Overview

overview

7

Static

static

3

cd768244cc...7a.exe

windows7-x64

7

cd768244cc...7a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 06:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cd768244ccf106bfe299060b93ae6066cdc144a5c86624448c9a48bdf0a25d7a.exe
  • Size 1.7MB
  • Sample240927-gszq8a1fpc
  • SHA256 cd768244ccf106bfe299060b93ae6066cdc144a5c86624448c9a48bdf0a25d7a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd768244ccf106bfe299060b93ae6066cdc144a5c86624448c9a48bdf0a25d7a.exe
    "C:\Users\Admin\AppData\Local\Temp\cd768244ccf106bfe299060b93ae6066cdc144a5c86624448c9a48bdf0a25d7a.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Program Files\Java\jre-1.8\bin\javaws.exe
      "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3936
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:736
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:944
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:2020
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:328
    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2856
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4044
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:1384
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3232
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4268
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1132
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:4724
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:244
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4472
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:4036
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1188
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:1300
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4400
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4500
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1516
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:2336
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2192
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2824
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:832
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:688
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:4532

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 a2df743c9fe3560abd69f9f64137222470702ca9e25e452057ed90b9055a21a0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.3MB
            • SHA256 859be5a922324c3b00a7373c66705a2f33a64361d40d4a3cdd514b806a767664
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.7MB
            • SHA256 3907c4abcffb0896cba37e2ac1e1054cb828bf56d5b37e1704229d764db4e34a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 26769f22e7bd49155d63c02dfabc99777fdd98ea2186d000cb73746bfc1513b1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 5886fd4e7a9ec5b3160389b94ebdef7635bf344cfd9dd5ef8d7f50fb614e50a1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.1MB
            • SHA256 8139a3e1f3f16ae09c32e105978b613b2b53ab63733b4c96f2c6045c2aa75de5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.4MB
            • SHA256 8c997449dbfcca14498ab42a0c41a2a8ad8767acd280d2fce9135e9a28ceb889
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 1e4cf9599f210d8cb92eabf861dfdc1d5fd1d12adae9f14ba66a5a727be994ad
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 1.5MB
            • SHA256 bc00ace1d3650357f01fda2151c21406269baf20f0183b7ca3dbeaff7edfb7d2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 096d3aad1f560ab04b00dff97bceeff34509291d8b936cf23245b1f5943e3b95
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 fffb3d67dbe47923e92e2dbb8de3853cc84261c516affa9c8b68d28975ef4bb3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 2a77bb0bb1342a7f79228fe8d8715f7bc702532d984638a5d7982c11bf891f63
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.4MB
            • SHA256 a35c8f95a4c258d1c80d577d0b7ce235f511954bc80f56b02f0a9070ac4226a8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 1.2MB
            • SHA256 1b1110c5cbcbd5d553a304472eb63b51c1fb3033bff377ecab51a0fd16f65bf1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
            • Size 4.6MB
            • SHA256 3da1452e77fc2ca235b0096f94883252016f71db137406ecc3c7d99ed55ede06
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
            • Size 4.6MB
            • SHA256 3b5db79cf9ceceec9b42d0f6c10d013a5977fa7ac170d7519f13eeb8ed55098c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
            • Size 1.9MB
            • SHA256 4d517fa820f2219737ed393f8c80329da18ed9bb9b01690771fbe5c433b9d573
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
            • Size 2.1MB
            • SHA256 cbc6d019c250ca2eb4ca864be037c25c5c7f428cd42a1dd2460f7c83742bde37
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
            • Size 1.8MB
            • SHA256 0149cf0ac2b4546e39334fa9bd30c9a378a1e8f77b72e76e14549d452961fc0f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.6MB
            • SHA256 450f27c9ab5228955136524c25e11243115369cdeeca2d0fbf90b7dabf5478f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 1.1MB
            • SHA256 28a88d20afd4cea9438e9ad7c6bba8e0709428b6441dc10344742afc4a80ad63
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 1.1MB
            • SHA256 0d37134b28d2ce58b5672eccdf173f17838a15e6808dc8bec1d02ebeacfbb89a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 1.1MB
            • SHA256 cc7e4749cb2a3839f78e527a3bd1fedd99d3ce7e78b4f2e966aae6fb918fc776
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 1.2MB
            • SHA256 0106dc0da5c06ccf1c8a738cf3e40c30a951ad626291821a004858695a64e234
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 1.1MB
            • SHA256 22ce7290f2827394918873439c82c31a79ebf84e7bba379f01183e9d4b45fa6a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 1.1MB
            • SHA256 595e969a3a4da0d391bc23c1289b854bdb2e676fe91868dc8a5a5f3c62d91017
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 1.1MB
            • SHA256 d2486b1dec01c99134df8577766d6551deb2fbaf74b30401c740d9c5912a9e70
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 1.4MB
            • SHA256 32f2173b8ee9c686193287408354048baea5807d3ba595f164a55c1c4031caae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 1.1MB
            • SHA256 a456a0b572f722d2c200de2ac2c34cecac95dde91265ea110654364029749ae4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 1.1MB
            • SHA256 6ae8d3e2501bbf257b222da492da8e8bc94971e62ba728a8db6c8427805a743f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 1.3MB
            • SHA256 2685a802fecc6275a2b37b8eb68aea3bfc5b30b8499bb2533c7fb26d52cc0977
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 1.1MB
            • SHA256 7c726aed8110172bd7424bf5ec9f06f6fc4dc8ed6e867b1b61defff75c1e8abc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 1.1MB
            • SHA256 639b25ce013b6afe16bae33478c0a3f8929508f8c9415b06c3b7e1f0d7b710c0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 1.3MB
            • SHA256 c407ab9ec96412d39df16e60db596e70c62ef961d51932555f83e8f5f314c0df
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 1.4MB
            • SHA256 3b8225ea8429a56b8cd0d7a2a0ad9660babddac1e152fff97d9f0c9d7895386e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1.6MB
            • SHA256 838ba372590925be3242a90d3fa0df329a1b783c1486b15e62df585a6753a277
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 e95aaa2f6c9a18706c2cd92569a90f55376d382d8de275e71f75cf8a4e70ffda
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 1.3MB
            • SHA256 64b39e25abff5179c31c94ffba7c772ab3a432dc173cbc1002e9ea3ee4c98807
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            deployment.properties
            • Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
            • Size 896B
            • SHA256 93f061b50ee18cb442f09e220ebb18154cd7768308b504b6da8e9102e08e6c16
            • MD5 SHA1 SHA512
            Submit Download

