e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213

Analysis

max time kernel
114s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2023, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
Size

1.8MB
MD5

83fc902787b30eaaca3d40ad12ceba57
SHA1

5912a778c138c119471cd36a750a832603abf6c3
SHA256

e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213
SHA512

bf1c4ed11b6f1a64f2db2f0c25b7ce4c7a8481fe85e894f20953839f2c50c185608cd0770a0dfccfd2524134faca67899850d5764c4b9d3f0ddf3c7928b47cbb
SSDEEP

49152:FKJ0WR7AFPyyiSruXKpk3WFDL9zxnSg/fZUm2I2vmSg:FKlBAFPydSS6W6X9lnBUm2VvmSg

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
100	alg.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
620	fxssvc.exe
4344	elevation_service.exe
2632	elevation_service.exe
4944	maintenanceservice.exe
4748	msdtc.exe
5080	OSE.EXE
2968	PerceptionSimulationService.exe
4388	perfhost.exe
1636	locator.exe
1644	SensorDataService.exe
4728	snmptrap.exe
2980	spectrum.exe
4168	ssh-agent.exe
4440	TieringEngineService.exe
880	AgentService.exe
3812	vds.exe
2588	vssvc.exe
3444	wbengine.exe
2604	WmiApSrv.exe
2120	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c4a340fd4ed6cb1a.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\System32\msdtc.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_cs.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_lv.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_id.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_hu.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\GoogleUpdateSetup.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_es.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_bg.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\GoogleCrashHandler.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\GoogleUpdateCore.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\GoogleUpdateOnDemand.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_hi.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_ta.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_no.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_tr.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCB6E.tmp\goopdateres_nl.dll	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe
3112	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2808	e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
Token: SeAuditPrivilege	620	fxssvc.exe
Token: SeDebugPrivilege	3112	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4344	elevation_service.exe
Token: SeRestorePrivilege	4440	TieringEngineService.exe
Token: SeManageVolumePrivilege	4440	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	880	AgentService.exe
Token: SeBackupPrivilege	2588	vssvc.exe
Token: SeRestorePrivilege	2588	vssvc.exe
Token: SeAuditPrivilege	2588	vssvc.exe
Token: SeBackupPrivilege	3444	wbengine.exe
Token: SeRestorePrivilege	3444	wbengine.exe
Token: SeSecurityPrivilege	3444	wbengine.exe
Token: 33	2120	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2120	SearchIndexer.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe
"C:\Users\Admin\AppData\Local\Temp\e75ce4701b8db9f5bac3f75113bc4e9860c25ab24814adec5201164b77363213.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:100

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4356

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1644

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3116

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2120
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4800
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
a1354fb3d209e7dc08c7c6e174fa04fa

SHA1
ed1cf0c1652fb7274d99481c14f2a6c009b94e39

SHA256
d6dd1b1bd1a7768814d6b269602152ab7bb61b8acbf9276ecfc6095b68c437a2

SHA512
a4492f05adc664b1d594442c1f0063312f3fcc6986c4a56fc166771262849b163a31388aca5b315693b34cdeca578b6727304aae5183636aa578de4a37da9bcc

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.8MB

MD5
a24d5b80aeb7b03a6bd01a9f515fa161

SHA1
e4e6b3706d6d61f70f04839a1c410e9509ba146c

SHA256
9843a34c1a95be2d00cc602bb1ba12efd0dd974cb5e079c0351bed849c2fcede

SHA512
3198ed6da1f5c19580667ac87e89e180e4caf8fee2dfad4b60941af0a60e01b80d638696000ed405c374d6fcd73f37723276087b5aa8218d0f9440ccf28799c4

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.8MB

MD5
a24d5b80aeb7b03a6bd01a9f515fa161

SHA1
e4e6b3706d6d61f70f04839a1c410e9509ba146c

SHA256
9843a34c1a95be2d00cc602bb1ba12efd0dd974cb5e079c0351bed849c2fcede

SHA512
3198ed6da1f5c19580667ac87e89e180e4caf8fee2dfad4b60941af0a60e01b80d638696000ed405c374d6fcd73f37723276087b5aa8218d0f9440ccf28799c4

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
2.0MB

MD5
4784a0c2d0a10ab4bc816359ccb8a467

SHA1
2853a16b68b87e85b6774afd1b650787cfa73c21

SHA256
bfa6e736415c417c4be7a2bbe0d29ae775811047b882789e2ce38bd070ccd917

SHA512
01a4c4f0b996b0c76d0a1078e1a18b1aebc246d5cac6d34cdb43adf0403c004f2bb3d7834e97e3dc4158f316c8eac42e23ff658146a3f300d3c8b05dbd04dece

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.4MB

MD5
fcb603cb4ebe5681137da6ed9002a1e2

SHA1
6404d803a23174afb903adbed1eb3799bc0581e5

SHA256
06a2dd04adc53daa56645e78780a0b6200d80c73bd1f00a927b450a9671a38c8

SHA512
391804b80c01a7759ca643dcf0b29ec9bb4549f0145c0c93851f39f7224a7f96174b1b96e0d3935d07c452b4a19ba57a51b216004b3da3899eeeeb51d2bda9d4

