blustealer | 3ed0594f9fef04feeaec1abc8f1ad0b85c75df614ba09377e394321ccb16e586

Resubmissions

12-05-2023 14:28

230512-rtgxxadd83 10

12-05-2023 14:17

230512-rlq6lsfe9y 10

Analysis

max time kernel
1198s
max time network
1200s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
12-05-2023 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order.exe
Size

1.4MB
MD5

98ac95047944a90076ed642f2b56fc7f
SHA1

e34b95acbdbead3a7057f6e42673bed24aa573c9
SHA256

421845b1fbf3828e4f4fe3e7147f501a422bd6ae755e388a089c67d005770b58
SHA512

8d415d64193df913602752c3004a7a24d7bc0ab29129eda9a1e9653e7cbfbaccb5ada7a1aa4a8b4ea81ff7fc2696fea242caf722e655b43f41cdc952738c5f74
SSDEEP

24576:N8whh2b5/1L3Y5zhzKSYIb34DSNCZlk0pRIIV6Kkcd4UiivgEvyV1jBSH:w91Lo5zgSYUI24ZlkwRI+9WUiiv7vyX0

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 19 IoCs

pid	Process
4812	alg.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4544	fxssvc.exe
3396	elevation_service.exe
4160	maintenanceservice.exe
688	msdtc.exe
2500	OSE.EXE
916	perfhost.exe
2880	locator.exe
208	SensorDataService.exe
2236	snmptrap.exe
3212	spectrum.exe
4204	TieringEngineService.exe
4212	AgentService.exe
3976	vds.exe
4800	vssvc.exe
3036	wbengine.exe
3780	WmiApSrv.exe
4376	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	locator.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	locator.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	snmptrap.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	Purchase Order.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	WmiApSrv.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	vds.exe
File opened for modification	C:\Windows\system32\dllhost.exe	vssvc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\msiexec.exe	locator.exe
File opened for modification	C:\Windows\system32\wbengine.exe	vssvc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	snmptrap.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	vssvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	locator.exe
File opened for modification	C:\Windows\system32\dllhost.exe	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	TieringEngineService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	WmiApSrv.exe
File opened for modification	C:\Windows\system32\msiexec.exe	perfhost.exe
File opened for modification	C:\Windows\system32\wbengine.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	WmiApSrv.exe
File opened for modification	C:\Windows\system32\dllhost.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\alg.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\wbengine.exe	TieringEngineService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	vds.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	locator.exe
File opened for modification	C:\Windows\system32\msiexec.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\msiexec.exe	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	vds.exe
File opened for modification	C:\Windows\system32\AgentService.exe	vds.exe
File opened for modification	C:\Windows\system32\msiexec.exe	vssvc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	locator.exe
File opened for modification	C:\Windows\system32\wbengine.exe	vds.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\beb56d89d33db760.bin	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\fxssvc.exe	locator.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	snmptrap.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	SearchProtocolHost.exe
File opened for modification	C:\Windows\system32\msiexec.exe	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	WmiApSrv.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	TieringEngineService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	Purchase Order.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4128 set thread context of 4352	4128	Purchase Order.exe	66
PID 4352 set thread context of 2812	4352	Purchase Order.exe	68

