d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514

Analysis

max time kernel
116s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2023, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
Size

1.8MB
MD5

471796b4ee15fb7152572a9f4cd69f59
SHA1

45c2cadf4dbd5b718a0d1b25bbecd784c6a08ce3
SHA256

d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514
SHA512

5522ae4f32d69df6a0a701ada4f0156160f6608f0ce5aeabaf3c015d7c2f15d22b404af13ff15594a5f305db5cb5edca00a17577a2d7d0e8bbd27e08b2033ccf
SSDEEP

49152:oKBOf2xGs+kgqlSTTLS5KmlwqaEfLNiXicJFFRGNzj3:oKYwnCuPlwqa27wRGpj3

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2220	alg.exe
4584	DiagnosticsHub.StandardCollector.Service.exe
4280	fxssvc.exe
2864	elevation_service.exe
3492	elevation_service.exe
2128	maintenanceservice.exe
5064	msdtc.exe
4648	OSE.EXE
2404	PerceptionSimulationService.exe
4896	perfhost.exe
524	locator.exe
2492	SensorDataService.exe
4432	snmptrap.exe
2316	spectrum.exe
4472	ssh-agent.exe
996	TieringEngineService.exe
4564	AgentService.exe
2132	vds.exe
648	vssvc.exe
808	wbengine.exe
2008	WmiApSrv.exe
3056	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34088b50e5e8e96d.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\System32\alg.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\GoogleUpdateSetup.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\GoogleCrashHandler64.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{84E556F8-817A-48AE-B9AB-5A8D3A9B120D}\chrome_installer.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\GoogleUpdateComRegisterShell64.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\goopdateres_lt.dll	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\goopdateres_ja.dll	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\goopdateres_pt-BR.dll	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\goopdateres_hu.dll	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\goopdateres_id.dll	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\goopdateres_ar.dll	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAA6A.tmp\goopdateres_hi.dll	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4584	DiagnosticsHub.StandardCollector.Service.exe
4584	DiagnosticsHub.StandardCollector.Service.exe
4584	DiagnosticsHub.StandardCollector.Service.exe
4584	DiagnosticsHub.StandardCollector.Service.exe
4584	DiagnosticsHub.StandardCollector.Service.exe
4584	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4728	d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
Token: SeAuditPrivilege	4280	fxssvc.exe
Token: SeDebugPrivilege	4584	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2864	elevation_service.exe
Token: SeRestorePrivilege	996	TieringEngineService.exe
Token: SeManageVolumePrivilege	996	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4564	AgentService.exe
Token: SeBackupPrivilege	648	vssvc.exe
Token: SeRestorePrivilege	648	vssvc.exe
Token: SeAuditPrivilege	648	vssvc.exe
Token: SeBackupPrivilege	808	wbengine.exe
Token: SeRestorePrivilege	808	wbengine.exe
Token: SeSecurityPrivilege	808	wbengine.exe
Token: 33	3056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3056	SearchIndexer.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe
"C:\Users\Admin\AppData\Local\Temp\d77bc398ad1cef71d62ecb4d38b797e52a3fc2dc764719b3e262d497747eb514.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2220

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5108

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3492

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2128

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4896

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2492

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2316

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4092

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2008

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3056
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2728
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
8fb813d25e662bf34d17290200d34a7f

SHA1
e0a928e0d3ba304ea21642a18e0da23199d5eaa9

SHA256
4b36dcf8eb038cd7ece5c864410480b6253c02a5b78ad2d95190fad0082a0493

SHA512
3b246f4845265b80ee2178299844d16fb81250d67ab57b1da48c834afe2a52142d68811b0753f7eb9a27aa6ac362cb7686082fb46e33a183abe128bb5c5baaea

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
4d9e8b16344050452a0f1e9c1a59abcd

SHA1
f67e4aff7bc039d48df9d266189e7fcfb745f76f

SHA256
345450118baba08e18d1f0c80e69098e50b8fde3cecca60e6e099d219dc60543

SHA512
750c484ac96050b7e4cac1081470ca701650e4ec14e7dbb79565b0e07dec1e6f252eeda43d9e4d6e937f53bc0bfc508028553f7e8b0b74814a12fcf9649f5385

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
4d9e8b16344050452a0f1e9c1a59abcd

SHA1
f67e4aff7bc039d48df9d266189e7fcfb745f76f

SHA256
345450118baba08e18d1f0c80e69098e50b8fde3cecca60e6e099d219dc60543

SHA512
750c484ac96050b7e4cac1081470ca701650e4ec14e7dbb79565b0e07dec1e6f252eeda43d9e4d6e937f53bc0bfc508028553f7e8b0b74814a12fcf9649f5385