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
04516f5e1b0ca86020751d1d90870825

SHA1
57db0ad458b7515e9d5057bb0fec4c4d6ffb3a32

SHA256
01f4eec7ece116edea471c22b79341c87714bb9cdeade37abb7e0109329956bc

SHA512
b60220f2c0e0ca6965018d10c469f44ce5943da598e06fe62b4cb1dfdfb662f4329f2a480d1524cbb6ad7d2a05a38cf222c206c7b8ce76d589658ff6adfee2eb

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.6MB

MD5
e7bb8ff87da098ea0b05d6b857dc4ed8

SHA1
f2d5e7d0af7e28f43db02af6ba8154bf2cfe6482

SHA256
3a5a75299bdad9f2939041d6c367034f69d200dc7821d66da6dbebba0a6c0bc0

SHA512
31ef46641a4f9131add9739cb6ea30e1ddb3b9ef0f945837666599750f967a5551e997dd04db6566f62005cd941fe937072441809e9a4e0581805bc3e35ec124

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.8MB

MD5
bfaeb2f0422ccfeca6837465cbb87b3d

SHA1
ac90da4bcdbc06932c16360cf3aa446a43b6ea7d

SHA256
1ea9e2e5e295947c169bdcd890488331891ee425d7c32590c875bd8fff344c07

SHA512
dd296adc3a2b28f38db8e118904d61f54d694b9e2a02c464a34f0f18f52fd2f75268bcc40ddc576fe7ebcf7335ac1334685e3e1597c3b4fa934608f68f74f6e8

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
b4650333b8eff511067d17cb09932a68

SHA1
dc451f9aa4d13289cb60d29164073eebf8a7c085

SHA256
f9e20425aa8ac4d8d17ded53ffb8fb841d48e327f5f09cce4e5d48d2c4da9f5b

SHA512
b2b8acb14d630beef37cffcd5d5053fd81ffbce5ab9def5e35e39ed114f7606e24a0292f11ad1a308f50e463b86798d7f8bdd4512426364e7ee7e6b7424b9374

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.9MB

MD5
5e56594b5009e518a5707c7595b34199

SHA1
0826add2f5cf83429fa9d16ff12970af72117d04

SHA256
be748fda4f9a2a963add9e7d748b400271585f16995a7ae8840f9d56013d5744

SHA512
ceecbc85ada78c6f93dcc0ba2d16ff967dac0d6afba041ebf8ec952e7979e3ed897f42ebe7e29932b2c442e3d9c01ee54fc28fd5ad9ca52016a262e971cde806

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
56c09d5cfd77cdea1357e71401182939

SHA1
f4f4e11aa52ff0e2a119bd9236e394a94dbf9c85

SHA256
159fa3be2bdaddf36758f9f5db5de56de7c4e343395c89a6616624eb093630e1

SHA512
3f2f566e45b1a70f81640dfd1d4217d8b0a77bd1fb5f591d5c3f7c3e092b8a082aa58d590a0fdba539c936864b221c81d70b1ee4e6e7328906c80164cdd8a8e5

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
73877de171057ab4272a14e15d79abef

SHA1
b55b163e7cecdbf1dadfe266be24f7af28f21000

SHA256
d0731e5b8fbbc2db08726fb0f6ee85d8b7d424ead13434782404e2416356d8df

SHA512
40a224398d41490bb1287e9a8254c4dc540681bd74cd64c1bcd7b99831eabb645d4f61a997f8b7edc3908f562edbae61bdfdfd8bd0c87e34f1dec119d8ddc6c7

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
3f5a2d7f57d2fcecc1c54c4051d9b5b6

SHA1
79b2f3ab9b5cb9e696835f16ee1db734627cee99

SHA256
9624644f6a149281cba77fc1b6b2b7ad1deb25cb5380eca3b5a9cc232e8c27e2

SHA512
7ccd7ed02d9799e46801aa78e1044b4d87dbe5d306d0657016304cfdb71a24e5aa30ffc7457e6e7a25e088a8bc55ecca08c391455ec4588062ef643bca8f49a7

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.8MB

MD5
17853c13eb160b708fc0d6823419fc3f

SHA1
24c216a48c5450970deb9069d506e2e758f14e0f

SHA256
2307bb605452629f2fa0d2e9682c4c07e72557ebb0ffdec4a7a3b8b152735bc0

SHA512
440714d24fa88fce40a49df027da8f3110b158ce7c4434025e11c9adf50041dbed8530593835c3554169213d99e1cf1ea7b5fb24ce7de38bda26230d75c4af42