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe	spectrum.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe	vssvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	locator.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe	locator.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe	vds.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe	vssvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	SearchIndexer.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	TieringEngineService.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	snmptrap.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	vssvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	locator.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe	locator.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{40D3A8BF-A886-4CA5-B2B8-54BAE5ECD6A2}\chrome_installer.exe	snmptrap.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	TieringEngineService.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe	vds.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	vds.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\klist.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	locator.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	vssvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	vssvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe	msdtc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	TieringEngineService.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	vds.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	vds.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe	vssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe	msdtc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	vds.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe	perfhost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	spectrum.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	msdtc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	vds.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	locator.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe	Purchase Order.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	SearchIndexer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	locator.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	spectrum.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	WmiApSrv.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	SearchIndexer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	snmptrap.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	TieringEngineService.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	vds.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	vssvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	Purchase Order.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice\Hash = "gBEXEoYbV0U="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d6f7f8fef84d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%systemroot%\syswow64\unregmp2.exe,-155 = "Play digital media including music, videos, CDs, and DVDs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.mov = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555 = "Windows Speech Recognition"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a7fd08fef84d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice\Hash = "kWoaCqFPUCU="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mod\UserChoice\Hash = "xUERS/pNJpA="	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d54554eef84d901	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.wm = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adt\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.M2T = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\Hash = "IBsKAhSgc1I="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.3gp = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	alg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\UserChoice\Hash = "d5UyqhQVL9U="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.mp4 = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adt\UserChoice\Hash = "wMNB3EY/ZhY="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice\Hash = "xWoLIC1NtEc="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice\Hash = "YvOZjMpahwo="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.MOD = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021fc4c4aef84d901	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.mp3 = "1"	SearchProtocolHost.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	60	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4352	Purchase Order.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
4260	DiagnosticsHub.StandardCollector.Service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
3396	elevation_service.exe
2500	OSE.EXE
2500	OSE.EXE
2500	OSE.EXE
2500	OSE.EXE
2500	OSE.EXE
2500	OSE.EXE
3212	spectrum.exe
3212	spectrum.exe
3212	spectrum.exe
3212	spectrum.exe
3212	spectrum.exe
3212	spectrum.exe
4204	TieringEngineService.exe
4204	TieringEngineService.exe
4204	TieringEngineService.exe
4204	TieringEngineService.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
612	Process not Found
612	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4352	Purchase Order.exe
Token: SeAuditPrivilege	4544	fxssvc.exe
Token: SeRestorePrivilege	4204	TieringEngineService.exe
Token: SeManageVolumePrivilege	4204	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4212	AgentService.exe
Token: SeBackupPrivilege	4800	vssvc.exe
Token: SeRestorePrivilege	4800	vssvc.exe
Token: SeAuditPrivilege	4800	vssvc.exe
Token: SeBackupPrivilege	3036	wbengine.exe
Token: SeRestorePrivilege	3036	wbengine.exe
Token: SeSecurityPrivilege	3036	wbengine.exe
Token: 33	4376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeDebugPrivilege	4352	Purchase Order.exe
Token: SeDebugPrivilege	4352	Purchase Order.exe
Token: SeDebugPrivilege	4352	Purchase Order.exe
Token: SeDebugPrivilege	4352	Purchase Order.exe
Token: SeDebugPrivilege	4352	Purchase Order.exe
Token: SeDebugPrivilege	4352	Purchase Order.exe
Token: SeDebugPrivilege	4812	alg.exe
Token: SeDebugPrivilege	4812	alg.exe
Token: SeDebugPrivilege	4812	alg.exe
Token: SeDebugPrivilege	4260	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3396	elevation_service.exe
Token: SeDebugPrivilege	688	msdtc.exe
Token: SeDebugPrivilege	688	msdtc.exe
Token: SeDebugPrivilege	688	msdtc.exe
Token: SeDebugPrivilege	2500	OSE.EXE
Token: SeDebugPrivilege	916	perfhost.exe
Token: SeDebugPrivilege	916	perfhost.exe
Token: SeDebugPrivilege	916	perfhost.exe
Token: SeDebugPrivilege	2880	locator.exe
Token: SeDebugPrivilege	2880	locator.exe
Token: SeDebugPrivilege	2880	locator.exe
Token: SeDebugPrivilege	2236	snmptrap.exe
Token: SeDebugPrivilege	2236	snmptrap.exe
Token: SeDebugPrivilege	2236	snmptrap.exe
Token: SeDebugPrivilege	3212	spectrum.exe
Token: SeDebugPrivilege	4204	TieringEngineService.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4352	Purchase Order.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4352	4128	Purchase Order.exe	66
PID 4128 wrote to memory of 4352	4128	Purchase Order.exe	66
PID 4128 wrote to memory of 4352	4128	Purchase Order.exe	66
PID 4128 wrote to memory of 4352	4128	Purchase Order.exe	66
PID 4128 wrote to memory of 4352	4128	Purchase Order.exe	66
PID 4128 wrote to memory of 4352	4128	Purchase Order.exe	66
PID 4128 wrote to memory of 4352	4128	Purchase Order.exe	66
PID 4128 wrote to memory of 4352	4128	Purchase Order.exe	66
PID 4352 wrote to memory of 2812	4352	Purchase Order.exe	68
PID 4352 wrote to memory of 2812	4352	Purchase Order.exe	68
PID 4352 wrote to memory of 2812	4352	Purchase Order.exe	68
PID 4352 wrote to memory of 2812	4352	Purchase Order.exe	68
PID 4352 wrote to memory of 2812	4352	Purchase Order.exe	68
PID 4376 wrote to memory of 876	4376	SearchIndexer.exe	89
PID 4376 wrote to memory of 876	4376	SearchIndexer.exe	89
PID 4376 wrote to memory of 2312	4376	SearchIndexer.exe	90
PID 4376 wrote to memory of 2312	4376	SearchIndexer.exe	90
PID 4376 wrote to memory of 4224	4376	SearchIndexer.exe	91
PID 4376 wrote to memory of 4224	4376	SearchIndexer.exe	91
PID 4376 wrote to memory of 1592	4376	SearchIndexer.exe	92
PID 4376 wrote to memory of 1592	4376	SearchIndexer.exe	92
PID 4376 wrote to memory of 4700	4376	SearchIndexer.exe	93
PID 4376 wrote to memory of 4700	4376	SearchIndexer.exe	93
PID 4376 wrote to memory of 3376	4376	SearchIndexer.exe	94
PID 4376 wrote to memory of 3376	4376	SearchIndexer.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:2812

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s TapiSrv
1⤵
PID:3792

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:208

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3780

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:876
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 780 784 792 8192 788
  2⤵
  PID:2312
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4224
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 780 784 792 8192 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:1592
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4700
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 780 784 792 8192 788
  2⤵
  PID:3376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
8c09f024212bd1c7c80e2c14b0532557

SHA1
a61df479fdc72eddaf179bff8f649a88500f01f6

SHA256
599dd51dd09ef6676e197a6084fba9f84cca6cd65ce580f44107041629b20b22

SHA512
c3ad01ef665a93cda0cbb8978ae53be5e32fdfff1a2146554b88f88624f747729c4de6d884c941cf3f384a1f4c2df76411299d88bbce3934b9be6d816d3783d5

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
8c09f024212bd1c7c80e2c14b0532557

SHA1
a61df479fdc72eddaf179bff8f649a88500f01f6

SHA256
599dd51dd09ef6676e197a6084fba9f84cca6cd65ce580f44107041629b20b22

SHA512
c3ad01ef665a93cda0cbb8978ae53be5e32fdfff1a2146554b88f88624f747729c4de6d884c941cf3f384a1f4c2df76411299d88bbce3934b9be6d816d3783d5

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.7MB

MD5
230195fcf7e7fd63c6ce38a3c2f89542

SHA1
6ec4ae0c628f0bea1895f20d4afa3e6c6d0d9575

SHA256
d618155dcc675b2e48403edcbe50e0db10bb161e56c181b0664c312554820f8c

SHA512
8d379742646e9956ea076c34e51fbe1f0550c58a6360d5efbec1e360a692647dffa55aa95dfd967653cb0c9125a89e34790f189823f0ad588a46abe95e3bceb7

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.4MB

MD5
6420c19b023607ef575fba1ab2709c05

SHA1
84c03a176e5f36d4f39d2c5d5371739c8806c6cd

SHA256
2c4c4aae2e9513461c2c1899d7f5050e3084aab86ec6c92c0d45de0d7f800b7d

SHA512
8a23d18a1e9a8b61ab0c60769fd28dafbb164ca4b560592537ad238bd181158f3dad450d2cc6e3454a084abf0a89101f5e46c2a662599803dde72cea09494222

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
9551a707e5770f505c946337989da114

SHA1
e4a3e261212b02e8d426806485e3c0205a401b62

SHA256
ca3074ff249a0bdcbbf908670bf505da018205f8d38b59846b9d6a0c63280dd0

SHA512
e97bf7ca6e44c16eaa492f74e31290fa31e619f73b0fb3d063c0f8b13c33fbe17e3d7a99ab55ff7379290b9175930ad296bbc73e3f3182521965ca6d5c6be67e

