296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742

Analysis

max time kernel
134s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742.exe
Size

1.3MB
MD5

904324ff55cd4b50c91b645c63850838
SHA1

5e4f97642470b693c71f6bd39e4cdef4cbbc3fd2
SHA256

296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742
SHA512

f0c9b03a31d7603ec154819d956700ea2bb0527f5400e6ff3f36f30a9f8a2c6e7b4fc0ab2e366a08e50c7c3d13455bdb3a8cf238b8f3407a8303bc2f5b65ea96
SSDEEP

12288:NW9B+VxSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:NW9BTbl0fitGbna8FLk2m1X2D4brr

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

Processes:

alg.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEDiagnosticsHub.StandardCollector.Service.exefxssvc.exemsdtc.exePerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exe

pid	process
1572	alg.exe
3564	elevation_service.exe
4028	elevation_service.exe
620	maintenanceservice.exe
4052	OSE.EXE
4796	DiagnosticsHub.StandardCollector.Service.exe
2680	fxssvc.exe
4924	msdtc.exe
4592	PerceptionSimulationService.exe
368	perfhost.exe
928	locator.exe
4664	SensorDataService.exe
1436	snmptrap.exe
4524	spectrum.exe
4292	ssh-agent.exe
2160	TieringEngineService.exe
1124	AgentService.exe
4488	vds.exe
4552	vssvc.exe
2948	wbengine.exe
672	WmiApSrv.exe
960	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

Processes:

elevation_service.exe296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742.exemsdtc.exealg.exe

description	ioc	process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c22ce549b3e2edcd.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

Processes:

alg.exeelevation_service.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

Processes:

elevation_service.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SensorDataService.exespectrum.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TieringEngineService.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

fxssvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

664
664

pid	process
664
664

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742.exealg.exeelevation_service.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	4768	296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742.exe
Token: SeDebugPrivilege	1572	alg.exe
Token: SeDebugPrivilege	1572	alg.exe
Token: SeDebugPrivilege	1572	alg.exe
Token: SeTakeOwnershipPrivilege	3564	elevation_service.exe
Token: SeAuditPrivilege	2680	fxssvc.exe
Token: SeRestorePrivilege	2160	TieringEngineService.exe
Token: SeManageVolumePrivilege	2160	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1124	AgentService.exe
Token: SeBackupPrivilege	4552	vssvc.exe
Token: SeRestorePrivilege	4552	vssvc.exe
Token: SeAuditPrivilege	4552	vssvc.exe
Token: SeBackupPrivilege	2948	wbengine.exe
Token: SeRestorePrivilege	2948	wbengine.exe
Token: SeSecurityPrivilege	2948	wbengine.exe
Token: 33	960	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	960	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

SearchIndexer.exe

description	pid	process	target process
PID 960 wrote to memory of 1548	960	SearchIndexer.exe	SearchProtocolHost.exe
PID 960 wrote to memory of 1548	960	SearchIndexer.exe	SearchProtocolHost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742.exe
"C:\Users\Admin\AppData\Local\Temp\296707ff4662b8a5913cae8aa9db9233fe3126ba4707caaa9da150edff584742.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:620

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3832

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:964

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:368

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4664

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4964

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:672

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
PID:1548

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
2⤵
PID:2392

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
Filesize
2.2MB

MD5
949efb592f79ef18d6472fe35b2c2f1f

SHA1
16a1843206a9aae855d3d2f8b6d9369fb09f22e9

SHA256
c62e0c125922f71699e40c518e2fe05926930de102a0e9fcc7d1441351915f04

SHA512
17236e494162b6162810cf3b6dd640d761cca2e394491a584f79f42c6ee8a8239afa3bf420689997ff7ea17efb326f2c101333cb149b2ec2e2b5c50e9c28f507