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.7MB

MD5
54542fd5e4c14e73822d9f67ce45d76d

SHA1
5f0ff566ee0215879c357b2167f7146a94a631e0

SHA256
23645cfe8e8eb011c57551b6db7a68b9c0819899ccc33aed34539c2c60ea43e3

SHA512
f0e16d24872f3652911d70a8376684fc0eead3518a72053678f86bd600fa9ac071f505a5510e7c1cf0eee068f43a272661d003dd181295d2ff5afd301006fce4

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.4MB

MD5
c14b28ce11606587bd26fefb2df406cd

SHA1
9d9d58467155269d29077d2c776c499e3b40b454

SHA256
dd7e9b35929251643c069c4d33b1b91095efd6ea2d48f3c5d0ae531dac8a21aa

SHA512
79f34e983fa9634b37e38df4e7f874be684c6fa26ee5420dbbbc7f904021875c4774eb01283b26194243ac34b20d48706e0b2569f67c511f26bb3219e56e5012

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
a27f73b8987aa5eb43f69833fe248d14

SHA1
e6c63959f38b9a44fec322740c3f8593646e1c54

SHA256
c543e388f16e998131b904d963fc57ff067c831f801081fbc239c4ce116f2b40

SHA512
64e14b13497c3736794fb7b72026840171faff229b3325ebb678d2c8d7d849441d5a3736c2cc85d51cc4ea7816bbdd6bd797bece78b679eee982b0dc4c90aaca

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
e25549b48534d50c99b4dc37fbbb9353

SHA1
34d08e1fa67b6b99c16b2434d25e13e5001ac9a1

SHA256
a52cd4224d75a034fc625ad6ee5237d8749e92a20cc5176609e0b8802cca640e

SHA512
c92c9926a4c40f2fea67f06f36a338547294f3faf86e8ed29b10d1944d4684fe77d4ba9086d6f06ff14889ae430ec267942a7c4eb489aa7ab5f0d1c2197addf4

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.5MB

MD5
9da629b8e18d90369e8416e82a0c7aae

SHA1
837123f262ad8ad9519db8106447a39af175b497

SHA256
2e2b44539be8627fcd1527d5a19b477b69a27cdbccb3c1f542ec542f374a9aa4

SHA512
99d898d7f92ed21456413717521c96d5f1cb619617241ab61ebbd891711a84d95c368bb6515536325dbc0e3067152bdd9e2b71b300ff5ed3463986906a78198a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
98e382239c1855b2318ca925e5d209bf

SHA1
94cbc39d1485ee7da4e1051b023d06838dd48128

SHA256
1565e75bb7d24ab941f59b4095db0fab3f1a8c8d600fc5491d79b4036bbb2362

SHA512
de08dc73fa8f4b69cd15cc334201a1e00d517b0a9b5cee00e9bb15dc2705583d8004d8454a61597aadfffdc518cfe1969bcb874aefee78b25ba26c192820fd54

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.6MB

MD5
06341a7a7632e4002f334ef0d3c26e93

SHA1
2a39377075985a730432993fb28cfc24e7d7c3b0

SHA256
d805fdcfa3c5d418ba827eebd4c6be8d8d5d7c4c4182f92a5adab950be248a77

SHA512
b99e0a44e2dd9eac6e7d6c46133ccbd65ede2a25200feb1fb72c26e2ef09d8025d3e699e2ea62804736d513123751a757828f7153230c922a2ce482f22758e13

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
24310d893a09bf5324602cf87eb37be2

SHA1
e8dbc11708dae52142f9904af67c944dc667640b

SHA256
ef620dfb09b11ee732c06db8aa2872ff448b6d085d0f237495842d5c952d108c

SHA512
8d1f7981d927cac86507b419b7b09e8d7c238a24af3552765bb48130ae2e931eee91bf3ff7a1e760bc124822f5cf0d4bbb0234a9bd8a530b498c6cc49bce9280

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
bb15e31d579543ea6eafce77af725e72

SHA1
61200167bb7b10cd8fe619b0270fc2c1c6e04452

SHA256
b6274d9eae1e4e0773f3be98b474482d86cd54167ff12d592b93aeac576182e3

SHA512
18d792e208b103e31bd589f87e58cc4df1377ed2ed3664e206d83943ed77558a1de3eba677a1229e0bc75700996140ebc825d9ae2092b1f3ce2b764f830b084b

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
39ed5f4de1f4b19b79f2341e40830031

SHA1
3f6c0ff405e692667d2031af28c7fd6528854c0f

SHA256
bc57cf2d57ea1b5cb1206983d49da646bae94c0632331450b51be9b231297b89

SHA512
07e231047f10431e5fd927a573851523d2b5ce628dc7767c8a5b62e94b47e8dea74bb8d5452a7491b0071390ece049b12e4ab99518c7ef3127f6de7700568545

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.5MB

MD5
70a43c05ca879b9eb424ed4dd04af177

SHA1
a8fc3d0741be98f13722dccf0cf663298764c5dd

SHA256
d061159850c6c1cbbf9c4bc79ba4dc768901b4ad383448181c9b739f63dff523

SHA512
1ec135f6a7a9271559fb05c64c271d91f943dbdded5e4c5d6dbbdd28bdc4391c9d70eeb8709f4da2e885f387b8d4cf9db5f959a58a6c2a7a058abd5b573888d1

