blustealer | 295ebe6ba820bb813c6e9dd5526bf194a8da0268085ba0fc805f19c1ae3c6186

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2023 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ 21032023.exe
Size

1.5MB
MD5

26d46c2c07d584f1a04280f47182e909
SHA1

381ec91ba5c4206be19a10a1cb0d2328a9385d71
SHA256

295ebe6ba820bb813c6e9dd5526bf194a8da0268085ba0fc805f19c1ae3c6186
SHA512

3cd2e063ed27a84cfa2513e76a77f6ed8a7987ff42f1e5e9ab9400491b1cfc0b407945ca09ab1a839807ac850a44a0521aa5fa2f9a90c9bd2df1ee0eefc3c8c0
SSDEEP

24576:D1fkORzjCc1R7CIPVQ/NcnBZuSAszPeo28pW4NiocXtWLezho6OrHRYfDz:Dabc7nyNgqSHzPj3zDYt8EhuWf

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 22 IoCs

pid	Process
820	alg.exe
4120	DiagnosticsHub.StandardCollector.Service.exe
548	fxssvc.exe
4204	elevation_service.exe
3692	elevation_service.exe
4276	maintenanceservice.exe
940	msdtc.exe
4264	OSE.EXE
3900	PerceptionSimulationService.exe
3056	perfhost.exe
4748	locator.exe
4700	SensorDataService.exe
4008	snmptrap.exe
3764	spectrum.exe
880	ssh-agent.exe
3036	TieringEngineService.exe
5100	AgentService.exe
5096	vds.exe
2508	vssvc.exe
5088	wbengine.exe
3856	WmiApSrv.exe
4680	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\wbengine.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1e31b96050d0d086.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\msiexec.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\spectrum.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\vssvc.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\dllhost.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\AgentService.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 704 set thread context of 8	704	RFQ 21032023.exe	94
PID 8 set thread context of 4212	8	RFQ 21032023.exe	100

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	RFQ 21032023.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	RFQ 21032023.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce14b2f13678d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bc5b4f63678d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb16ceef3678d901	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000838216ef3678d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a3570f03678d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d9af9f13678d901	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2b714f13678d901	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	95	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
704	RFQ 21032023.exe
704	RFQ 21032023.exe
704	RFQ 21032023.exe
704	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe
8	RFQ 21032023.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	RFQ 21032023.exe
Token: SeTakeOwnershipPrivilege	8	RFQ 21032023.exe
Token: SeAuditPrivilege	548	fxssvc.exe
Token: SeRestorePrivilege	3036	TieringEngineService.exe
Token: SeManageVolumePrivilege	3036	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5100	AgentService.exe
Token: SeBackupPrivilege	2508	vssvc.exe
Token: SeRestorePrivilege	2508	vssvc.exe
Token: SeAuditPrivilege	2508	vssvc.exe
Token: SeBackupPrivilege	5088	wbengine.exe
Token: SeRestorePrivilege	5088	wbengine.exe
Token: SeSecurityPrivilege	5088	wbengine.exe
Token: 33	4680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4680	SearchIndexer.exe
Token: SeDebugPrivilege	8	RFQ 21032023.exe
Token: SeDebugPrivilege	8	RFQ 21032023.exe
Token: SeDebugPrivilege	8	RFQ 21032023.exe
Token: SeDebugPrivilege	8	RFQ 21032023.exe
Token: SeDebugPrivilege	8	RFQ 21032023.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
8	RFQ 21032023.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 736	704	RFQ 21032023.exe	92
PID 704 wrote to memory of 736	704	RFQ 21032023.exe	92
PID 704 wrote to memory of 736	704	RFQ 21032023.exe	92
PID 704 wrote to memory of 2828	704	RFQ 21032023.exe	93
PID 704 wrote to memory of 2828	704	RFQ 21032023.exe	93
PID 704 wrote to memory of 2828	704	RFQ 21032023.exe	93
PID 704 wrote to memory of 8	704	RFQ 21032023.exe	94
PID 704 wrote to memory of 8	704	RFQ 21032023.exe	94
PID 704 wrote to memory of 8	704	RFQ 21032023.exe	94
PID 704 wrote to memory of 8	704	RFQ 21032023.exe	94
PID 704 wrote to memory of 8	704	RFQ 21032023.exe	94
PID 704 wrote to memory of 8	704	RFQ 21032023.exe	94
PID 704 wrote to memory of 8	704	RFQ 21032023.exe	94
PID 704 wrote to memory of 8	704	RFQ 21032023.exe	94
PID 8 wrote to memory of 4212	8	RFQ 21032023.exe	100
PID 8 wrote to memory of 4212	8	RFQ 21032023.exe	100
PID 8 wrote to memory of 4212	8	RFQ 21032023.exe	100
PID 8 wrote to memory of 4212	8	RFQ 21032023.exe	100
PID 8 wrote to memory of 4212	8	RFQ 21032023.exe	100
PID 4680 wrote to memory of 3424	4680	SearchIndexer.exe	122
PID 4680 wrote to memory of 3424	4680	SearchIndexer.exe	122
PID 4680 wrote to memory of 1880	4680	SearchIndexer.exe	123
PID 4680 wrote to memory of 1880	4680	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"
  2⤵
  PID:736
- C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ 21032023.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:4212

