8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2

Analysis

max time kernel
111s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2023, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
Size

1.8MB
MD5

106b10b10937eb57d248fa830b6b8b61
SHA1

74018a5f3e9c5c5109ed7c253860a6750cfed3e9
SHA256

8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2
SHA512

28b80206950cd66cb6e05623a88b3d7d6ef8531c76a2e3e077cbe8527ca97dad24509d3f235ea89217e4a51d9f3402d9e61bd31ce65f2a7e4c9b0fdf0eb94c66
SSDEEP

49152:BM9QPdxwfE7WlFwKAfzuTiDFUFknLTM7rr62MboH7:B1PdVQFwKZCFgiTM/22Es

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1360	alg.exe
2288	DiagnosticsHub.StandardCollector.Service.exe
1744	fxssvc.exe
1448	elevation_service.exe
1596	elevation_service.exe
2724	maintenanceservice.exe
3140	msdtc.exe
1656	OSE.EXE
5000	PerceptionSimulationService.exe
2156	perfhost.exe
4140	locator.exe
432	SensorDataService.exe
1456	snmptrap.exe
1636	spectrum.exe
4416	ssh-agent.exe
4676	TieringEngineService.exe
2160	AgentService.exe
1008	vds.exe
736	vssvc.exe
4772	wbengine.exe
3292	WmiApSrv.exe
1464	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\msiexec.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\spectrum.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\25e1deaee4ef4e69.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\locator.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_id.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_sv.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_it.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdate.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUTA857.tmp	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_ca.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_et.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_bn.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_am.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_ar.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_is.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMA856.tmp\goopdateres_hu.dll	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2288	DiagnosticsHub.StandardCollector.Service.exe
2288	DiagnosticsHub.StandardCollector.Service.exe
2288	DiagnosticsHub.StandardCollector.Service.exe
2288	DiagnosticsHub.StandardCollector.Service.exe
2288	DiagnosticsHub.StandardCollector.Service.exe
2288	DiagnosticsHub.StandardCollector.Service.exe
2288	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1960	8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
Token: SeAuditPrivilege	1744	fxssvc.exe
Token: SeDebugPrivilege	2288	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1448	elevation_service.exe
Token: SeRestorePrivilege	4676	TieringEngineService.exe
Token: SeManageVolumePrivilege	4676	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2160	AgentService.exe
Token: SeBackupPrivilege	736	vssvc.exe
Token: SeRestorePrivilege	736	vssvc.exe
Token: SeAuditPrivilege	736	vssvc.exe
Token: SeBackupPrivilege	4772	wbengine.exe
Token: SeRestorePrivilege	4772	wbengine.exe
Token: SeSecurityPrivilege	4772	wbengine.exe
Token: 33	1464	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1464	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1900	1464	SearchIndexer.exe	130
PID 1464 wrote to memory of 1900	1464	SearchIndexer.exe	130
PID 1464 wrote to memory of 2816	1464	SearchIndexer.exe	131
PID 1464 wrote to memory of 2816	1464	SearchIndexer.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe
"C:\Users\Admin\AppData\Local\Temp\8dcc9696b47f0a6d1c43b6ee57c4dc97a3c35ae81961a7689befa8c3ed5e13d2.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2748

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1596

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2724

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3140

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:432

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4548

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1900
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
37796ab3ed1973420f6ec95171c49a67

SHA1
6747716e4ad6a2a5818e54e4b3f09ec7e2a5babb

SHA256
09ce2a59ddff4ffe90001b67b955b0651eb33a6db685f5687125e1538d69cac9

SHA512
4af38d0ddc8abed88fcc8f64281ecef65b255adb296ddb871a81e7a725561bf181733f83a3437864d5b759aeec0387cf93c40845b31db693734e66cf6d4238da

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
e16e5923a72c3a0d48e0a2c064385426

SHA1
f93deaf113789b025bb0b8a87641c4ba4222152d

SHA256
3d420255ff8771baafa0d90cca76da3361f62e6192ca9f6ed28c7fdcf6b1c7f8

SHA512
ef4d4bd7f4f0a1ed591e6501526f1ccf3fe2808e55a82e021ec77aaa72d0bc43b700b1fe09fe688bbf9ad06d631da02f7c7de53e73be4642e458b8e11d291fea

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
e16e5923a72c3a0d48e0a2c064385426

SHA1
f93deaf113789b025bb0b8a87641c4ba4222152d

SHA256
3d420255ff8771baafa0d90cca76da3361f62e6192ca9f6ed28c7fdcf6b1c7f8

SHA512
ef4d4bd7f4f0a1ed591e6501526f1ccf3fe2808e55a82e021ec77aaa72d0bc43b700b1fe09fe688bbf9ad06d631da02f7c7de53e73be4642e458b8e11d291fea

