410b643b3afabfc5e3faa8b0c0b23e327a86ff412db450024eb79ed4cf3b283e

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc4f93a10c1e554371fab1900c0767b2.exe
Size

672KB
MD5

cc4f93a10c1e554371fab1900c0767b2
SHA1

e6eb72f240aa125c4dea17ef1ede9c8e7e51d7f3
SHA256

410b643b3afabfc5e3faa8b0c0b23e327a86ff412db450024eb79ed4cf3b283e
SHA512

c88fc62b975c689813d1428113b7e67774d51c33fbc605ed6d700a8e4a405a937b116dfe1a215123b7aa52a92a11f8aef735a533f69ef6684e388f99f00c8dfe
SSDEEP

12288:meBNUbTVO86UCHruRdp+WA00SKCpVRwfiXSVUhbxk9e/pJu:mJIUCNd0nKwYKX+UhbW9eM

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 6 IoCs

pid	Process
4652	alg.exe
1544	DiagnosticsHub.StandardCollector.Service.exe
1608	fxssvc.exe
1164	elevation_service.exe
4356	elevation_service.exe
3100	SearchIndexer.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-983155329-280873152-1838004294-1000	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-983155329-280873152-1838004294-1000\EnableNotifications = "0"	alg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	alg.exe
File opened (read-only)	\??\K:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\Z:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\N:	alg.exe
File opened (read-only)	\??\M:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\O:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\P:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\G:	alg.exe
File opened (read-only)	\??\S:	alg.exe
File opened (read-only)	\??\Y:	alg.exe
File opened (read-only)	\??\G:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\L:	alg.exe
File opened (read-only)	\??\M:	alg.exe
File opened (read-only)	\??\U:	alg.exe
File opened (read-only)	\??\X:	alg.exe
File opened (read-only)	\??\Q:	alg.exe
File opened (read-only)	\??\W:	alg.exe
File opened (read-only)	\??\U:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\W:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\I:	alg.exe
File opened (read-only)	\??\J:	alg.exe
File opened (read-only)	\??\K:	alg.exe
File opened (read-only)	\??\O:	alg.exe
File opened (read-only)	\??\L:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\Q:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\S:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\T:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\E:	alg.exe
File opened (read-only)	\??\H:	alg.exe
File opened (read-only)	\??\T:	alg.exe
File opened (read-only)	\??\H:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\V:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\X:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\Y:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\J:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\R:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\P:	alg.exe
File opened (read-only)	\??\R:	alg.exe
File opened (read-only)	\??\Z:	alg.exe
File opened (read-only)	\??\E:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\I:	cc4f93a10c1e554371fab1900c0767b2.exe
File opened (read-only)	\??\N:	cc4f93a10c1e554371fab1900c0767b2.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\dllhost.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\pobkpkpf.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\nicmhdhj.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\syswow64\fgfjkpmq.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\fqbgbilb.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\akoldgeh.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	alg.exe
File created	\??\c:\windows\system32\dlhlfabd.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	alg.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\vds.exe	alg.exe
File created	\??\c:\windows\system32\joopebom.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\ifpfpgok.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\kgekhppi.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\lpokagod.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\perceptionsimulation\ajqmandl.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	alg.exe
File created	\??\c:\windows\system32\djgnnaaj.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	alg.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	alg.exe
File created	\??\c:\windows\system32\wbem\mjamplph.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\locator.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\fgjjfima.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\alg.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	alg.exe
File created	\??\c:\windows\system32\mpnmfqob.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\olfbkddo.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	alg.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	alg.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	alg.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	alg.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\pljoinpf.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\openssh\enlgiecm.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\bmkgoapc.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\windows\system32\diagsvcs\fkcnfced.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fdhiojbc.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\mhljnepc.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	alg.exe
File created	\??\c:\windows\system32\aligokpl.tmp	cc4f93a10c1e554371fab1900c0767b2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\7-Zip\lncjookl.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\kihlpche.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Google\Chrome\Application\jmofaklb.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\miqfjfol.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pppjqpbi.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cedpmnkl.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\pijgofaf.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\pgildlkb.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\hhgmcicc.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\kmfiqdlk.tmp	alg.exe
File created	C:\Program Files\7-Zip\jgpijieg.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\jfjkgccl.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\7-Zip\gkooamha.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\obkakffi.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\7-Zip\nccafaqk.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Internet Explorer\dendjgfp.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\lmmbdibo.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\lodjmcbf.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\lhbjhkab.tmp	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	cc4f93a10c1e554371fab1900c0767b2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	cc4f93a10c1e554371fab1900c0767b2.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7c6ee801477da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1d45e811477da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afe9f8821477da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4a0e7801477da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045517f821477da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e91dca811477da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001227b6821477da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe
4652	alg.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4588	cc4f93a10c1e554371fab1900c0767b2.exe
Token: SeAuditPrivilege	1608	fxssvc.exe
Token: SeTakeOwnershipPrivilege	4652	alg.exe
Token: 33	3100	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 680	3100	SearchIndexer.exe	109
PID 3100 wrote to memory of 680	3100	SearchIndexer.exe	109
PID 3100 wrote to memory of 5032	3100	SearchIndexer.exe	110
PID 3100 wrote to memory of 5032	3100	SearchIndexer.exe	110