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:820

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3976

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3056

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4700

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4008

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4832

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3856

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3424
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 900
  2⤵
  - Modifies data under HKEY_USERS
  PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
4049647d33ffc529778a1d3f1da3f89b

SHA1
63f8f12e1b12f8f860aaa75713a758e9bb03ac79

SHA256
9bf402622eba3cb68680f7651ca66fa496ece6b4c148b6238d52d76e58497abc

SHA512
89a37f8b73b6110d9a40f5ee8662250f1846708275ccc0f3660a1e4ab7d2378af9b127c5eff9adc9719d849d8772be7534d07c1c734a44553e98b88c69f96bc8

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
b94c5aa3c529469560a93d0f9d2571f6

SHA1
c236f99866cb0e8aec7e6ebc4b7c4484aeec875f

SHA256
5d48e31f321345ce4c3637db8a91b26b495d724d5db2db589df49b3b5c43d7e8

SHA512
810eb1069ca989b46a24748212bb90cb99693e5ba2bd644b498abd80d1de175f18e9090b817d9a80d82683dd17741f6dcc816515793ea25d6c49b14c29e59ddf

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
b94c5aa3c529469560a93d0f9d2571f6

SHA1
c236f99866cb0e8aec7e6ebc4b7c4484aeec875f

SHA256
5d48e31f321345ce4c3637db8a91b26b495d724d5db2db589df49b3b5c43d7e8

SHA512
810eb1069ca989b46a24748212bb90cb99693e5ba2bd644b498abd80d1de175f18e9090b817d9a80d82683dd17741f6dcc816515793ea25d6c49b14c29e59ddf

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.7MB

MD5
5e7376fd134581feed0a63832ec6e4d1

SHA1
c02bc913b6cff4d402e49ea5c48af650e7f372d8

SHA256
72e249ef45444b1632550e662e8d77e15dfdcc4e77ad7aad8d9e3030711e747e

SHA512
f41b8ccc9563605f70c725cb3024e589e96060c26ca423fb5b8f72f1c65535eab6d1fabd606ec4f0fe37d75a129eaebd80cc873e8e240b2bdc15284ad4bc688c

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.4MB

MD5
e5b30b6322e5c75ed16629b52e3ef0df

SHA1
1b42266cf3c576c396b4707ab327576cfb181871

SHA256
2d0ce75d309379d7b1661b84f7566a64f2f0e62dded2e7abfd24ce4da0089281

SHA512
83e3446d993b81cb355f479f6b67f28be9feba18a63cae6df7f2fe75f5df81a34acf635de0487c13df9c456ae726f91c9711e210842d3d2709fe6a3557f91b14

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
ff6ecb4b6b08da8b2d50929e322e581c

SHA1
094cc99fa304267a260207e45b19561d83e07cf8

SHA256
589c2eaaf69dea6adeeb2dfb4dc7ee73a35bc67f9e61f1d2bc6a4809aada5b5a

SHA512
c714c754ee43cd5c8bb517343723e250a8c4308056943a2e4833165a567b67e45410c34cd152eb04912956dec96ec81ae7fe44804d313d2100c68b7c5ccd64c1

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
94db990619fb7326f77cfe8bfb1e8552

SHA1
85e06095d15926fcdd9020850a74196a1f12e095

SHA256
d99d5300d27d8f766ff5a23a38d1ba2688c075c6ff7bb814f1a355b6c430d83b

SHA512
fef9b2b139f66136e5cc60a531dda4039074b584bea36ae7ed6ba8c752e7831a4ba089c25ad72a5e65e6ec197fcf55e1319ac097eedb3a9dedfeafb7abf24f83

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.5MB

MD5
eda27d31bae54897b57f0f5106dd7c09

SHA1
7dac90a397dcb2ead92fd21d0bc2338c836b74b7

SHA256
44aee06ee8660f6e9dc9046e3d2835f45253459edecb6e59072267370faf59f6

SHA512
17b3b760d5308f2993e2fbed620d62b4f71ab620c4ed68d42dc196d7e03f3a625a39eb96d12c4b398cf8aea04a35da8c7165d2fd3da34ddf60a24230c95f75f6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
777cfbe8fae917dd0ef5cbe0df3d677c

SHA1
491502b079f6140bcbee36af116042dd6ae10c4f

SHA256
2c2191856260dfea87d18cff83174dbb70f0d374a3bdf9c93e08d84ed9ac1810

SHA512
cef4ff2b0856e8f14fd74220c757bf1ff8dbc7bfd103a23d52267a02bbae6faa01a63f06c31eadbcdeab01a594b0428a6a269da75761f6eec0909a45b9d9c2e8

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.6MB

MD5
95f037720c7fb5bb25349a0f8291ba7a

SHA1
4e84d18af1d01491052911953cefb4725bfca272

SHA256
2ed80f6cf7d5ea82825d7d0b8a831b9d63525b970b6fa3f2236261c7b062f3ff

SHA512
70364df78c75460b4f91b0fc4cd0154f963c43cdc8ba38631b6af5aa0191df189db2afa000c3820b924a2f8633ef0aab00ceee73f5821338cd640e8699fe0a72