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.3MB

MD5
730752666533984614e3fa2c356e4dfb

SHA1
68a4c6646331d1d1e73624f86e10d9cf291b3ea5

SHA256
5f2a3a718925f28cc60ef9a211ef835068fc89919f0c9462b448f1c1d90235ab

SHA512
0b6c8a78a2a0596bc1880615f140a78637e96e0672bcff02ba016df90c7372e6c40ed881ff2ec78e2f5dac2303b83945e74bd6c01938f47cc7a1239126e264bb

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
92ce7a36a79721c98305b071181f29bd

SHA1
d6197d4332ccf49733c97b1640df79ddc091ec14

SHA256
0db571d83bd73db1378326db40d98c2e582a14d6642ccbd2dc3baca14a17fd3d

SHA512
0645e020fa8c78c747480627191d0b92469f9c9564ac55446e4a4c7933ce6d659065feadd240609591bd0b963d537285fb94ca04e4037b7383fe5b245d9ff27e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
8b67c8cce7cfd2575ded909d74bc022d

SHA1
999dd7a6766d7a4343e56a520334216f5e3ed320

SHA256
252cb7f4464f935a6aaa9db7a6367c0837a3220d848a8297035eb6a78a3edd6b

SHA512
4aac1aec6a58ed0d90512aac4fe7937984cbfd2ab435cf2a29dca9ed12dc683e951a07bd6f41f2a06f00a2241f2095fcd4bf0afd2b548f7b3e7af9a4a060e2d2

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
90695ab309383fac3b2a292d811961cc

SHA1
b062251ba133ddf69a3c92d2151bf132398b862e

SHA256
2cc11314b0b60cda97a8c257a58aee3cc7e821731e13af7a0804c9d9f17f80cb

SHA512
5f9e4c7ff0c99115bed1a4286eda253a5b197a061f68416c85fad3f5af843a86ac95526a17d3fd822fb3ce3a78a1e54228a1983e20fc3bacc8e9a53a34f74800

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
5282b9ee47c0d41dd6d2c72bfdf3e0c3

SHA1
8abb823598dcb90afca2b24caac30f831d78e931

SHA256
6309c11d929d83c2a4490550d945cce6ceb61fe5b68d12577d048d62868cac8d

SHA512
56fb84f7cb7487f6b69676d0018f393dcbfdaa987e23f5b0a0dbf64996f95efd14d5168b57c0b6121f4c35fb9b6b70c5c0178d789a5d7d6604e0916f36c2349a

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
87d62c1f6c2d58ccbcbf87017f56800a

SHA1
83e7b10e5f1e0f9aab1dd355c08476f7a78dc56d

SHA256
6856df0ffe44540f77da8d3539de5dbeb937fdd1f5213a0425a1676e7c8bf712

SHA512
1e8bec8c6bccfc62dcf9440da289af54d746acb67e151c6a0b022472052990cd2a38da7321711ea645afb76ad568d5a3a6ff72a05868353e2d7bbcbc5ae38a24

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
0a5c599f9b73a9a95e6feb47a42e3aaa

SHA1
f0514a2d1a690800355b1baafbce682c5072b360

SHA256
1155f7128a18c073076bee6ef808a535f1c28e54114c4f12268ae95566fe45a5

SHA512
234cfb00e491b543a5615d60f912c8ec1c0cdc8494e87fa02dd0a03fa41e2da17b044571fcc9104cfa413edfd37d99474843cc9c5611db74d23c9655334dde47

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

Filesize
1.2MB

MD5
bade871bb3da5d3ac4706c061cc9c35e

SHA1
8cf073db2231037cc966dd9da3e6248e6aad2847

SHA256
5bb3d523f285c97d3ebb61bdb475f8b40d24076bb11ea0ecb8b2927685468dba

SHA512
3007744eb0859f19649b907d97d25267d02c4b6d8b4d110ab9627555846f79f0e37dad4bd2e11bf75c165755e1148232d3f2f3a3f3450e6d97a30ba6971c4664

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

Filesize
1.2MB

MD5
83b9df2cc5f3c8cd0453b2cba5530e0b

SHA1
08ebb8f19357335b38acdae34aff59a3392b948e

SHA256
41d338b027fb7381050ad07328b2a573a29c3e9f170193ac06c2abb6b96a770e

SHA512
5452d1713a0bfb1ca537d00ce16124a91811f2f8d96b5fc6ab9ce9e40123a1485d8eb87d282d915e948b678bcaa341c0e5f0f572356d3f55f31bfff7be6bc9b1

