16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
Size

625KB
MD5

cbebaf8931541edde6edbe6a130f7dbe
SHA1

43c3de702e7ebe6a9f47dd28f0221e67946c739c
SHA256

16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765
SHA512

e3d1acaf49ff3946379a2c79e801f1879065d2ec131a33690597f537a77237b660586a83f39d65e1edd55e514551899a44a9115d8e90442652bf81ca9244d7ea
SSDEEP

12288:g2XVqKNdQ8yRK6rkObwsToHOOWGgqvoEWH/lInNg4JYU5a0Cuxy:NXVqIi2lObXobHAEW9INFJY0au

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
208	alg.exe
2664	DiagnosticsHub.StandardCollector.Service.exe
4576	fxssvc.exe
4992	elevation_service.exe
3228	elevation_service.exe
1072	maintenanceservice.exe
4884	msdtc.exe
2800	OSE.EXE
1396	PerceptionSimulationService.exe
388	perfhost.exe
4040	locator.exe
3832	SensorDataService.exe
3996	snmptrap.exe
3408	spectrum.exe
4312	ssh-agent.exe
4736	TieringEngineService.exe
3456	AgentService.exe
4396	vds.exe
232	vssvc.exe
4324	wbengine.exe
3720	WmiApSrv.exe
1964	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\System32\alg.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\vssvc.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\106a6be0293b476c.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\System32\vds.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\AgentService.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\wbengine.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\spectrum.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fe64fb17fa1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026aa73b17fa1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044bf48b17fa1da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000055d46b17fa1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c6bb6b17fa1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060206ab17fa1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9ffe6b07fa1da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2664	DiagnosticsHub.StandardCollector.Service.exe
2664	DiagnosticsHub.StandardCollector.Service.exe
2664	DiagnosticsHub.StandardCollector.Service.exe
2664	DiagnosticsHub.StandardCollector.Service.exe
2664	DiagnosticsHub.StandardCollector.Service.exe
2664	DiagnosticsHub.StandardCollector.Service.exe
2664	DiagnosticsHub.StandardCollector.Service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2396	16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
Token: SeAuditPrivilege	4576	fxssvc.exe
Token: SeRestorePrivilege	4736	TieringEngineService.exe
Token: SeManageVolumePrivilege	4736	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3456	AgentService.exe
Token: SeBackupPrivilege	232	vssvc.exe
Token: SeRestorePrivilege	232	vssvc.exe
Token: SeAuditPrivilege	232	vssvc.exe
Token: SeBackupPrivilege	4324	wbengine.exe
Token: SeRestorePrivilege	4324	wbengine.exe
Token: SeSecurityPrivilege	4324	wbengine.exe
Token: 33	1964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe
Token: SeDebugPrivilege	2664	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4992	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3556	1964	SearchIndexer.exe	110
PID 1964 wrote to memory of 3556	1964	SearchIndexer.exe	110
PID 1964 wrote to memory of 4572	1964	SearchIndexer.exe	111
PID 1964 wrote to memory of 4572	1964	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe
"C:\Users\Admin\AppData\Local\Temp\16c3f3c23eebcb96e29d4bea38bdde4b9d2ed345795a5dc567c0f843dbfaf765.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:208

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2696

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3228

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:388

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3832

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3996

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3408

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1916

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3720

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3556
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
381f80b706be109386fd2a17509e3bec

SHA1
40a77e8c4b3cab5a10640fc262135ec04286dd63

SHA256
f1e7ac643667cc319193d46338b50bbea70d9af4f5336397bafc3288255bf4db

SHA512
4a3e1a435e86fc1508e848d761c2146f5432a1ad3f697ceb83ddec6dfe12d37492ba3cf54f9b9a25f913a9ba6b168a813560411423931993803ff22542b92a75

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
797KB

MD5
5f4a7f56316bfba83b9c51f9b9887a01

SHA1
4955d79fc44aaf4b82ca5d113321ef11284bb4bf

SHA256
cff46a65658318905c8cc27fe771bfeca1a476fd39f823b8d58935b174185dbd

SHA512
f9ac13934a0b24771aaff17adb3841ae6c75850d2324b7b579b330a3960808963191d4d59f374d741b77f97442258015880f17429c894f3e8c2bc4b0f56a73bd

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
dae613418fc0f7a7fd0302135dcf4f9b