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	alg.exe

C:\Users\Admin\AppData\Local\Temp\cc4f93a10c1e554371fab1900c0767b2.exe
"C:\Users\Admin\AppData\Local\Temp\cc4f93a10c1e554371fab1900c0767b2.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4652

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1644

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:680
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 808 812 820 8192 816 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
1.9MB

MD5
03098b3c7e7cec825e002934f5bba30f

SHA1
e8c45c27b7e9cc48098db133d2fb2f344e9885a9

SHA256
b256b17d9edc3a75a87a5e1359d02cfc7c1e9b2773ec59d7b0c67621010f6373

SHA512
fea6df1e41f0045310b1605c6f1289d60c3acdce6af5b9bee6984d48a8932e0c99496358b9ab482234a90457529266c93f76f5f534082129d35cc6ee917784b1

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
832KB

MD5
01a054c1d528c740012a9878f02d504d

SHA1
78cb93f7935dae45608f82558fb47888009b7e19

SHA256
60846ae30845ad0d4c0d9fd6fc0704933a2a13b1ce3f003872040e5be5bde916

SHA512
419eb248d1d78d31b2c220dbdc7b9d2ca616d12d1ac9dca344852e662b677e934a04d41b507a441c15dbdb739f16755be1a0c1311454de57584db06fcf92d72a

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.3MB

MD5
967d7c2d16440fdcb5b901a5df6596e6

SHA1
1d346dcff34b73b82e6d462acb09a26ef66af058

SHA256
85e1937f842b1705338a28c6ed26285cf9ea383538a464d50646770002693e5b

SHA512
0b9344ddfa6d53e4f55ccea4edf7b5c52a1e50321ad900d7e2e2dd7718b4fee75daabf0267696bbaa01503067a88de4769f0674e49d9b3f653e6fe505f921ddc

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
05f11a2b13697aa81c45db3b457175a9

SHA1
743afbd511e4dc1742bb96d452a9480bffc134fa

SHA256
720c8ea176e771ca2c16bf869c7ff40bc41bcbb145c11080022a3d77deafd8e1

SHA512
6a8dc64dc08aebc8092d6b9af1126f0ae31217ff56cf80e8bd2b189a6c2ba564a08041d8f7532e8626a65a43085ab24cdbd7ab0e3a0f84ba60d88b6e411e8cf5

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
410KB

MD5
51564a4227952ee3c4bdb95cd4e171f2

SHA1
56b457d14f11d3afcc879792c4d8a9102400fd1b

SHA256
d5b8b690c74a305ac25b3bfb07b753bb717b62846e8d9808ad4d2622a9739152

SHA512
3ccb88b002a6ecd46de5705609b66443413026270361f62a4829ecd05306640b07dbc45fd35c3aff6dce18a123e27ce9322c2b2d137e951e67763d8a32994653

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
672KB

MD5
346857ae21b9bdedae71725248add667

SHA1
173167e523ccda9350bb9c0f2645eae29bef5098

SHA256
700e28ca0687469685bc4d386e66827bb7fe76ff92048edc12bea97608b07d4e

SHA512
5e01ddd5d4dbdad5f0bb7903af50bc6c9dc55d556207fc31d80c5890ff2a0b8e4616710650131c22ed6f1b8668c568731191a8a0a6c6fe130e1420e1e8de7725