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Filesize
1.4MB

MD5
b8a2eb195c063043f4fb79e1ced05af3

SHA1
65a5eb8d31fce660d87df6d21294214d0b5d870d

SHA256
ba5fa615ab33225b6293db7ac1de6d0931d5a65cb1692ccabddb5220a11db9c9

SHA512
3052618696a3e3b107e8d550a8ec524521fa3da1428d788c56ef99dcf468eeb5beb845438fb681977b9c987cbb418fae801f90c816388a2097b12307322cfb50

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
1.7MB

MD5
725598c5d67f1bcd9d0713f7a5233ec7

SHA1
33115c0429e90a6a64ab95868baad4aa028a1ecd

SHA256
b9d66b5e0c6b7e94663ee80f656b91e1e165cf0dc83ae4546bba59c35a396dc0

SHA512
833244357b825490e264cf18631eb447d8709e8d79e9b39e2dc291c83fa5d33af11ea0c8ed2cc3493ec29a60096d3410ebc71b425a9df511d504fcf106f5d120

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
1.5MB

MD5
18c5a9022702af5f8a67badf5beb2b0b

SHA1
e8b7fea4d8b065dfee96204915755c627b304371

SHA256
6b01ff1c8cfe65b49c2cdc1350acfde49a05ee2a851bfa3ea1b24c1020196a46

SHA512
26dfd795e6cfc1062774a6aaa6ecaa9e5522ee8f7e85f49fc3b082b37269f2080e1597909a8d6c6d8844a73e446d55afe0fecd001740bd1078199a12cc86fe60

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
1.2MB

MD5
d184d93068bc6238d7da0f16f093692e

SHA1
e89bff7b55e514c8f0fafe5ffcc86087a814e081

SHA256
32b30a2958c25438fc3129e6c832e0149cb3e2dc5e072bc2a68d8baf23302a5f

SHA512
f546a4250e6c96151064bf9d8b5c7e57b7166d7b8b47720bb869f6eaa2cd9ec959a44576253f3367f77079331e98d7abdbc26398079aa0dba30cad165831e41d

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
1.2MB

MD5
8674ef8d97907a8db97a118f5feb2da9

SHA1
442ba0b2543dc7be237fac6bd82865d5aca363d2

SHA256
a9141b24aacc8b28d0e9c3c92eaae132d67d744b9c3374707164ae64cc6f3ceb

SHA512
13b5ad9eba8da1ab00e3037b2b4dd631c440e90b8fd864b2bb50f653c2d78e736a973d9aad0d075dac9aaa44cdca6d5f7fb48a52c74a9b0255180fd2d62836e0

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Filesize
1.5MB

MD5
f70d246b6cd7d15cc0c90c0646bde303

SHA1
13e6e96ec6ab88989c82fb11519cd803fd8c942f

SHA256
6ac5da41dbe1c3e27ff3c5e05e564ebf7b3c35135a6b98f5a7feb30d6cfedb32

SHA512
14785f9daf7d9940492d4079b9c7ac9d898e7ba3f213e0a805fbd624ee3f6e92afad451fab307e496fc11cf7f536e30a4a9f5aa201e09bfc2a3796879063840e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Filesize
4.6MB

MD5
c1d7989f3e6b9e25cc8f673f8fd05f61

SHA1
3278bd52bd83b00385a720339bcabb897fdb9f0f

SHA256
57df6b9ce6765740ad1d437b278aea29cf6ddfdb6b5c44cf3bb461dc914ea9a1

SHA512
ce85643dbea552205a733f692ffacddd15f5ed6d4d5d34b599f20210a0b601f344df20452e4a503c7067f002c896a6caa5f902758f37c3b8bc9d090c5c94d879

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Filesize
1.5MB

MD5
53594547a8c875008ce5202da0db8059

SHA1
3fbf43b60969b4feb3429534bed80ced9af0d322

SHA256
46183bbb3b9236f689fb0ea7f62d3b05cdc643b35359c024c9c25b8b78c4f4d2

SHA512
d0e68948b8f837fac9e8cdc79bbb079f1ed9cd189d7301c3608320b05247e707de102913111469f416e1fdc76343bb66778a4178eeed5d623b5c0f7c5a981616

