716575190730e3e271fe0adb506b065967e7fc3c5479d5f2b328e3efe4c47688

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6b68a217eb4f8eaf5462fa659e691b0.exe
Size

672KB
MD5

c6b68a217eb4f8eaf5462fa659e691b0
SHA1

9304fb3d0ceb0d05a3286a4f2e99286eec6b75b1
SHA256

716575190730e3e271fe0adb506b065967e7fc3c5479d5f2b328e3efe4c47688
SHA512

ea6c2fe6372ee0718f11ed49bf9f921a9c376c1e258b544406bf854b21e150f910637fcaa95de876f60b5a507ad3582c07113ccf9f3ae05cc0cb35b661bdd08b
SSDEEP

12288:deBNUbTVO86UCHruRdp+WA00SKCpVRwfZXSVUhbxk9e/pJu:dJIUCNd0nKwYxX+UhbW9eM

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 6 IoCs

pid	Process
1864	alg.exe
60	DiagnosticsHub.StandardCollector.Service.exe
2096	fxssvc.exe
4740	elevation_service.exe
2560	elevation_service.exe
4400	SearchIndexer.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-275798769-4264537674-1142822080-1000	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-275798769-4264537674-1142822080-1000\EnableNotifications = "0"	alg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	alg.exe
File opened (read-only)	\??\T:	alg.exe
File opened (read-only)	\??\P:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\Z:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\I:	alg.exe
File opened (read-only)	\??\J:	alg.exe
File opened (read-only)	\??\W:	alg.exe
File opened (read-only)	\??\Y:	alg.exe
File opened (read-only)	\??\N:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\L:	alg.exe
File opened (read-only)	\??\R:	alg.exe
File opened (read-only)	\??\Y:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\E:	alg.exe
File opened (read-only)	\??\U:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\V:	alg.exe
File opened (read-only)	\??\Z:	alg.exe
File opened (read-only)	\??\K:	alg.exe
File opened (read-only)	\??\O:	alg.exe
File opened (read-only)	\??\E:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\G:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\H:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\I:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\M:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\R:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\G:	alg.exe
File opened (read-only)	\??\S:	alg.exe
File opened (read-only)	\??\X:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\U:	alg.exe
File opened (read-only)	\??\X:	alg.exe
File opened (read-only)	\??\K:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\L:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\O:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\Q:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\N:	alg.exe
File opened (read-only)	\??\P:	alg.exe
File opened (read-only)	\??\W:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\S:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\T:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\J:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\V:	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened (read-only)	\??\H:	alg.exe
File opened (read-only)	\??\Q:	alg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	alg.exe
File created	\??\c:\windows\system32\cjflclja.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	alg.exe
File created	\??\c:\windows\system32\fhekaqgc.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\ofapbehb.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\locator.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	alg.exe
File created	\??\c:\windows\system32\lkoqhodp.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	alg.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\degmnddo.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	alg.exe
File created	\??\c:\windows\system32\qpkdkbbo.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vds.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\kopphind.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	alg.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\oeeepfhg.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\aokfmnia.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\geijmjlf.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\perceptionsimulation\ekoalmdm.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\syswow64\gkelemam.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\chigaklc.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\alg.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	alg.exe
File created	\??\c:\windows\system32\pgmccebn.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\lgfialnl.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\openssh\leidjldn.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\iigmjeqf.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\locator.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\wbem\bjheclin.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\windows\system32\diagsvcs\jphmlogg.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	alg.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	alg.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	alg.exe
File created	\??\c:\windows\system32\fifebobf.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\cmfjpcao.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\cedpmnkl.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\lhbjhkab.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pppjqpbi.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\lkekhjjj.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\7-Zip\gkooamha.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\kgacdccg.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\miqfjfol.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\pgildlkb.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ekchdkjb.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jipjcfed.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\jkgaipki.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Internet Explorer\kjkookie.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\obkakffi.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\jfjkgccl.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Google\Chrome\Application\elidehmc.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\dotnet\pijgofaf.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\gmdjpecm.tmp	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ddnfppgh.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\kihlpche.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\hinkbeag.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\7-Zip\jgpijieg.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\olemadei.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File created	C:\Program Files\Internet Explorer\dendjgfp.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\cfqhogfp.tmp	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	alg.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	alg.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	c6b68a217eb4f8eaf5462fa659e691b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ef088ff7e75da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071a496fd7e75da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fddb0fd7e75da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000090250fc7e75da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092e69cfe7e75da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be9c31fe7e75da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003bf95fe7e75da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000248440007f75da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe
1864	alg.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1868	c6b68a217eb4f8eaf5462fa659e691b0.exe
Token: SeAuditPrivilege	2096	fxssvc.exe
Token: SeTakeOwnershipPrivilege	1864	alg.exe
Token: 33	4400	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2592	4400	SearchIndexer.exe	109
PID 4400 wrote to memory of 2592	4400	SearchIndexer.exe	109
PID 4400 wrote to memory of 1228	4400	SearchIndexer.exe	110
PID 4400 wrote to memory of 1228	4400	SearchIndexer.exe	110