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.5MB

MD5
1c49175d2df0473c5ee7749692cc25bc

SHA1
d7e8a8722dd55ba08a63add63365de7ce2880815

SHA256
eee9a267a5e51a60311e50f7c45fff3d01e1c9629f67eaad989ce5857acfdc1e

SHA512
e90836d888b482785fea0974a7421540acf85b13adc5cacbf23c834988720134e9ef160dab9501943faa35a0e8e6df54d4ed3a97e43d0e730f56db41890a6c7b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
738KB

MD5
1b87e620ac70243b8aa929e9dc815894

SHA1
cb45de2034f560ecbaf57b1b3223d754ecd2e89a

SHA256
93b637a30fe5324f7a58cb6ad8f9c35442e317b07b9f73dd7df576fcce2cddcf

SHA512
5e900a27a802cc18971d876ca99629f1043b026187b47d38591d1be436b783fe83f88f8deb13d20fdc3a2b50e321cd67e1a1bdf52f4d9651d2cdd0850630ac89

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
23.8MB

MD5
7ff233fe133eebb97c6e0dd5d570dccf

SHA1
ed27b1829b599e74a9d5e64fa6bdd1fa93c35c7a

SHA256
7e557e800733206cd820b0027d368374047285cfc833bc36ab812eefc5652fb9

SHA512
1d2b6911532fa4e740551c112e518ef6b168711793dff1f23dcba8010af2ccd325fbcd1b81ac282bfc6c737ed8ec36ca6cd48229cef8751d837d9b5a45a6a92b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.5MB

MD5
9e086d78d8729490428f2895e6539c4e

SHA1
e9cf777b57c5ddb672804964799e342018bdf70b

SHA256
1432b9a87945f7df0598951bf8d073fcf96a0dfc263940e449e2ef243c45862c

SHA512
d0e34e58d0c10bed57424e622f775bb087dee45de82539a110a6dce980eaaf75b60b056b47271a91ea1465f3062d0619fc848ea701ff7cf1b4e7471d79e70f2c

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\kmfiqdlk.tmp

Filesize
637KB

MD5
2be2097cccef0122251a1d5828b23503

SHA1
92936b7da707b7c94cc2e5879b8150a05d95d6ad

SHA256
d80d87f9f559686a87c7ff09bc38699fb2f943a98dce10f56f86387d2f4dc772

SHA512
830c10bef067350f188306e2efd95dc14c254806d0767014b264b2269a6d804118ce78b659c7c6314cd4fb87eb6d90d27d23cc19755c441e4a480009b05afd49

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
1.8MB

MD5
7817e0dc05fe2f0af343c6a6a33f63a0

SHA1
b81452f088b527c6d81531d861558c769a21f1fe

SHA256
66d7e0b6666bf5698bf9530c508bdb2b7a12f80e62708d8f469c84fe6f654862

SHA512
0af51ee3f027a6cd3031e88841672818659a6329bc491b8d197617bb7186fc719c2a7821b3ec3c44e44d0db635329921f7b0a0d0dfa2058b6b8cd47671d05841

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.0MB

MD5
4f08a81305d3315d374745b7918b8a9b

SHA1
da36a9c622bf746384eb2618a03024c504f1fe21

SHA256
8b653f566db24bd192cbace376103a36db5b45a92dc2494602f319b0121ed256

SHA512
54d2b8b2843e88e8dc4c5e9ef28d09e16ce517a9a0fc75c28bd472180522fbc4d8e6241034dd43431164332025aa8529f2763e96c80b49e3e686c67d1da21fae

Download Submit
C:\Users\Admin\AppData\Local\aknfpoko\jikhplmc.tmp

Filesize
678KB

MD5
778cf91afc2a56530db15ec5af7d9e94

SHA1
31f22f58ecd399e36ff813a46397bdd3646535db

SHA256
03ba1ec9c011b596a9803533ca3c86bab920385affe83f0b2ea2352780adb0e2

SHA512
213a9e6a7359cde72a22d8c1a4c260beadf0e8e58dbed13ab293e7ede59f5d1d9799ca257012adf627f81f79163bb2b17641f41bd73ec16de3e1cfba84d10a66