SHA1
800e7d4c87834e59256623e371b1ff019046d048

SHA256
e1f039d471e532186015b93db0ce2893fd98fbe52409d14e408a4a98ebe74ff5

SHA512
e3582b7da2e23d664f0fddc399b591f312c8e9ba3fd707f676ee21d417ab4ab0441868fe444468b7442417ca73c25ac954c751e15c7e7f2bbd5600918620f848

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
5ed05ef10a65a13a1d238af9670c4767

SHA1
2ffc96711114332b353c57ea32fe3c55c8f9cc39

SHA256
195d724e77ea951333fd13d27f4c609392009b41eb782de65edf9c43f80dac28

SHA512
9c8d70ec0a15e80c0f5b788d4d686828bd8c796f60520c6ef53d4d55f0f57048a6d7f4eaeef4423c7867d36968bc4c0635faba75afaac413cb808e23b897c3b5

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
925e541c1060400ea1905b0f72fc97c0

SHA1
b82b04992fe682fce30b217d17d14e9c3bfb4608

SHA256
95f1b8e2cfdb70026588ffd62fb4f5496dc3a652195a7882116b45a21d26f256

SHA512
912ee601d12469a247516e67620ebf20b19a6bb931f713fcc69204dc3ad56e4aefd43aa16e0da822dcdc93a9de42c35b4debd15912670ae2f322d77b99258a40

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
1b092a2c0b425b0c52a58183a1b9d64b

SHA1
04eb03d1531934efd4d07aed9208989af45f5e97

SHA256
bf8523c5bb9416ba17412efa8886f6e907c4cd9cbfade229f7bfd171ee639634

SHA512
0da616a7661ea29fbb74755979a7e94053970e1ad85b1a9791f14b206eb95fea7f0da3a03538439f16584018d2f30e49a45bf92998cf151be2bb0628b57da2c4

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
934520afd4ca0485d35579c80db46bd8

SHA1
3bb4fe667e86d127888dad3bbcc0b93b38650b76

SHA256
92502255fa1c0783a7819a27bf170a7993775b735fef5e297a7bbbe1c214128e

SHA512
31c2955ae83a2fd716bae3ee40c5970132666c9641764f969bfa2121d6e07aad923e7e4f365614b8063c8052680d903080e08cf5e3ef2fcb233060be0f76b30a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
9b04726035f609a3518d121c1430b3ae

SHA1
b530fcf469d3244c622ca7839425c4ad5f0fb2c3

SHA256
3ba439c17cec76b89240900e16e9a4daf6194d59ffdb4b6319d4d16fcc75463f

SHA512
a8c1792d44d17e97ec500458b8663b2ac01b5776a1d4f2c58ce7b5965827f468cc5ac48430d4d9d3bdcc9ff61a8a014a029f469ab817f4fde8adb8c1724d3edc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
8311c1cf33290a90e7ace7c09aedbcf5

SHA1
36087d1d6505eca6bfad4753077d284cf3bd71fd

SHA256
db19c9c6197c35fccaf33bb4801deb99b2fd33fee8210729ba593fc8cb2d1510

SHA512
b071c62f11edd29f4666d15962c786826eea9f534a81cf4c44f57fb46fe0372416e552ea271c827f927fb69e8f19d5358646a0ad867a15f8a6ceb0d4e5cb1a4f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
ecbef913a5ca069de0672124a437e569

SHA1
a38cbe1936dea0372ac437556c881eeebccc3ac7

SHA256
96fbba6f9110fb1d193a2e24d4b48425a4109e7a44a8837c9c59d5ee7f5b50f1

SHA512
ae87ffd9decd230aad78af513446ecf6ae50f83eb982162aa8c413c192f9ebfdc917db9ea50ee75add734f2e934f0015836097d04c863c14a29da0016bef654f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
81ddf49f15011350eda175752c05a1ef

SHA1
cbe18553ae3dc13de10df17f78628dc12b180e67

SHA256
dd9b5f8d5ec8a212e0fd31b9799526ed7f4d39c4c5c0a3857a4e788e66b92c43

SHA512
9048fe34e298dc95400850eaf906b60b291783c235ed3dcf1ca74fd1b3dd3e0e5d210133e09b1417a7520a7cbc9c0ba7c999eaf51eec63868e6fcb5f7bc9a6ce