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Filesize
24.0MB

MD5
999e307d10ac567ee712c34acfb0d4c4

SHA1
614d142ee0cc6373e9ec0b0fcd4b2ff63b0a99b0

SHA256
7ae8aade9ec522a74703cb51fa8ade4bc71545f1a750a8d3f3d7996a15daee7a

SHA512
c139c3e443245a92eaa9123a9a9fd3c6cd61b788434bf7ec45af943beeb8ec6866ab3662c593285149ebc55c95c15583b2d8fcd28d95a0598e4e2c1a3b3f8b11

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Filesize
2.7MB

MD5
e4c9e3d2eac9fb2986695c64a05247d1

SHA1
f0664f41313bebb5c4cfeb5bf33953c121c196fa

SHA256
87b404b59e596d69cca82441c4bd8a7b6652a262e18f4aef5f79b4b69a6e11ce

SHA512
6acbe4ab74303e2d6f15b4a6a8512087cc51f9d4cac81f7fc22cf4c48dad96b5ceba56dcaa1f7d6a7be321ab6c537e57e353f3c65df83ee15c2513051fb21c75

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Filesize
1.1MB

MD5
0c70456f9e256aa9eac49157bd52c289

SHA1
6258d0ec6c4063b5d537ad7e1fecdfc31530883c

SHA256
227c2b57b2eda76a63b962994f1e27d87f24cbc97d4b2e66b6d6852268881171

SHA512
69a405ccf79d4dc436672d7deaf4d4a7d7b4fedc5acddfce7df4eb7026b24a7418c283e242675118f270499dfe45a1bb8fb9fe6d61cd93a921492e51992e84f6

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Filesize
1.4MB

MD5
acc6a7c379910d6d3c214fc4b986826a

SHA1
be1ad90aa65bfff253e3b57c679a280b01c6a5af

SHA256
4db491bc02277ea4235e1e1943cff986529033570be6a2db5e03ac5e7a700d99

SHA512
4f33f4f0821ff3c29eac4b5a230d19bd49aefcacb7efb80f771da0e950f87aebb9205dd49e191f2125df3aeaa8d8ee3e54f83d266a4074931f62e49ac9056f4f

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Filesize
1.3MB

MD5
7bd053d753e7f50a89ba4bf927a3d796

SHA1
ef15214867673bc8e5160bde6de96ad028f13226

SHA256
dad8b55a20460f22b912696e3aa9d1f7fc3d98dde958a7a936ddb9a9e64a7d0f

SHA512
f5fc61d246324797bfb4c8db597ef152c749e5b5b8c01da2d589dd7306feb931923bfed7272d6d408b6eb85681e98cfccdd28cb76e51829fb134a9040365378a

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
Filesize
4.8MB

MD5
92c8987028422e52585001f81341258f

SHA1
3a4356f4ce90f329d1bae3b456be4e4a308744b6

SHA256
3c4c93f7afe71e5630f9c7935939aa38c9c36eb4aa626bfe5d95db88f34543a5

SHA512
bb840d41e715d263a17641473127b76270d105f42b7c100994961ad9cc7d51cd80fba44a7396d84571e8dfb42d3bc34aff3dd4424ac5ff3a07fcc617005d4c9e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
Filesize
4.8MB

MD5
09028b4e9c0a984bdaf5bbf62b044f2c

SHA1
3e90df5849801a5bf0e4a9151e977e3195149465

SHA256
a4290f3c5c4168523b5594ae979262669e9fd862a81e7c95318976b44d386f3c

SHA512
68f3b3f32576371fba2891f0e791b9b2d4c7b0f3425bb3caa68fd691473844e8511f9f9c125b6a62337b058ee1a8b009ad30b0add451b7ab9887ff37320b41d3