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
215cd690ceb0833adaef4032f80f10d2

SHA1
14ceb68ffddcc3475eef86b5da06491bfc38634d

SHA256
496f87660847c443a667fdbbf56d0189d6e7dc730f9f645de2e41d767d3208c1

SHA512
ccb6c9eedb7b19ad58217d9fdc76a6434c13394cd147994616b109a3a0cf12f614de5c1f4d924833afd3ccf5be2f994fbeef0808188a69a1ec22db7620508a97

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.5MB

MD5
785274ad855dd0120b49c8559e271f96

SHA1
8c1b26e47c58d91936c2fb1b6ab1083f6f157802

SHA256
8b180eb64c0debb1ebf3b6814f8d3143d4eca2d008473faa27145617c4c62135

SHA512
034e991ce23b8512439ed9508c331cdd550934f38864a8a82863820ca10d8dfa9bab6dcf16212dfb00da1bc208c6e7cbac13b7dc77437e83fecac4ca20c3cd90

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
674dd16653d8ae56c21fc00b6364aa33

SHA1
6c40698ace239c5486d379bf5592cf2f7c0c9b50

SHA256
0e72096ed04899690bdf87dc3686e97a7e3f44b0f1bc45d511ae20f5d38e74ae

SHA512
4e31aa93c8332613dc486c418bd666480bfae4850843c4acd004b631d4c47314ec555f5be2c22f1ffe105a86c8da3658f0f58080ad9c678f673d6f8a0c36b0d0

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.6MB

MD5
aeacfdb2f9d56de97218e62a58ad35ec

SHA1
789347875ff4ed5636deac52dcbfecbe18bf0613

SHA256
c2c0ccb0b1a9d1a75f86237bde0ad4bb0a6cf7c39f147303d70f8d03075cb6ac

SHA512
5ee6f58cd4ed109c984238fa6b6d9f96a73903b10c7c42d4ca42bbad4ac79be3dab024d9d9e282b19c69ddb4f40941ec9cdba47c774256d074c9595d64873afa

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
f6961d54b74a3198025520e442b3d49d

SHA1
dde7903ff40467f72c87ed9915bae04a8d67f229

SHA256
4d5f448b17f02b48a33fd349129c3538458cb77397ea07971b7963ad9e8f113b

SHA512
3d8f36f856c3cf0ffb8f54e2b40d6e7e2a7774fee2094ff70def3200cd8a06a319d6fcad343918cf1368b00ae2cbd7790776452cf684a8414ecb3f45e0682ec8

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
0f98f2da6547dc886d01ca771b676cee

SHA1
4549a153642b161028fecc89568a773b01a5dd96

SHA256
e311847d86ab810a8c8aea575824e1bdb8643c70bebde7c4ea82ceda775ab8ad

SHA512
50e2aa54b0fb8cfe843dd513473260ed85a23cde188a6b2f5fcc317d1e6955c551ede4be5577ad258c1a1d6280c3cb3d65083b93a8a0fdc4cdced30f59160be4

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
abe08f349e554c81dfe4cb3794c1cdff

SHA1
24c46e9a437f8ebed83cc931811550a343156a09

SHA256
3642ebdc051b2b341faa9d795064320826ac40ee8703bebd38bf0ea5430f453c

SHA512
c9b895623d58eff2cbb5277d9dac3a08042110cb0359044e73b9b7db90487f9fd87d16e05579dff62f966c41737b6726cad42e3107ee667df6b08bafd94717ff

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.5MB

MD5
1d63b05de02f66fced251a113f16f4a3

SHA1
990f3ec20d33c96dc18d9f1a9d7db526c9506a04

SHA256
179ecea5878befb3fca79775037cd27ec074e24a78ed5e23a9dd0b3770986f6a

SHA512
cf57c914d24f9730105693039436d56864b9b697e973183fa013914f8f14d45cf0c3f1cd911308bd79cf20b2eb41bee3b6d211c3d4beded7d756f204ea365f49

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.3MB

MD5
84a8e827760f150e4c7ed856fc3c77ee

SHA1
1a20cd2a70ef2720d3210d42fa64df71b9e0a02b

SHA256
8c6cad3f17a6e2c381bdf915220a276e93b099241c86ece261852bc91fba1963

SHA512
76fcd5cdc6f29f8324730fc20b347c0cf65d86ea360b12d023ff8846876bd67f40f600008a37a9a727bc6ad82999a3d45f42f0bb8622fa6052dadb4bce0a5ac8

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
84e05d01acd003f89286eac0ae230b9d

SHA1
c1644a4481151ab862ab80ae7865f42333b8491b

SHA256
911afc9038d72383cc5fc8acd83af78717df9f28c41ab9111728dfb8ea6b5d64

SHA512
1f63fb39561ea5e9eba1c45da86f19db710962a8888489a403c7ad5bc64769bcdcdf996f4a4499f21d566df6f21a9b03d140d1ab2d6fe8909a89e05ac76ac304

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
f21acda5de7dbac866132c15571a4290

SHA1
dc7ca50327e830c00cbc59be37f04c2fb4cbb04f

SHA256
bd594fa36f9f0a45aef85fb6d1d5d7b61a3f6625ad6615a112ae8d6c8d6a1b68

SHA512
3334eea9721b6ed13a09b4ffacab57697e176325b93659211de9f412f4f47be5d4f173e7b5dc594e0788c023cc8654593abd0e5a796a04d44c3edd57c3d2a6d9

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
70080ff3beb6c518f5f90ece830b5c2d

SHA1
11f266de523865fd035850729872bb2d1ae37241

SHA256
52f5a42caa4a5c28aecb2e1d72982382c76832bb7d2fbad00c1fcddf720da83d

SHA512
0fdf7104e179b87a68002e48b53179758ca35ab8b481acef5885be89e003fffbd70c49c630f2bc253097508e741e25b0706f32f71399bf62c8cd678566a8059f

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
fa32189099966c87a9e0bdbb9e6fb699