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.6MB

MD5
ca0b7f5db4d55e5d4c664c5ea2bb03b6

SHA1
261c57461f68c2796ab8e843a592ccae7dae72d2

SHA256
7a01bfbbb471ebd722e6ac9d588ffd935bb5436db87abc7471d8127ce854be9b

SHA512
b0db1863169b671b722a7760b2580580119d6118c8c9b6c3becb8816a5cef5d66ef6a649f2e6a8526ab1e41bb377d9cba86cea1a09aebfc763899c1349eff8be

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.4MB

MD5
795493b6d658ee29f739e60af802d1e5

SHA1
ca3cee099a1188a7015fd0a5bea88c7468218d16

SHA256
4463a93aa67498e3dfe9ad2191fe8530e02f227747cde8589bc44855d5ec240b

SHA512
20eab4d0566ec04ea990b2c00ea8eaab550eb877f8677aa6629f75588d6a4ea730702ff009675cd79b61e5bd54f57a150808cd0ad25853fceb7bded685535ab8

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
f47993258b09c20ba73a8f5107fffda6

SHA1
044f8bc126ee8684f7d32b7b9b67dd3a52e79d1c

SHA256
d457e402f0daf3f1f7bc2a3c153de14ab40a63aaf6a0f50ca2d2c70b675a8fe1

SHA512
950f51604e7ac9d40f6202e5b3b462abca4790e9a7dd0763059d7ae01160634f704ee6f17a1dc3178251d8d35985f4f2408aab061c91de685f9f7c49934141d6

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
d057858749c56f44e3d67b0b154e16da

SHA1
7d1b98d122c7bd73af305695b241fa2a5c067037

SHA256
d012b39905043afe68aeb9cbe7a5dbdb8813b4198176dc4e5761677bceb37db2

SHA512
70e4723f08bd1a840e0c049973c90405977191a3e1ab4ad28936835874dae3f97fb2e5b2022d683e2b8e0857ff7bdb988a5657e37dc6d8d62b627528eda629ff

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.4MB

MD5
66d5c43194afbf6448e4cc470d101b9b

SHA1
53edbf8e55b62f94d4d04423742648535e0f010e

SHA256
50e9f02e3157b9b4fe06a067029e205f748accfd69fb387fc04a76dbd2d2f0ee

SHA512
56ce7b4e056bd8b27d896b2fddc3500f64da993b7a654cc530a4353510770956cb760b72c4278da2f3c2bb22dcf89c4f66d26410efc7961b157881c864ee0ae9

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
5b7857f7097ea0417a1ccda970866435

SHA1
5b75c4a591d1e21ab1dbf482d0363ee45b7f2bb7

SHA256
479527f0037da27970722bef5dc3a30ae5e7f9705e45d843625d223a76fca7d2

SHA512
11d5554c1ae5f0842f5a528e238b8b8229fb185558515afa28f8297b9e683d35a3a946c5daeba4f05cd7a01ce0bf27a393dcb0a1def93e4f3d22accb052b8dce

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.5MB

MD5
b0df26d9024d9f2c0f32bfe8e2342340

SHA1
f5eba7cc345d9528222f1e5e53ce8a06aeceba16

SHA256
c5b981e8792275e2b71fdf04cfc4cebf54b6ce436d091b24d366768b2b05f31d

SHA512
1fc7befd819efb64f528549a25862cf7d6acff175d3e600f10f6e4593d8bbc2fc850b88007026d399686538ff0b2966582c44d75cb09d00056ed07d4bf59278f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
b62d5d607bc82ce22473ad999c5b8c49

SHA1
a39bcff9df9a167c61ffd3ad2b32baf19601c7cf

SHA256
a1859430d3702bb8783675d527f02130403aea1add828b96980ffd9f1831a2cf

SHA512
b65501ca4b2620cb1e71705ab570e2320316c2b73a5b1d375a3a32ca49cc76ac08d68604a388f610b786488045c7450f325ebd1ee37d1e9d616057d99a66692f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
231b8c2e7ce5100d9021695498eb5349

SHA1
0b5b553e8f47b4167bdcc22b147691b6b70b6a55

SHA256
91c62d8ad719688f0a6992adfbf465aee4bb21e1d7369dd68d8a712a4ee779d6

SHA512
0ff28ce95e0add85324dbe78cedfb62cc377a2c331c2345d7701cfa8f2ca89d6ff6ecc09a375a32cc1ffe14f1e1cb504aa57f45140c0abbdde7f86e465060d0d