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
Filesize
2.2MB

MD5
f8566b6d13e74637f3b27ca4c0291d23

SHA1
2110e73f3072ed1914708da0358688880ab9694a

SHA256
29da853a31729f57a20cae0ee6a955642920264cebda005c1cf999d2012f87df

SHA512
ca6f5615b1d330c1d4398fdd93bba1534266f6777fffb7c2bd379636fdff74808c1531353a0af951f65e2d6fbfd326bd79cefdf678cb3fd3a5a0d29a3e2cc0da

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Filesize
2.1MB

MD5
da38713371eee6f1a6e17a3567253f0d

SHA1
2a4cc6769e6cf412a5a5b580cb2ce41ce6ad4bf5

SHA256
10967775fb8e05027ce938204fc3462d08f486256fcc0dafd315004c1ab34ae1

SHA512
7846ff5f9977ce470fc5606ba991ff3ad2da475dfb30629d4b56c1dec6cb5d2c354d2ac20e1474504fa2f4d2dd0e3d43e51a255c040b259dd2945dd492bc09f7

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
Filesize
1.8MB

MD5
00a238e329eb797d4100fe0c89b52f0b

SHA1
662b2f5c9de021de8c9647d8e69bfdbf99513263

SHA256
040ea72e80cef600ab944a31a56825f70c9e7dd37b89051d7536a20bb267ad30

SHA512
8161350c3ccd438b2084261ef800a56b657706039df942192a4dd5300e4c7fd863ac4ae1f0265545d66d5c3ab62c92a69229711c13498f26944477cc8e08cca5

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Filesize
1.5MB

MD5
7ec9cd32cf1234b92988a94e73cfd571

SHA1
a27a656fa3940d34a1cb92049044a2c255038982

SHA256
231f60c6dc75f2a47186df0c02bd433286f5dd83918bd9bc9d5be1dd4478ac7e

SHA512
ab0bb1ebefc126ca5e1761bad6b8a7d3b87f000178090d6306ebae905cf3e39413d9d5a1dfff98e29d117e3c43efa9db8948f4886f29c61643e670dd3973ec65

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Filesize
1.2MB

MD5
904e92023e64ead42c5846db9042c548

SHA1
c27b345108e21961d077c942a96e69fd6fe452e9

SHA256
9f041b089c31b16dca290b4cb21201caf917f58103c8b04ba00b9b07736df527

SHA512
01e44558108e14dfe3f948e494826fe65eb50c9930432dd9b38cfd46372fc03e578e6d7aa16472164db7561afb3d298053077b5e5faca0c6395fdc57fbbacfa8

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Filesize
1.2MB

MD5
b1737013c692722b692eebd30403acbb

SHA1
ce71ef6fe76d2f3dc788f287b45348290f5ebc5b

SHA256
cca26d57c9ad0b185f72b416007fd01eb6651c5a65549b8b2ff21227b27e3dc1

SHA512
e6673fa377cafe722c49f0b08f9cfb812abb17c747a092bcd7aa193898107e2862263bdb379bdaca34e3f0ecc9a3f786262b92ddf7f55459490eee9d5d833c82

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Filesize
1.2MB

MD5
7ea897911302d1281fdc63537cf7b47b

SHA1
bacb9483623ec3ba0d66bf08473be9fbffb5d36f

SHA256
0a40fdab88d9df854e7051f3a5d540b56532b9c4fcdf5aa11634bbc0fb1fa17d

SHA512
0ab5033111c1ac3ec483ab8ed2c506265b2ca2f8860f04583a8d4f93b160fd536e27dc48f7116729409fa37d40dc39652cb7b015ad108c5786c78ceca243104a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Filesize
1.2MB

MD5
982aea96c526739d93eff03aa3b128a3

SHA1
a227aca4d0e4801e17d6ba5d70c2465dbe4a8f36

SHA256
de997f032bc3b2827996148c79cbac6d69bf964046d8dbb271f74ea280ced080

SHA512
2d3f62b2a0647c661cf8ab6e1242322b6fdff831f8a06dcafac8f923d1ec0dc6194dcc51b4346fbcebf8138b10bd173c7197b2b59eb8906aa50a0752cd36ea46

