386ec7440d8d81a5ef72bdc553c218a7fdc92ebc590e0aa3443869fe5129185b45e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe

Filesize
1.1MB

MD5
11847300cb339f900abce5d674997ad2

SHA1
822b202bab9a3cc6e61926e2a9fc02136dfda042

SHA256
7c798679c4ecd36334e71ee0df3eab8aabea3a51cb1baa540a1ae54ca16c0b27

SHA512
3ba0b2973029c7624afce5f26e143b3ffffe26eb71b27047cd7e434e6109557fa9b2af0e7dc7bc12f11d18a03ad8da17e692cc41632e9be62bece865f80283f4

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe

Filesize
1.1MB

MD5
efc71508840d048d683816aadcd0be84

SHA1
976515bd8730b9a3f2f4174e2870d89ea442a458

SHA256
a9bfeea683fa688caa5ffab1ec52411f1692d706723c3a5f6a790ed4141494c3

SHA512
85daa5e11d88a6e62754527dcf27ed99175775ff3c48747c6e86f2feecd0f464461293f446d61c086c19756f76b1129156d711944b116d990a7e561187352087

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jhat.exe

Filesize
1.1MB

MD5
d1d1f32629d8a013a3589dc84bf4dec8

SHA1
fd02f7fae09f53cf0623386cbc2ba6b3ae9bb6e3

SHA256
79eb3369529fabac4d5eb7713843f797a301645f85294be9093dff43b94679ed

SHA512
f4955e4762b9cc97c523a57c38ef6ad28ee83996cfc170200783872b9124ef41121fcd399dfa2830c37f683670ebe5e53876ee332933366b7fe2ed96afd5177d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jinfo.exe

Filesize
1.1MB

MD5
709c23bcb14c70cd804291e72c15fdd4

SHA1
2bde811fdc6d35706fb7ba7d0d9fba1a082f1d5e

SHA256
f109026fe099ae393b04a04ddae381eb0c6dbd4ac8cf54c3321af0ae1c511a9b

SHA512
4ad7929b7a3ce0e5af4bc849e689e63a0875e530ecdab858e5b0da16f9610b670aa01d1f55252285c9dd689d1b837d22f1862379112ef3e1e36b3f86e9d629a6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jjs.exe

Filesize
1.1MB

MD5
180b5d764e7088c9ee1111b181f1c1c4

SHA1
1c7d3640fe12bcc7997ebcd3d2f0656530b939eb

SHA256
95a04748421cc38a85d81d2cff3dc095e6c7e63fdde8fd7f7cf2abc253c7945e

SHA512
13e8ac1042666c6b8169548c7d1c29a11943b383a76508eeab229dc85b75fa90b9d7d4a882d86e4aa4a5fc20a4f2bc7beed23b83434d962c81d383d79aee1e84

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jmap.exe

Filesize
1.1MB

MD5
96bda5d8a7e82a2c4fcc2d380d986a80

SHA1
086649e768b73be3d64e70f127145aa8621fe630

SHA256
b6c8b67c1981d4fd7ef18d7783d81ada52e564bf85fd4ee5a068cbc0bece29dd

SHA512
cd6b61fa5673904e9e3abb74d201dc8d1edc37c5a7fcd4d246de11f3312e4a029f8346ea5db18c2c8854b7790e2093a1ce269ef8cb174c3e6f553df5f920dea8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jps.exe

Filesize
1.1MB

MD5
ce6f67e1c087fa0006e63a6a62e016a5

SHA1
a444086d499e565c5bd9ce1cd8e8042a64ea5d3e

SHA256
94e3f562b783b6d51d2bbb48d70d5083440de570d54af36496aaee69ead5682a

SHA512
ad11e46b2b115387f2611b771b9f93dacfab3de3d43f0d7f94b7b2671d9fce15bddec8761ff47ef24698c85ff7c1124a2e234529829fb0c5062f27997a8f6b00

Download Submit
C:\Program Files\Mozilla Firefox\firefox.exe

Filesize
1.2MB

MD5
e4cf3ccc0f58dc9e0c1d530e07d1513d

SHA1
23cc6503fee45831db6c4b5a9969c328d4cbac42

SHA256
b96eff3defa5a2eedf6cb29e6a53a91609ad43fc4ef6ca772ac2444d1eb03632

SHA512
9246f92d4a6e1e9fe8dc9e9a96b41bf83e64920c5442b1b55fe7170c4c9d2908b8aa5656f208477883d0c813be7a24e9f310d3d990013e6835f35742809edf09

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
1.2MB

MD5
03bc1609f6b31b04052c9a71889e908b

SHA1
fe8f7ce0003d4189bf98ef70af483df39c3ceb5b

SHA256
3f00e0137d88644a809de5515ca37c0536596ed59ec0f18ec8ba93b8ad494fdf

SHA512
45d28aec87f861db718fce568b3f34dce1f866b8a7a67f7ebf83c086b317ba12fcc0cdfdfafe1427505bfd33f1c4c634fee981c27c7b46bf3866d017836fea46