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
7.1MB

MD5
8887ca3bbc1e90c2b596b343ca1365db

SHA1
2c3c45159630914ed58bdd5d4e44c826f5798601

SHA256
c67ca75726ac3e3dca8499d18c6346790a4fd8ce67a686be1259760e79660290

SHA512
b3dd81a5139b42fee5b9be5d4f10b3219bca6466d636821a88ddb9a12262a8cf21102c20cf5b87dd66fb0c9654b6451dcdf44460ef015f83d5b5a6d6128dc495

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
567e3ee2c329a3a1a4576b03c09626c6

SHA1
1fbca243368f6b95ff61d3beddfcdd8a9a127376

SHA256
173d221cb60082b9faf16007e8f7189f747d468e5ebd8ccd1bf07fb8a5a25cf9

SHA512
9b932d3096cebe16807deb3629e4d5414ba578dab05753476e5c3e4d93301914ed25932fdaa4f1011758411acdf5ae97bcc696984c1668c7f0447c6c5510a3ea

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.5MB

MD5
df37cf20050acfc0de26caf83c2f5179

SHA1
ffffac855da28fa125521aa7f7907153f2cea1c1

SHA256
987bb9368e6a64fd49b5958dfd11572ebfd8cbbb8203c03c790742af8f36f488

SHA512
4f9d84afb4a97f0483202a3391d526653957d1f95306ebd7d1e5ac99835e903068187a5dda3c3889c771c59c7054865c715ab8a016cc7e7060c01d60559e3b18

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
1.1MB

MD5
1c1c2116684e5aa0229a77e8e972a207

SHA1
eeeb1b93455a7c6b79de65754ae2778565465ab5

SHA256
3d1a36c02f58436cf4db7823cd10af8f18146621d4e1f3e419b5282e45247780

SHA512
34642291e602ffefefa9fe054d677e6f36c5ffec74e83fdbff7495f0331820321d34e0301d6a81251e57087cc12efdf8a43ca6f8f10725a0e4073f439506abac

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
1024KB

MD5
20e8e26338e86f9040203a2d238c1345

SHA1
028447b25cbfcd813e5c8cd2d6f5b8b9f32e36c4

SHA256
9c70623b7591222446556d4ec106fd7fb3b02d72caa914697c03934549641c2a

SHA512
0034619c7eab655c85aa6c833d77b52fd94226615e654261bc4ec973e1dde6ad3da49d9d4f5cd202d375b6557fc7ce87b1fd43b3feacff090c91b3d3ea8ba7d5

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
fd854af45b1769ac5cd3e703da6c1865

SHA1
723cdece2a85fbeb2dc42bb69666f3558350a562

SHA256
dbd68691b369b6c339ef8040ea42c086bf991d5e35321d88b944504da0425afc

SHA512
0f096884cdad8d456d73d126eb38806d7f4b9ced8a0a272fba65c263f01cd1f3a62beb8d4a5acc7dc888bf1a686b92348099758135fffd052be944cc1e5a9481

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1024KB

MD5
b2f0171bf399a6e76409425cda7fabac

SHA1
278096f7f56f0efb19b700d9a3a4c86dbc01d5f1

SHA256
052d9e1726c589462c6c3c76fc18ba35f1159f7ef431fc9441f639cb320b4919

SHA512
f171bab52eafb200c82d0ee6ebef253358d6aad65bf6ea7c81d7c6f9ed8f038671ddf6ff35a8ee2c2880676c49ba106b9be6d4a2bbf6f4eea55c886246549c5a

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1024KB

MD5
168aab51c11c2f7976ebf6af42c304b7

SHA1
32b9d257b94b1d73f051082686d83bda7af3d573

SHA256
33235e1370bac56355e6f55f8b45d524c225bc46e9367055938e5926914bc3f4

SHA512
11caa650e7988249b19c00395c40664116d395c3ad9c12204709a750a808832e2e000b2dceb2fd1548e3c373169cbc002f6310ecddd1968f2e0bbf6ef1abffb9

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

Filesize
1.1MB

MD5
89385c32bbd3ce2c7a392cd15874665f

SHA1
855b4027c3e9d63519343b79a9bf50616ae4fd4e

SHA256
4b6e434f90338b52221c404a9424c48417be2c0e00308427775a1beb994375be

SHA512
e5460f165891e9ebe8adf647e203e2cbae28f7409f1985b786c63c1650fb8ce2a76f89badb34bab11168264e8efb3f39d549c58883cc5e7868b54e8d68da7cc5

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

Filesize
1024KB

MD5
e19280bf226bbe9024b677278fcfb0d8

SHA1
acaeadf29b002bf80eea8c722b15ceddee7a5841

SHA256
10d6f621948853475d2708701db1e3b32b9d9e037f6d6d5ebbe2213bd165e46b

SHA512
07413ccc7bbd6a07c9a0dcfa23a255999d236894fb9da0aa29e1a15d9aa1f1e50cc19b98087f6fb2b951209995d22cb7b5064f0e796faaeed9f4decfe196561a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