SHA1
aac445efbf9de878e418f85c62d5574b458fd0c9

SHA256
f7fe3a308a2c9778590fb8280c29e9ba34255d527480f08f6cae1ecb42af7797

SHA512
a608d0f10dad115a2ca6f5a22b65fa53a195fd30a4660e7f170a40d4a68b7918aa1f2a71c77ffc4a9acec648a1228eee357a8805bf44ac59f94594728e60a6be

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
fa5950c5d8a00fb4cb71b1a65999c41c

SHA1
23d5fea1abcf161726bfb9304906bd286aaad3d7

SHA256
f7accf5b99f959722748738b3059db891b890038a37daab0da5f2146eb4b91f1

SHA512
1f889651bce0a4ca485948a6bd90a966d273928168f19161c0bcda07930fa3b38bc424a17ff27e999963f592a3ce0a99502ec083fe58ebf758c6621376cd02ab

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
1f5a0826ebd3e09cf6101338147cd075

SHA1
9f227e1290c2332a0f0be1ade4baf96e75348602

SHA256
a801291b2b2740fec8755da41e5b330bedce0bdef127d2bb488a8e274fb02404

SHA512
2d50f9042bb942b51d8ca09150a3c82c34c80b9c894c18a62358ae9b3c90703838052ebe0a8f38cf05a1a9f588200a6166d3d78b9277c11bfd4516b9ff388783

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

Filesize
1.2MB

MD5
131ac40d455c3314531bc6cc89b30880

SHA1
832c3fdb0042498906a88dc19892204a56ae63d6

SHA256
ee69cb06aa50009015e4497280d7e93322bfc6c5169ec1d4a0f09400441615ad

SHA512
63925a7d830a2d3d3291655d10ff7a475f03554bd0acec61b226cc8774f00b2078c6301d1ed55fb79258a9dc4b4a705375d4f975a17c641e2f66775db21d796c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

Filesize
1.2MB

MD5
cfec4154a0639cbb07dac6f2ec664ed8

SHA1
9740a232362a05af66951c1c215dd22cb7f640eb

SHA256
d30d2827549ab94fde3a6b09f9f35149caec360870bb82b1dd6b03081526b569

SHA512
78ac37bfdd1acbbbbf85eb7a18dd84eb265c72ab81712166304c10eb420b79ddfeeee7331cd21683d2cdf5c3981dfb3bb8105799be01aa909532f0533dbe0d5a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

Filesize
1.2MB

MD5
12c2e90d842cc51a52f1a73757293964

SHA1
fd6bc7c8f20245c0194486375eb349de71dd12af

SHA256
e0bdbbb45aa12dcabc6988a6a927648f36e497f98a82d1ad91a575d62f36b9e3

SHA512
05dca0114b4d3cfd21f479eb9db29bdbb7ce31e4598d80514ac2ad7aa9c35a123d8dd234944ba4a9edea934b7e806c121734be53dbf4c9ebe6b47539ed346585

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

Filesize
1.3MB

MD5
9ad22359f3176aa4aef1cd4e3fb7abaf

SHA1
16bdb153c1c02621487a740898ea824bd5ff44a8

SHA256
8c525865ca06be38836331492fe6169cba7c64eca39c0318b15a4775d5a05ce1

SHA512
3be887fbfdc5cd4028b6d84433ff47089c3e7da4b0e31f9516ba37d7d443ed779d1b357f5e7cda0dda893309311a6445f13c044aba6f2bc9c0bc194bcb7b2a18

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

Filesize
1.2MB

MD5
81b34533b8611bac53c1e2b867bc7d4e

SHA1
4e0d144a36ca63cacac5042e4676b5297046dffb

SHA256
8cb2907324b0348850aaa16a88ce9e4f256b723427ccd3bdaafcacca5892270b

SHA512
c3a294dcf55480ebaf7bc056b618257fa6e472287a70d2f3add5e125cdd19f7bca2c86b872ba279435459189996c1bd466bec70043f14dee6a2e0b4986b41066

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

Filesize
1.2MB

MD5
9323709e24777a93c69a6e248190d446

SHA1
c1aafa7e7a6dd09ccfd812283a05ff972d52df5e

SHA256
2f584068e1d4c9213c5f0a70297199d3d281d17235815f19d015c858f47bc271

SHA512
1d1b03c87da0d51ee416fb2905950ccdebdf33bb5d8c6ef8d1af4421d1ec0548c3b89c41428779f244a21689bd6f5b9ba1ba936cd2ae13cb3f557ca3268e2f8e

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

Filesize
1.2MB

MD5
e20f9463ad527919942b18e7b39ff8c4

SHA1
06f913f9770398f04f00ff691002fbefd700b103

SHA256
3594ea010689084df38b624d8523a47c9932dfe9dddd128297ba10cef2bb3fab

SHA512
12aa4ae0671f6aed7040292bf5810f47f15fd38e2a34a736f39952c926a91715ee1e70c52ea9738db46123758499e4c9d68993c5cb07dc63b280f1e6f5198787

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

Filesize
1.4MB

MD5
d83ee67d84694296382345eef1ac9979

SHA1
9f367e5c4e7963d77be9889634ea4dd7883d3213

SHA256
e1979960a7d3b5bc56b338d6efc5cb0305808f68fb0a64b22a8c054681482fde

SHA512
999f9ec08cbe232acbd598f8a2daadcc9ae6bd96dc526e8e63122a055b66413dd87646ea0cc36c655ad112bc6bd9feea471cfb67bdd1acc93f65bde2fbcff612

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

Filesize
1.2MB

MD5
0046481c84a8e063f2d94e295d76f44d

SHA1
b64d0810d5d51f2f4959e473bc324e309d79bbfc

SHA256
af0f9a290e9ac1fa1efaa90ba1294a9ad898bc1996c766668a1b4fc0315fe506

SHA512
bd2abda4ef0c9d2de5f3c8ddf7efb524bfed713a1d7ceac0576e5df711802ede6e33d8321cc02a174b3ce08c230d30717406983328b54846d6ccfbf0cf3bcda0