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.6MB

MD5
8f3c8874e17780992c8b429948056c86

SHA1
7f0b83cc12b69d1e3f48d240d07fd90e78e0a3cc

SHA256
7ffaaa6b4efc9153b4278f9698f6a472d33c100cff9768e32a5d95a682deadb4

SHA512
750a65fec7178e0ee2c5d846eb07f6ebfe137e67af54a615c1c1316d80fb92f479e9d94b1b7365b0aee550053bc44a46ee6272dcadfc8846eb097c0aa4a0907a

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.8MB

MD5
3891900a0d27cc58bcd8c342d10dff20

SHA1
c5d4b7587eb041ac5c80431c4ef49f17927c33bb

SHA256
46955265cf7f78c4455c13817b07791e53baa21884c2483c07a4937bd5f88fdc

SHA512
ca582cce5ef5e334ea237544d8e58283a0a6356728ef7caf77eb2aec6c626b2d9d6109b4c272e0146f81d2b46ecd75fa794ffc6c6d5513cedafabae01c1c9129

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
4.8MB

MD5
4fda4159b914d5fba3eec082f30517c9

SHA1
b095ce4a412a6e9f381bc219e0ce48bfaba8ac80

SHA256
56703ad47fff6b4fec41450cec8329d9e23857e2c8e11356ecf1859be757b086

SHA512
55e41758d18596d5cf05047f1e3acf4bf0ca3dbbdc0144c527d3c7207ca0d96ff0e982f77f2bc7188a2c09f7abd8d22e58226ae96df3129e9eb097f553f41eb2

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
2.2MB

MD5
4cc4bd4e9fc43904374f3df4484064f2

SHA1
6fb4976fe7325b0b1ec682abb2a80f3e4927105a

SHA256
b0ec1e05be5c376cbafb84bbe5c28ae477ad72e7fd3dabe5dc9a5cf5a978f624

SHA512
42ff0802086bbf0997692edb7018001b943f26f402c8bed163bfae5bb83b2df55f23e8cee62d3635e6727f8dbfd40c3269174f3c386f89a4cc54a3c986a4e796

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
984af17f8e063df6efb8cd713e1a5d17

SHA1
0676f50e1dfeb9ad8519456df0f6f9c8069856e6

SHA256
7e39f065221a9137d2aa92dbc910fdcb4906dc81eb4e50db980a03eda7d5097f

SHA512
14411d06d5a256661069b80c16c95a3b37223590112727eb1c6640c2c53cf8aa89dcc640905fe8f72f9909422cbb23ba526b637d8ddaf3b1ef32b95bd07c3d52

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.8MB

MD5
cc0d0cecf6e601240780dc8b17b8c4a8

SHA1
a489a9cef37bd0e5ac56dbb87b5a28daec1b1483

SHA256
4112d8355aad352c0e4109300ee49a801348c54ae61590356dcacce29ad1776b

SHA512
d4612c162ecb3264aecfa80653d3b7f793860cb16ff1b5e7d2a5badba32fbddd61184be614c57c41dc6c06ad507e4d00e9f16becf887c136193650ff6ff51e50

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
bb964d30d500817e4aec222194c5daed

SHA1
d1e30335ca754aea5de0450c0025b3c0eed65511

SHA256
4080593ae3bcadf0a34aeef7a02a451b1be9d1fef43bb20e8af245a9f654f9e6

SHA512
c93deb2f1828deeacce2c4253ecc1dfea5df3aa39b4f1b872e700d4fb71860cb89f48f39a2d64e47c3af10eeb7c0f8dd475bf2ade9325b812bffc758b61800d1

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe

Filesize
1.6MB

MD5
a9a5e81d63466b542131eba0804e34fa

SHA1
6bf5eec6f427c14587123c78abc7250301d78de6

SHA256
1c6e797fe89be3fdb7d650f7cc4d97a7c19bc7652e5a6e13c7d3f863b777cff7

SHA512
e1860726671429899e1e48d6d41235e10fd3215683c968798c698701680a8c9c02f1cf45556ca890c0470a2d8592170f927e9739cfbf8faa9cd952933ef80eac

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe

Filesize
1.6MB

MD5
66186c40db76bdbef244f5bb09a5d416

SHA1
11a8d56f14641734ad196fa9990ed36ca35b7700

SHA256
a534bdc5c90c12a8cd0622c68df4a01487b696d50eed79d3c0f41b89223b30ee

SHA512
b178a504a0a877487f7dc6277d54cd61ef73ce5cd6247824193ffda2113ad69e20dbd43d1ff9f615c16d3d88bcf20c52198ffbecc920bfbc7d85d041faf74b66

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe

Filesize
1.6MB

MD5
2ab4d515d5d7000316365d751325df07

SHA1
bcb87135a9b8327efc9c2caf5c5b03b63707517e

SHA256
8928ed1a20411d36b91ca4705b64318b02d221542596a37e7763175afb193350

SHA512
28b62d338a5e12b6ca8eae43da85c02f61fb4c7d518b8d4dd38680b498770eeed753777a5656d8cb3bd5dcd8a94612574399bedd2ba9dc73601d80ade65da2e9