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
487KB

MD5
c5a07c0566da132c564b04fdf0e74819

SHA1
c78e24ba0189d4e0a2879ca5433b2abd26a15311

SHA256
43d846a79234f9a8d6062919f24c6d686b4a481d7f765b2853df8c368c82d359

SHA512
24699f23baad458e5eb2fcd7528e3b741e243441e2b21302dd796769cf98139491ff64258006d89fe6db1eeba07fa37df99af1533867441035b3f7f826cb89bb

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.0MB

MD5
b3bf161637fa1bf23b46ccfe1b9d37b5

SHA1
f7daf245fb1393d2708595434921bfba3570bdad

SHA256
7f5d1f6d9f1cb2991ae9c5680ba6cbe75266f7c00e5bcadfb2452b1e311bb48a

SHA512
36b4c45056840dfd457835c8c96e67eee9fe945baef57a37224477364b8a4a81a26987fe55522e80efe9442eeef6abd0656dd4e10a201d4c3aca0f7a9cd6ec41

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.3MB

MD5
9cb781342f3d5de8249a118e834c8f4e

SHA1
c204399f5083507d524ff45ee415e2bb62183939

SHA256
795fbc9c1b703cc9952e32ec33155b43235128ba1cbec41deeda7e28b79b9a2a

SHA512
6c569a4f653f205b1eb8987f91937c1ec75443c2521f95a8faa86c89234bc1b6ec404deb546c2e1a0bfc4670004bb9664d3748e03e8a8afd47705bad39deedd3

Download Submit
C:\Windows\System32\alg.exe

Filesize
489KB

MD5
e39c52319b9bdff7ea8c19aa53b42f9d

SHA1
693eff8a4b1d29421934c71dcb07ff6e5b4d2787

SHA256
b0634e19ae6cff611c0c2f1e2e3c149c4a7a976f4fe869737edca82b7a696766

SHA512
100a5389aa1cf96f23e4c9b58147102d47367fca0f7a5e8bddf59fc72ba88267de371e430388f2853189842fd233a03e35ea0636a60fe0eb25e355fbe525f1b5

Download Submit
\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe

Filesize
1.6MB

MD5
a2969099ff973cfa03ef5b85b2458978

SHA1
cd24ef975b4369a659e7e652fe44f17278751e8f

SHA256
f75bf8d6b57a3884ea2814ee167accfe36bbc16c31f9013ba18f444615b3efea

SHA512
5419e411d0ac2d5bc5d5e7419cf6e9e9f00dcc909fbc97b32f391e631d95341a400ebb7b83d5b11016bb00dc738fe14a2baf22dbd7d18e491df259d1d53393be

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
613KB

MD5
585390ac1acf1a7e26853131123db115

SHA1
1379f2ab991d21bf106f45ce234d426dbd12d80d

SHA256
8a41ede2063b74f0078618e5389d0139994519b945f54bd035a1b763310ef078

SHA512
aaae61aa6a1cb1b0fea8017e4c651feab2011cbe760a507e077d3b29dd96452771225a5a304aba9d22d42bf6e2da7b2880c6c7ce39bce93c38369e50a821c95a

Download Submit
\??\c:\windows\system32\Appvclient.exe

Filesize
1.1MB

MD5
022c640534606c8f37e3410c5287947a

SHA1
925b95ff75a17b90d85a30e770d9c4ad4dace844

SHA256
394bf4bd910dc6ff5d6693e5d73cd5654dc6f8a4783abce632791598554a9339

SHA512
7675b7426735b50652d2750d74b31c6da71346fe9b9ecadb6ec499a0995bc1a0085a35ae1aa4a7f4de1dbca98a82d15af9e88e0a0ccc0ec7562a867d2fb292dd

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
896KB

MD5
bafb14ea66212ad1f91dfb8be95fff75

SHA1
29df6b107953037ab11612da190f9cfceee728a3

SHA256
42122ba4b0bd11d811209baa5e7fb72cde1c9a1c2acc81d189e3c58a4950e481

SHA512
cd09d2676bfd190af031b28895f08c64b5c60cba641c39485f0a713b41eda5cb919fe7246cebe6271d1216cb06d06bb840e87cc32409d45f4efceee5eeec46ac