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

Filesize
1.2MB

MD5
d0e6956e438ea80cf732335a0b978eec

SHA1
c9047d8c3d1518aad640e981ef8005bb01352d77

SHA256
a5c6f7f8ec23f045581a740402e7077e45a7773be5c220684bab130b47b32419

SHA512
60f82542beccfb8494b5502944782d56933920e552a1e91b0339961a95799d7974738b9e78bbe66df98bf5994b2b040102536c258af7417cf821750fb86bddd5

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

Filesize
1.3MB

MD5
567943838456935c26c5fadf8db4e46a

SHA1
69d25b7a34208fbbdc6c542e7fea51fedff9473f

SHA256
1f262ec6d451c8059db050b65815e303a8583a2b290c28a27cc840396bfa8c59

SHA512
2e39a25072de87956dc0fa2d38a8d96bbd8c8c7d775d935f18e7aedb143ca6275084c2273bc7e843c6bb4aae87b787f612590f2eb465aa75f3da3bea34d900a4

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

Filesize
1.2MB

MD5
10a1bbb8747ced98dbb0a5b530db0758

SHA1
70bbeec8780991bb8eaea247a3fbcb5658cebe0d

SHA256
5802948c95af0fc300a730cd147ccee74cdcb5bddb154373f405ea9e8efe6871

SHA512
a4f1a247a43f547c5f3ce4f0a979146f3dea33ea6d26b03930df7d6e464f81174dad3e5837e1db4f7c75781494938b831979ba220a59dc3f50f68b1ed05e4415

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

Filesize
1.2MB

MD5
81d7b1d17ab5b1a4705fc4292ffe6d1a

SHA1
a0429d518e89e8b1e8d263ff975f605b92fadd2c

SHA256
9fffdf1cea0b97ac3aaa7efe06accc33722a7c3b6eb111afc1a4fd2354f18ac0

SHA512
a09d7f161e07b8d318b33e4f7d7c84cdfcd7db8afd4d19ed8659cfb89d4d71aa56a3179e278d8754e027bf21f159f43a0f0183682166ba2d1a1da514dcb164c7

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

Filesize
1.3MB

MD5
6133bdb6b249668424ae1c44d0c5cba8

SHA1
3a8e3ad186b7d2a96c65836f984c642a79b2d342

SHA256
64651e9394456cae9e0e5e8bbc1821ffad91755525dc31348dd6f35e27d895e3

SHA512
b17152223135ee021b08b21d28f67caa43fd83888e59dbc010de8f67019bf9d0de5c9fc3df08339ea3cb76341e1f32bd9ef260cd533bf41fb6c68458df05b370

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

Filesize
1.4MB

MD5
9c25669c6bc4c3f3d5686344da1a5eba

SHA1
3df148937c0be6a29d5b61f9f9c2da49cdb93827

SHA256
9859e423014c79874ee897ecc822035c3c89b65e158696bf97da34a75afab5b6

SHA512
6edd2b0b386665052add8be32f559d90f57ff30d98c75e791b4ad49cbf587c3cc2c6949f95bc7d709137309443b7d5dca42d21fd048994b2ad240029afd02596

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

Filesize
1.5MB

MD5
876af4450f899b415cc11d2fb1cb1f66

SHA1
338eff827b3c670d5dcac4b9a6f38a6a098c0c3f

SHA256
9e79f1eaf16bbc3a688152613e142c9e71b29e601c05b91e8e7f3e9f576a281e

SHA512
90d276f10e6603e39c64a6e88164b4db53dfd609907da6c284fa066462131d29fbf5b766d182568bea7ea888815c0af3cb7bd167a84dc40f39053b74b05eb41f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe

Filesize
1.2MB

MD5
68be4c42623134581b06848be768bd78

SHA1
ecf96c11dd4ba8e0d4924df5fa1f6ca98348a375

SHA256
454118e2a6af10c9abe7d59216c9ee7e995cb5cd29a40b66a9c6e7c6530c1a5a

SHA512
a028cba07f70080b1e42d605388bd0f81fc68c0e3ec0ecb2ece739550aeb829c0660540459fa3e515ae626f8498ce7c9800b7e01d9fb590b1e9e7a6ba26d2549

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe

Filesize
1.2MB

MD5
f690ad51d3d0133e23e1161d5f839618

SHA1
52d98097d8a1a5330b7c17451d64c534df73e7d8

SHA256
982b1e6931d2f027fca051c76ebad64ccccf24178342d47ac361476481641afa

SHA512
23d06f5f49041b2862d549705e2967e3a95f1c0ef355e3c31830567deb2a6927e1b1cb9383da0bac6ad03be60005294e04b7622df797cb7be08f3415bc1e5b96

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe

Filesize
1.2MB

MD5
e733e84f61206e9b9071495d1ae9fe5c

SHA1
493cb12c10b274f667707896e57bdeba74563d94

SHA256
4f2ae7967ee9de5b9350d5e04572bb30ac9e761f5f8fe3e83f73c72f7592c947

SHA512
53f86b6c4d2dcf76abc451c0dc0472e49067a86126d268efdf5cd147fe25455caaf13e97232c778ccf44cd0a0a1a3050d48fb863bcceff571717035c33e56440

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe

Filesize
1.2MB

MD5
3caf57f67ad37032fd813afa5159367a

SHA1
f0df429e44d8f2f1992bab6a5604f70a69c43ba5

SHA256
312de2932eec9973370aa01f6d20090ebbfd2b0e40a530ab540fc9a192c73749

SHA512
dc5787dc4ef0f92e9f161ece4d88a95f8a0620f1a93086e883d66010dc0e307c995d040eaa25fe636366dfa52fc89eabc182d243360cc62d66abf026a7dc5f49

Download Submit
C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe

Filesize
4.2MB

MD5
2b2df5fd1b136856aefef439a21ea5a1

SHA1
57f5722554af62ed69898c98e96ec99f39c9c533

SHA256
5b0bd303b41851737011de5d77eb66aa998deeac625ef2a1913d3b3d40fd0e0d

SHA512
fa0ec4dcf5ceb3ef4ca9da8031bffd3e6a4f61d4e91f04c640924eacf68aad30bd0c4c6db84a4b042d4f3a11c16fab3e6cae3c5a8ade7a15b905ec4f5e652dc8

