3ca965aca1833a08b9b97caf5644ebcf4cf6563ac50bc8cb43e7132b02859c9b

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

259b8f49479bcceba108cd989a53a60f.exe
Size

705KB
MD5

259b8f49479bcceba108cd989a53a60f
SHA1

c94ad26db7815e74d96e12beaf06086c31e50719
SHA256

3ca965aca1833a08b9b97caf5644ebcf4cf6563ac50bc8cb43e7132b02859c9b
SHA512

2f094fa901db38e92619d4c773dcca29abbfd387c51be1be854efffd8ab3267308b7e4df5925d2aa7cdff35af13e3b8d2797268ef72eecc87f3f1fc6851dff66
SSDEEP

12288:hDJnJM4OpSpnO8kTrlUpBWi9xlwfSSvhlnWz8v/zU5H9LzvXl71qulHr/Az:pJnJM4OqTW589LIJq8nzuH1vXl71/

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 6 IoCs

pid	Process
2372	alg.exe
5000	DiagnosticsHub.StandardCollector.Service.exe
4940	fxssvc.exe
3880	elevation_service.exe
1168	elevation_service.exe
4484	SearchIndexer.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1497073144-2389943819-3385106915-1000\EnableNotifications = "0"	alg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1497073144-2389943819-3385106915-1000	alg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	alg.exe
File opened (read-only)	\??\V:	alg.exe
File opened (read-only)	\??\W:	alg.exe
File opened (read-only)	\??\M:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\T:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\Z:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\M:	alg.exe
File opened (read-only)	\??\R:	alg.exe
File opened (read-only)	\??\G:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\J:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\R:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\H:	alg.exe
File opened (read-only)	\??\K:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\U:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\Q:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\I:	alg.exe
File opened (read-only)	\??\X:	alg.exe
File opened (read-only)	\??\Y:	alg.exe
File opened (read-only)	\??\H:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\I:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\W:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\Y:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\E:	alg.exe
File opened (read-only)	\??\Q:	alg.exe
File opened (read-only)	\??\T:	alg.exe
File opened (read-only)	\??\E:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\P:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\U:	alg.exe
File opened (read-only)	\??\Z:	alg.exe
File opened (read-only)	\??\S:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\J:	alg.exe
File opened (read-only)	\??\K:	alg.exe
File opened (read-only)	\??\L:	alg.exe
File opened (read-only)	\??\O:	alg.exe
File opened (read-only)	\??\P:	alg.exe
File opened (read-only)	\??\O:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\V:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\N:	alg.exe
File opened (read-only)	\??\S:	alg.exe
File opened (read-only)	\??\L:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\N:	259b8f49479bcceba108cd989a53a60f.exe
File opened (read-only)	\??\X:	259b8f49479bcceba108cd989a53a60f.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\msdtc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vds.exe	alg.exe
File created	\??\c:\windows\system32\perceptionsimulation\cjjffpod.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\blinibnn.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\ofamkabb.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	alg.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	alg.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\mbepdfen.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	alg.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	alg.exe
File created	\??\c:\windows\system32\albpkhdd.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\vds.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\syswow64\iipmbmbi.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\abpmgpln.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\wbem\oaaqqopo.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\kelanfqo.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	alg.exe
File opened for modification	\??\c:\windows\system32\locator.exe	alg.exe
File created	\??\c:\windows\system32\fpfkcdic.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\bpaeipik.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\ghneifjf.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	alg.exe
File opened for modification	\??\c:\windows\system32\locator.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	alg.exe
File created	\??\c:\windows\system32\openssh\mnnppfan.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	alg.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\pnkbmoam.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\jppmdpen.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\alg.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\iecehpll.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\mgbkaoea.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\mkhgeifm.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\nhlfcgph.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\windows\system32\fdpkgikc.tmp	259b8f49479bcceba108cd989a53a60f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\ipohfhfc.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\olemadei.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\gpiefnkf.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\7-Zip\cedpmnkl.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\7-Zip\gkooamha.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\kihlpche.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\jfjkgccl.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File created	C:\Program Files\dotnet\pijgofaf.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\lhbjhkab.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elpkkale.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\hlepeenn.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\hgdapnff.tmp	alg.exe
File created	\??\c:\program files\windows media player\lgodgmnk.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Internet Explorer\hfoijjjp.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Internet Explorer\kjkookie.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\kgacdccg.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\jkgaipki.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\7-Zip\jgpijieg.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\jmofaklb.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\pgildlkb.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clmaedbq.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ddnfppgh.tmp	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\obkakffi.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	259b8f49479bcceba108cd989a53a60f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\miqfjfol.tmp	259b8f49479bcceba108cd989a53a60f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	259b8f49479bcceba108cd989a53a60f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	alg.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	259b8f49479bcceba108cd989a53a60f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d621974f1a3dda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007e69b4f1a3dda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e988d4f1a3dda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c489e4f1a3dda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ab2ab501a3dda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6dd55501a3dda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ab2ab501a3dda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b9109501a3dda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c144dc4f1a3dda01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe
2372	alg.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1892	259b8f49479bcceba108cd989a53a60f.exe
Token: SeAuditPrivilege	4940	fxssvc.exe
Token: SeTakeOwnershipPrivilege	2372	alg.exe
Token: 33	4484	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 4512	4484	SearchIndexer.exe	112
PID 4484 wrote to memory of 4512	4484	SearchIndexer.exe	112
PID 4484 wrote to memory of 1572	4484	SearchIndexer.exe	111
PID 4484 wrote to memory of 1572	4484	SearchIndexer.exe	111