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe

Filesize
1.6MB

MD5
46261a37b471e84911675bb4e6aa0b6a

SHA1
728bfc8bd9e94ff1a5796da80fdb1bc7c27fcd8d

SHA256
4528a692a03671d27e8a4b0848096c540773962ec9a2ffaec9c0cdca2f163a46

SHA512
5ff748089b98f2522c2411606de1c213f8bf4269654e489da3c4a90c8b781671605094ada840d63df9ab5a0bab4ac814d17916c6fcadd658d419c660034112fa

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe

Filesize
1.6MB

MD5
ef5b56101b266e863acfd83a9427a272

SHA1
cede1752cbdb2b619237f97d5d8138f11dfc3b9f

SHA256
1abeac7b4c586f6c30c02d67044d8ec61dc90aedd10c182ec776008d403f19f1

SHA512
e23c5db4733964573dd4d11877198dd3f1be5673c1781d3327d4c7221b7b275b9fa7e3bce4126c4edf6828d3f0c0b08cfb84c3a79df747841c7c2ca56dd6b587

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe

Filesize
1.6MB

MD5
9bc3da505f28147b51644295eeecdc63

SHA1
7007d1531777c0e3455a51ca3d98e410ddffe8f0

SHA256
d0f08a4e11809156e4319007c8215a3d4ed6563363dfcb58b204933eeeaad0fb

SHA512
01b48b2ae2d38f63b7554708d81dc97be694a1fd13649d22e5ac4e724bdf92b5461ea7bf3d8e2da409ba7201da2c047bd00717fe1f8d9dfecb479a65da0f4fa7

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe

Filesize
1.6MB

MD5
bac52c3f50d4ff32989a4296a9beea5a

SHA1
82d18bf238a9db2957d694a98faa4922910a4f57

SHA256
0d267c83d1aa4c4c290b48b504e69e45c2d69d87feceac2ac63bc06a34ad22a0

SHA512
212423be6848e48068c914eb224431e0f92c0f6fdb0340712b2e89a4d1398e0710699bb6f7aa6bc268e8d820ea75a6f6743c25a5fb4fe6ca68ef5dc4823e4321

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

Filesize
1.7MB

MD5
9a3b075a7beb1e6cdabc3f31cce2e966

SHA1
8bcc63bb6fe375187a68136933ac36e21d8e06a4

SHA256
b0de12f5a1b0a1ff8e2e2a2d553390d3e3d457f6c0f1ed168d334b98723c28d7

SHA512
e4e33936bdeeb1de16689f70ff5e4ef7062b020e2ef312596cc2407ab7169cec30eca0ea7b748181c2797cb1e0b4cd66de0f9b951770d022a47bbda64552d971

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe

Filesize
1.6MB

MD5
74b556201b02c001b93f99bfbe9c43fb

SHA1
b2ba149d70b6145a9a60fd18026be16d5b64531d

SHA256
6d03f21706f2a6eb752b008d3496a0606fe3c9c2a437a180dc428c9ce58970f1

SHA512
55866a03d0f7925419cefbf3dde7cf82fffd1e45d33edd45fa6f62daaa746dfb7e11e58be87d3083a37d5fd696fb2db36d21c49e74c667d93f26f5f348743310

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe

Filesize
1.6MB

MD5
b056b308522d8a78947a3afeee3b8585

SHA1
cc43a635546208fc0b7dbed2e2bea48e5a1d2615

SHA256
c52254ba6f826bf5c42cd5acd0b1db0b243140ea1aa26f0d2fbbc34652666131

SHA512
dc2450975aba75ad8e0643111113cf2489a8c68f797f69697bd1c1be4de73ccbf6f3094d47c958ae110b295a479edf278341d93f5d5a1de6c6391f039c6d0002

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe

Filesize
1.7MB

MD5
8be8f76b134d80300cb3831b513dece9

SHA1
9cf8c83927ff2901d808d0c34791118a03e00978

SHA256
b19be3b340ccd7082f0f71b44a7d7a997f5cd1c307be5354c3a496823c14035b

SHA512
bb847aad214d16c9187f36e50a1029f2a2d28060b628aa9e3af4038fff8669a08affb49105de518c3661961a800747c0635bd959373c13b3e12547cbf2eb3bc5

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe

Filesize
1.6MB

MD5
719f4f3303d7cc860edabe56c72796e3

SHA1
fda92eac07bf9aec552efe812bf985a76462c095

SHA256
2aff08269dec661495e672ddef4303be40ec1dd26ef1ab9ac552fdd0257348cf

SHA512
dd785eceb8ba5e84bfdb1260e0bf51f52dff74e38d5a872d161baa124a33f2e0ed2bdfa02e8760b966edd85c723cbbbabb892cbfd144391c26ac4aa669ea4d8c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe

Filesize
1.6MB

MD5
358177aaa30116436fb4ffe78ce44201

SHA1
e10583a4f32cb8547a14500cf359ac5d4f109194

SHA256
0d373da9005eab67d71fc4e877ecf40158ba7901b5f1a5d660a38801e6115005

SHA512
5fb7b73ecbc3bb4e4077c12e4ea5d91da56e63035f85a431ae04e456217e4801aad4df396c101805a9bb11d150835ad045bfba4026e17000bdee97a8413be765