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.7MB

MD5
a77b97d143b8d1338c5719c58046a52b

SHA1
e333c784ba2afad20b46a5d7bbb5e6c4b2d0ab53

SHA256
0d210079ecda26c3f188727e04bc6fa51d2de097266582f41be68804efaf56c6

SHA512
51bf2d231b98c10e255dc42fba855b7931c47869402e10c671fa682c950f5ec6fc08f91febbaa27ab4cd1da8d03c4441cdc0fbcab1d5eb50910d56792f006088

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
45ec2ba02d83c5d66ac5a93a10838490

SHA1
f5e346cb189f31284016adb25b3682f6e2db30dc

SHA256
4e54e4bfeb2dfb3526c23ab598503bbd0b56e97af5ee70a5992dabc7e0a50cbd

SHA512
360174dda835406fd134e3e01ead8d795df21155eb2bf3d2406647553a061e44cf7f9961c8d305e48e8a92a1fd4d73b48f8b81fadc4bcda47ba5c5483d14b21c

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
da6272ff569b39051c0cdb4dcddf553f

SHA1
dbdbfb1118f3a12a664138481f10b60b493c68df

SHA256
4b6086ce4f889b464add39644ed886531e53c339f3f5536e4a06c9347f381240

SHA512
38429fd62f879a68860e9ef6bbab29570ce226f2a9b75c47dd8560c9705c8722f265f24426ffef78b611a5a95c7221349a72f2d37d66bdaa82bd597b463e334e

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
b9578a1369d7c1016401c8988a97c063

SHA1
df8d3436566f4d0bcf708716699a3f08a9908818

SHA256
de7bd0648d047fa2e68d360526828f46707ec651c0d620c030ddb26412dc2d9d

SHA512
e2495e2c99caebd20edc5db2e35382106a04a72d85e8f2eac795c96b925aaa196b19e88ba6188935b117fa122fd0862a7476b800b9c87280a7c4eb26aba1be8d

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
ec6240a5a5e45d8993b62132947bce11

SHA1
92cc2a2903266630d0b11f31dd1ecc6618919faf

SHA256
5bc4b59d9cd8e228dcc879501cb700dbcd4ed8516ddf4d1a5846a1357f830f4f

SHA512
5b80580f86d700af27afdf648a7f94a73ba816fd96329026f29fb76b1e8bd4210179252cc2ad5eccab17e57dd61faade75d3368b960056827b3569fa2359df07

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
ae23c38dc1b4e3bc2ab947af644ed15f

SHA1
a69f7d0beca9e098cb4d075e9cd164ff5540ea5e

SHA256
7ee700d841cc21656dc14b75b0c30b282a34b17916cd454e1b16202f01869a85

SHA512
4024e8aeaceecdcb54c695c6dae22c9f97e9b773170a745d638dfe43101b042634dfca344bcc6b87f9047e16e01874bb86f1492d05673b47e5ae690ed91cb4fa

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
ad6a7870d992bb8208d3340144ec031f

SHA1
3f3deeef69ee66bbd79b305fc35cf07abff944e7

SHA256
83072fb2b2b6f5977bd1a63c96faa05e518e2466b5266f5326098029052bee06

SHA512
a429dbebbd38720857d1235df57da6cafec5aa201c1a15106bc19906a9e9373f9569c8556633194b4fead34fd813c53793456bdf794d352330eaba6f3e460b3f

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
318c0e92ecdda7358dac0788049c14a1

SHA1
6f9b45a51e023eff2dfd9f521b1ec6db007fb693

SHA256
d7e8c9b07f72b5d3517a05dad2ef20a63fa2466c35b7171a67c9f3ea753cf82a

SHA512
93f0beae91a4b6409e67414f646549867598d8dcbbc155d255a8ce4a58ea568cbd1035785a68c7de2a37e80e5d231dca2fca686a14b2e91f109e32f8453b5ab9

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
318c0e92ecdda7358dac0788049c14a1

SHA1
6f9b45a51e023eff2dfd9f521b1ec6db007fb693

SHA256
d7e8c9b07f72b5d3517a05dad2ef20a63fa2466c35b7171a67c9f3ea753cf82a

SHA512
93f0beae91a4b6409e67414f646549867598d8dcbbc155d255a8ce4a58ea568cbd1035785a68c7de2a37e80e5d231dca2fca686a14b2e91f109e32f8453b5ab9

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
4d2b8448115e3441b2a0d23fc43f1bf0

SHA1
cd502446f9ec8610d14752019cd84250f39e29a8

SHA256
c2b9fafee5db515d9855bf1f177309446a8ef7991ecf4c419a2e7f2b9f4deba1

SHA512
9637a014efe309ed18d387e35036ce6cfce56f49bf802c62b649bd19d611876116c3e7fab346d2be36621c2ad0496d59887213af0f0c816a3fef04e12adbfeb3

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
6de71cb88f0bf34a800e2470229bc1b6

SHA1
9737c2b861704bcd115c4ff1dbb0ea776d943d6d

SHA256
046d4714eb38a93f434c38cdbb2d4641b3bf0f0ba5e4516b0e633769cadf950f

SHA512
462cdcf76941af29e3c2ce6758c188adc2728b11c62749ff35f1c39599a0581d41240f31fc97080c444ba90661bb43bc36f1e7c2a730240341789f6fbdd9e7fb

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
6d634498145d49d68ec1780e09c68c4c

SHA1
f7419196a202b4cf75bc1ee818209e2c9d577369

SHA256
8be2c496e8c01250d5aeea508c859548b04f4264a444016e21626306a4f187f9

SHA512
ed8668b74efa1fa7f63ee266d7135e0368122c63cc251164febea150d16ed895d837555b629606238f1d5474b258c88639a8f27ba4435e8d895243e7456659a5

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
29962fe5a658df6bd3d7d2bf580f78af

SHA1
901ef44ee876d3b93caf3f4d366629d135302fe2

SHA256
bcdf6f9680f374b5b26dc4176c42b1f0693101801bcf56d1ee3039d05c3fd77f

SHA512
17ea55d8799fe38c8b50032326dd14cc807e92d487a512e9aab7e9494241fa9642df6f68b845bf8ecce11dedd0d4e433c501e34fc7df6b93c492676e475e31cc