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
125ab095c652c117f9e881c238d6f18d

SHA1
2e258bb827feeb29f2d0fc9bf2964da81c20c192

SHA256
16b2b31a46092a3d7e1c70b5991e4c45230e36bdb3fcf5e0b6ccec3516f056fd

SHA512
4ca4a1dd9bae8346fb7911c5b148833c349b0f3efbaa602f31ec6506def8c7c387f489981a341cbc12a01c9b5b8a8a1d3a2555377889a0f229bb186e8e677b7b

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
708dcd9268939407295add605c700ca2

SHA1
c4249b192c8002b0a20f847136a175ab618291a0

SHA256
4ba6b4d11af99b0d37a83255769923a9ab5b51290ff8a93e42cb8570b7fb9cca

SHA512
9e26399934df84214c6cf6485c94efaf8563e9fcb8c79572b920d1241ea1949cae6da6580c06326f979e3597eb640a28ad278f219fe4c6f94cdff9d0b51f9952

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
c28f09041b5fa3dca626b5b600910751

SHA1
79934e2f6da2bb477cf2ccaf8f5fb3f42364fc71

SHA256
41472f8a31f557faa54d160d120a3675a93e16782e881cd1b0d9a9c88e5f3a49

SHA512
1a60c800ccd11d1c95f3eede12525f2502842a4ce32bf730cc02154fb14a3c1c56ec8bffea1ee1901e52de46da575587c728874449e2b57f54f7203f0e4a6320

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

Filesize
5.4MB

MD5
319c83274243399813517a57efcec71f

SHA1
ce60aa8a73f347a558b24a94c5aa5928937d63e1

SHA256
6488f729056bc2fc877f1c6e9a471ff13dfc7458007758187be3dd48376e65a1

SHA512
cd3aa87d5ffedc54668cb4652ad0741bf5cc2babf0b670f8de1401f5276ce78c4720863fd1acc6bd166706b18cd5f7b053d1e6930a5d3fb87efd5283e528bf19

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

Filesize
5.4MB

MD5
8957645e97ec089c83bf8f673d1b54fc

SHA1
ae0aed4ee0f00296d1b8d82203905461523091b5

SHA256
64879ff0f4274708178e8b4eec06aab6f4baa352c98a4b9d6b631f948cb2a70d

SHA512
fb5e1eee0a1fdcee36ddb3aa55e35cd71bee56a37ca0d657ad3d0698b0f61e42e80dd41dbb89c40dd70df0728ed5da4d9ca1b2566d5a73730fd4e39d7a80e0c6

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

Filesize
2.0MB

MD5
d8d294eae479bd35a22bea5f5d011a5e

SHA1
ecb36a01aa536645b30d724ee7afc1d61d04698c

SHA256
374d29c8f35ddfa514c95ff79da5978e0d1e3b6a68997d03c270d5e643003223

SHA512
b07460fa86b3a5b91b94357452721bd47750c228f98886cd953adb12b776a862b10df29dce9b2b6b2b7e4566c0afeaabc4894c3da2dd3b393899a9f516041718

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

Filesize
2.2MB

MD5
08fefab72409093bbee3527b6d7b87ef

SHA1
d1ea4a1c8861d79c8fc122eec6993c576bf34bcb

SHA256
140a5398ba3d020113c34ef6b232461156cc9c28ceefaac29abc6be94f0de50c

SHA512
ad0f0e4062e256871bac4ade153b06f00f6558df0cd959fd4c8c41357542c0a43e14bbdfe48ebe6a8a5d14effa0fee872510a30960bee47fbb46ccf9eb33b466

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

Filesize
1.8MB

MD5
b5e2fa8b073b06d8af8686f92f95f722

SHA1
42b9b4ba3761ae22bf6b9fc7048964e9d2fd9063

SHA256
309e767ef37c2fdb2a349d41cc89cc1bb96bb3c54dd8d7a5ced0a49fafbd03ac

SHA512
9de10a88edee9fb9483e4c17dce1df23c23749bfc9f8822d5c98d6bd555b6a958ebaf5041bbc8f8416250bfb0e4d3bf354c5cb8ee597a393019b3404780aab14