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	alg.exe

C:\Users\Admin\AppData\Local\Temp\259b8f49479bcceba108cd989a53a60f.exe
"C:\Users\Admin\AppData\Local\Temp\259b8f49479bcceba108cd989a53a60f.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2372

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2560

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:1572
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
1.2MB

MD5
11b4ca07195f92c7184612e551e9a000

SHA1
c33e071d8975e3e042095137737532a4aa0714b7

SHA256
9911071616cf9c4f4444a218a9cc88fe906087a037dd17adbc374c650e1e1683

SHA512
e18df670879819a4f18ac2af3970b2d3be91890b001ba411186fdcb3cedf5ef789fe9cc6006fa710b728dbfe5b6df7b40edc777f1d4a59c8b2cd954ca16c41e4

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
92KB

MD5
f40b7155ef00da4f05cf5bc1d4c787c8

SHA1
bc0b69770a2508931e0f31933ff0885353445546

SHA256
a150279c6bd0f824f68ca77ce2dac1a7a08881b86a1976f3480ad012f18f2b64

SHA512
29fbd49a0bfafa17d5df1ecd892acd256bdeb13a31df32cac2a9e7351a2f0029eed24dd23df20220dcac48dd83dd85fc7971d6c0892eed3ea3c656d4eede20b0

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
96KB

MD5
bae420b5e386c1e53e529d2ec345155c

SHA1
157edc0eb1b708126d7cf0e8e4e038cd0fee803b

SHA256
9878c5b4afc323d41d56ecfb7e5cc42ecdd6013b284e86ff68652c6d53863bf7

SHA512
29a4a685d87f666222e5cfa89647cc80274945787d16a2d4b0f48b44d3b2ebced03ec410ee889f5bba2851aaee317ece680976757b9b08418d7145c21ac88502

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
410KB

MD5
ad0cc60f487169759e8551864c6c5579

SHA1
70f0e13b72d42df93b76b424f97d4ee0498eea48

SHA256
2616d5ade9350a5fa1fa281c46015626c6aa7422b3d99ce3fb491a68691b1eae

SHA512
c1032883342d0568969c6a1023671e5dfce22960d44d55176bea982052c048f28c62f5cd00d60afc1fad5f7dce61a7794d4a717f6f0c5e573948044641bfd1f4

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
672KB

MD5
32c785c10755bcd4ac4849bea6499cda

SHA1
ed512ad5d6ada57d5f1fe307a29633d4d7553fb0

SHA256
11e59c2b07581466d34e05dc367570ce476cfa0048b0fc29ea478729c19a5c40

SHA512
9a6664e71bccfff5d3a1531ee4ac53771b15735cc521c47484518dcdeb8278fc2af27a8479d66f52d02b76bd160daeed774ac713e94f2c2f5ccb74157ced4ce2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
3.0MB