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
cfa1594ee070d0dc1c71c1a0d4ccc2b1

SHA1
0ec5c699fbeea6e466c19de5c8f28e5d53601c2b

SHA256
65054c1427b12787b38f3ca1101e64e74bed5c7a57c9c9b6044098ef3b5e7d9a

SHA512
a1ca7b32799ee865209548365d94a20eaf8c3da43d3fa6b16b511cf501c74ba69ce65ed6ac4e6de12aa78f70c132eb733d26ca5e72ccb7fb3fa63ce533bbf6df

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
56b32fcd6dd28f1c288a4e591ddf344c

SHA1
33b41344b05d6f9a3bc8032515492bc6a6a90141

SHA256
a0f70454043223f00a41d24297008c98e8a9912298fbb0d86160f6d90471820e

SHA512
b268474f9216d22836ef0e7a1fc9f5af4f037408e81182299eb9e1418a5a2baa0fa7e4fee7ad56d60e6fbf79b774ff44957bd0f0638b3772bb7dc84a7c38ff09

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.2MB

MD5
de00e8c8ca8f14895ff27abd8f30536b

SHA1
52e9cdccd60b010297bd591dd387dd45618e5fe5

SHA256
d0b12fdd5990f2fb09722d45183d93c0da950697649e17f09e05db6a4615a07b

SHA512
7769e8e99db764be281cc3c64c030651f66fb7b760ce8ffd0d532a89cf19c5416297692c00ec4e40d0b4f353a429f323ed7bdfbfe110ec59b0782048f5063dbd

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
c42335111f32e521594756b87953ddfe

SHA1
7d6d50cdc6153f781cc2825d939c51b02306f448

SHA256
e20fb00e2117397ed41524f18a4bc1108e9503cfd7d61b492a3ad9596d9af51c

SHA512
11b6fd75bc5e9f0153d53591042c889c825108a6572d4b7524da56c599da45b8249a409f7087bcdd996c39a4184c499da4db43aa908163b0e4b3b1589c3cd127

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
0457f348f9467f19eea4b23b726145ea

SHA1
6610705d68e8d68eb1a9a303ded50e9fccf0f8c9

SHA256
eede4dbcc497c91fef69b2ba757e1258c55aaa5b8fb8229f1b5016e04b640fe9

SHA512
af2243d80a6214e17d37d20bcdc4320408bc34e4a139e043628378c9d254a30ec3b96e004690827424b24903e4321e135e868321df78c0a9fa51ae992801f37f

Download Submit
C:\Windows\system32\AgentService.exe

Filesize
1.7MB

MD5
da6272ff569b39051c0cdb4dcddf553f

SHA1
dbdbfb1118f3a12a664138481f10b60b493c68df

SHA256
4b6086ce4f889b464add39644ed886531e53c339f3f5536e4a06c9347f381240

SHA512
38429fd62f879a68860e9ef6bbab29570ce226f2a9b75c47dd8560c9705c8722f265f24426ffef78b611a5a95c7221349a72f2d37d66bdaa82bd597b463e334e

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.4MB

MD5
18996f8d06db1c052b0ead47eee7f379

SHA1
021b57d22fd818bbe0f8878cd67b0f1c51ced0e8

SHA256
061565f54033c10a29667ac20fbec4434be4761ae452f4b8ea257d93db73a24b

SHA512
70468d7fc2102e92cb55f0224772bd89fd7c88b8970b3d7fcbffb451b9a32d27a91e603591b864bd3023e7ec201d58b67a7801943d1540ddd6c8365abb09d872

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
ec6240a5a5e45d8993b62132947bce11

SHA1
92cc2a2903266630d0b11f31dd1ecc6618919faf

SHA256
5bc4b59d9cd8e228dcc879501cb700dbcd4ed8516ddf4d1a5846a1357f830f4f

SHA512
5b80580f86d700af27afdf648a7f94a73ba816fd96329026f29fb76b1e8bd4210179252cc2ad5eccab17e57dd61faade75d3368b960056827b3569fa2359df07

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.3MB

MD5
1e0c042951ee6121f19f86c7bebbd208

SHA1
8ef94fef565d483b85865566d9f2ceb51882e658

SHA256
fc84e0c9bf66e026f04042a689276fb173771d17091715d61b8a9cb551192ae4

SHA512
0c128c2cae1e4e6ea293ea81f0a29324887edfc1813257074112438be267d073ed92eb6e4e3c519b7aba0c180ef66007925a9d53d9e4faaa27b391e804f02eba

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
ec51ef97a8a293847d7ca1085dfd95ff

SHA1
4b271114089fea96d2ab66c8b02036029fb686eb

SHA256
e8bb859f99e842daa45184cd777d24c237c0064402ba6cb1fe840bfb6343ea8f

SHA512
0541918e0296d24534b932de94ccc18975a11ee2a87b32c7e36546bf0f16e3be4a3777f8e9ca649fef322c5c1acb5d748ef6d2ea7af0c987bd2649b33f4c7983

Download Submit
memory/208-998-0x0000000140000000-0x00000001401DB000-memory.dmp

Filesize
1.9MB

Download
memory/208-749-0x0000000140000000-0x00000001401DB000-memory.dmp

Filesize
1.9MB

Download
memory/688-278-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Filesize
384KB

Download
memory/688-555-0x0000000140000000-0x0000000140210000-memory.dmp

Filesize
2.1MB

Download
memory/688-290-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Filesize
384KB

Download
memory/916-718-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/916-1006-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/1592-1202-0x000002002DEA0000-0x000002002E0A0000-memory.dmp