            securitypack.jar
            • Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
            • Size 12KB
            • SHA256 905a454fcb15e9f2a469a9a7e6e42b8c6425d20b33a59be5b84818daae964807
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jusched.log
            • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
            • Size 164KB
            • SHA256 08f09c82190b82c2b8d157942bc450d5def0c049c2577d7cf92cb23f6fd7c00b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.1MB
            • SHA256 eb63720c879fcc96da02950e5a588601e81a7d9a069df56ad35188c335b1e5c7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 b02fa33bbc6da7a34831288144df35a3f935dba51920126947d0ad1838e710c7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.2MB
            • SHA256 e38f4cdee6a1a87cae1e838398c048331e27fd3fe0608f34375f6a3bd8390f6d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 64a50d84f24b94375f81f035aa5fcc325ea51dce4d6c7cb13f5534a0dcc2cbbb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.1MB
            • SHA256 07b26737834d60316434800992457bb3b72f138b0d18da8cffadf55adbfc7bd5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.5MB
            • SHA256 ff83790e3917cf31c4d771ba57a16a534516e801574554daefdfe8bca1033b7b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.2MB
            • SHA256 90372ff398f96a3966e0c7362f13da8c8fa26ac818a8fc1acaf3f9e3ab13899e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 03de1f83e9ced5d55ef7187084fa135ccb43fdde838865f1d5247019c2266de3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 855f2c01de5f06226ea9d4056c357f67359c8883e37238d001892711b560152c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 8a65d484a8d2c68fa417b45b2b37435608e75a60bd3766613a39cdfbafd214a3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.4MB
            • SHA256 354be0a27b0cb98781ad7fff7d79a428bb1cac58d41ae2051d35411a4d633075
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 a13b675d3a751e4dec316a61bdcb0d1e837d09e7ac2007bd7ff2b760cf22e34b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.2MB
            • SHA256 4bfe6d91d4400808cc1d1fc466772f071fe747028aaaa7160741e927271c9239
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.3MB
            • SHA256 571e64c57f8eceab5d7705172bd0fa1bce2d706f9f17df94cfae7d893afa7636
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.1MB
            • SHA256 aede97af81eda399505659ccf4938444180ff425e36aca9540388d732848acdf
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 a4377cc103242b37548055c57aa9c8bd23ebe0d7514f4b5516f54539cf164644
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.3MB
            • SHA256 de2a67b2362f34f1e9d4b258d0d3d013b17329c41de61690dfa7e748f2d27dcd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 52f869de634bf807796d7c8a50f1a835699887d11a8ca4534a6205168c421538
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 5b19704b603cdd5a87e6939a1810921f8bd321f3a4cbfe4b01e73b294472dff9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.4MB
            • SHA256 3dc32a3061edb2c72bd5224f88b61618b4a814b7b0f87b767455c125b37af321
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.2MB
            • SHA256 8e513387bf3186a34001bde456f1c71c75751f7c3f677ee3f8235fec5b2c3677
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/244-583-0x0000000140000000-0x0000000140128000-memory.dmp
            Download