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

Filesize
1.2MB

MD5
f10160a60191c36a71e38515713e2977

SHA1
cd794f2830ba942598bafffbad42ad4755d3a79c

SHA256
b26e1202b62c1fd002edcc4c7f853c470991c36212560230f9db37a3cf6428a1

SHA512
796b0ea9992f8a988f0caccac00415b3bc4cb26b40db3d60ba341b7038e98d5d72e971d95d2282056d9a433e5fb5f7c5ee7d1a048dc6772e01a64f89cb459685

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

Filesize
1.3MB

MD5
7807f48f32b2010b28f087ed114645e6

SHA1
1f18ada321350d9634f0f791b8c3241f4d0e6805

SHA256
a800b8858a0181a087fd037fbb6ca6c6d80c32ab1fa8e36f6424c2c4440b6c25

SHA512
ddc516ae22da86389103996ba6111ca95763a12990def37cd2e70280ce3ff588f1380fda156b92124f17d5a70b505cc102115d945bbf74e1de93b2eb4c972765

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

Filesize
1.2MB

MD5
9a3d78cf4e51f49a994b8a651764f3ad

SHA1
c82f3cc42171156f3bfd14ec3f35996611ee171a

SHA256
c2e7a46eadf3c82f278a876b187192d5014cc57ef95bfbf7fabeca1eab4c6dbd

SHA512
0831dc1488c7c6b2cb9c0f1cff8d939d180569e1337171e1cc25719e98943b2483849bf9c0dd4b58af27ef274c18e4dbf572e33f8e3a6ba42aa153c81f901c84

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

Filesize
1.2MB

MD5
55fe691b0b1a2b4b2ab14aead28b5edc

SHA1
777913fa012da2332a518614147c0c2efbb8f652

SHA256
4b38c48262fd659ebca039c2feb7e8a2289b6e94f590b77397b2316e5b931660

SHA512
2bca3cd1a643e83b54a571c5db99ca2fb3c8f43a07207f88c8bdb8020c32d11b4aec73ddb78aa7da048fc20a903bb76c25d947d8dd6081098ca7d93df450be0c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

Filesize
1.2MB

MD5
049ae2b0f198d54ed30faf955578c76b

SHA1
bc944787c489367aad948d2411a00fb96fda3cb6

SHA256
5e176e4d9f8dff12ec190d96a200b4c1c6fccfe14cb1d590c6d490a37af96658

SHA512
feb2d09707c27250d677dad8faaf7ec0f98075a2a29d4904cc214f886c693d4fdfd1cfc17211146f66e7f1ebd270e1cc0788401d1e2563f1e4ea312a1804667f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

Filesize
1.4MB

MD5
0c550a5dc05eb2f88605fa714b47fcfc

SHA1
e4a14a400675f99b8e1a1b828d71abb8ecf9630c

SHA256
3f0dbce2e0025e92ebcf5f41b0ab6ca4b76fbce83bf557abb0123cbbe31bae6e

SHA512
17d0238c358a4c32636dfedecdd3df6d186bcf8df770a2deb9931920769dc9fe4fcb18ea893a6d4f5428445d1cfa7f97c4a710b266f6c95f08074b296726ee3d

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

Filesize
1.2MB

MD5
478f6cf07a36b3fae1411b4c87d7c928

SHA1
963c149e9dc79ec151fcdf51fa968897ac798c45

SHA256
7d982280e42963c06eafbb2dc8273599faef0d5c57e66c78c2290aa99477ad21

SHA512
2ab2e2a78ffbad0b215bb9967eca491f20b61b66dbedaa3f4f268ada44b56f94122a367e2371159dd1d5edb95bc300605d2f305ee63d5ce9ce9d8a40f2406231

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

Filesize
1.2MB

MD5
808b1bb07a734680867274fee88cef49

SHA1
3ba83f392dd95204b2e96d765bee077db9adce8b

SHA256
cdfa3b0aaf1e6638741d15ae69eb7a7103d412817d3235def7792bc9ce9e7bc4

SHA512
2c4bb77db0d17e4c84e1331ecdfcbb7e865755b2897c03ec63f8cee65a5b9167bd6695f88e4c39ce39f3f7752f6b7b01b66871c08361e5801dc045575df4d9d0

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

Filesize
1.3MB

MD5
3766fdfbd80684019b941a09fdb2a5e3

SHA1
758a151b828dfef84ec58bd28c9cc45aab1229df

SHA256
a2307cc34c0491731677e297dc9fb4fa16ca0dbb248878aec56d005d8965de98

SHA512
367a7b2bcfd9c3f9567aa134c12f07d5532f8f619142ab052562496d4bd3cd9d30e12bbfa64153f2a2df3337a2f2d0e25c27be28a64e9645ac044c8c1d37825f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

Filesize
1.2MB

MD5
dde50dbab84efd73b65c9933eaee4837

SHA1
955f2feafcee074f753f0197d0f1e614eb8aae9b

SHA256
a6660a19deaa6e7d0d634f69fa8bd418d5fb6f1af342f79b1cda166e4bdd812d

SHA512
5f009d0103e952586e91a92adc412a9cd21fb284e8f777f82ab13b01acfd48a082ea77f49d1ab5d6b32e5f8bf99cd361de137c5bfcbb7611afd90eeefdd7e775