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
24c821808f3a9e9e858f0bbc2d1563a2

SHA1
425893645449d018838bfa430a711250725ad961

SHA256
82d6d0e968a538cbac30ba34977a6f4a0a4340b33937b9b6c07e3e41f1d8244b

SHA512
9477fd87bfd3495fac622d8e76587553116b9bddf0887fbe0a149ecab48bb1ee51da8105d057c88e9a2f7175da391a85436dee5277237dd50d499aabf5126d58

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
b09030cab48ac52cfa2b5cd067119e01

SHA1
7a4837032118f1fb114ba30daa8e570622d349a3

SHA256
c7ea8b893069196a8d43a9e6b4116b55aa7faf91907faea3fab134fc3e663207

SHA512
035831fa4c397935e13267bf94df09d5b6ba7b5b7be29c819d24225adc83824499f93a1b11c902c4ecd73152e4cd15d01f7fd1ce7c8cee42066195ebde30f163

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.3MB

MD5
17d650bedb76f4dc2b2bb0034e5e3eca

SHA1
a3e4caec0ded1ae21d71f3f98a827ee0edf774b2

SHA256
66802d4f1a4da862b6d5c6ca877e6c18387cbc018b3bf2c179f87d84c40c86b2

SHA512
42bde6f68160381abcd514287e0ac02bd47a14092987e8ec02495d9b6bc7678d110973fb6f7479523362b60f0dab1cec9b28867f5db434ce53b72eb5fe717d90

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
9b257ccd8445ebeda8280a2a5fa0f2ae

SHA1
c28fda5bc54ddfe72f9c2fd48219385365f1a5cc

SHA256
a2fc31062cb8de3c46c22ee7c4141c28c74304b46a9887739fd5d0b52ff18045

SHA512
c78b3341fcd20782a2f3779b74c3cdf51252766f51c43a891bf01082df00050aa12431d3e22c625eb34492696a6e1ec6de7fe677d217352b48cbc688341698f3

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
bdd2e35f77547b84344f29dd7945da61

SHA1
9369d093e294cae86b9d7cd480a8b6ac0164e10a

SHA256
78e016f502f0ae7559422401000863f38cb18d29994e6b94b7c3f22b8c7795a4

SHA512
969eef4c656c4c5ce9bcc4802f0ec4c90f65f891e85ca1443f6429f984b6ee3a69300d258a968b0799db78d49228551262db42de3c7e1e52cfbf8cc8f313bbb2

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
a3bf5dd2c2d3e8690c569a0285d731ce

SHA1
78fcef896e6370fef607b79f33c15b16bd2ae80c

SHA256
e436392e1cf15fd6512998fae64c16e0db33b6947b05bd0f777f36c01394ddb6

SHA512
164ca1132f9cd482cf1d07a006edd28f3f3a1a8f4ccccf0adebba119b7cb1d1f3e16ec5489cb3b45b2230d137c07ccc0d7fea02940ba3c172cac993c32acb863

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
1e9361f5b055f8908575d2d554fe9064

SHA1
739a89ff9ea4c3a8d57e5d5989ef7282e269c296

SHA256
d0fc477cc5acf3586e6db575e6c69de9face1b385215d33f0cf115aae69e2a61

SHA512
79411849aee288517d9d69c9cb90e55b60a245a57b5e8b31ed1d157eae5f57c29686ebf80a99d73873fabd13b1a3a7e76f7cf0239614dc880a3f9dd6ca7ae7d4

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
6d7bb4a134d4d29a551dd409866d473b

SHA1
66ff45e31615cab917bffdf4a83d2cd50e30aad9

SHA256
29e1ccfd92a194e26c72c22ee44cb76c54e13fde1daa6e4a0f54f1be85aaa390

SHA512
f6e088f685ef7186dccb161c623756ba26c298b72a212c0cbd6160b7076623cca3756037681fc5468ec6a23b2f926a1f077ceb53eefcaf1e161d52b78ea5c19a

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
0617c0d3bb22edbc69c1c590549ac0ed

SHA1
9a56860a3138b4fa74d9ab80535d616490da580e

SHA256
78e5b5b57349f4c55abdbb68af8624eef950d60511205b38d0f5fe562bdd6178

SHA512
72b385dec4bd5508c97ed962f600fc5b06b4aca0ae450b181fb399b46e1c8dab3b6a9b42bedecf77e9a7602fa666ca3f58d6c7f4601ccfd94f3b93b4d7ac6a01