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	alg.exe

C:\Users\Admin\AppData\Local\Temp\c6b68a217eb4f8eaf5462fa659e691b0.exe
"C:\Users\Admin\AppData\Local\Temp\c6b68a217eb4f8eaf5462fa659e691b0.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1864

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:60

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3000

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2592
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
1.9MB

MD5
9c88b083ef9bed10991e78dc2ba42abc

SHA1
d96307a7e914f5537a9a97db4bf796ca0f97593c

SHA256
edc367c475c46adc4cc2790161a3cd78fcacb4ed2eb77ea29c32cbc85721976b

SHA512
9cb58a436d5e1bd52aff4557cc1f8780db72a8a5c5904e4c81eeaf051c7f68a97040194a60bebe38d12019a431e8b92de46a1119c45c02396b53fab0b0a42871

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
940KB

MD5
1af9b567b04e2d7170c0a80b59cff103

SHA1
bb7bfe31553fa70058945ded9c923dcf94064ccc

SHA256
113a66e13c8ae462eee036e6ca4288018a937865bfc71f6ecd45b0fbd511cf7c

SHA512
1f9d81ac99df3852b7742eaa870eb0e4154a5ba7b13dae5d726f8620f397936d2be055cd75396903ce8a88bcc14bcbdff13e682da874f5ec34697e264f7a66b6

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.1MB

MD5
dc861ca68a49de78410dcdf2792fc77c

SHA1
8c97ca418d636b916214f4d201ac9e10538cc39e

SHA256
32de138273e65fa53cda7e538372b706a11bbbcd4cebe070472e019e6a870fdf

SHA512
782c615aaed8657029ed83f307867a258d34df56f324db95f8944a22899cb6698dc0bc9ce8635de8d79b061c354834c4ef104f012110c338188bc75a08855484

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
66ac3bfb015e4983fb4531a5f2a01ea9

SHA1
5fa9937fa6b95fa1859f185c74a5efaed9d4ccd9

SHA256
ad041635309fa8b925ba483badde4d93c0553197d28505db4542d4f443c5bca4

SHA512
fc860b412b856e132fab41b096f81aac8cb65d8a6c7110be537b2f697d545feb0cef072c9de68974bd0cace9471e4d6b6bff78eaf4d6a9ed1e8502251acdb858

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
410KB

MD5
ed6ec134d5b2fe0623155b47d7ff2ea4

SHA1
d7a4be9bb893f26f6662beb92cd8aa1636c97320

SHA256
8612f0d3bc0849db63ad659d84cca487b2465836ab2dc0cd03628aaadc12e091

SHA512
ff6975546dfe6e7945eeb7254c81b353527c8f7d8813163a762683b6d4bc42e10c6c94914f37690fc3fd68255703e9db106e62ed33930a8baa87f782d35c2780