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.7MB

MD5
7138262826c2fdd999c84843bc8a2325

SHA1
9c35eeb2697d12d474a4c895e68664009478f20c

SHA256
02fb9e80126fb9b53fd5c4fd9c84b835e87f2510a7307dd7d103863e54d39e45

SHA512
80c8be1f48352c013fecf0a172d5811d82775e70b0bd661f7671da4a6efaeeae9a49b710c1f83319801ef1a832cefc3bd2be63a19a7db16cf76bc59c50398a63

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
02637c43dc72510dbaf22d6f9d777883

SHA1
6c331801b012ca9c2bc8217e9e679c95f8c55f64

SHA256
eda367dc6f35e5a0452aaffb32b5bb61c34fe824a742d6555594f5b404e55c02

SHA512
fb3b7ba627e7b9ca84939f75c30660dd65bc52259564e5c434aa6be8436b7a6f73ac7926569a2573a066aa94535f7959dc25d98ebad5951269af63f54041dd9f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
1df72cde47e4f984af4f1c11534aadbc

SHA1
fee47e8c1ccee5bb74e8d98e875655cf0c4e6e21

SHA256
4959fb1277703db40fae974c33980391884d09df33703dbe18e44fe27171199d

SHA512
dbbc8e18aabfff2cd3591101c393b63cc3557fa3de27990318b61af1e9b2171c0b0f6b8aff1827be771a72c0d298a2619f0132cabe5d2b2e7537a539b34aac3c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
2fe5b2ced773ecb31a88db4239ea4df5

SHA1
e51d6867927b12d3ca31313fc72fac28d911c69d

SHA256
fde45fe54f5df2a41135eab00a670d7f59c3549a668f5d1687f774a8872c2f5d

SHA512
dca8f3997d878b045d3768415b146964495abb5388444de0a4b4b41da2328e3009a653cd5377d3046bcff337a62086368c63a0c9598560bf238f516c7eb252f7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
1224183c766590494d6e1f50d7560f59

SHA1
762fae81d729450eea7013909d8251f12c7b9c50

SHA256
53a68f0cdceec146525e2c69b72496e90f01a0c84d2c02f247cc1629ac6f9a55

SHA512
41a2e0349fa64664257eb3af3112c0d15adc64f8f907cdb8a9b1ae6de48fdfa07be78936c54bf598049dbfdec9388aa48b15743544d9a1d4f6939ab8ce4e4362

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
0e6720209d99fa9866e341dc49588fcf

SHA1
cc29d32c43b65a8943e94489aa54329570d9ab8e

SHA256
0aceb595fc3c9588a1ee70a311119ff4b26e3922365b10d75cc69fc51322f018

SHA512
fe28acd4052effcaf564db5fb24bfd6608d0c78884fe709068f9be58552346025b8c1375ad83d6a7d2e88056c9556302415ee7e9cd13db6126ad6e163f32621b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
228f5853879078875254341ecdbc4668

SHA1
3490ec3a2fd38c478e3b546b5bfb557206cb1ee9

SHA256
d8c594e8b5123ca5a5deef9c627bcf77abd6527204820ee18ccf2c439892680f

SHA512
9d4fba24af0b7767c8639709ee8d9b6602c726dadde4fefe8a1afe439abe0fd1392be6669650493e7f04d7d3ab2c5af47cec8af4e9b1ef14522a30ad96ecb1e6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
581KB

MD5
f546b84da486a0f1b55959a1968bb13c

SHA1
2c3af53ed52940a0c3215d4ed440603f25421108

SHA256
24f2852676b0b6bd3dd5b611daa781cf60f02e813d2887de055fe6d5ee4aa968

SHA512
acc81242b79a335562655b6117a90e01c9ee0533400e2674adedf7b4e4817358549c4a9e319e8a213f63fbc71467dbfbf16a608acb4cb1db96235273e743868f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
841KB

MD5
19d27431896e336b30e81a0f7530db87

SHA1
4a4424b79704c60597409f22f34a5d5dad5deb85

SHA256
f0cb795ba4e7031a375be70e458432f976839f9daac8ee5114e0cefb6cf55a54

SHA512
f67632ab125a8d9e84103fae059033f21d2c3692aa7f16fc51dc829aaad99918cbff280ba0fcddd885eff40b5f51f1c16886baf71dca530fce972d0e76e17ef1