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

Filesize
1.2MB

MD5
2303327956ed99be115d2c62f02d9f0a

SHA1
f527a16be2acb9d9e66a31221c1dd9c65601620d

SHA256
8f0bd2845b998c3fdfeee6d96d3d08907319ff5b394c16e35448fba277c9c84f

SHA512
3bc12f260ee89839923613f62c23943a08ca617fdfc6d582f21689ac602d229a1e96c37898aebba3e6fa2f7edfeb55ebe1b3f91262e628a80ac2b07714720c25

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

Filesize
1.2MB

MD5
5d410dbca55fbfb991c4631e2f65702b

SHA1
a359abfffc772611187f516e2ac9732d546b3291

SHA256
fbb4515b5913d8236a256d351537cc2489e4f0b9efc15b22d15b0a2c79cad8dd

SHA512
3e83aa4e0d2196925efb4378636a82d518c8dc99bb7a42224abe1cecb1debbdf82c323ba8fe2bae034ea60702fe65ce64073bfc15f0183aae124c88e32561a91

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

Filesize
1.2MB

MD5
f258cb49e4042eb11a33f7417e32612d

SHA1
ca4cd4dfc610b3a1279c9f605cad441bf6f50b21

SHA256
9dee6cd0e2f30a00990d1c3cde119a25506b2d6769a7d3abeafc427656b75b87

SHA512
f669954a779029dbc2d744cb29fe04a69de3eba95e904eeab661c32070ecad73fc32da2a6fef7f7a105e99c07c67832db1d6a640e96960afcf383b7984ea2a6f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

Filesize
1.2MB

MD5
8eb4bf53c1a6fccbb974c49aa6c78119

SHA1
2fd8c774243c40a3ecf57af547d1e33bd0ab7b5b

SHA256
cc101b24b89bc1aadb102a86b07c3ef49eac9d7569a27954014914ee05ff99df

SHA512
721f26aa0b3c636e6892053215263a83a387fa0191d4709093d65bed793e03e709cb9843202142e30899b66115e0306809a5fc219d85f1996000d28ebce0cc94

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

Filesize
1.2MB

MD5
eaca8e36b807a0b366e1802380ea6827

SHA1
47f4ee28c1b14c2b8511c576ccd0dfc5e33f811f

SHA256
f8ddd8d02436b562abdc72061a6a6fbde2c92b381e2bade537f179527533d0fa

SHA512
6cdce743d2b8dec0fcf48f5b9d1c1f1f98bf3a625000a5bfb6696b66adabd152bcba61b6bd1c61abbd15b94e2bae1ae4b13f9c242a75148133f2fc3634cae3c0

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

Filesize
1.2MB

MD5
1cd8b51bce7409028f0129a72a4a8382

SHA1
781836f49d7477a0353657a010906f61771879ba

SHA256
73859bfd2535f1beb4277901ef4ec6839494cf8613fc5811c6b8de562dc7406a

SHA512
449852d05228a9460f35d0c97d80e023203808262455dc35fa4b59bdd2ba71dbf679db61a603b5dba78b336d255e9260cdcf8166beadf69835f437e86f097b84

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

Filesize
1.2MB

MD5
63be961bf60a0bb2d0a78806af8aee40

SHA1
d0dad9d5ba5daa49f388c6eb371b15bc7ecfc516

SHA256
63d7e02a1edfb4e4a023d54ec28010861c704b24d2e51408ff6cc39b8ae87c9c

SHA512
839230e29b6516caac7dccefd1bc18acef811862a65917c3541dfec643e3f323c0886d69af46fa7ce2f5d7e255ce9fa1183842e846917eec2b6851d17a792779

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

Filesize
1.4MB

MD5
61bfbf0f017ccf378303479f5e52db60

SHA1
8dfbfdf9ac6c1c86897aca689ac04eb3565be066

SHA256
6561229691824571bd1d762115ea497f80db293f298f3409a957152d667cbcb9

SHA512
2fd889fd1402a25337443356a95b3b1b4e206f12d44d81595e15701d0436e57b0b6fab7e8fdeb7f02e0dd2f40050da6412e23bd53aae8677793a3b386534104f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

Filesize
1.2MB

MD5
829b98bcff3a6d0f11508c0239ecfbd4

SHA1
3b4920ebc13cd74c79114ab9e403807a7748b460

SHA256
28ca70cbb32da63b1d77439964db874c30ecb220a4c5ac1df7760333e68a4a63

SHA512
c00c81bd1a4a51d2977502b441dc360776acfc3bfdc00b38a3d6521d9d95c845cc214ec2d50717eb934a126ab7f7210e1fb29f51712682a82df2794dd93d945a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