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

Filesize
1.2MB

MD5
b9afb0107afa61b4b18d0b12083c5fb0

SHA1
5ef203e0bec4ad3a15e0b1ecb113247f97f8d8af

SHA256
8e2be757a57bf41051dd6e6ae8a4b102d6b03d8a8761cfc44d43d9913fc153f0

SHA512
9d985010a6b813006c00e2829b37c9a89ba1e99e1f6f59eb36afa19ac7832aaa0c6b8f04d07964d42d7960cd20f26a8cea2ebdb5cc4364b3e0c2686bf78094ba

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

Filesize
1.3MB

MD5
1cb3f5900a27f2e8cbeaa9d97a26c2f7

SHA1
226c615ca64b00fdbd1f4529e90106e57df723fe

SHA256
71525840c747c6c8c016bdef52c76bad60cc5f2dac4ad5ff3b598d7c5c783bda

SHA512
a935c72823968cfc6816294ec32dbcb5539f1232c7a6e8d2407143f41a76b19c900157bbdf40447358e63b4774b0bb33ff6e6377b8ae56773f86178ff6f623a3

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

Filesize
1.4MB

MD5
27e7321ca998a99fecb741be16d28c34

SHA1
387fa6c2a3f2b196a77be677c931f81214564d4a

SHA256
b7f49acd8cd5e3a93a4f4df07a1e22437148fd3afa0674ee9596bef7a07f1f99

SHA512
d91806f18f212094ebe01d83eb72034c9f353ef76314f6ff41ae594e77081e03d8d5c0a4054232d9dc27dfaac52102c232607264c41db5e3ecb4d5823a9ebc53

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

Filesize
1.5MB

MD5
ae28ca20e4d477a75fbdf0943ac7c8b9

SHA1
242eb640f9add81ca263a164d5820f6973628f9b

SHA256
7194ec5355faf7e9054bc567462523d7fa9aaeae88dd3f6b60a7d1ac402d41ed

SHA512
acd09a358fa99a723afec84ccb9b6e600dd7204ac4e8eb1d17aa288f1bafd25feef968d3239cd17c48d45748dc38835e903b5432b38cd16deb64f3dbaed26871

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe

Filesize
1.2MB

MD5
a93fb5a45f34dff59bf64eeeaa32cae6

SHA1
aab86345b6b056eb4eb38a7cf42ec045d5d1ce8f

SHA256
a98e4b501a6d2127e1912b401839051b842482abeb4f3bc6e5fa31d857210f32

SHA512
db7fef9cfa25159d4d1325b2365091ba6394041de55b36e23c5b5bf4d4bb852ee3dcc7d2d2643948b8cda32dbf2bae084d9270544c9fefc4c5a245502676de1d

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe

Filesize
1.2MB

MD5
862183e89b61b7e486156a7373ceda86

SHA1
490b02e032e09b9235a983105afc0914cfc21248

SHA256
ddb0c97de817eef2c83658d874b2ceda6c576e4d8b845451fc3e9b3fd2e9c6bb

SHA512
d10e417bf04007191d656d51de357082770868c86bb148b7a30dc9401cc9c09c0ed8545cef628882edd606510c0b62bfe21f260a1f5417e8555c2336790c2ade

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe

Filesize
1.2MB

MD5
b2f9e664ada619353617ce58a507b29a

SHA1
a9f77838fa3a32e495ecba4a96512ecf4056d19e

SHA256
07d6256e52205ddaa0fbfdbc41062556f117d7b5e1a9911d57dbaba1ea9ac7cd

SHA512
18bc646af519d4c6c5094741a4958bc526995b131a9dda4688dd73c36458e862f36648a2f5734baa2b8751a594fa21e5319ec190b1edd2d3aac590487f80082d

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe

Filesize
1.2MB

MD5
3154d98c1d42a7f8906897b48e65ba92

SHA1
2764fa2e910637c1e7895fa92116108b2cab45ed

SHA256
d4d281f833d4d350dd26dce466c6c8e3f9c2be69d22027c4c72add2d003c38dc

SHA512
71495162779a4b1c6dc979dd5b42e87761e28a66bf6c5c904707d464a2136e556deab37c4aeebb7e2701935434db55f0d498e87e5e66b21d2c1ae7239d2f76a0

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
327bdcea9275eec785e9534d1968837a

SHA1
c2654080314248e6dabfee6d772915e3c739e7b9

SHA256
e53205ea799f70374d3f32e221d5d687f6fa28831e94f6b4aa54288e3d99d4ef

SHA512
a5712b81eb6fc51cf9d50a8e8f12669211e72501375811787a69040ac6a339b65f721a3957475a56d2cf4c700b30c28b6ec8fe8f9e7dde66495230a268bfd073