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe

Filesize
1.7MB

MD5
80442b6c57df76ca685bf7bf8d972b1a

SHA1
d8da30a8852046551975ab625f6204baf6e5d3bd

SHA256
5d0327cfdc3c5715ee6d10b0ac604d06e78a8f7ae5efeaa66482bf5a49e9136a

SHA512
155731c86f034b16b6eae8b47a6a6eefc0dd13f3bf4326dc8149db0dce2d6bf26dbb6d6f27b8fecc72c264635e2c318a08b59211ca5c53a1bd9108101ef5e61c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

Filesize
1.7MB

MD5
7a771b7b5da360fb058a141fbf3a1900

SHA1
c9fd96c55673db3aebe4789b068beb9e3c1662ba

SHA256
a276ad8fd599e1e2caabcb158344151197dfa496abc8a5726a7410ffb8e819ef

SHA512
01a09e49b103f20eb4dababed442fb8c8509f595df28abbd0ad7a7893bcb14d3c67006b427a689245ada88cd3a00ac2d1cb42d264783ba1dc8557b22404db878

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

Filesize
1.8MB

MD5
f6f1ea483208dface92f6505e2a143ca

SHA1
a289bffbbe622dbe416ee55e7e13a46feaca355d

SHA256
ae8ef10ec2f95bb653159e627dc4b2ecae81bf36d193cdef4197d4a8bc5d25b3

SHA512
90eba904053838d500a04b298214890b600603d60a5e8451664be83aaada77221c97d5de0346bce9d939ee7845143df5764ffa73fd745092f40da82cbbbb26e5

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe

Filesize
1.6MB

MD5
b68c15712df8053b8f6f72e9c8e46a24

SHA1
56ae04a770d6091a1286a49866280deae2dd6f86

SHA256
659ec08c83f2b898a5dd04405d76eb484b9cf789b3942f422d2e462e65f3562d

SHA512
f8e824178f1cba06ecf3be228e4e3f1f73e38e7370baf98755ff6a2fbcfa7f5d2a645c9ad3c6f8986bd08a5da0b05c1f690d57ea9da1bbf9062869a0a40b62d8

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe

Filesize
1.6MB

MD5
51a194d67d48d678ff42299d0d4a39c7

SHA1
4623732c7180ec5823c86cfae8a0adc19a39cca3

SHA256
aa0b1e80d94faeea269cb8ac4e1cb4a5e3f608639a9f7d6ecc2a93dd8e01ae9c

SHA512
b4972891de3016e416c9f1a21ca3bca04823383316a4c6e141e0cd5a436a7e8c260d4653f5e6ce7bfacc00185ff52d40a56b89a7f8ffad1c0e717ab26e751141

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe

Filesize
1.6MB

MD5
ee4afcf867907b62559aa2f8645f93ec

SHA1
dcbbe879afc8ae6fd438432af4f62c9c426220fe

SHA256
c007811554fb5fa63348db49c32a73aef807062e3c0432a52f309354cfc34a68

SHA512
243c20b4e7c5e43d3bd7c2bc638309fcc91a418b9558808d2caa666fa8ad8fb5b72765bcf9629f1556cf83de56945c324cf608e86756d80e0a97ee1fb48fd988

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe

Filesize
1.6MB

MD5
6c3ba868c6d59179e71bcc39af7a78ad

SHA1
8842d512aa81c5d4c5784f08d3dc64d67fd7d2f6

SHA256
f89086657d40e2740efda0e389326474cf21c80676c3dc7248e70e38590a32f9

SHA512
028626069c3df859e9aee0dce1a4744a2391ce80ff3a017cb1f0bcf0db7c21a06b9813f5c0c64f5173ff5fe1d6fab1d8b7be55958832e2e8aa3454839858ec3f

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.6MB

MD5
878513c76040f3edca9aa94315f4b2ea

SHA1
e1142f76b4898519026ec28a66be86993611984c

SHA256
2095406ffce6b341e7de5797fe4c4b5921c2c51a85d17b865f9d7c0a30f60b69

SHA512
cd794613f0f96d8f6054ff0d9272f37fc9a4c9125bf0c2bbef1aeb109c56073b873a0b66007f6f1449b561f2feb868ff83c221e850f650dd9d13776b6aa69073

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
88101a2f2ef7dbe414ecb856cff76156

SHA1
244a3e9d849a82bb53b50e17f05062efe1455cc8

SHA256
8c1e1bb26383c037d902d6ed9b4a5d293af8e8d31c7865abe7186ffedb774375

SHA512
14c416eb3aa05834b0b94b6a6363d14ef084133225ee39b13fce983dce8fc29ec76ad4e746ad3b9e5b183ca638ef692123a7cdcdc4beb73ca4d4a05bd9817bbe