Filesize
1024KB

MD5
967e254f99a53826def96194895037e0

SHA1
0afeeb11b6209eb4c8c1f48f105cd55806f1f14e

SHA256
0e768bd1e944b925ad20af1224354d21e2509c69ccd81ad79e0f2bc6311ceb6b

SHA512
f6e06b20f6147d56120a47bbdf9ec834dfaac844ad9e027c00114a0cc2470abf908662486b218908dbc06779f2b7258df9814942ff2f35a93e0d17c456acf032

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

Filesize
1024KB

MD5
7039172175b7335c591aff1d8a0226f2

SHA1
6f5dada2446cc92deb53e5a41148b09c01dd9a4a

SHA256
c1ada1c97056e8c70466bb464f20e4fa8721ba80f2636f2689b9c676fb042b67

SHA512
5a8a363264d740acc6b049e3e6f1b9d1d5e1cd9ccbc7c231fb3780b9150a0db96935e5e4915b34ef7204834a35f87c160711c191423a5f4fcc1fefd8c3fec252

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

Filesize
971KB

MD5
ae942686c44c5c33ba718e3437cd1451

SHA1
0a2edc947f3e4df02d88b0243d536fd889206897

SHA256
e9a4b08ad554125fbd1d5f23e781749af88a392f28e9cc95c490da5cc83e1359

SHA512
e25c153ef6167ce7f41a67a7586529ec9fdd9b33ae7a3b9c786f1cd354dbb149306bd5375c0c4e0a06f46e7c0e8bb20764a8f6f526bcda54bb683d5a0516dd05

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

Filesize
1024KB

MD5
711b3e744241c45e8d176ce18cfea3cd

SHA1
c764838484526d082a14a9779adb5c7804ba6cdb

SHA256
33ae22b3194ce46b49fab753377af1e203562d12b25cd0b07a927489b5ead9d6

SHA512
380ec4424dc4a92133da39dcc4e6fdefe95b47434b85aa0016aca1d5eeec9bc4c8697960d0ee7128f867886f9084818458aa94aa19947c5dfa86cc355d7fe55c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

Filesize
960KB

MD5
392827f520bd2034cb6f278c028a12d6

SHA1
6ed31cee67ce53390590d2092e098001f4996b99

SHA256
c1f61d06282570a44a02fa69ac39981859273817860e141600d4ba7598987504

SHA512
54dc3e7cf331aa548bc0599c0344ef79090fdc62befafd72d4ad4e98ab58a9d437828e4147ec39c2993c21fe0c2b480aa44725405ad571f8c12243cd7c203429

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

Filesize
960KB

MD5
cd5a48aff9b8454cdecc506b09776c6c

SHA1
999ed3796d7b8f2c394c2fa421fa6c3d1cb4fbc9

SHA256
b6c8c518c05cb864e94ca3f9a3e135388479af5415cc61f18f548c4cd4a6a190

SHA512
bb1f62abfe321830051512ef0a8e2a5d8c23109c4f73bacd1ac85da4734320492c1145a7742bc02e37543369a8a342d31eeb1f78e17d59ad25b1c7b1236d4b38

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

Filesize
1024KB

MD5
597f3c6f75645cb7bac8adc2369bed8d

SHA1
06a1f79f6fd8f38c09d49f72194bcdda4d4ccb4d

SHA256
9be714cced807d50d857c354002b4add71e5513a18048dc52a80808354fb9878

SHA512
edff62df39c674cb0b80a7113a031b8da0190efa6d7e49fde6b1bca647ee8ea46b82eca09dc9435e5a51ac090f3eddb247aebf9933dfccdad92cdcd162962fbd

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

Filesize
1024KB

MD5
94da9a766ab83d9cdec468e7b84359fb

SHA1
7c5d82e72a82c570d24134af73ae3f8ce360a50b

SHA256
f49ac651894e4aac69f54c95641b5058b583de4b4804b4466ed2f8a56b836151

SHA512
19850d9cbb9aa78cdf38ae19429410a1080d018d41c2623f3780e68124587f19c11b55a97f92f5830676408a9def9323d3bd6490b50feb4c3a55814a066014ea

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

Filesize
1024KB

MD5
11c40a5c8e2bb68b185460c7f72afba1

SHA1
32531ed86317fcdd6a4027fd1ad118b3d720b063

SHA256
89ef8072d810210dd4f7ad9a33b73ea59fec5fd6cd0d5ec907ec7b8cae747fa8

SHA512
fbe9fc67b2975a2b83873109e60f0624312a691da695f7528b7aaf5504dd8e0da675544dab9380864cdf97dc14a9014a4a391fb84ec869bc90f4c37f212478ca

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

Filesize
1024KB

MD5
29a2afdb608a7590b1693444f3cb6d42

SHA1
49ce62766e4c1dc03c1d6d955dfaa53b10bf41a6

SHA256
de790ba0527a0a87267078be88cdf18f8062a288841322a678b0690aef740543

SHA512
2912ee7b3b46e7b084cd76edfe5733667eb446fbe86627fda66827f447ccb9789876bd16b6b1ea5315e39c28774091b5e0ed991903789e243c747473650032cd