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
03f6ca600c6902e11d5a6a8a4aab8bc0

SHA1
ab4089b616f0789add9e7c1923c7c11035e2e401

SHA256
213f1056ecf23cc9c9d8862898a90ffec181c0e6367e5189d53bbd39888b062d

SHA512
54154f8cb30f356640e05e2172ae5b099d6454a58a466eaf24ee2194bbbe268ba97f93e996375dcb163f53e0c61c638911789d8e3384b427619c360f62938e92

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
5327998ceba76aca33f2b2d12160b76f

SHA1
5960c4b49b9bf30a0fde72bb8d97354b80a76346

SHA256
1d123561ca3e7251ce20e931e98170c2c4bf7c83f45ff74ca5111585678dbe74

SHA512
36954b3177ea7e6068ecc759c56ba27350dcc603280ef8e8f8fa57486addb07232283fcd49e26911b7b678382f31a9d1385c53619b5b3ef1a01d2c50533b5a89

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
d6c73a750b7d52b824ec1dafc7114d27

SHA1
68785cfab1e9e15286eb9439897e5ec39bf325f0

SHA256
282cb9e054fe05a8550cfd4672d318b9c9a3120efb495a6d00c08bf8ee4c24dd

SHA512
167518fcd000166e878bb6af64a842aee2f8ad0bb008040dcf004c1b135aa109408da7edb5b467da5982edb5a950bbfcbb560a914c3631bccb3a60f4d301c7ab

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
98cc1894305fc854daa52bd69707a60e

SHA1
eed3543be5988d5cb9adef7f93fcb6161a4063f2

SHA256
43d4edcd976f3910f36e125cb3e12f5d861e1d2983d7c84592f92320aab6d0b5

SHA512
21c3130a081937d972d6fb0c7529b9705aec1db5e748f9f7bfa6707395770a377040c19c801a10ca68c585455059b74d991cf7f8f4cc5e25207bb3a9e34995f4

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.6MB

MD5
a0420b7e24ec191ec99ed37a64f1a4fe

SHA1
67cab1aaf9d43feb155daa49d40729d91f8c0e5b

SHA256
6701de35cbfff670e5700ec130521c9293d68016091efa7bbd01df2e3f3d888e

SHA512
0d0335b8019d6b054c7c1867ffd704d9889adda822d735348543de559ef09277a26d7cceb8ac85179855df82aeaf8d39b07ab1ba56bad1881972bc55829cb4ba

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.6MB

MD5
a0420b7e24ec191ec99ed37a64f1a4fe

SHA1
67cab1aaf9d43feb155daa49d40729d91f8c0e5b

SHA256
6701de35cbfff670e5700ec130521c9293d68016091efa7bbd01df2e3f3d888e

SHA512
0d0335b8019d6b054c7c1867ffd704d9889adda822d735348543de559ef09277a26d7cceb8ac85179855df82aeaf8d39b07ab1ba56bad1881972bc55829cb4ba

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
7a72abf38f34cc1871b661fbd5c9ae3b

SHA1
f2c789776810d78d37e3352ec6c083015b393767

SHA256
3fbc725a282b43f7fa7fb9e745e59d7e46c5956c312b3a5c808f65a4ce9e0839

SHA512
daf42d9dc5f1fa482f1d67040637fe72d8c4e2c3168bd9d0d36feec824a2c2a8fcf7a36adc3bf5e238c5f676e5e9d4767a12ed5a8c677e624216d34cde140c1b

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
e5c399a9db9f7102dadce9a765dbdab9

SHA1
4697830b98abadbb2e3022a396179434fa7b5886

SHA256
8f8c342881c1442f9519be469f0c6a874e8eb621868f8c37a1c133e3252d2f5c

SHA512
48c0bb8508fd3c496a1a8da62638e21174ce94be7e1b5d2dd1a1887787fc2331e67c7d55cfdaa231f500ef8c7ef92c542fe36001069b10edce20725a33d88ce6

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
52075c2a59912affcc7105eaad7a6aec

SHA1
5f04f41c937e3b638a3ddc7c6cf002514683c8d2

SHA256
caa8fbdb196fd87ecb30868ebfbd153297a41839f306c6fc3a9808c5d63127a9

SHA512
6d367e5253f936c57a73d564674c6285a79c1ce8dee7a15319ca7ce5668b1dc131e0502a8a874916cb096f0e6a927ab92ba43e1fabaa06a52f0421b862ebe73a

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
62c0ec9dc5878ac8602048ef3f3edec3

SHA1
9718b678cb0448aae2c528ca1538b3b510e5cc1d

SHA256
9b19e4e40db39ab047662041cc6d412353143b7825b149696471515bc4188408

SHA512
6c0f36e45d2c88e52eccd7f0c784d622eeee80ef36f473420e54f66a743f8e570381e55589340241dcb0cb2cacb58cc1e7cd525afb24ad10e2e6ddd56cb77732