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
581KB

MD5
a20f2c5a01e87a58d6d8823dd1ccff94

SHA1
5f5a75d0864a274effe88c37450fd430be755dab

SHA256
af54a91be225a14afa86a894ce959f7007f8a53665d4607a78f91592ac259e20

SHA512
a1c29e616a021b51ef531686d9ba9c464257990f8e2157c47ec6058970a1706cfa8ea6765e9286f1feaad59611653948519b056f2b758520c142da825a76defb

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
581KB

MD5
33581d2ab50ca1150ac3eb6bf545b448

SHA1
22a39245c4deb55939c2268cf6fe63d34d1f67e8

SHA256
1e542863ecd3246b40ad4b67b51051fc4102fea1a0ebf76bf0de0c56868e8dcc

SHA512
895b5b7488e3ae8bc069ffbc532a8419ccc948992a491d83958f1b411e2ce8ed13ba51ea1f17623b27f7b2a262ac712bf753befedf787ee8a98e686a29d9a6ad

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

Filesize
717KB

MD5
a3f24a0ab9fff0f9c7a26e3676edbfeb

SHA1
f99b60c6a3d28e85a1dae78feb0c0281bf6a8ac4

SHA256
88b1748cbfc3fd6b3bb89ab5712073b6c2ab63d02774b9c1322a61b9ccf928b8

SHA512
69a83790db21d62006c500910ec72ee4c3c1323ba1e7d9c845f998d2e8f870cf8ea94073ff49ada5ddfdab807fccf33d5ef4ef1d3576f61ea0cecc6e19fea6d6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe

Filesize
581KB

MD5
1b02fcac3d9e4f7fa9cb1cee4e01159b

SHA1
54ccbca422dc7ef1860d1ecf5b0db48e68eafa03

SHA256
b8ad2814974b06a664418ec859167abd269675d4eee5e6780435d20a7a8a4bfe

SHA512
30bc216a75fc736da8470b773202cde6a623f4b0661fc227f2e05eecee293d0a81f7cd13cbdfc45a1eef250c3c07ec5f00278aff16c5e3361da62d7bcbc2ff05

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe

Filesize
581KB

MD5
7c10ebf70693e42f612e1b56fc80683e

SHA1
3f514dd57a2e4bd5a9e178e53043a8048667f390

SHA256
a81e4c05ab43caa72f417b0c063c90f4026ab2e46eda8ff354d93ba6b284baf0

SHA512
3e50e367e7a335bd2ce7ac69100e87cd842eb7c3b6503f841c3cc8f77d1297120832e410f8cdde96bf70c8605b16db2380449005159b3dbabfbf0b6d5fa69fae

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

Filesize
717KB

MD5
3bff6ca4637fc9c50f3abc48404ea15b

SHA1
f54aa42352d5d3b988ad37b3e53e7a34a336fbd4

SHA256
e30684457c92d6db7f968385dfe1eec9999559b22f3c747a3b20b99e1d192605

SHA512
6fd7d0cca616852095d9ff924cdc186ac4635eb66be9ea821748188534f1445cef515ca71ef804c00b36af2df930ad1b91bdcacb5b7a55c10f613dd1f444a3a9

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe

Filesize
841KB

MD5
7c2c1b46fee327d58efac8d514a2afca

SHA1
aed7ce308bf3a8acf8de932b43c5ef56b86cade1

SHA256
03e92477fd27aa34926ad66c52d2206f53aca9f8c0b32d71d4137050dffbf28a

SHA512
ec8162e86cc742190baf5b56d6ad41768f99f1375e3b9b5ec81a173b10ec7fc129659b42e446d7bbe2a0a05cd872a093728cdee22f9a6f4dac16e1d4c10541f8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe

Filesize
1020KB

MD5
c0d97fec1f1a4518402907e99078d6f7

SHA1
2d0a26aac6f74a24a5fd43f4d3845b94a4d4366b

SHA256
3edc1c41f817bbbfc4c08143660f4d36937af6c2a5a97b41f6c9761745911192

SHA512
e4199fbd2076962fd7b7bcf568ccc4616b5defba83939ed85673a16d03fd47b309b5808824e4c5395b383702e11800d5d06898a43928af245a0a75e9ce454c8c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe

Filesize
581KB

MD5
903a0c19ce971593f596b294a6bccfd0

SHA1
05f63c20a27f8fbfe6ace3c0f584796fdb5873d8

SHA256
0e391665e77c00243cd47c2c8b78d5e587bdbe2977160d30db4c52aa6e9b2935

SHA512
76349e2e49f814271f910a238b651bda0d99662b12bc98c0bb47c512d9d39f9ff5e5e30831eaca77ac85bde39dc03a710494b448d1df9f304e84f35fa5daad38