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.6MB

MD5
5f7fec206e1657d59d28dc5786f7fa75

SHA1
92c2d0567bf697c2fca7b4083fac3913f4acc8e1

SHA256
de1744ab672ea990bd43f3ba3d49e67052710382d76fafdcc258850907ecd43d

SHA512
85d8b206016cfd08884d21aa831391c8b41b610d5d5e12da9b4512e7136f6212ac02e56c7a8dfcdbe24b5ca7aaf5f9af08b3c75f7702ee6ca5df8262c382a14c

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
1559bef6f662fa16f632af92d640b81d

SHA1
20345310591b308d260a7ab8e8caf782b35233f6

SHA256
73e374c9434c32a969ba8ae16509949956d6ca536c3158c4c1a3e1a395e6bff5

SHA512
62aa503c35b5241bf2c78ea6825bc704a6ccee5a74d02632f43c1439cb9564818b0799c825785b3b5a5af25169ff039e87c270ac7a93b0796c98172c4570bf44

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.6MB

MD5
73f95ee6aa08ddce03e0d3356fb64cc5

SHA1
54082d810a8e32db739d58031ac2a1b076b570d1

SHA256
0eb31a58d62a2a7363992d3585716733840251261f16099451be5e43462aefba

SHA512
15afc6506bbd7d06ce1ac68c87eb9311194493a0d06d1e7e37dd91f6659b385df96c7a47593eb9ac13a38eb0949fa06b9738c58752f46fafeec3f45a3e1e5836

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.9MB

MD5
9e2302c95c9503bfdcc8ce13c2d184ba

SHA1
691c7cbc3e26ac8a694a4d8281a232494f94ac74

SHA256
f7088807fd46920c6c87b3714aa57195a1c8aaf3a9f6e9ab3a07f06ecddc514f

SHA512
506d13de6ad76810e75fd25593082b8399b8ddb38e01b12ffb6f1f22bb51cc4acbc807584fc3fb6ff36e6b683c16974e182c3bae1748713f0087ac78dc7e51fc

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.9MB

MD5
9e2302c95c9503bfdcc8ce13c2d184ba

SHA1
691c7cbc3e26ac8a694a4d8281a232494f94ac74

SHA256
f7088807fd46920c6c87b3714aa57195a1c8aaf3a9f6e9ab3a07f06ecddc514f

SHA512
506d13de6ad76810e75fd25593082b8399b8ddb38e01b12ffb6f1f22bb51cc4acbc807584fc3fb6ff36e6b683c16974e182c3bae1748713f0087ac78dc7e51fc

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.6MB

MD5
5cf9ccce75e50552a75211200b017d69

SHA1
f8f327d6de46e47149fb633f984b1386b83afebf

SHA256
36573ccb57b4fb66de0e2d8bc35c615536e68c6969c8d92d8407e40d93ef23ce

SHA512
03c532a800e7c1e7c7362f55b50546069eb8386fbe5011b12025bae9ec45c6d26ae34b5faf3901a27e171363677c91c9e138e49f70e2b287383209d5e0b09300

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
3d998ed6ddbf29f1fa1dd652a757a1d8

SHA1
3d37b5843f09b8acc32368b759b74c6a77b411a9

SHA256
dbbdeddae490ca992f52a93c005822ed014c9bb77427d8a412e38784d0b04e8d

SHA512
d37f0fa030fb3c81ea11e0be568acf527582c6e00cf5a123c289a01cb663fd7ab76b68bcc4341d4fc79a34f54fe07ec7dd90b08e0927b2020ea33c01a37aa5d4

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
4f0c7ae33d863e12c59d71747a6f2a77

SHA1
ce810afd844c745ca4c518d2a42871c03cadaefb

SHA256
58d6ba4b069bfdbc714b95a85336cea87547f137f2bdbe68487010265675a6fb

SHA512
ef1190a4f1b0359c535f2ed5a64b9058b8a5e2c5bd65fdb2e8cbff915941e00715af4969c635099ec9e5616100ef77cfe621a114cbe164037fe71e12678552c5

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
fbb8e35861ce9504c00ed35cfc1a3bc5

SHA1
a0a738234ce2141d355142e85cc99da9560ae7a0

SHA256
f64e315173240c2c42c434921ac0cc4fddb01112dd079e901193ec67a52b2a46

SHA512
6da4b1eb24df73e5ba30672dc1e4c0035952a1a97c040fe0d35154ef4644a29e7f2bdca626170db596af4424c3b311f4e2a12c1795906b2b87ea97b11a456cdb

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.9MB

MD5
cd89a681799b16dc2fc53e44cbb000cb

SHA1
dce4265b03cbcc1bac80d0463cd7200317769692

SHA256
f370ec70fe0b3794c64e90484955f92ca193c88641727ea9963ae75d048707d6

SHA512
94b0c7a73157f35f6262cef9020ae56d7928f7f4ebc705bb85b5f629b69970294ba96578ff52ed44c577476b3814f70aa3dc5894d02b0c8e571b48cdbe3d6518