Filesize
1.2MB

MD5
678de291607049f168083a406d43d8f0

SHA1
c1fd7e0c2f478068c52832099f8b4a3fd3c7d993

SHA256
8a54e0a2212746184fa0b16cc90ad312561a66f84eb7ca0448622e87d1031311

SHA512
8a506e41d1ade133a96fd6a870c5d81e72d84bf5d08babee24e502a4db308e36bdbf116b7825848ea139aaa313719a0db5846274c2add8fa9dc0a4c4bd0eb8d4

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

Filesize
1.3MB

MD5
508dc81664d3f0502b02181aa9512e4a

SHA1
9d674403e726e23c1302e106befa9814e7e13dfb

SHA256
213a88f6f4079d992a644ddc5ee099ba1073e901e3981f5c7e45aaf909628c6d

SHA512
7f79606a0ac2372c491ec38a54cf3ab29574157396ebf16d18a8ebfa035dc97ee6c4be73676ed6bbdab8c22b13014e97dc74155f8f8dcd0196d9fc9c48fa6566

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

Filesize
1.2MB

MD5
07f7864a8ed57be95f467ead1f4b6b95

SHA1
930f05597e940249f53bcc2eace2cccdf4c61c2d

SHA256
3ba79500dd98841697154c7cac55b89eb719f80f8a1a884e4ce4f9bdafe500cc

SHA512
f5fb16bf6fa292cd4ae3e279e36a996b9fb7353f8e10535e540846cd7d47e3172a24ff57b96cf0f69bf04ed180a52b6538437736f632caeba8b1985621eed31d

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

Filesize
1.2MB

MD5
05899b6f5dcf376e4482b343fc5fda00

SHA1
617bd1bfeaafc9eebac29e6958b7f51fbafd85fb

SHA256
0feaac4e0141a82dabe53c3fd5d0f9cb87f915347daaef47976d55ff16ba4421

SHA512
59e8db615e6e526e8fcbb2116df21e150a1efb5806c1d26241ba015b8bab6acc03de3f9048f1639c416e86fb8ff78a0f2e5dfde2daa3b9286392c49b3fdf795b

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

Filesize
1.3MB

MD5
67484ca5e3c69883816c4eb10914e65f

SHA1
5f62226595b8bfd3c3321889d338cef6d535acc2

SHA256
d6c18437abda0cc54596b0b0d68fb9482ebc2b57c707c690830211d620dcb5fc

SHA512
141be4ced348de5af039ba338c002a74c1cb3b11a35556a748d69a6a06b44a45f410569025e330a22dc6d50a04b8abb01e9c2d9e0c52a647cd13b65c2d1fa8ba

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

Filesize
1.4MB

MD5
36b61ed5f07daded965c4955386e1371

SHA1
266f6214b0779f310672afe9f559f5fbfe45a464

SHA256
3253b67da6346f6c30962d383ed798ce51a2c2142e207c43daa79c76a8124a14

SHA512
5f1106be2ee187f19a357f4177e6999f60d7de1887090c5f09be5bfc127376ceffb0d295724b7c85a93efd7584f738e839a2ce1a5b99aa89b94b518e7ef30e35

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

Filesize
1.5MB

MD5
f59ffd686992b395861e07b7cb43d1cc

SHA1
a0fb9fc27024a26982d3ff5e96428956e4a2dba6

SHA256
d040de33662f03d4e458832e07c51c91259cd6b8ae54672b72853d4146f7b259

SHA512
469c7d0ea4aeee5f71242227211fa99180326cd75af5778b6aef919210d6b5ae6f6e04ed76af6c819c20812ac138d0c08a25cc148a7e22569a62682f4e889d22

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe

Filesize
1.2MB

MD5
b4cf98911830d9d56e9043ae4d630ed3

SHA1
a18cb312908c0b5a9523d181cfcb0595a76e92b6

SHA256
5e9c208319c67d4326515c4088028fce80051f913da2d64936b3162c85ffcbed

SHA512
01b2995cb8a47338b96481bce809673a7f7f84b2afdd109adb357c7ca08a6bc69980884d1c5787a2c2b1497e84c81217f2cac5963188e231014b9641a17f452c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe

Filesize
1.2MB

MD5
1a99990b9b376cce07a9138d45b7397e

SHA1
8db767847ae9d8a019d3236b30fe23026995cf2f

SHA256
407e3e526c758f1f7454844381faee4bfdc6a9b3cca2ae2d1af67b7b520225b8

SHA512
5481b9048834bde1f76eb650d7df146f5231254651ce31b92926b97a7734040bfb87f4a33e796593d01fd377ac52035773a659f4177512c416167f692031135c

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
892d11ad2fac2287423cf7eff5a33fc3