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
672KB

MD5
593b4c02534cda8c5ac500cf2e5f31dc

SHA1
170f22387ca0b5f37aab95c10b151c5bb2df5cef

SHA256
2dc9ddeccd0325b881199112b2158cc7eb50adf84d682244510d478bdd35b845

SHA512
395fda34922393c4df1c748d0baa04dde2da6ce4285db52570f0714f7225307c47cd1b7601b85d1afc9b1bd50e13abe3218d9654c7dd5e9eae35c7c18a736fb6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
278KB

MD5
4d19871a7e08b8ec2acbb56a311f6f41

SHA1
ef1706b9016ca15f958ebb52cbb9bb03d8142395

SHA256
e06fce59b943485ba312fb2d4f0b95bddef8b121c2428ae3aee5a840a92cd725

SHA512
a31c6c65ed9e58cf0adb62824907cc8e3d3a22e2428b6f0097a72e3f0190f879af0a0104c0ad6039d438e93a2798ed5681a4ddd6a233bd36e2cf92ecf61c988b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
738KB

MD5
65c06d183b80be94dcdc935465322301

SHA1
5578d31dae17027040562aea0628e113403c4377

SHA256
187337d58933d71f19b14524c35646a4a6054aaa27d1c67c764dfdd8c9041f1e

SHA512
97571b1c44523026792f0b6fdc501b3de24e36103153850653f47bbcb2ca3ab6ba40c969e402ffc32c51a5dc0ef2d716d471151c84c5742b3dd8aba4a282f49d

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
6.8MB

MD5
91cf2da0735e9fa0e2976d38d19ba540

SHA1
732f73c851899085ca6c0671ddf554caf21f2d96

SHA256
a61a2f5bbc00b60eaa01298b031fd78b2abcacb1ac02131a8007e3bd1cef38ca

SHA512
13afd5449e23e6b652ab91758eb0dd1458bc06938c2e14bed12d79685f737565e9b231a42a047ef3ae75e9f16daef3924fe68ce3ec9ec6667f93d02c3e765736

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.5MB

MD5
cf54482a498fd1a3c4e68e6c14069a87

SHA1
e3e52f69586ca850c50c81b6cf32f15ac76d1ce7

SHA256
9a679aca1150a54a9502e94029c502e7379bbf4dc0f62dd7c138acd6db1bd5d2

SHA512
993494da9878fbf2f0a0b95116556b00a20315237c04e55f1a48341036ec6bc0ed72d046c208bce74d4878a071a764eed0e72f690625856ea9d13a8b89bcbdf4

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\gmdjpecm.tmp

Filesize
637KB

MD5
79ef55a066bac064239209a5e634680f

SHA1
3a0f08d585825c697daeffdf5ff11a55976ddd09

SHA256
7259103925655c675fbd958045a0c372490d63d2e252bfd36ce1893258cfb7e0

SHA512
2834a83f59973b3c33ce4dc3cad5a3b51f20dbb1ba7ac6aa0276ace5e460f8d98859499a97fa2af3aefebf9b9fc33ab99ec8f63290e579d5b5df5b6491766ce0

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
1.3MB

MD5
617931c614f59bc32965d8050650c0ea

SHA1
c9b5191c0786a6bd34427ae15a76a3958de4a7db

SHA256
2df6eaad421c6e16570decd2ba568eb20caab8985553815df1cc8784253ea317

SHA512
4f048a1e79a178d57b824e6edfaea42fdae87254cc97eeae2309ec9089a6221a7f17e2e5bb707b44ad246f4499f89790a56f8a9473243a4aa9531c6ca1b3d27b