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

Filesize
960KB

MD5
816ce586f0b6ecf6bd65312b39f40210

SHA1
97765e19d61ab0e27faab47637778b5d7e8b52d2

SHA256
5683535dfab20f36f8a59de995595e05f29fd042cdf6b4303207d805145460b4

SHA512
c2551a1c696b9d5ac295a3942c389cb899f4a3caf6b73ee232bc49a508d6c1def3d63fbade3fb2628fe4ff2672030c1cea627682847a2ebd822d035898b30dcf

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

Filesize
960KB

MD5
7ef1800cc450b1cfa811c80b99a8050e

SHA1
7eebf7486407292b33bf14cf71b4753675be2a26

SHA256
9deecc40901b5604f3f63555351e1058f83ddf0f77e76d017a0dd126af0eca60

SHA512
82c9e0322523e42d44c51eab1eef10abfc775e981d9fe9879c6bcd1e776608517a63db636385c0109cfe4316961bd438937d91a36ce6cd41b8fd6eadb5350ec7

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

Filesize
1024KB

MD5
b2852c59dc2b1566d010d75491b8c1cf

SHA1
6acbdf9f73362d9bc3905b66c9210a0b9c1a0aca

SHA256
67680e74684d98a9d364f83f1fddd62c8f8a731e94e7bf878c93ddb5a8bd294b

SHA512
fb73ef88a8c11d2f17d20ad8f9fc7798a198a32d38aa7d78a6fa56103bfeb017cbb302f20f49111ef23ce7145e1c195bc751f7dbf0d2b44b59cf6993012242cf

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

Filesize
1024KB

MD5
2d443c6d4992228d88a98f5c7bf0d0c4

SHA1
a168a0e6a18abec7ebd7964b6538dd99d69878c8

SHA256
e0ec5797eb90c56cca7f77475ddeb9155b99260c6d2927709dd0e27323c35cad

SHA512
57c532d7e0dbef56fddfe18ff752f5d5e938cd2b1bf793ab085a573a023d81ea6b8d6acea71112503e14c0609fbb296520d0411bcfff82dbdc00790c1f907479

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
0eec2a955c8914f0dff5e66a26b3506a

SHA1
5375c3acd66433b009605fd2fc593140ddcf65cb

SHA256
329382b2496cc79b16d82d2913e7e2a4b8d2c7722c3bcf95f0485cab7521a07c

SHA512
5c27760736a08fe4a75076376a70e2fffb6f386cd326823c91e928f9743501ab9ff631cc6e623697fc599aabc3248b387b8d82540ab2d7928f78267f4cd5de1d

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
0f4bc4b00b721da848709c5092eb8c36

SHA1
0788b9ab44b6dad742680d3fd6a9f483f4907b46

SHA256
ec892297bb091c572877aba9118b06e325dbd78320dfe6aa6e27034ef29ec688

SHA512
a08fbb703fa54ed08797653f5de9744159228936b98bc8b5968598cb40a560ff35f27cee2eb1cdde5d5298287324cecd5e573f5bc178f7ba56084029dd8886d6

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
0dcf47d6ecad1c1d47c88ac44d48cead

SHA1
4a6d35e582bc7b1e25d4e499ec06c17de0e6fa82

SHA256
f5855e29a75b863ff382557164d99e2c53ed117029ff341db838a34c253ed5ea

SHA512
cb23d0f039c77886edfb70341912948feea8ed4477f3912cd954883e714b4c3e0b3a7e61e78666bac52e465c05159c5ee8d347189ddda8e96d7481b896e87391

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
3b0b498e2c2296783906b56a059929c3

SHA1
b02a0037bbc39eec791123e2a65910ba1adf3366

SHA256
55a760dccf6df0defc022d4b5a5bddc35fdedf7c200b4e11bc71d7838fd495e4

SHA512
fd452defc189f392bbac007c9a3a6ca41577f0abd7f8d0a053c484601e529b6298e1b60734bc7a0125e36bbd8ee79d3381d7e70aaff082399c8a7883878d4902

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
fe0bb82ef23ba91b88c48596532f3910

SHA1
593924c4ec7027d7a17613673048c592d1cd5f70

SHA256
d3c2013cc3e7456d580bae32eecfc8a182091ea8ab5096a1b137468ed26c981f

SHA512
ebf8a58e78d35dbd38c093bc7942630f56075c108aeb97371d17f80325f835a5a91fff84bc07ad1752be988c6f088fc5690bcdf6f09431e7c8a50cd0e19c6ff3

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
d573abed9c7dad7008b2f12ea8a4957a

SHA1
67917f351e7cd0e7d4ad1e4770a80ac1bab89b0b

SHA256
5fc460bef8866bde5717e5e79f783a06c3199098414b157528fb46c40cfaab06

SHA512
fae4568d747b952dd542c77fdcf8258170bb4ecf86b5620ab098dd649e98240fbb0a3ed5979ea960d01ea392277ca9ad577d2eaf68d45809d9ded8dc3b246654