            memory/244-401-0x0000000140000000-0x0000000140128000-memory.dmp
            Download

            memory/328-56-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/328-65-0x0000000000EA0000-0x0000000000F00000-memory.dmp
            Download

            memory/328-59-0x0000000000EA0000-0x0000000000F00000-memory.dmp
            Download

            memory/328-99-0x0000000000EA0000-0x0000000000F00000-memory.dmp
            Download

            memory/328-102-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/736-391-0x0000000140000000-0x000000014013D000-memory.dmp
            Download

            memory/736-33-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/736-22-0x00000000006F0000-0x0000000000750000-memory.dmp
            Download

            memory/736-20-0x0000000140000000-0x000000014013D000-memory.dmp
            Download

            memory/832-921-0x0000000140000000-0x0000000140159000-memory.dmp
            Download

            memory/832-592-0x0000000140000000-0x0000000140159000-memory.dmp
            Download

            memory/944-39-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/944-47-0x0000000140000000-0x000000014013C000-memory.dmp
            Download

            memory/944-45-0x00000000004C0000-0x0000000000520000-memory.dmp
            Download

            memory/1132-540-0x0000000140000000-0x000000014013E000-memory.dmp
            Download

            memory/1132-394-0x0000000140000000-0x000000014013E000-memory.dmp
            Download

            memory/1188-763-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1188-462-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1300-845-0x0000000140000000-0x0000000140195000-memory.dmp
            Download

            memory/1300-482-0x0000000140000000-0x0000000140195000-memory.dmp
            Download

            memory/1384-128-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/1384-123-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/1384-125-0x0000000140000000-0x0000000140162000-memory.dmp
            Download

            memory/1384-117-0x0000000000C00000-0x0000000000C60000-memory.dmp
            Download

            memory/1384-130-0x0000000140000000-0x0000000140162000-memory.dmp
            Download

            memory/1516-518-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1516-526-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/2192-911-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2192-542-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2336-910-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2336-537-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/2824-577-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2824-920-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/2856-459-0x0000000140000000-0x0000000140234000-memory.dmp
            Download

            memory/2856-91-0x0000000000CE0000-0x0000000000D40000-memory.dmp
            Download

            memory/2856-93-0x0000000140000000-0x0000000140234000-memory.dmp
            Download

            memory/2856-85-0x0000000000CE0000-0x0000000000D40000-memory.dmp
            Download

            memory/3144-9-0x0000000002450000-0x00000000024B7000-memory.dmp
            Download

            memory/3144-1-0x0000000002450000-0x00000000024B7000-memory.dmp
            Download

            memory/3144-0-0x0000000000400000-0x00000000005BB000-memory.dmp
            Download

            memory/3144-134-0x0000000000400000-0x00000000005BB000-memory.dmp
            Download

            memory/3232-509-0x0000000140000000-0x000000014014C000-memory.dmp
            Download

            memory/3232-135-0x0000000140000000-0x000000014014C000-memory.dmp
            Download

            memory/3232-139-0x0000000000710000-0x0000000000770000-memory.dmp
            Download

            memory/4036-443-0x0000000140000000-0x0000000140129000-memory.dmp
            Download

            memory/4036-702-0x0000000140000000-0x0000000140129000-memory.dmp
            Download

            memory/4044-111-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/4044-473-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/4044-105-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4044-112-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/4064-599-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4064-922-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4268-323-0x0000000140000000-0x0000000140162000-memory.dmp
            Download

            memory/4268-534-0x0000000140000000-0x0000000140162000-memory.dmp
            Download

            memory/4472-598-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4472-420-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4472-919-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/4500-873-0x0000000140000000-0x0000000140175000-memory.dmp
            Download

            memory/4500-500-0x0000000140000000-0x0000000140175000-memory.dmp
            Download

            memory/4724-398-0x0000000000400000-0x000000000052A000-memory.dmp
            Download

            memory/4724-576-0x0000000000400000-0x000000000052A000-memory.dmp
            Download