MD5
7b52b1286f501eb94219af7a57be0e46

SHA1
9b1895d2b7b99c0f68cc2b9e87048684e9466bed

SHA256
d4442f4851d271d50d1c3be3d2fe6e8c254c9db81a8bccd2a68a175d18f583d6

SHA512
1f1c8368617f67f4c316bafaa97b2b3eb6f6caec0267d90614bdf9d9fdbe2f2898e9fcf14bbafb2fc34bc71d7dc63abaaa0dd321158900aca2435773e0e04d18

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
738KB

MD5
36332850ed6fb3129a49b3ef9d67cef3

SHA1
4cf53dc5414d386cbcf6e227359dbd8df8384c9c

SHA256
2ed6963b67442deaa1ba886879203345a862a454f40cb3873924e741d8991202

SHA512
b52d33fc23f2ea20ba38df82c63a06b90f4a37880f543050402716959a7589b32d2c90ffc4dc0edea307e5ae6c8766a3870696b2d27b90ced1b734eb823d4927

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
393KB

MD5
6662955a72c08a5783ca444568ab7374

SHA1
2371596182aa34a83d21c51597e11105f1cba90b

SHA256
c0476410276753a539cdb712263a10bbb4d677becbe59fb9823fb5b39ca5d1d3

SHA512
98ae1f98609d45562d47342b090141838e539e5f1c93aa99b3d7f574e69b6fcfd5c5c827ba209c4a5db4a91cd7cd33b2435674737619aa5384a5e43de2813c62

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
1.0MB

MD5
259827b5e3d38aed758ec256374a2c01

SHA1
2b6655a81803c5776d071c2d604a4ac4120929b3

SHA256
07c96435cf060c9a0f7183752521360c557e037230a884ab1ba85ce0481fcd88

SHA512
3aaf3ef74e82d405c19eec23c46070b56ef77a4f56479b2c70f675681a7fdd0b96e7fc7011261f3514bb6ba60cb50470b158ed9b2976779f1e522c8fc16b4883

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\hgdapnff.tmp

Filesize
637KB

MD5
b8976dedd2bb16de275ca02fefc8efbe

SHA1
d2ca430c12ac46a52b10dabdd7706d77d3222df6

SHA256
2dc5d002c94fc64bbfda0439fce3a4d9a64225cd47dc43cb8ef14ab11394eb07

SHA512
298c2f295fb8c4c29f30936e918c264e422810acf24f22a21ed5d3a62896d1722ee7c072197558e00a71954e181bc2895f813753c94ea04d4ddd4a991ecb9b31

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
384KB

MD5
ff9ae1a281067f36140b146e4f5c72ce

SHA1
259dcfe862d10923d1ce099fcb7ac5f99c912654

SHA256
b2778d3a9d2a9dfd0b0d2a5c13f2c0b83341e2a83755ac4d0ed2d6543f4cbc96

SHA512
35cc938da97b6bc52c45e53f0fb9435168924a452415e4735085284af9fdd08963bd991dfc48fbdba0e175f20955a031f972071120587d22a9a7cc290fa8e4fa

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.0MB

MD5
7a4e2d2c11b1e9f22713616116a3f29e

SHA1
fd4d391a234940c7ea326147c202faffea8440b6

SHA256
a12dde9ad3895622032ab962070e429a3fa5e259646ed506100d5abf36910eb1

SHA512
f327e8f20cca0802475f25b571e8ed1b679e7ea9e35b88cfd37f19ffb8bc253e2c71a656c4624de247776b6a7115d2758ff85035999f62850902289cddd05718

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
95KB

MD5
e95d4d2cfe8c4673ea7eda72499d6388

SHA1
931e93bda667e81f420cacccb5a91f6d6f494d97

SHA256
7b3ac3a11ec66ece3d98c41f1b0ef7ec1e856ff3ec3036f1457f8ee0d1ef0b48

SHA512
18087c4c3be7191165149a9eea1f4c9fdc27d42443764e46870683a0f747ad93432d6221a2dbd152708b88b718c6341d118c03210e3555c98d3d3386d651dcbf

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.1MB

MD5
42900f4c4b128dfaeceb05e9319b260b

SHA1
52ef24a916da2f4ac5aeb2f598a6b9e83f317da6

SHA256
f1fccc2342c42f87a94c47d4ed69f3ee53d05d06f6a0e76835c6093914694e9b

SHA512
cd68f9d05dd6b8d962abf5e16cb0b4c93123ae46de88863244a98c6a17722a97ff8a22434cfefc3fee0a368abb672434439d2085bf5f575c2da757759a88b719