Filesize
2.0MB

Download
memory/1592-1341-0x000002002E0A0000-0x000002002E0B0000-memory.dmp

Filesize
64KB

Download
memory/1592-1199-0x000002002DEA0000-0x000002002E0A0000-memory.dmp

Filesize
2.0MB

Download
memory/1592-1342-0x000002002E0A0000-0x000002002E0B0000-memory.dmp

Filesize
64KB

Download
memory/1592-1198-0x000002002DEA0000-0x000002002E0A0000-memory.dmp

Filesize
2.0MB

Download
memory/1592-1197-0x000002002DD90000-0x000002002DE90000-memory.dmp

Filesize
1024KB

Download
memory/1592-1339-0x000002002E0A0000-0x000002002E0B0000-memory.dmp

Filesize
64KB

Download
memory/1592-1338-0x000002002DEA0000-0x000002002E0A0000-memory.dmp

Filesize
2.0MB

Download
memory/1592-1336-0x000002002DEA0000-0x000002002E0A0000-memory.dmp

Filesize
2.0MB

Download
memory/1592-1334-0x000002002DD90000-0x000002002DE90000-memory.dmp

Filesize
1024KB

Download
memory/1592-1239-0x000002002E0A0000-0x000002002E0A2000-memory.dmp

Filesize
8KB

Download
memory/1592-1200-0x000002002DEA0000-0x000002002E0A0000-memory.dmp

Filesize
2.0MB

Download
memory/1592-1206-0x000002002E0A0000-0x000002002E0B0000-memory.dmp

Filesize
64KB

Download
memory/1592-1205-0x000002002E0A0000-0x000002002E0B0000-memory.dmp

Filesize
64KB

Download
memory/1592-1204-0x000002002E0A0000-0x000002002E0B0000-memory.dmp

Filesize
64KB

Download
memory/1592-1203-0x000002002DEA0000-0x000002002E0A0000-memory.dmp

Filesize
2.0MB

Download
memory/1592-1201-0x000002002DEA0000-0x000002002E0A0000-memory.dmp

Filesize
2.0MB

Download
memory/2236-1026-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/2236-752-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/2500-716-0x0000000140000000-0x0000000140226000-memory.dmp

Filesize
2.1MB

Download
memory/2812-167-0x0000000001240000-0x00000000012FC000-memory.dmp

Filesize
752KB

Download
memory/2812-220-0x0000000001230000-0x0000000001240000-memory.dmp

Filesize
64KB

Download
memory/2812-159-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2880-746-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/3036-1426-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/3036-818-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/3036-1056-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/3212-767-0x0000000140000000-0x000000014016D000-memory.dmp

Filesize
1.4MB

Download
memory/3396-239-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/3396-961-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/3396-274-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/3396-228-0x00000000007D0000-0x0000000000830000-memory.dmp

Filesize
384KB

Download
memory/3780-1061-0x0000000140000000-0x000000014021B000-memory.dmp

Filesize
2.1MB

Download
memory/3780-863-0x0000000140000000-0x000000014021B000-memory.dmp

Filesize
2.1MB

Download
memory/3976-1051-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3976-794-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/4128-120-0x0000000000EB0000-0x0000000001016000-memory.dmp

Filesize
1.4MB

Download
memory/4128-130-0x0000000008A20000-0x0000000008BD0000-memory.dmp

Filesize
1.7MB

Download
memory/4128-129-0x0000000008980000-0x0000000008A1C000-memory.dmp

Filesize
624KB

Download
memory/4128-128-0x0000000008650000-0x0000000008788000-memory.dmp

Filesize
1.2MB

Download
memory/4128-127-0x0000000005D20000-0x0000000005D2A000-memory.dmp

Filesize
40KB

Download
memory/4128-126-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/4128-125-0x0000000005CD0000-0x0000000005CE2000-memory.dmp

Filesize
72KB

Download
memory/4128-124-0x0000000005840000-0x000000000584A000-memory.dmp

Filesize
40KB

Download
memory/4128-123-0x00000000058B0000-0x00000000058C0000-memory.dmp

Filesize
64KB

Download
memory/4128-122-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/4128-121-0x0000000005D30000-0x000000000622E000-memory.dmp

Filesize
5.0MB

Download
memory/4160-252-0x0000000001660000-0x00000000016C0000-memory.dmp

Filesize
384KB

Download
memory/4160-263-0x0000000001660000-0x00000000016C0000-memory.dmp

Filesize
384KB

Download
memory/4160-270-0x0000000001660000-0x00000000016C0000-memory.dmp

Filesize
384KB

Download
memory/4160-275-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/4204-791-0x0000000140000000-0x0000000140233000-memory.dmp

Filesize
2.2MB

Download
memory/4212-789-0x0000000140000000-0x00000001401B9000-memory.dmp

Filesize
1.7MB

Download
memory/4260-165-0x0000000000480000-0x00000000004E0000-memory.dmp

Filesize
384KB

Download
memory/4260-174-0x0000000000480000-0x00000000004E0000-memory.dmp

Filesize
384KB

Download
memory/4260-217-0x0000000140000000-0x00000001401FD000-memory.dmp

Filesize
2.0MB

Download
memory/4352-856-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/4352-131-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/4352-134-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/4352-135-0x0000000002EB0000-0x0000000002F16000-memory.dmp

Filesize
408KB

Download
memory/4352-140-0x0000000002EB0000-0x0000000002F16000-memory.dmp

Filesize
408KB

Download
memory/4352-149-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/4376-866-0x0000000140000000-0x0000000140178000-memory.dmp

Filesize
1.5MB

Download
memory/4376-1062-0x0000000140000000-0x0000000140178000-memory.dmp

Filesize
1.5MB

Download
memory/4544-251-0x0000000140000000-0x000000014012E000-memory.dmp

Filesize
1.2MB

Download
memory/4544-204-0x00000000004D0000-0x0000000000530000-memory.dmp

Filesize
384KB

Download
memory/4544-216-0x00000000004D0000-0x0000000000530000-memory.dmp

Filesize
384KB

Download
memory/4544-223-0x0000000140000000-0x000000014012E000-memory.dmp

Filesize
1.2MB

Download
memory/4544-245-0x00000000004D0000-0x0000000000530000-memory.dmp

Filesize
384KB

Download
memory/4800-816-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/4800-1055-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/4812-155-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/4812-151-0x0000000140000000-0x00000001401FF000-memory.dmp

Filesize
2.0MB

Download
memory/4812-147-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/4812-860-0x0000000140000000-0x00000001401FF000-memory.dmp

Filesize
2.0MB

Download