Download Submit
memory/1164-187-0x00007FF782D80000-0x00007FF782FE1000-memory.dmp

Filesize
2.4MB

Download
memory/1164-44-0x00007FF782D80000-0x00007FF782FE1000-memory.dmp

Filesize
2.4MB

Download
memory/1544-166-0x00007FF6B81E0000-0x00007FF6B82B2000-memory.dmp

Filesize
840KB

Download
memory/1544-29-0x00007FF6B81E0000-0x00007FF6B82B2000-memory.dmp

Filesize
840KB

Download
memory/1608-37-0x00007FF636550000-0x00007FF6366AF000-memory.dmp

Filesize
1.4MB

Download
memory/1608-36-0x00007FF636550000-0x00007FF6366AF000-memory.dmp

Filesize
1.4MB

Download
memory/3100-315-0x00007FF7C5750000-0x00007FF7C58F3000-memory.dmp

Filesize
1.6MB

Download
memory/3100-268-0x000001A9ABD70000-0x000001A9ABD78000-memory.dmp

Filesize
32KB

Download
memory/3100-252-0x000001A9A79B0000-0x000001A9A79C0000-memory.dmp

Filesize
64KB

Download
memory/3100-236-0x000001A9A7780000-0x000001A9A7790000-memory.dmp

Filesize
64KB

Download
memory/3100-235-0x00007FF7C5750000-0x00007FF7C58F3000-memory.dmp

Filesize
1.6MB

Download
memory/4356-193-0x00007FF7D7000000-0x00007FF7D7255000-memory.dmp

Filesize
2.3MB

Download
memory/4356-53-0x00007FF7D7000000-0x00007FF7D7255000-memory.dmp

Filesize
2.3MB

Download
memory/4588-94-0x00007FF7261B0000-0x00007FF7262B0000-memory.dmp

Filesize
1024KB

Download
memory/4588-2-0x00007FF7261B0000-0x00007FF7262B0000-memory.dmp

Filesize
1024KB

Download
memory/4588-0-0x00007FF7261B0000-0x00007FF7262B0000-memory.dmp

Filesize
1024KB

Download
memory/4652-150-0x00007FF6C5A30000-0x00007FF6C5B03000-memory.dmp

Filesize
844KB

Download
memory/4652-17-0x00007FF6C5A30000-0x00007FF6C5B03000-memory.dmp

Filesize
844KB

Download
memory/4652-45-0x00007FF6C5A30000-0x00007FF6C5B03000-memory.dmp

Filesize
844KB

Download
memory/5032-329-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-367-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-305-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-306-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-309-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-310-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-311-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-313-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-314-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-312-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-308-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-307-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-303-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-317-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-316-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-320-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-323-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-322-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-330-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-302-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-328-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-327-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-326-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-325-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-324-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-321-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-319-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-318-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-334-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-335-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-336-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-337-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-338-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-342-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-341-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-347-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-348-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-359-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-360-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-304-0x000001C40C890000-0x000001C40C8A0000-memory.dmp

Filesize
64KB

Download
memory/5032-370-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-379-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-380-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-381-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-382-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-385-0x000001C40C890000-0x000001C40C8A0000-memory.dmp

Filesize
64KB

Download
memory/5032-386-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-392-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-391-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-393-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-394-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-405-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-406-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-407-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-408-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-409-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-410-0x000001C40C8A0000-0x000001C40C8B0000-memory.dmp

Filesize
64KB

Download
memory/5032-417-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-418-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-429-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-430-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-433-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-434-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-435-0x000001C40CC60000-0x000001C40CC70000-memory.dmp

Filesize
64KB

Download
memory/5032-440-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-442-0x000001C40CC60000-0x000001C40CC70000-memory.dmp

Filesize
64KB

Download
memory/5032-441-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-449-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-450-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-451-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-452-0x000001C40CC60000-0x000001C40CC70000-memory.dmp

Filesize
64KB

Download
memory/5032-459-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-463-0x000001C40CC50000-0x000001C40CC60000-memory.dmp

Filesize
64KB

Download
memory/5032-300-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-301-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-299-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-298-0x000001C40C880000-0x000001C40C890000-memory.dmp

Filesize
64KB

Download
memory/5032-297-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download
memory/5032-296-0x000001C40C870000-0x000001C40C880000-memory.dmp

Filesize
64KB

Download