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.6MB

MD5
dd0d448e5a08e03a6678af5284aba8bc

SHA1
a8ce695a6805970ac8c1c1781e18009e87493976

SHA256
9d04bf4c5bd67465db4eafb8b4da5cb06bd5871087c058e20eb8f13537f38c84

SHA512
dd58f8f64a6cd2bf8b0ee7a9fb44c77ef5e9e32c77f394e977e39c8475f93c0d5b9fc5190958972a85145eb8497b203b960b1ed08f17acb206cfa45b2c7cb17f

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.6MB

MD5
dd0d448e5a08e03a6678af5284aba8bc

SHA1
a8ce695a6805970ac8c1c1781e18009e87493976

SHA256
9d04bf4c5bd67465db4eafb8b4da5cb06bd5871087c058e20eb8f13537f38c84

SHA512
dd58f8f64a6cd2bf8b0ee7a9fb44c77ef5e9e32c77f394e977e39c8475f93c0d5b9fc5190958972a85145eb8497b203b960b1ed08f17acb206cfa45b2c7cb17f

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
bea55ba48713459a8223f4ee93852f0f

SHA1
63119f8ea93601ca6cf4722cdcb2901ab5e9bd98

SHA256
c20a0357791b7cc7cedb1d0585ccaa01f21bec559742d59b8ad059e70ccb7763

SHA512
16ade282cd88aa0599eb59ea7d99ef75b2fa6caaa2dab10ccc3a0cf1ca2c335c2aa958306cc558757358e65aeb9d3eb7d71372e5df3928c21c9a78b02535d539

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
c4e143dd9f82f49ed4eba535be551168

SHA1
e5a4e21ac7bfbd150428245158017434cd382e2f

SHA256
be10bf0a3053b817ec179c4ef2f58aaffa924c29909394846fe5cf140916afb2

SHA512
42142b54847b46a570a1f0bc5762e92a1fcbb6ae5a08297b19b808c1a2ba5b2f1197d746ed4963597461e28b062e916ea84e96cd4f17fda10f883130dd58c5fd

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
59b1ee8e4edd38e244b2758909451345

SHA1
4be12a6340bbd2d3c7a11a6b7f045af1ab8e84ef

SHA256
6febcc8296dc38e006d5179e006fe4f25284f1e468a64cd283d9fd28d6147791

SHA512
50ee43a15d3124d5609fdbb961b6a45ad1e33ea16db7bfdd92e526cdb3051bd971cbad518cbf27a70c632452ff96d7da381263da0539ee0875feae145f7ae631

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
59b1ee8e4edd38e244b2758909451345

SHA1
4be12a6340bbd2d3c7a11a6b7f045af1ab8e84ef

SHA256
6febcc8296dc38e006d5179e006fe4f25284f1e468a64cd283d9fd28d6147791

SHA512
50ee43a15d3124d5609fdbb961b6a45ad1e33ea16db7bfdd92e526cdb3051bd971cbad518cbf27a70c632452ff96d7da381263da0539ee0875feae145f7ae631

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
4bc2b06c04c20252aa1f2c03b1b62b20

SHA1
fca4b2e84dc09c19e4d9ed6e0945d3f140a879b4

SHA256
36b039e2821569dfdb0eed2e9dda26a847901238b610a6f1da6a9c02400325ac

SHA512
40e68d6d9f6169693c8abc5a45f9aadd3ac2e45dc9b37b249ee30d410f055dfa754b345d188c8c305fa13f981fe8876faa3697c80f476ac16942203bcdb55899

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
fd2f455f51393f3566c1535840e718ec

SHA1
433432aec02073782ed65f131c9eb719acf76e6f

SHA256
e42f5d7280710eb60ca3b782f6f59fcc040a6698c28160a637f1e3b8fb030d03

SHA512
ac5bc17d19356abd993f12f612fdd93bc7674d7ad5af0fb0ad92850a4ea255426ab1eea4ad0d779feb29344af7b9bb59a61532f26f76b0eb2c6e634713c39cbc

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
9fd597d6d54c15ee5a02d163d03e06bc

SHA1
30c33f2895de49f4c864000a7f1b31b2a712ae02

SHA256
dbf4aec8a3bd88d234dbd2f7dd8a1c3954c1deba5b4b29dfca92fe9555959a7b

SHA512
9371462c34bd2bee00f4ae2ed73e9878ae405f13e1f2168804a13ea28fc83882062bdaebfef895a050f00ada8ec4ed7e1890ad5b351c68e1e1ac0b3cc51c5cb3

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
8a8c14a338f4fa68ea9cca2b5205c6b8

SHA1
6600dbbf926e675b51f5704fba33b1ac552082da

SHA256
9d84d915940ea944d3379081754e25f28c4d9589433e3f9fa90f951a4a50a1cf

SHA512
d989eb17d18d6e8e93514f17bd9bc7169514f6ea794e65e8a9dd3fee648082bc921bc4199dad869cb0a609571bc0b84571ad15764bc66c953eb7fd5c9990e4d0

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
231eeb588069cee32b37c967104edc10