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jqulwp3.zxy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
300KB

MD5
3b6501feef6196f24163313a9f27dbfd

SHA1
20d60478d3c161c3cacb870aac06be1b43719228

SHA256
0576191c50a1b6afbcaa5cb0512df5b6a8b9bef9739e5308f8e2e965bf9b0fc5

SHA512
338e2c450a0b1c5dfea3cd3662051ce231a53388bc2a6097347f14d3a59257ce3734d934db1992676882b5f4f6a102c7e15b142434575b8970658b4833d23676

Download Submit
C:\Users\Admin\AppData\Local\Temp\neworigin.exe

Filesize
244KB

MD5
d6a4cf0966d24c1ea836ba9a899751e5

SHA1
392d68c000137b8039155df6bb331d643909e7e7

SHA256
dc441006cb45c2cfac6c521f6cd4c16860615d21081563bd9e368de6f7e8ab6b

SHA512
9fa7aa65b4a0414596d8fd3e7d75a09740a5a6c3db8262f00cb66cd4c8b43d17658c42179422ae0127913deb854db7ed02621d0eeb8ddff1fac221a8e0d1ca35

Download Submit
C:\Users\Admin\AppData\Local\Temp\server_BTC.exe

Filesize
226KB

MD5
50d015016f20da0905fd5b37d7834823

SHA1
6c39c84acf3616a12ae179715a3369c4e3543541

SHA256
36fe89b3218d2d0bbf865967cdc01b9004e3ba13269909e3d24d7ff209f28fc5

SHA512
55f639006a137732b2fa0527cd1be24b58f5df387ce6aa6b8dd47d1419566f87c95fc1a6b99383e8bd0bcba06cc39ad7b32556496e46d7220c6a7b6d8390f7fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp99B0.tmp.cmd

Filesize
162B

MD5
f50a0d9737457770b78b0a2b3926e97b

SHA1
dc12a22a6cf662c2abe0ea8cf0ed32d87cbf35cf

SHA256
0f8bfec963ab4ec5fb69753eee48dc988e725143c74532ddba38bb30f7a848b6

SHA512
4a68f495ef024bca5656bdef2e7eca27bd516202942f9e1e87362450645c45ae6187a3cafa618508afc9c930177da28613286197452369aa8def3b4ec75d5b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
3.5MB

MD5
e7114d96ec31d8cd1c0233bd949d1e0f

SHA1
6433ace48fc9a6d4de4451d0a35c91af7c69d507

SHA256
771b160a95fb3bafe050a2e5552a1c697a5982773104c6a2b9549b538935ed23

SHA512
66d19fd4eea704b67e5f3568590ebe3ea42cdb0426fa4bafbdb35814f9fac21ac37126e4a3ea238f8dfb8e5cd5c2bdbe4db60a26b72ce3883f40c6ba4d2113d7

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.2MB

MD5
526969de6b0e3a37099d2258ae167384

SHA1
4ed1eba3b74d2f7bc6cd08b2f7a1c42968c20506

SHA256
750418894d019fc8e1baaa898777ae1f8c795cfc5a99ae7a648ab630da663a30

SHA512
ac2603e880ba5882884eeb1d2b2b78d934bddef10f5f814fe5fb545624d8d8649cbc1c4c5d00f8da9f92c61b4d3bfa40c58ad0eb8aab3bc8589f91c43cdf2fe7

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
479da299478c96114fb021922184e388

SHA1
b105916144a929c41bda942cc1e70ddd9244f743

SHA256
31b4f43e2d5cfe05e7f0fc30e4f937b22fd3737cf67c30852c79c648ff30336c

SHA512
ecd0a92d831c520e1ffe4decc773068d6b9bcfba0bf241f283331ba1b2f75916410cda346b2306819e6e7843a2280981fd3b7448331ab759e3fb6e3576f405fb

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.2MB

MD5
e55fed9128d55cc6a32e1da5ecd5f92a

SHA1
92bd87d24c7b39221d8e02c0b13f4f85b0a01cbf

SHA256
f728620ca5cdd8b563aad5fe92581baa7d932d99ed6353b16483b9f652424542

SHA512
1c5f7f7196c0b368fbbfcbd1e3a842208b9643be3b009e912ee7a6f7d2c6292f8793f44bc42650c83495c7d755e5537987d83c073b3a81d1a64716fb052ad760

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
ed80cecd1dcbfd514ca59dfb0d3320df

SHA1
57b117b26798e20fbf9e198e46c0993e2b75d27d

SHA256
617d6866c74589234a707da11d7053ae7a41317c11cfcf036537b5dd22e3852a

SHA512
214415cc2f22780695c449e1bad1760e49e803e42519713fa2a121b0de1005db428ae59a38f19e1803db334beb5b65de9386f554eafe613e88f9b9560e360150