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
cf34abc5fce74d48cd6af5560e47ad40

SHA1
891bb23cda769c2d62552e89895c1374e875c91b

SHA256
c90c71abd73cf5f8885def574a8f8d78e9b32e893769707c48b6b9870e74f0a4

SHA512
ad66ff6c2d55cbc5d43e93bd96420e745ac39e8c13ac986e7e1fed61f4194be0e573eb964d5c3f25d29d374da9e8f32edbeb06589105f5d8af9426b836bccb70

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
09c5a9848d6f5427baa5d00c1731c45a

SHA1
006fabfe3923220e762d9cd732819384d4e148ab

SHA256
cf9286b4aa482bc41fca798f8d47312d00477aafe1e396692af726028907998b

SHA512
8c813c79919cffbc054543f806f7df911d16dece7ac7fac5a119a02b48fac9f8317b32a78197107e75b02289b7f482b069a19bc1aba0efe2749d8092b63853b7

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
a4b98e79e1476e99df0f970d06a99464

SHA1
32d990fb308d8cc2646c3627c4652d90e32d0be0

SHA256
a1325d64e0e626191499782b7f9496971060fdbdd171b484f9d84caaa52d6e7d

SHA512
f245641a9a9a40b8fc7251d74df13380ad855707b9844c3ae8e6d88671ab3700e2dca52dbbe5daaf335e92c66566b8f4d214450e44123a2e5e22e7cd3ee4b3c1

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
d95ead74fe8ef83e3c8cc2b822b55fa4

SHA1
24a430f401615f8cf7d6be5e39e354a6ee460489

SHA256
8df9e32fe32576f8908c7efeb0af20008a8b0e37c2aaac4ba6167104c0f37252

SHA512
4cec5fcf71be30aef71e77bdd2686b0fddee769988527bb4f63203e662d08fefaa67df3d29a504fb1654646cd205f63122dcf68f7b46c068842461607380b5c8

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
66921113ba886023d59c0d8a33771d6e

SHA1
4ab83c6d2457afc8e5bef6ef32a2cda6aee705ab

SHA256
39a21b5e31ae50d8d5e04f45ada8a756f93e9f69a929c5abd782d1853bcb601f

SHA512
c79afb13096b9fb66e559d05beb650601c74944b88cb18661d60efd4189a14940301c4b6df9c22452402777fd9c23b4243a3d4c87ff257a65696f593c85c27a3

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
93e1e49ff3ddf8abda65358b16db1f46

SHA1
2674483380afcc20c041aa74a4fdcc11f4ba53b9

SHA256
48704676a2b037cc4165db655e5f5761549640ad44c140b58e03f68fd17fa762

SHA512
ddd0fd708a2256a98e7d9f574c31266f1f2d2dfbb693b89b2d4559a3e25d00ec060c03f30ffb7214532f6a1e7e9dfa22ef774f4d5120b84192d26421c1eede5a

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
a7f1236b861778dabfffa44017e16493

SHA1
9bffd13075aa2fc5de454091f1c15d070b4c5a32

SHA256
afe6dcb51e151275791627e437ed13cab5021c8b4abfaf8be7da35d8e53d3058

SHA512
67aa3bf55cc5fb6b9e25a5f8f07c0b32f30f76e420b714e2336274dd4c4bf17862de14e081ac3a14311a432caed086796c09c16471b28ff803af12ba36bd599a

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
81c1e279f044fbbfb1a52b1539575f9e

SHA1
1090aa5168627e84ec6668af5489d53bc3a90c39

SHA256
fa70899f0e8dc631fdc966d141597524eca18fefb3473399501ece09001bb843

SHA512
7acdc47951369801604d8442663c0440984559faf72e67241817e6bbcd7b779998e0bb0937332e1ce3980e010663065d82a28f5befb36b2c38062514ea726a45

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
f110220bb8d119df10994f111d1ab441

SHA1
317936e53f0376362f0cf5e7af1875b9e173eebd

SHA256
9bfc7182a7127043c9b6708ecf14467b559193742f2e1bd39930ffca14bd3d5b

SHA512
a4eaef5fd42d98f94ab3ddd0b4e0f79cee9653e0886798fc96de360328e23ed9b1fa501c649a2dfc1db83ee23457cbd8f3702a96eaf838dbc9cd2844bb02d5c9

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
d6c73a750b7d52b824ec1dafc7114d27

SHA1
68785cfab1e9e15286eb9439897e5ec39bf325f0

SHA256
282cb9e054fe05a8550cfd4672d318b9c9a3120efb495a6d00c08bf8ee4c24dd

SHA512
167518fcd000166e878bb6af64a842aee2f8ad0bb008040dcf004c1b135aa109408da7edb5b467da5982edb5a950bbfcbb560a914c3631bccb3a60f4d301c7ab