SHA1
623681161f00baf9a4932f03d2b0f085c5e771b5

SHA256
a98a94b83cca64cd6b68017d5c307175528bdeee9ccaf0236c022357815f0ff0

SHA512
163f3ce50f40f6a38e75144fadf256776ea691ef35304155819ffcf1ff686f7cccda3b1870eca57fee6d3ec6c96fa52dbc061a8d96012b3d6bf9e77030ac9d26

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
be9c394431596099c78e0a521c9eee8d

SHA1
7915720990a4e79f13f475e7b526d57ab32fb0a0

SHA256
c9d6b20d8dd14f2774729b8ab162e6aea728e39712f8a7b72623e38a706409ce

SHA512
be9f4bc7f546c4e95b58da0106097398f05d462dc8d03a23a74ec964324f1ef186a881477c9bc8dfc7a8c4307321cb96c36e63f2f47cf6d15207d63b170023c3

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
6da88d6fe184f4d00b5197818707bf69

SHA1
872bdd356e6a68bc286662cc8e5386430ed9b7e5

SHA256
3514207c5be65592466ece93a5a67143d321bf2133ea384103f08ebd952a583a

SHA512
e4cb9d883e13882d7d0f77d29ee511a7b36753b9226a625171fa9fcd94bb369f6b188e24ed6315780da462db439bead94d59961c47a3515ad6ced49557d883a2

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
7df657898330e6fe1e254c091680739b

SHA1
0d62aafef4c0a966b1d92de59dd9a0f3dc49d990

SHA256
cf9d32b05175332cc051c1fdee2d00c3b3e54ff9e261a13626b867c12d6ac10e

SHA512
c4a7083cea8098a4f33ed7a1295fe6800c1525a5191f333d8634cc97cc538ab28a30334dc212a1dadc4b1c0a92593c2a2343b7d6b69173cd3bace619f3008eb9

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
fe9e9beadc628c17004cc1590b895657

SHA1
12acbc3650f4a27044940e5f5f311e03b590b0ad

SHA256
187f3fc1d4ca746a6be368873a6eb6dc73a57feb3df679d8320512233d21e573

SHA512
56d17bc1efb602a2099077f9456857392b24357acf185798d1556089bd894f6901da38909bb7f9e96f61c9d89e3ad96ba15c21ba4c4e8c0bbcebe376461c9ae7

Download Submit
C:\Windows\system32\AgentService.exe

Filesize
1.7MB

MD5
0dcf47d6ecad1c1d47c88ac44d48cead

SHA1
4a6d35e582bc7b1e25d4e499ec06c17de0e6fa82

SHA256
f5855e29a75b863ff382557164d99e2c53ed117029ff341db838a34c253ed5ea

SHA512
cb23d0f039c77886edfb70341912948feea8ed4477f3912cd954883e714b4c3e0b3a7e61e78666bac52e465c05159c5ee8d347189ddda8e96d7481b896e87391

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
70d5c2ff34c8c6bee81367f51186cffd

SHA1
df48b124b4f10e074e5b4ed9ef5e7b1dd7ea5a6e

SHA256
2701ad5dc3fde6ff9d4b1c8841596fd326e398b3d5883f6f8fc544829c9352fe

SHA512
e5ee74b40af5acf73bd04c3726e863201b1afb1c6af72f3eb2e6cb0a634470bfb772e8642f99448b906e82c0c984622e9092aae137c73c5db1ecffd4f40b2b55

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
1.5MB

MD5
3496aab31300584a1a3e4151a4143ae0

SHA1
9afd50ab08dd6ec6bf02abc3237a2f5d1ed6d397

SHA256
cb9f7898371179086dcc0e408a56d9eecc70aa7d616e08dce626160f6fe99539

SHA512
9656a8846b96b7b914c6cd5b48383c9ccdf211cfa8a2fc6ff437a8c3c54e4c7102843a7d131638f6363752b8e9fca19b99db54bfdffe57240d37a73a02973b1b

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
fe0bb82ef23ba91b88c48596532f3910

SHA1
593924c4ec7027d7a17613673048c592d1cd5f70

SHA256
d3c2013cc3e7456d580bae32eecfc8a182091ea8ab5096a1b137468ed26c981f

SHA512
ebf8a58e78d35dbd38c093bc7942630f56075c108aeb97371d17f80325f835a5a91fff84bc07ad1752be988c6f088fc5690bcdf6f09431e7c8a50cd0e19c6ff3

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.3MB

MD5
8344dd6b74f7fedea218e06d0f4ce975

SHA1
cda992fbd6f65c18949252401ea97fea728c873c

SHA256
6bebf9d68752ae58a481e58727188d02fd7703c009df386689ab42d9614be9a2

SHA512
642d3efb9cacf36039063b57cd643172c547de4094c8d45c50751d912f8fe076773ee956025aa1fe181c6783136cfdc34eb1bbcd26b63fb352bc82a14d4bbe16

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
91d6e82700172c9204960f6333a1d76d

SHA1
1201b9b5f5363f25041bffa9bfcdf32fd2b74c79

SHA256
033dda7bc5daed5fd1f2d53dce8a4a9b0c716a9ec1cceba577f2ba91cfe6f094

SHA512
ad0515ca7438ebb4e406d48ea40f3fbb68445597b69f69119854ee56d2eb48c0f838ae01935d0fe2ad56c08a485908f0cf1587681a63a230abca751a4d14d7a0