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
146KB

MD5
f3a6a3db8adbd1e3f40c4a478602a8be

SHA1
0f994b0968a9677215fd36ca1ae6b7aff945698e

SHA256
e42b55ce01b9a7dfa3b2879f3a9ca41f7990e419fd8c15eaf185ed26c64e2a17

SHA512
8fd323b3312d64e42b86431a95cb5bcb1aff86cfb40afc58a780c1561a65273ac58170560517ba7a1ca233b8bc8e2dd9f2d314782c66ee11bbf9188e660339e5

Download Submit
C:\Users\Admin\AppData\Local\pcbqpbdi\kfaiplig.tmp

Filesize
678KB

MD5
20643188443ea4695de442177c8e7b6d

SHA1
7e7b881d301b5b4c823682b8254ed5bfd387c6cb

SHA256
d6ff6097aff03aac9e61d5dca0533939c4480913e07e9665664f41f4514e2514

SHA512
82aa33c961a380536d07bed6573043410ff1b9818eb1a9297e42cf0e9c403962d9d20af74228c6096302cb4df5ec533a4e90d1e786a303c32d00f0c42003335d

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
487KB

MD5
03fec2b91e962751bb6f1bb8f982ceb8

SHA1
c76fafc109633b2c635c61e2d4a6f81019f13f3b

SHA256
a8cb1d700e29d82635e6e4c5ab56de6184cd9ca82a25e568d9ad03370f0d6627

SHA512
eaf403480ec4b3300013bf0dbbd3eddf6631bf78f236f860f4ed275472d97060a7e3b492ab47824e14542b6e7bdfa393497eec85f2d1140357d2ce5af3eefaf2

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.0MB

MD5
3b48fc945e7203ceea74127d6dd78b08

SHA1
c40c67ac37eb7af0fe9033f21695f5322f14f2dd

SHA256
e1da15502e6874607ca306f4472742a0955feb10360c9bbae332851f96bdf61a

SHA512
e12cebf046bd8b8b86b9f26d9ee1d5232dd86840f6ce29ae6e3d68995d8b7c50c71ac39c63ee33a491f6daf8b13538e369e1920d4aec2728bc1c0ea38a8c13fb

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.3MB

MD5
93c490191971e62ea75779b197e14473

SHA1
515ac12ed933b14996c9deb691c0855cca4fb8ee

SHA256
a8ab5a070ccbe3f3bb700350322f57d3ea56c5f3d6efdca266cd53c1a37ccf00

SHA512
031f315f24bf5821bcf7cd8a948c0368d990def60a59ffff74b707e857927b4b4eb53d11a9378e9b82bea4dccd20626576ddc22fcad63e13587841348bd25d9c

Download Submit
C:\Windows\System32\alg.exe

Filesize
489KB

MD5
ca62646a06637a172c966456759224f3

SHA1
1d82e558de5b83e2a2db4718efbd42f958b83a2b

SHA256
68c83d932f12d074bd2e6d5ecdee5cdbc810da0b88c54ddabc33d67bf48686ae

SHA512
31344183b5dc06d0cf94428ebab782247b4ba2c5a30794ccb60b54fd40287855a52b52c5e725d50c760d12ad0d8c1090e13753bf957c7c90e5999802efee303b

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
613KB

MD5
a3d23240e5b6002a1df0afc823b9ffc6

SHA1
3a903f616d1b599d2689314dee3f9b577e3582f2

SHA256
7823eb457131fccb75b1a5712200f2fb261646a5fbf54740a602811ddec3f77f

SHA512
d11841059bee2b5a063036dc429a55f41674ec27eab42d49434c50d7a5d933266a50d45aa15e3549ad30c9edae3907356bcc2c1e424fef840574026fed279fb8

Download Submit
\??\c:\windows\system32\Appvclient.exe

Filesize
1.1MB

MD5
1e3c9ca8706d543ed96e6283400b1e7b

SHA1
2a13a0c2a163114f8dd228cef50d7ae82d2284fd

SHA256
050267866454dd3e2241f62f8a0cecee533fef52df59f79047f97bee5833e1b7

SHA512
dee60b7ac5d30cf7c7ec0fc90890769164ca78e39fb18ae544a6f80a610fef61d8a706130671f308677f82b49eb25b9bb8edff3f1e198080b3de6012f10656eb