SHA1
c710993253e4f020b9524f966c58df9346db9a58

SHA256
7ade6fa2bd55dcc4619a0e8bfe911c1ace92e7618161591d5b48bb6229e97fe9

SHA512
3a4e7fdf3cc2a6c36bf59b5cc4f2e040050f20ef122e44c16991e300141a857ff781b480784294167deacac4abe5dcbf8b1ab2e05e00684c5e4ddf09df2eba31

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
28947db0e2bc0aed9b068de192b760d1

SHA1
a5b7ca0bc1e78a98a5272466a5e70e64688c523a

SHA256
c579aa68929c8bcca94a7a09e95fc02d41fc018bcfa49f5d8311cfcef3649bad

SHA512
1e3f45ee12bc5cf389b12fcf1a2d67ad40e60fc37c8d338eb6b59a6c712e051766bce1c0bcef072cb624c088bd8ff1f20846b164b502b9b15ff9c10a7ce1782d

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
a8007445652900f9e08831c8c47b1c99

SHA1
e97fb591550c52b2add5150eeccb28cba18c5513

SHA256
538d908f96af43ee2a790fbc97d393a761483ede2dc0bbfa1545b5ea97501e69

SHA512
76678328b67bbf77e0b27137e253daa10d7aa0c35c3180dab4363bb3630eff120062272f9712c2bf99f4e546ccdd39623e79a1b3da0c4748f786b3a8425f4783

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
c2e24ccdbaf38d107924374e48cea0a2

SHA1
b363c4c18a739d16252f38d014d99404142093b2

SHA256
80dba4ab70c5ee4c61c1fea7507b1cfc88e32c17822a45041d76b0cf3f57ea4c

SHA512
2d6619b6dd4c78636f209d70b449391c585aa9263c95a12d89c87d930ee06ad3db0c04beae440e8b674f5b85dff55c8f360a3412a133f5527b1ee7a7288fb6e2

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
0b8aef753595d769bd9cee9ca5723099

SHA1
0f4e27e772a3e03368ce014a977c2358c5d5f0ee

SHA256
292676e35b9b72291f419b687d76b0ded663f9f98f005d7b6428f2cd0d7088e6

SHA512
83fb18ffc2350a8f92844cebbb076d4d4dc208e191f0be8cce7a5e0a79a1fe347894f6ac25c75654a09451a4645c611f6a89235da9bf2c1c10b60548e13b91b4

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
06515292bec0e5fa4bd1974ffff93479

SHA1
90f173a69a65e30c77d6bb6fe642410bc11269ea

SHA256
c35619c17ed2e034c2384aa47f41fb008f2b9d887c13cb81a0cc3d3ea85078b6

SHA512
dc9f1b98126751afc60bcf1ce05b6c10171e91becdaa5009263eab3b009e913baa4d46fca6d8a1d14c56107db22ceade04b14961c3fcc046690e8a231c449509

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
06515292bec0e5fa4bd1974ffff93479

SHA1
90f173a69a65e30c77d6bb6fe642410bc11269ea

SHA256
c35619c17ed2e034c2384aa47f41fb008f2b9d887c13cb81a0cc3d3ea85078b6

SHA512
dc9f1b98126751afc60bcf1ce05b6c10171e91becdaa5009263eab3b009e913baa4d46fca6d8a1d14c56107db22ceade04b14961c3fcc046690e8a231c449509

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
008efd2ac54b9c0d1daf27e6dec1ac63

SHA1
0807d0a858e600093b82f685010be6012f835e12

SHA256
34f19cb93ddc616e2f8cb53cf7d384cfde8bec87e0bc51fe089b0fc87a9f3251

SHA512
9a17b8fea58f558dd31405686426138a11d27c04452e292d8283bd6f80153b5362f682f7a0e6535336bf756525a66a6fdfc82f1c0ef0a5142369fa29a5d73cc5

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
826fda497929dbfd34f62533dce12311

SHA1
336f5776317e8bc013bc54e7097e139b74289769

SHA256
48144eb686048856a78e2e7a2f8abc469aa4c1ad4ce10a18ad28af865ab63285

SHA512
12320fd6f984c6bae60b8514a125183f8f40b50e01e89ecf10a7c07eec0d28260bed4b0e55db69fc7ac63601f3cf7cf2be0eda6d9789f516bdef7a0ef61be0d0

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
cd7e07761e2b4d1169a4888d78ed1163

SHA1
fec8649abfacfdca8c855bc0a9cc34cc5811297e

SHA256
1990d9f3809debc52cb8ccf54f4c2a4b18dd3c9f3049fb303e7fd41e3b2ea7c1

SHA512
324c32464f74a3a2b94652ebaeb013dee168b1237dffadfc51af5a18d100d4dde80bc7a7c84c29e6410030dd157a79a740d6542f8ba617c8f9dd80ba5a704444