Download Submit
memory/8-140-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/8-472-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/8-158-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/8-149-0x0000000001510000-0x0000000001576000-memory.dmp

Filesize
408KB

Download
memory/8-144-0x0000000001510000-0x0000000001576000-memory.dmp

Filesize
408KB

Download
memory/8-143-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/548-185-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/548-180-0x00000000009F0000-0x0000000000A50000-memory.dmp

Filesize
384KB

Download
memory/548-188-0x00000000009F0000-0x0000000000A50000-memory.dmp

Filesize
384KB

Download
memory/548-201-0x00000000009F0000-0x0000000000A50000-memory.dmp

Filesize
384KB

Download
memory/548-204-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/704-136-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/704-138-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/704-135-0x00000000053E0000-0x0000000005472000-memory.dmp

Filesize
584KB

Download
memory/704-137-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/704-139-0x0000000006410000-0x00000000064AC000-memory.dmp

Filesize
624KB

Download
memory/704-133-0x0000000000860000-0x00000000009DA000-memory.dmp

Filesize
1.5MB

Download
memory/704-134-0x0000000005990000-0x0000000005F34000-memory.dmp

Filesize
5.6MB

Download
memory/820-156-0x00000000006E0000-0x0000000000740000-memory.dmp

Filesize
384KB

Download
memory/820-474-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/820-160-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/820-164-0x00000000006E0000-0x0000000000740000-memory.dmp

Filesize
384KB

Download
memory/880-330-0x0000000140000000-0x0000000140259000-memory.dmp

Filesize
2.3MB

Download
memory/880-603-0x0000000140000000-0x0000000140259000-memory.dmp

Filesize
2.3MB

Download
memory/940-238-0x0000000140000000-0x0000000140210000-memory.dmp

Filesize
2.1MB

Download
memory/940-234-0x0000000000650000-0x00000000006B0000-memory.dmp

Filesize
384KB

Download
memory/940-561-0x0000000140000000-0x0000000140210000-memory.dmp

Filesize
2.1MB

Download
memory/1880-627-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

Filesize
64KB

Download
memory/1880-764-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/1880-626-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

Filesize
64KB

Download
memory/1880-649-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

Filesize
64KB

Download
memory/1880-650-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

Filesize
64KB

Download
memory/1880-625-0x00000258CEB30000-0x00000258CEB31000-memory.dmp

Filesize
4KB

Download
memory/1880-624-0x00000258CEB20000-0x00000258CEB30000-memory.dmp

Filesize
64KB

Download
memory/1880-695-0x00000258CEB50000-0x00000258CEB60000-memory.dmp

Filesize
64KB

Download
memory/1880-724-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/1880-723-0x00000258CEB30000-0x00000258CEB31000-memory.dmp

Filesize
4KB

Download
memory/1880-725-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/1880-784-0x00000258CF110000-0x00000258CF12A000-memory.dmp

Filesize
104KB

Download
memory/1880-765-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/1880-766-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/1880-767-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/1880-768-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/1880-769-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/1880-770-0x00000258CF110000-0x00000258CF120000-memory.dmp

Filesize
64KB

Download
memory/2508-647-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2508-386-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3036-351-0x0000000140000000-0x0000000140239000-memory.dmp

Filesize
2.2MB

Download
memory/3056-585-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3056-277-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3692-550-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3692-216-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/3692-215-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3692-206-0x0000000000190000-0x00000000001F0000-memory.dmp

Filesize
384KB

Download
memory/3764-328-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3764-600-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3856-416-0x0000000140000000-0x000000014021D000-memory.dmp

Filesize
2.1MB

Download
memory/3856-693-0x0000000140000000-0x000000014021D000-memory.dmp

Filesize
2.1MB

Download
memory/3900-274-0x0000000140000000-0x0000000140202000-memory.dmp

Filesize
2.0MB

Download
memory/4008-326-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/4120-170-0x0000000000670000-0x00000000006D0000-memory.dmp

Filesize
384KB

Download
memory/4120-176-0x0000000000670000-0x00000000006D0000-memory.dmp

Filesize
384KB

Download
memory/4120-184-0x0000000140000000-0x0000000140200000-memory.dmp

Filesize
2.0MB

Download
memory/4204-192-0x00000000007B0000-0x0000000000810000-memory.dmp

Filesize
384KB

Download
memory/4204-198-0x00000000007B0000-0x0000000000810000-memory.dmp

Filesize
384KB

Download
memory/4204-552-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4204-213-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4212-200-0x0000000000780000-0x00000000007E6000-memory.dmp

Filesize
408KB

Download
memory/4212-211-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/4264-271-0x0000000140000000-0x0000000140226000-memory.dmp

Filesize
2.1MB

Download
memory/4276-220-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/4276-229-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/4276-232-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/4276-226-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/4680-694-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4680-417-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/4700-589-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4700-299-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4748-298-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/5088-388-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5088-648-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5096-383-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/5100-361-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5100-353-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download