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
93d824f31da8192a1c7b06df1bd0fd54

SHA1
2645e322f64ebed0367fdd7ebf1842ab56cb2e9e

SHA256
7daa1eb90ea8e122e32427dba816a816869b4b5486f32b48c32a5de358f8635a

SHA512
0eaed4829dc328963fc98d6787e9f48911736645de671bb04deda55ee62776745b506f226da2344fecb6fa2e5b23fdd94dd562bc49aa34e9a1f7ea0058f154c1

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.6MB

MD5
463a22cce0ddde3f870e0c76d1032d31

SHA1
87aaaca631ee01f6f13dbe4e5b840453fd4ee68a

SHA256
2e28ff0ef718c5134ea2e65029290f29572abef1938590b41b5765ab83d95041

SHA512
42833482767179c832c66506deed3b539f1fe1c28cad24f218bedc0c8d23728da2df58b56856621b5d4720bf907533963bc5149903cc89ca2c0e485c2c3a49a5

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.7MB

MD5
9107943fe1fbb8903018d3c7c66943f9

SHA1
b05342581a4ded892951fe0734ece8460ff9e7cb

SHA256
635b8577ad491b760a1e2674a5fa71d2ea9bb8a21052603c832199e4190040a2

SHA512
a6668c9536951dbcb092080b06b57439760f84a827bf84d447b4cda0b6261dc77c27573a98c994fc64b4333e9fa4e8ef80a8a85b95f02924d4c2afe6f6a4e4f4

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.6MB

MD5
010538b35740abadb76e9e24365127ce

SHA1
7846f7e54a0a483ada90a385faca5824222d5d69

SHA256
05a8de6b2983007f300982ff668fb460296be2084614931aeb1bf146aa2e8ad3

SHA512
c4dffe743c1f4d9e70b722d25f7230f3047338f7cb1e569b61cf18678333ee771aa64f662409cdd2025e3848dc442cd37ecc05988eae878368f9619f06b0d560

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
1eff242d17893f863acc3ba44e364aba

SHA1
37219452dde559a0dade6f81f5b213bea803166e

SHA256
3971beb10d8d4977f78f74941a0dcfdd55fd6c22d5eadca5144a6b50de5e24cd

SHA512
d320ae51a6aa35f07dbe07431d3fef404bf648d360f335c45188cd97caecd1b00db3a87ad32af4d2e1700201a20c7465f883013f7172ede31a3ff7c9c4951e73

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.7MB

MD5
b9dec848d474a202b9b25874dbff7dcd

SHA1
f6ce0adec80bad7397bb6c824bd7593eecacf718

SHA256
b76e0db366b9fef783c38f1f399a49c8be4358b4215e9171feb5fda25105c353

SHA512
29ad84a1e62a1efabee5bc9878ed02c65c6c3d1c9d284ef8b5c84dda45392f4dbe48cc57f014ce0299a2fd30fe8c95def3b6b0383a1217550934168e41042158

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
cea7d39f3d2786c537ffcf5fb646e622

SHA1
f808eb0302ac7347dbc0991d76966cbcf712fde5

SHA256
ea51321eb0d7e0ab46cb087e76630e5e89feb77fef4da2431a8235cfb2503d28

SHA512
a2cc898bc16b3b046044358c9e72a79cf8689ba67c2c785f2b0ee1439e19ab72f16f4952d2d8ee6bbc09b98d67dbb5c6fcaa05858f9a960cf4fa12792cb0398f

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
df946a547889259a36f8dab517105fa3

SHA1
da1c1931d1f25325d0ce013e10a42d1852d8550a

SHA256
3c676a81aeec73bcca0da1e5bd53cdef3843ff1ad9d92a5a1cb284c3ca8802c1

SHA512
35bb285ca3bdcf30230cf32abfa53e29f5b64f6da0289e40f05eb8b11fc3d3da832b9d225faae2413a6e80c4878cc50d0bf7143992eac09e36c31054b4fe412f

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
1559bef6f662fa16f632af92d640b81d

SHA1
20345310591b308d260a7ab8e8caf782b35233f6

SHA256
73e374c9434c32a969ba8ae16509949956d6ca536c3158c4c1a3e1a395e6bff5

SHA512
62aa503c35b5241bf2c78ea6825bc704a6ccee5a74d02632f43c1439cb9564818b0799c825785b3b5a5af25169ff039e87c270ac7a93b0796c98172c4570bf44

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.6MB

MD5
0c357b9d9f20021c6c5b932b16721a98

SHA1
ce873656ad6a1ccbcd07a0e67443b1bfaaf9e2e3

SHA256
444377721ff29b2f35ebc67184dcc9253dbdea6c799d7da840f7ec954ad10102

SHA512
d407970fe21078f842041899f0841fb9dbdef1c0788893ef51a30c2bcfba5082bfa918b51b30adae01137c4181690ec8ec1f4bb3f9ddee3fd98f27f419c98991