Download Submit
\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe

Filesize
1.8MB

MD5
ab9f1702c407ad1f201dde40f8d0ffca

SHA1
be3f739ab058d6047fbc17799c3ec8f1052f8ed4

SHA256
b1e1b9c2a80e861646762e630a9cd443e260f2b51e095e52f46256010bad7513

SHA512
7fb9b6d304be9f27ab20a6ea29eaf52438c99fe8f7d0d6f7495b3a019dd47fdb59007dada7787d38d095fecacb453bac481d2b24c24f1c13a397a2a5585768fd

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
613KB

MD5
4864fc1d30de09c8c74a0520b1e7ef05

SHA1
8f80b06d9530a96c3348d2654d77d826b097f6e2

SHA256
bcf8dfaa1da76bfc398a34d615a8e4428c671c1b98e60662fe16eec6f7385ffd

SHA512
7d9985ee4802fb346d2486053a756668496563ab555b89a9404b1170f425b049d666f6bed7926bc4ad722d191087339da4a8dff3fcb01ed417b39b24dea3e2ed

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
640KB

MD5
936004812dd1432a8c224cf49ef3ae4e

SHA1
c649f5a8583b2336a4a42d3f7f9ca3b7f8b890a9

SHA256
fd2b7ce907c5b770559d14ad9e943df3b1195d0b14d42166b0231091e771af9d

SHA512
52487a6877cb482016affa8fef79c7094ea3164f899a0d79658ae0f03bfa490167707709c47fc8cdb2cf3a978c6dbe8d7f1b49daf9e44b438af73e4fffbf6472

Download Submit
memory/1168-53-0x00007FF72E0C0000-0x00007FF72E315000-memory.dmp

Filesize
2.3MB

Download
memory/1168-188-0x00007FF72E0C0000-0x00007FF72E315000-memory.dmp

Filesize
2.3MB

Download
memory/1572-283-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-279-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-450-0x000001B6C60C0000-0x000001B6C60D0000-memory.dmp

Filesize
64KB

Download
memory/1572-446-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-447-0x000001B6C60C0000-0x000001B6C60D0000-memory.dmp

Filesize
64KB

Download
memory/1572-448-0x000001B6C60C0000-0x000001B6C60D0000-memory.dmp

Filesize
64KB

Download
memory/1572-435-0x000001B6C60C0000-0x000001B6C60D0000-memory.dmp

Filesize
64KB

Download
memory/1572-434-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-274-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-275-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-278-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-288-0x000001B6C4E70000-0x000001B6C4E80000-memory.dmp

Filesize
64KB

Download
memory/1572-289-0x000001B6C4E70000-0x000001B6C4E80000-memory.dmp

Filesize
64KB

Download
memory/1572-290-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-287-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-286-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-285-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-292-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-297-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-304-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-303-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-307-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-309-0x000001B6C5F80000-0x000001B6C5F90000-memory.dmp

Filesize
64KB

Download
memory/1572-313-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-308-0x000001B6C5F80000-0x000001B6C5F90000-memory.dmp

Filesize
64KB

Download
memory/1572-305-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-302-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-301-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-300-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-299-0x000001B6C5F80000-0x000001B6C5F90000-memory.dmp

Filesize
64KB

Download
memory/1572-298-0x000001B6C5F80000-0x000001B6C5F90000-memory.dmp

Filesize
64KB

Download
memory/1572-296-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-295-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-294-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-293-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-291-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-284-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-433-0x000001B6C60C0000-0x000001B6C60D0000-memory.dmp

Filesize
64KB

Download
memory/1572-282-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-281-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-315-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-280-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-323-0x000001B6C60A0000-0x000001B6C60B0000-memory.dmp

Filesize
64KB

Download
memory/1572-322-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-334-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-335-0x000001B6C60A0000-0x000001B6C60B0000-memory.dmp