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.3MB

MD5
73bdc91011a1e8a7d171318b1e2c65a0

SHA1
0b0ed7a1e66e76967a5a0231970f68303b83ea36

SHA256
13860d1e44e4c8ef0ed8f00f8e77c50a611ac7225f71406b562160bf698f107d

SHA512
9e6eb7f20a986544ede1a2c208675e66ee442a69a27ae0eacf5fe7332c820f0709a0482db5512783c22997ad20331ed359547072861b978ff2bdd971a44c70ad

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
0dee41f157233944f457fb0ab487f087

SHA1
e47fd2420a7011cb34a4312bda3c8df95bfe9030

SHA256
ec11d48481638a26e2fa49f10ca48fc72febe21902bdf8221122e6f96e6585f6

SHA512
efcd0a85a30cb8f748d5cd4a652e677e1c4b538b0d4c758d21f9033898735724ba2692f80b8b067c8bd345177399cc08a665ab2a16bfeb2b9402911b21a46cc1

Download Submit
memory/524-254-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/648-565-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/648-473-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/808-477-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/808-567-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/996-563-0x0000000140000000-0x0000000140239000-memory.dmp

Filesize
2.2MB

Download
memory/996-463-0x0000000140000000-0x0000000140239000-memory.dmp

Filesize
2.2MB

Download
memory/2008-482-0x0000000140000000-0x000000014021D000-memory.dmp

Filesize
2.1MB

Download
memory/2008-574-0x0000000140000000-0x000000014021D000-memory.dmp

Filesize
2.1MB

Download
memory/2128-126-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Filesize
384KB

Download
memory/2128-137-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Filesize
384KB

Download
memory/2128-128-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2128-133-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Filesize
384KB

Download
memory/2128-140-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2132-470-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2132-564-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2220-13-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/2220-141-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/2316-438-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2316-446-0x0000000000700000-0x0000000000760000-memory.dmp

Filesize
384KB

Download
memory/2316-535-0x0000000000700000-0x0000000000760000-memory.dmp

Filesize
384KB

Download
memory/2316-486-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2404-168-0x0000000000750000-0x00000000007B0000-memory.dmp

Filesize
384KB

Download
memory/2404-161-0x0000000140000000-0x0000000140202000-memory.dmp

Filesize
2.0MB

Download
memory/2404-162-0x0000000000750000-0x00000000007B0000-memory.dmp

Filesize
384KB

Download
memory/2404-401-0x0000000140000000-0x0000000140202000-memory.dmp

Filesize
2.0MB

Download
memory/2492-555-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2492-431-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2492-476-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2864-109-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Filesize
384KB

Download
memory/2864-100-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2864-101-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Filesize
384KB

Download
memory/2864-169-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/3056-496-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/3492-114-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3492-113-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3492-180-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3492-121-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4280-105-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4280-97-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4432-480-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/4432-435-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/4472-451-0x0000000140000000-0x0000000140259000-memory.dmp

Filesize
2.3MB

Download
memory/4472-459-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Filesize
384KB

Download
memory/4472-558-0x0000000140000000-0x0000000140259000-memory.dmp

Filesize
2.3MB

Download
memory/4564-468-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4564-466-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4584-50-0x0000000140000000-0x0000000140200000-memory.dmp

Filesize
2.0MB

Download
memory/4584-51-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/4584-92-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/4584-147-0x0000000140000000-0x0000000140200000-memory.dmp

Filesize
2.0MB

Download
memory/4648-149-0x0000000140000000-0x0000000140226000-memory.dmp

Filesize
2.1MB

Download
memory/4648-146-0x00000000004F0000-0x0000000000550000-memory.dmp

Filesize
384KB

Download
memory/4648-376-0x0000000140000000-0x0000000140226000-memory.dmp

Filesize
2.1MB

Download
memory/4648-157-0x00000000004F0000-0x0000000000550000-memory.dmp

Filesize
384KB

Download
memory/4728-6-0x0000000002300000-0x0000000002366000-memory.dmp

Filesize
408KB

Download
memory/4728-261-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/4728-125-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/4728-0-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/4728-7-0x0000000002300000-0x0000000002366000-memory.dmp

Filesize
408KB

Download
memory/4728-1-0x0000000002300000-0x0000000002366000-memory.dmp

Filesize
408KB

Download
memory/4868-568-0x000001F01AFF0000-0x000001F01B000000-memory.dmp

Filesize
64KB

Download
memory/4896-179-0x0000000000770000-0x00000000007D6000-memory.dmp

Filesize
408KB

Download
memory/4896-173-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/4896-415-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/4896-174-0x0000000000770000-0x00000000007D6000-memory.dmp

Filesize
408KB

Download
memory/5064-142-0x0000000140000000-0x0000000140210000-memory.dmp

Filesize
2.1MB

Download
memory/5064-332-0x0000000140000000-0x0000000140210000-memory.dmp

Filesize
2.1MB

Download