Download Submit
memory/464-152-0x00000000059E0000-0x0000000005A46000-memory.dmp

Filesize
408KB

Download
memory/464-364-0x0000000007140000-0x00000000071DC000-memory.dmp

Filesize
624KB

Download
memory/464-122-0x0000000000FA0000-0x0000000000FE4000-memory.dmp

Filesize
272KB

Download
memory/464-361-0x0000000007050000-0x00000000070A0000-memory.dmp

Filesize
320KB

Download
memory/844-340-0x0000000007610000-0x00000000076B3000-memory.dmp

Filesize
652KB

Download
memory/844-283-0x0000000006020000-0x0000000006374000-memory.dmp

Filesize
3.3MB

Download
memory/844-329-0x000000006E0B0000-0x000000006E0FC000-memory.dmp

Filesize
304KB

Download
memory/844-328-0x00000000075D0000-0x0000000007602000-memory.dmp

Filesize
200KB

Download
memory/844-357-0x0000000007930000-0x000000000794A000-memory.dmp

Filesize
104KB

Download
memory/844-356-0x0000000007F70000-0x00000000085EA000-memory.dmp

Filesize
6.5MB

Download
memory/844-362-0x00000000079A0000-0x00000000079AA000-memory.dmp

Filesize
40KB

Download
memory/844-310-0x00000000065F0000-0x000000000660E000-memory.dmp

Filesize
120KB

Download
memory/844-339-0x0000000006BC0000-0x0000000006BDE000-memory.dmp

Filesize
120KB

Download
memory/844-271-0x0000000005750000-0x0000000005772000-memory.dmp

Filesize
136KB

Download
memory/844-365-0x0000000007BB0000-0x0000000007C46000-memory.dmp

Filesize
600KB

Download
memory/844-366-0x0000000007B30000-0x0000000007B41000-memory.dmp

Filesize
68KB

Download
memory/844-368-0x0000000007B60000-0x0000000007B6E000-memory.dmp

Filesize
56KB

Download
memory/844-369-0x0000000007B70000-0x0000000007B84000-memory.dmp

Filesize
80KB

Download
memory/844-370-0x0000000007C70000-0x0000000007C8A000-memory.dmp

Filesize
104KB

Download
memory/844-371-0x0000000007C50000-0x0000000007C58000-memory.dmp

Filesize
32KB

Download
memory/844-239-0x0000000005040000-0x0000000005076000-memory.dmp

Filesize
216KB

Download
memory/844-261-0x0000000005820000-0x0000000005E48000-memory.dmp

Filesize
6.2MB

Download
memory/844-273-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Filesize
408KB

Download
memory/1516-107-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Filesize
384KB

Download
memory/1516-378-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/1516-101-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Filesize
384KB

Download
memory/1516-109-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/1664-13-0x0000000004BA0000-0x00000000053A0000-memory.dmp

Filesize
8.0MB

Download
memory/1732-126-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Filesize
384KB

Download
memory/1732-135-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Filesize
384KB

Download
memory/1732-151-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/1732-133-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/2080-38-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/2080-30-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/2080-36-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/2080-363-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/2360-118-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/2360-123-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/2360-379-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/2360-112-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3512-84-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3512-163-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3512-90-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/3512-96-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/3620-14-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3620-99-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3620-25-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3620-17-0x0000000000E00000-0x0000000000E67000-memory.dmp

Filesize
412KB

Download
memory/3620-26-0x0000000000E00000-0x0000000000E67000-memory.dmp

Filesize
412KB

Download
memory/3620-16-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3916-43-0x0000000140000000-0x000000014012F000-memory.dmp

Filesize
1.2MB

Download
memory/3916-372-0x0000000140000000-0x000000014012F000-memory.dmp

Filesize
1.2MB

Download
memory/3916-44-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/3916-50-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/4048-121-0x0000000000D60000-0x0000000000D9E000-memory.dmp

Filesize
248KB

Download
memory/4572-380-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/4572-140-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/4572-146-0x0000000140000000-0x0000000140155000-memory.dmp

Filesize
1.3MB

Download
memory/4992-153-0x0000000005870000-0x000000000587A000-memory.dmp

Filesize
40KB

Download
memory/4992-385-0x0000000008590000-0x0000000008ABC000-memory.dmp

Filesize
5.2MB

Download
memory/4992-384-0x0000000007680000-0x0000000007842000-memory.dmp

Filesize
1.8MB

Download
memory/4992-124-0x0000000000EA0000-0x0000000000EF2000-memory.dmp

Filesize
328KB

Download
memory/4992-132-0x0000000005C90000-0x0000000006234000-memory.dmp

Filesize
5.6MB

Download
memory/4992-134-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/4992-166-0x0000000006860000-0x0000000006E78000-memory.dmp

Filesize
6.1MB

Download
memory/4992-170-0x0000000005B00000-0x0000000005B4C000-memory.dmp

Filesize
304KB

Download
memory/4992-167-0x0000000006240000-0x000000000634A000-memory.dmp

Filesize
1.0MB

Download
memory/4992-168-0x0000000005960000-0x0000000005972000-memory.dmp

Filesize
72KB

Download
memory/4992-169-0x00000000059C0000-0x00000000059FC000-memory.dmp

Filesize
240KB

Download