Filesize
64KB

Download
memory/1572-316-0x000001B6C60A0000-0x000001B6C60B0000-memory.dmp

Filesize
64KB

Download
memory/1572-425-0x000001B6C60A0000-0x000001B6C60B0000-memory.dmp

Filesize
64KB

Download
memory/1572-339-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-345-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-344-0x000001B6C4E50000-0x000001B6C4E51000-memory.dmp

Filesize
4KB

Download
memory/1572-356-0x000001B6C4E70000-0x000001B6C4E80000-memory.dmp

Filesize
64KB

Download
memory/1572-357-0x000001B6C4E70000-0x000001B6C4E80000-memory.dmp

Filesize
64KB

Download
memory/1572-358-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-426-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-362-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-370-0x000001B6C5F80000-0x000001B6C5F90000-memory.dmp

Filesize
64KB

Download
memory/1572-277-0x000001B6C4E50000-0x000001B6C4E51000-memory.dmp

Filesize
4KB

Download
memory/1572-371-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-276-0x000001B6C4E40000-0x000001B6C4E50000-memory.dmp

Filesize
64KB

Download
memory/1572-378-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-273-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-382-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-392-0x000001B6C60A0000-0x000001B6C60B0000-memory.dmp

Filesize
64KB

Download
memory/1572-393-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-416-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-396-0x000001B6C60C0000-0x000001B6C60D0000-memory.dmp

Filesize
64KB

Download
memory/1572-394-0x000001B6C60C0000-0x000001B6C60D0000-memory.dmp

Filesize
64KB

Download
memory/1572-272-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-271-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-270-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-269-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-401-0x000001B6C60A0000-0x000001B6C60B0000-memory.dmp

Filesize
64KB

Download
memory/1572-402-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-405-0x000001B6C60A0000-0x000001B6C60B0000-memory.dmp

Filesize
64KB

Download
memory/1572-406-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-411-0x000001B6C4E30000-0x000001B6C4E40000-memory.dmp

Filesize
64KB

Download
memory/1572-412-0x000001B6C60C0000-0x000001B6C60D0000-memory.dmp

Filesize
64KB

Download
memory/1892-94-0x00007FF69DA10000-0x00007FF69DB19000-memory.dmp

Filesize
1.0MB

Download
memory/1892-2-0x00007FF69DA10000-0x00007FF69DB19000-memory.dmp

Filesize
1.0MB

Download
memory/1892-0-0x00007FF69DA10000-0x00007FF69DB19000-memory.dmp

Filesize
1.0MB

Download
memory/2372-155-0x00007FF7B3680000-0x00007FF7B3753000-memory.dmp

Filesize
844KB

Download
memory/2372-17-0x00007FF7B3680000-0x00007FF7B3753000-memory.dmp

Filesize
844KB

Download
memory/2372-45-0x00007FF7B3680000-0x00007FF7B3753000-memory.dmp

Filesize
844KB

Download
memory/3880-182-0x00007FF6618D0000-0x00007FF661B31000-memory.dmp

Filesize
2.4MB

Download
memory/3880-44-0x00007FF6618D0000-0x00007FF661B31000-memory.dmp

Filesize
2.4MB

Download
memory/4484-267-0x0000018621B10000-0x0000018621B18000-memory.dmp

Filesize
32KB

Download
memory/4484-230-0x00007FF7E2F40000-0x00007FF7E30E3000-memory.dmp

Filesize
1.6MB

Download
memory/4484-231-0x000001861C170000-0x000001861C180000-memory.dmp

Filesize
64KB

Download
memory/4484-247-0x000001861C3A0000-0x000001861C3B0000-memory.dmp

Filesize
64KB

Download
memory/4484-263-0x0000018620760000-0x0000018620768000-memory.dmp

Filesize
32KB

Download
memory/4484-338-0x00007FF7E2F40000-0x00007FF7E30E3000-memory.dmp

Filesize
1.6MB

Download
memory/4940-37-0x00007FF7045C0000-0x00007FF70471F000-memory.dmp

Filesize
1.4MB

Download
memory/4940-36-0x00007FF7045C0000-0x00007FF70471F000-memory.dmp

Filesize
1.4MB

Download
memory/5000-166-0x00007FF6CB9F0000-0x00007FF6CBAC2000-memory.dmp

Filesize
840KB

Download
memory/5000-29-0x00007FF6CB9F0000-0x00007FF6CBAC2000-memory.dmp

Filesize
840KB

Download