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
fb6638803b071c2d2424ff8ff1dad105

SHA1
8b1110cb6b53206ab3f60b365aae620baf8df364

SHA256
ac0c9d3be6df79b53b45f8898c8e618964ede4fb33099ab99f8cc0be84afe01a

SHA512
61e6c882cb85d6152de3c4e2f50f1b8c5cbea23080d9ec16430d744deb6628f9ab552c79e4d0826142b2a620645fe1f1a4171385a9f82d5ccee6ae24600775dc

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
f9694f7f318e7f429a0652edd52d1942

SHA1
c26cd3678a2a1d69a98ba1acad16a37d2196ef09

SHA256
c1b0c14bfff2e7e9a5e1a85b0d28aad30906f2ea837c0cf1e5bdacabc78dc591

SHA512
09ed1dc730758ebf48faed26ce386310215a7a9af7768248b273f9decb89a35c058e55071e5c8643ad3569cbd62392564792d7312bc1bf3f4e4b45dc2940844e

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
b11259f762319adfbf6aa7a9200bd6a4

SHA1
e195bdb85a24c5dffb770f0034e17457b5be6dff

SHA256
0cd431ec9a6237bdc11bf5fcfd25fc088a30063c82bda34e5bac51311cf06b4d

SHA512
27dbdd45531bdd31ea4441b3784a02f1bb5d95a658d3e38e59c6122bf6bc5d2c79c633a4ea4facdaf2a97fc7e127aa39699dbe4acb1a01ff190b032f391c1470

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
93293b7b1e1863617ff17e33330d0a28

SHA1
4d3d4b542aacd3b189488c626b9a4cfb133c5927

SHA256
973f355a627c36584d19743938ecd124346411d85f9fd46f65db32c623aac831

SHA512
6e62481eb761ea16eff014359a15764b7b844938a1252c9897f851f25ee3be695ed1fff2e83b4bf089b0062a44f3ca97023cbade68e72a3846e18817bc76a214

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
b24e4ee307f20fa33127e87b56feab19

SHA1
9f208bcc83f806ecbc2c23215ba87dabc2c7d12f

SHA256
51a4f0e2e72083c5d81dfe74b304552211425c72189ca1d312aae13187be6b21

SHA512
77665a9805b1a86b11f3ef50c67c3631f7963c3e4ed9dc26746d2f9a320eb62592c9102ba3ebda1d0a09670df3c0ab02e7228a3411395df42eac96056c29e077

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
a496a91934745a8554695ed03e26b8fb

SHA1
fa3bedfd2eeb2b06c4b16d7a885c4670816746eb

SHA256
7079e3329b2d231e19c0417fba1e6850c20fef4992e5ca1d6a4ac0f39791b712

SHA512
ad0dd1a07bb285ff18617af367181720bf98e0a86dce0e51664852e142d76521f29dec951c852ce08303735a4d42564fe7a2d886b319da1175c8c10b5912a48d

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
10dea12de1308f96faf144233575fd78

SHA1
8541df65824108250cf5ffdfb3d766c7f417a280

SHA256
da667a1c6f23455ff7f5d3bb762f4d6004638b2173bc2bf449f7b8f778d4ebcd

SHA512
f1928bfd3f7269f4fba86dd181e7f33b9ee658de8db00b9582e13d914a82f4e177b7fa7a72414d5c12b05755f733c78b816206e00b0e4bae3709a97967077a94

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
17f51fa9c55e13143e5ebfbc9aa77230

SHA1
c897f68d8e7468596c1ed4bfd6829f5ab161b7b4

SHA256
c5d7d7acb02d09cb293de37a47225ed54d071bcf8d89cbb9e4f8c69178059910

SHA512
63dfdfe7d17967f914d4177b8c0b1c146639204a61d1b14338ea58bede2c4f8ba8f4545a2897c60c33ecf6b33e689207a5e8274b636df2404a0c459a87005cc5

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
6ac1881d309259a15c9ae88d5c3c303d