Download Submit
memory/60-29-0x00007FF760E90000-0x00007FF760F62000-memory.dmp

Filesize
840KB

Download
memory/60-165-0x00007FF760E90000-0x00007FF760F62000-memory.dmp

Filesize
840KB

Download
memory/1228-303-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-307-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-436-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-435-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-433-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-434-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-422-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-421-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-420-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-269-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-270-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-271-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-272-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-273-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-274-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-276-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-275-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-277-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-278-0x000001B8A5B10000-0x000001B8A5B20000-memory.dmp

Filesize
64KB

Download
memory/1228-279-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-280-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-282-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-281-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-284-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-285-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-287-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-288-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-286-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-283-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-289-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-290-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-296-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-297-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-298-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-299-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-300-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-419-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-302-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-301-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-304-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-305-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-306-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-312-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-311-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-310-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-309-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-308-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-412-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-316-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-317-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-411-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-321-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-322-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-327-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-328-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-339-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-340-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-341-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-344-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-349-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-350-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-359-0x000001B8A5B10000-0x000001B8A5B20000-memory.dmp

Filesize
64KB

Download
memory/1228-360-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-361-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-364-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-365-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-370-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-371-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-384-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-385-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-386-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-387-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-388-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-392-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-396-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-397-0x000001B8A5AF0000-0x000001B8A5B00000-memory.dmp

Filesize
64KB

Download
memory/1228-398-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-409-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1228-410-0x000001B8A5B20000-0x000001B8A5B30000-memory.dmp

Filesize
64KB

Download
memory/1864-51-0x00007FF661EB0000-0x00007FF661F83000-memory.dmp

Filesize
844KB

Download
memory/1864-17-0x00007FF661EB0000-0x00007FF661F83000-memory.dmp

Filesize
844KB

Download
memory/1864-154-0x00007FF661EB0000-0x00007FF661F83000-memory.dmp

Filesize
844KB

Download
memory/1868-0-0x00007FF7D9FD0000-0x00007FF7DA0D0000-memory.dmp

Filesize
1024KB

Download
memory/1868-93-0x00007FF7D9FD0000-0x00007FF7DA0D0000-memory.dmp

Filesize
1024KB

Download
memory/1868-2-0x00007FF7D9FD0000-0x00007FF7DA0D0000-memory.dmp

Filesize
1024KB

Download
memory/2096-37-0x00007FF65FF60000-0x00007FF6600BF000-memory.dmp

Filesize
1.4MB

Download
memory/2096-36-0x00007FF65FF60000-0x00007FF6600BF000-memory.dmp

Filesize
1.4MB

Download
memory/2560-53-0x00007FF72AB50000-0x00007FF72ADA5000-memory.dmp

Filesize
2.3MB

Download
memory/2560-187-0x00007FF72AB50000-0x00007FF72ADA5000-memory.dmp

Filesize
2.3MB

Download
memory/4400-246-0x000001C805ED0000-0x000001C805EE0000-memory.dmp

Filesize
64KB

Download
memory/4400-230-0x000001C805DD0000-0x000001C805DE0000-memory.dmp

Filesize
64KB

Download
memory/4400-229-0x00007FF7D6320000-0x00007FF7D64C3000-memory.dmp

Filesize
1.6MB

Download
memory/4400-262-0x000001C80A3C0000-0x000001C80A3C8000-memory.dmp

Filesize
32KB

Download
memory/4400-320-0x00007FF7D6320000-0x00007FF7D64C3000-memory.dmp

Filesize
1.6MB

Download
memory/4740-44-0x00007FF67D1F0000-0x00007FF67D451000-memory.dmp

Filesize
2.4MB

Download
memory/4740-181-0x00007FF67D1F0000-0x00007FF67D451000-memory.dmp

Filesize
2.4MB

Download