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
cd7e07761e2b4d1169a4888d78ed1163

SHA1
fec8649abfacfdca8c855bc0a9cc34cc5811297e

SHA256
1990d9f3809debc52cb8ccf54f4c2a4b18dd3c9f3049fb303e7fd41e3b2ea7c1

SHA512
324c32464f74a3a2b94652ebaeb013dee168b1237dffadfc51af5a18d100d4dde80bc7a7c84c29e6410030dd157a79a740d6542f8ba617c8f9dd80ba5a704444

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
52ad55d4be4734378211189fc79f4e26

SHA1
03b219bef81d3fd6376bd594dcf5c995cc5b8aae

SHA256
2dfa983c2272978cccd929aeabda3188bac8b7ad575e92f2e2de1d8132159b50

SHA512
348faa88729e3c9176c75a209e877fab45bd74933aee37a0a40cef494f4149708af4eb5791ac5966bcf9b3bfad36b15e13ec5c7e3f11dc35dbb89961aee6488e

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
a8c9f650e9157fcfb4d496f2bf2abbe0

SHA1
42e3242e66e2eb5528517a44603bb1dff42c9a5e

SHA256
ffeb8f13ee0b1873a646556907b5b93424c7033cda16038a598393bbbb78fd62

SHA512
42b3caaae425f7a986f9bd147e019684a6168cb662831ccb75aac2f9f42c0c929b17bb7b48e4e3ffeb0ad2421b819318ca2ad4c3cea83f9aafe29c3a80daf86f

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
e815ac80b36673ea0395f87a715bbf1b

SHA1
bdce74c11573e9c48ce933a63042932c72e1e2d5

SHA256
28aa5703909565b6fc6bc86b501a9849ecb548c7d2ddb9bd614e7eb5920a9aab

SHA512
6e794da7a6137835d710a4aacbcbe28f68dcd4c0db1c3e887d88ab2be657493f0708f799ea0971b7f17c1390d9da65326a3c205135fbaf3d2308e7b778bf11e0

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
1c62e3ebabb1147b4ea502058272a079

SHA1
421ca7affd3d4822f399091239cdd7f662e4d0e8

SHA256
4d72de32ddd74266c8ce8129a877286c134a1f394b2fd81853039ab86aa49d02

SHA512
18dd1f612c9595c489d2b68f0636a421022b1231a896a7f67279b353654972f604488cc0e3e97bfcb75eade8f574b78b287f326192cad5ed616c4e80850756e9

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
27345749185874f80ac652b2c71c8f12

SHA1
115295109366c16e03ba576e30aa5b6c7a76ed97

SHA256
cb74a8f19ecd8595c599b8e2d1e19b8816e509e414bdc76a18df10750b865d6e

SHA512
89c41cb158c4611bfedcbb0f762191fbf44036e4c45c66f5bdd0e8f08eb2a601a6c331105a390a3055ced266645fb9c003da096639564c692184125af4292298

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
1e85ab41a16a89cf4fefb0362b2a1b39

SHA1
43868547b4395d1e1353379410ed4851fe1e80d2

SHA256
f73cc2d7b6da699c50dfc5a33b48d6eb7ee35c22b37d4bc076a45cf64abbeee5

SHA512
4426d7053c9753d2a394bd59919f061155f04a78a3eb7bd0ac45394acbf09fe73cd44fa17f5fa5833687a8609e49bb5a411191650d5136536543ac621b3caedb

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
e7a276895baeb9bc8ff8d22e926e5621

SHA1
4bf889b9dcece91af046918061e485096e3f38fc

SHA256
e29abd64eaa35270b0c1ef2305439e7702a3b4792ecab0869c25b759f1dadfc6

SHA512
c89837f9d7ad34f60c9f9e2ce2136702869e3d76cff68c13814421061b86f96fd92de25edaabbcdb2ecd405a3ab17321ac813d75ba581834b9eb2e57263090b0

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
41eb588e179f038bbdc886f712397d58

SHA1
5611f6445c172d3df30f9a3395e8cb086b0f88ea

SHA256
020f6d00d91c3acb5eab7bb20eeefe6a78ec4dc101930086ec0762312ed876b1

SHA512
16e0cc72f723210499bcd54ec82f97338666b45eb11b004ee7688b0ffa7d60742a032408af72be805201ad23a4990f5405f3861f00f92091a4d1bd4e479d0b27

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
06590105702d71d30fbd9b374402e5f8