SHA1
7cd2b61cb4fcab4ebb212b1f34328e594f69e382

SHA256
4a7fff065ae9c9ce2ff31b72d452cadf8dcbd500a7094c81c162610a673cf45d

SHA512
5ffd251c0d0102d2cfb7e3bcbd87615bc1dda1b93e392d8dcfb07a15d719f0c65b4563628c6fe5fa02146070e1873be4e8e7ee347d1a7c86a10418ef587cf8a7

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
c8816bfb3ec536fc3918304392239850

SHA1
2c3622dba99d6d435124dbb41842104d16313123

SHA256
69533bb5982c757fd18cb010db73e6ee1df8801fcb988bba6e2cf45f5550877e

SHA512
1f7f93c1ad42e30141161b9fbdc39627d3eef5f9fa91206c3c3a627f3483c7c508c066139ce209fc8e6206211f2b27f969d76f08538c595f05aa2681995b2134

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
fd67ff6f5889a4a0ed7af1151941bf85

SHA1
9e351f4cb7291c58b4dc0d661b9ef8c228660055

SHA256
1a2cea4206429ab479c1fa3280be3ddabc691c92be5c11ccb33a8c28c22cebc0

SHA512
b96eb36b731df5ccfde25b74491e6a6fac2c5563957d73e430493e9aa81ecdbf4caa415ed5544fe2d3bb7cd52a6a29ad9030130abd37af3265d798ed5bae8a53

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
8a6936d9b9a4633ed7eb336940ec9909

SHA1
f0a78a40603f68907665bb1d9288c2d48b33f835

SHA256
4c1e27d6ae920c46527e185dad9e1b992e9857d87dbb5dccd46b515e0d26e5ed

SHA512
6348a22750ed73aedb4e6fce1570d6191bd6593f49b39737bfddbf706cdd005ac2c69b65af751001280858179eb7d99d9de0aaef4a854ccfea8b10075a88d6a2

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
e3b57d4f547675230cc96be166410532

SHA1
896d3212ba9f19ff589ba25867a45e98e9343468

SHA256
a78df20710d4f9d9b03d14ed65057363f462e861880cbd0428da4529bbb3b628

SHA512
ea090c989eb1d466dd883cddfb7ea5a57230db7db6681416b181de4c4e70eac767441dd70473701be9fa9900b3039be32278e5d7228d28777663365c35921cd6

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
ddab879ff417a1b9bbeadb1436d05053

SHA1
b425bcd51868827b355c9c6e845ae472b088ba74

SHA256
094371bffe695bd5a66ad231d6174d19251bf45f36ad293be1297c38b9507e73

SHA512
01587ac447036c383823f976cdcae00684e68d0adc01b265d224df8ad02bd3bc975f5c33893a9086ecdb434e131d39ca3541f89ebf682046c36785b126be886c

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
d300168df06b0bba95612fc9cef84271

SHA1
08a68027de1f4e20c17c44878026b460d84c94c6

SHA256
0b7293820712be1a33dc1cd08bb73d5ab868d513b1ae30ac1d1120b6a21a0dea

SHA512
9df3b0c4cdb74dfa0e00a2a6f9d1cb5b7e0c30d21120361adc6a613e316890c8a9dba9dbd072b69829d8600563fb04078bf0b68cdee934cc61ff1c31f1e64fc9

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
5db93e9b706ab343236a2409aa8d4e8a

SHA1
5d163624eb7c6a73960414c6eeebf06bee5287b0

SHA256
8b8c3b30534d3ab336d6a3939e15ff14d785b0027bac0a594331cc91570f9c12

SHA512
d95b27c0689b6243d9d23aeb688143109b68f4ede5da55b6c9e3d90648294421924c87a48071d3c6a709e4eccfa7da5456eebf22cd410158f90ebda534c05dac

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
0f9031bd4d710cef4dd2cebc1a3dc276

SHA1
acab6b21258e4eb451f2fd916cda8cd0b473cb36

SHA256
005d939d0e3d4335d440d3057742ea785539eac68a6ed557bae87421c329be17

SHA512
a72827551d653cf34d8d1a97d2a50775b64d50f89c08aba1d1526ff17050891008e153f8e6f577150e76ce9bf2d04b53bc617adc6a6f6f38c880778fb4034db0

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
396ff5d3269976452268509ba43ff158