Download Submit
C:\odt\office2016setup.exe

Filesize
5.6MB

MD5
55e407961b88502f5917fe53d0a704ba

SHA1
dd66e3deec0de10ce8a8611c5dc1dac569cb0333

SHA256
210f13d833f719e72bd2228fc36b5a5ec9f1697e21806fa1f529785b2042d2c3

SHA512
db19082a79a3861f359ce33c9928ea6304995b7b8d05f64eeaef430817433a08d961ea895108b6fe0d8cd1bfaf62d176c41666739d560d466447d97af810af93

Download Submit
memory/100-142-0x0000000140000000-0x00000001401A7000-memory.dmp

Filesize
1.7MB

Download
memory/100-12-0x0000000140000000-0x00000001401A7000-memory.dmp

Filesize
1.7MB

Download
memory/620-97-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/620-99-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/880-468-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/880-564-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1636-474-0x0000000140000000-0x0000000140192000-memory.dmp

Filesize
1.6MB

Download
memory/1636-429-0x0000000140000000-0x0000000140192000-memory.dmp

Filesize
1.6MB

Download
memory/1644-562-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1644-478-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1644-432-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2120-498-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2588-475-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2588-566-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2604-483-0x0000000140000000-0x00000001401C3000-memory.dmp

Filesize
1.8MB

Download
memory/2604-577-0x0000000140000000-0x00000001401C3000-memory.dmp

Filesize
1.8MB

Download
memory/2632-241-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/2632-121-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/2632-113-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/2632-114-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/2808-6-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Filesize
412KB

Download
memory/2808-125-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2808-7-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Filesize
412KB

Download
memory/2808-247-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2808-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2808-1-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Filesize
412KB

Download
memory/2968-165-0x0000000140000000-0x00000001401A8000-memory.dmp

Filesize
1.7MB

Download
memory/2968-163-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download
memory/2968-240-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download
memory/2968-402-0x0000000140000000-0x00000001401A8000-memory.dmp

Filesize
1.7MB

Download
memory/2980-447-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/2980-487-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2980-439-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3112-144-0x0000000140000000-0x00000001401A6000-memory.dmp

Filesize
1.6MB

Download
memory/3112-91-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/3112-92-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/3112-76-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/3112-84-0x0000000140000000-0x00000001401A6000-memory.dmp

Filesize
1.6MB

Download
memory/3444-573-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3444-479-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3812-471-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3812-565-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4168-460-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Filesize
384KB

Download
memory/4168-452-0x0000000140000000-0x00000001401FF000-memory.dmp

Filesize
2.0MB

Download
memory/4168-561-0x0000000140000000-0x00000001401FF000-memory.dmp

Filesize
2.0MB

Download
memory/4344-109-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Filesize
384KB

Download
memory/4344-101-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4344-159-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4344-102-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Filesize
384KB

Download
memory/4388-419-0x0000000000620000-0x0000000000687000-memory.dmp

Filesize
412KB

Download
memory/4388-467-0x0000000000400000-0x0000000000594000-memory.dmp

Filesize
1.6MB

Download
memory/4388-425-0x0000000000620000-0x0000000000687000-memory.dmp

Filesize
412KB

Download
memory/4388-418-0x0000000000400000-0x0000000000594000-memory.dmp

Filesize
1.6MB

Download
memory/4440-464-0x0000000140000000-0x00000001401DF000-memory.dmp

Filesize
1.9MB

Download
memory/4440-563-0x0000000140000000-0x00000001401DF000-memory.dmp

Filesize
1.9MB

Download
memory/4728-436-0x0000000140000000-0x0000000140193000-memory.dmp

Filesize
1.6MB

Download
memory/4728-482-0x0000000140000000-0x0000000140193000-memory.dmp

Filesize
1.6MB

Download
memory/4748-371-0x0000000140000000-0x00000001401B6000-memory.dmp

Filesize
1.7MB

Download
memory/4748-143-0x0000000140000000-0x00000001401B6000-memory.dmp

Filesize
1.7MB

Download
memory/4944-128-0x0000000140000000-0x00000001401C7000-memory.dmp

Filesize
1.8MB

Download
memory/4944-126-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/4944-134-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/4944-139-0x00000000015E0000-0x0000000001640000-memory.dmp

Filesize
384KB

Download
memory/4944-140-0x0000000140000000-0x00000001401C7000-memory.dmp

Filesize
1.8MB

Download
memory/5000-574-0x000001D370A70000-0x000001D370A80000-memory.dmp

Filesize
64KB

Download
memory/5000-575-0x000001D370A90000-0x000001D370AA0000-memory.dmp

Filesize
64KB

Download
memory/5000-576-0x000001D370A80000-0x000001D370A90000-memory.dmp

Filesize
64KB

Download
memory/5080-401-0x0000000140000000-0x00000001401CC000-memory.dmp

Filesize
1.8MB

Download
memory/5080-158-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/5080-149-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/5080-148-0x0000000140000000-0x00000001401CC000-memory.dmp

Filesize
1.8MB

Download