SHA1
57100ed9c6914222e1df97627d99c7dd1530d833

SHA256
fce515807928b0cfad80a805bf693297c3729144865198d9f0afcd7e7cd1a5fc

SHA512
23def40913377c57a4fbb25f4c418ecbd032b79ade522195ff1ee3e16d3ec32f0b7c99c84d7e95e1888a2614ffdb2845ea1aa1d52d6d0e63b14ad3e0138f2756

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
949d7a4d273e6dc2b23d32eb339e9271

SHA1
876a447f0004734b579baa5eb610869972c21be3

SHA256
6e0aaeefb208f2225a969bdfde1c2f5685a23febb27ff3f1bbabf235bc5dab99

SHA512
498dde1b39b414cbf20b1a754cff19aead20b2b9111277aa394eb6584f2a178b95ab4323057b607da65e3c83849ce8c5c0b6ca1d385ec1a96a4d9c22c1ad7911

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
1.5MB

MD5
050602bf9936c46ff463b3914f54db94

SHA1
39a38e050a0d1e3c51d24d8d75d62683640f18e4

SHA256
6b3cea1678b0b4f26b162a83a544efeb2273fc53f81c65e8f942ad0bfe089bb4

SHA512
3c3469c56dfaa8b4a54eeecd08624f21f31174abb8ad06fb30160c4f3cc6e77155d27ec596fc0f82620dc140b287839061d3be279c88dd1be1f88c92684d2fb1

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
c2e24ccdbaf38d107924374e48cea0a2

SHA1
b363c4c18a739d16252f38d014d99404142093b2

SHA256
80dba4ab70c5ee4c61c1fea7507b1cfc88e32c17822a45041d76b0cf3f57ea4c

SHA512
2d6619b6dd4c78636f209d70b449391c585aa9263c95a12d89c87d930ee06ad3db0c04beae440e8b674f5b85dff55c8f360a3412a133f5527b1ee7a7288fb6e2

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.2MB

MD5
dabdee494363bd97ebedda4e62b77cdc

SHA1
42acd1527795f418ebe27c6beb3bbd79efad4628

SHA256
120bd1f170d066e4dee627dc105739158bde3e6bae402eb0cd9cb7ea49255a1b

SHA512
88d81e0ff891368af0692943e515c94720b8067f22ef90511462946a0d975474b8799e246da86b9f4a9e845dd08c77f27b61c346e8e1fe9be68bae8225ceee38

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
3c706c04a48c0c506cb2b297ae527e0a

SHA1
72a2314bbcb3bceefa8fccf0db96a9df0fe0bae0

SHA256
12ee7a0cdb8c987c32f55e993c8d2366fa42828e14ea7d04ca977c3f907b43b3

SHA512
b07e5efcf70058f2788ee4d315b5da1330110c6cf4155d406af8a0ebef984941cd2eaea528bd6314c34c400a825cba7dad6601b8bc347fcd942e808675407078

Download Submit
memory/432-440-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/432-189-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/432-443-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/736-481-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/736-568-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/1008-567-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/1008-478-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/1360-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/1360-142-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/1448-109-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/1448-102-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/1448-101-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1448-171-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1456-442-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/1456-193-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/1464-491-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1596-120-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1596-121-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1596-113-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1596-114-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1596-182-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1636-291-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/1636-276-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1636-444-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1656-150-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/1656-155-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1656-287-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/1656-147-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1656-156-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1744-99-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1744-97-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1960-0-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/1960-270-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/1960-126-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/1960-7-0x0000000000750000-0x00000000007B7000-memory.dmp

Filesize
412KB

Download
memory/1960-6-0x0000000000750000-0x00000000007B7000-memory.dmp

Filesize
412KB

Download
memory/1960-1-0x0000000000750000-0x00000000007B7000-memory.dmp

Filesize
412KB

Download
memory/2156-414-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/2156-181-0x0000000000900000-0x0000000000967000-memory.dmp

Filesize
412KB

Download
memory/2156-175-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/2156-176-0x0000000000900000-0x0000000000967000-memory.dmp

Filesize
412KB

Download
memory/2160-476-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/2160-474-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/2288-60-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2288-92-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/2288-148-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2288-54-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/2724-128-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2724-125-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Filesize
384KB

Download
memory/2724-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Filesize
384KB

Download
memory/2724-139-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Filesize
384KB

Download
memory/2724-140-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/3140-143-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/3292-487-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/4140-437-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/4140-186-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/4416-459-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/4416-467-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/4416-561-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/4676-564-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/4676-471-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/4772-484-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5000-164-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/5000-163-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download
memory/5000-170-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download
memory/5000-380-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download