SHA1
06ff79559241e415273299b1b7d7ab808cbfd586

SHA256
ae6b135ab8c3b079b9f384081e1fee0be5f237a3432e3db8518f3646f9f2f298

SHA512
58a9896da1192fe68fb97d387dd2cdca4c695fef58d572e7258c40cf69a9c962d8de5ca4ad5a0b9e618a4ef2aa8cc7138bb1352458fa61a8feb5f8f993195db2

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
a528999ced2de66d44ebe9beb5a8b733

SHA1
4380ff44a5d7372005d2b4e1994fde31a3a1d90d

SHA256
c1034ebfe89c640f04ea27e2acec9ab24360502d967e0a901a6e1a68b6739f22

SHA512
20c1d8c286a5ce2590c78759108245d331501b13a7e2d0994bfaab83780f2335518cadd85ccb2f25fd46bdeec2486fc0f845c8df8da0944f4275f08869a2e4c7

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
f676bffec330dff6938a5395ae8b2133

SHA1
ab0861bcdd521b459da54cd9bdaf50bca67c639a

SHA256
826c91b2ff6e19618660303a4a9170ceee02fa8a8b9a4b65a028fc08de21e7c3

SHA512
911bae579693248eed678e0a2a3ea37611171970bc2d791cf0d6d53cfe74273e33251824bee74989bea8a80430a15696f04cd3f56ed2e42fd603b6c1f8fc593e

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
34f9565db82b042d03f5723daf9c2e78

SHA1
ea35ba76c939fce32d037f39027579f1ce7a928c

SHA256
147432bc4ccdff7ec48878575f4b87b09737372cc511a75cb945bbd5fbaefc93

SHA512
5d6d6d8c923fc0aeb924a987dee4b4feb906cece64bf109e4bfede3794b04dc60aa68de3a69a0a5add0e58505d1953fa1d4017d7ccf71dead63c946145e0ef80

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
5a92a16999d6ced5da2fa792e74e70b7

SHA1
ccc7ebc8b48908d294c244d8f00262425408a19f

SHA256
1b1587cf385e7592061bb6052c3defbc4f57107c052595c8a8bb41dffeebca11

SHA512
75a74337dc2c2badba72b993f532726251c6d82a698660a545180c239ae16670bea58acd0874c773a1ac7ddd0eedf675f8c892f6a7855a9e089c7bff4852a24e

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
635KB

MD5
a3c32c3c3d0cfdaf9b3948487d82efe1

SHA1
ffd15e558bcc44529303ce7faceeb6e60947e250

SHA256
2fd55ad7c8a90d3815a547deabe984231e6d06f5a7f4d247c818cb70b622fbf9

SHA512
bca50a86727f98565ac2a4a7e08c29097285d4a3c9f2afa6655759e3ddba9a4487547ccbf8ca68c4a39101af981f011652bfc1305180c3865c5ae607506bb0ab

Download Submit
memory/208-111-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/208-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/232-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/232-466-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/388-105-0x0000000000810000-0x0000000000877000-memory.dmp

Filesize
412KB

Download
memory/388-100-0x0000000000810000-0x0000000000877000-memory.dmp

Filesize
412KB

Download
memory/388-108-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/388-162-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/1072-62-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/1072-66-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/1072-57-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/1072-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1072-68-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/1396-158-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/1396-90-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/1396-96-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/1396-89-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/1964-469-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1964-171-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2396-0-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2396-88-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2396-335-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2396-8-0x00000000009D0000-0x0000000000A37000-memory.dmp

Filesize
412KB

Download
memory/2396-1-0x00000000009D0000-0x0000000000A37000-memory.dmp

Filesize
412KB

Download
memory/2664-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/2664-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/2664-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/2800-78-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/2800-84-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/2800-74-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2800-155-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/3228-50-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3228-44-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/3228-142-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3228-52-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/3408-130-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3408-458-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3456-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3456-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3720-468-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3720-167-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3832-457-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3832-166-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3832-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3996-119-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/3996-325-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/4040-112-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4312-143-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/4312-461-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/4324-163-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4324-467-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4396-156-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4396-463-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4576-41-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4576-29-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/4736-462-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4736-146-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4884-149-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/4884-70-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/4992-32-0x0000000000740000-0x00000000007A0000-memory.dmp

Filesize
384KB

Download
memory/4992-39-0x0000000000740000-0x00000000007A0000-memory.dmp

Filesize
384KB

Download
memory/4992-34-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/4992-129-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download