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe
Filesize
1.2MB

MD5
8a3150f4bb212ae809e32f9a4b6b0e39

SHA1
bb3fd58539748b2cab7e7ec73a0642fab5e638e2

SHA256
0fb71432d599e1401e91601822905dbb7c82cd5de7bca2c7d4dab23c915a135e

SHA512
03f1a37258a89e68eaad9fb68a3d13626f922e6f84acb744ea69d6b1146bf27718b2f8bb1d70d46e86e6a11fbbc2e0d987447231a3fac06fd26abfe5c8fbc565

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Filesize
1.2MB

MD5
3b43bdd3f51923b866283ae731ecc51a

SHA1
c8417a597172021e4f4d484567bf566971e39de1

SHA256
5fd71b3f7ca90e1e63b1fbbfb3957ef58cc3efc46f433e04e8432a715a01eab4

SHA512
04346d6984997f7a5616128ff671997e1ac44bfba943b3bde7dedad1a77f1fbba7169f008d5b0d7255f9c58c923dafdba8aaa523c63b24f00f918ebf8c36d082

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Filesize
1.2MB

MD5
51a537b75bd92b145f6bd80fba62d13d

SHA1
96e7fdb4a88f4bb97130b373bced067a4e5c9b9f

SHA256
cb42f376fa97d0c1c3df9efa6019ea43439dd49ba08c342c68c7887d798f1e06

SHA512
83e8a866f5b1f16284e895e86829240a2d5b0e8dd0fa261f4554926404bd9d226ca15cae17f34d5369d96a9c439c7b95440afbd4c8466d59b2ca5456f8516c5f

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe
Filesize
1.5MB

MD5
7f1c9f126c09e11956f24bfbdba7d57a

SHA1
79eebc4183ae417790b3b782a75a5566d79c4b21

SHA256
909cd0a7f1dcbea789928adcd3e04992fd9534c85fedb99dfd101056246fdd91

SHA512
ba28904e4536b3642522aaed2f438e323d41c5f60feee8df8ca3a8c8f709998ae8d3a4741758588e3d9c3c6bd71ca794a27f89bd681e8cf687e4eebd6b2bf495

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe
Filesize
1.2MB

MD5
bd12d16a14f61d0c03fcf75f457a0bc2

SHA1
d35abbc5251f23d65501c0a3988f0be2ae936c6a

SHA256
cc4f0064bee360b789eba6ebc6f4f6c6b4786f9713774832b51fc2ba6bdb855e

SHA512
cc2bd1d933795618865b6fa651b0b2b4ce6faf9696338af5c0b4e22731b9156ea94e36a7c553c7e94e9dea78c44619b35c2200b28a857bc421089a506c3236a1

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Filesize
1.2MB

MD5
897688da01d3bfec03152e934b7dc41d

SHA1
cb22aed27924a60f94d7b14e6720635d50fd40eb

SHA256
e3061ccbeb860f97a9faf0d371eb4753a4c80f00d7df4d7bc591a5656a2e6c9f

SHA512
ea575d60d54a4c553722ec6a73d77fb32f4aade25a7accef4c092731ded4f3724d3adc3ea6f20c696cde05c7dc8fed14e0e4dd08951ce357b4a3de36fe6f8b77

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Filesize
1.3MB

MD5
43063bd05e77d71439165a8cb521a70a

SHA1
a55d26de96c6aa16b5e2f86750a044fa48b1802c

SHA256
9fffd22155de6106afcf24535644dae7da883d1b7328d0473bc76c4564997aad

SHA512
7b3e242a49a01e9657b2896469941d4929ce8c479dfa725a1c8df57e893100a5794c4445a8e0a9175a45a8cc4a87a15b3962531ddeccabfe1b6de26b69f1d28c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe
Filesize
1.2MB

MD5
20ac5236462a11e1fecf7710ba6856f7

SHA1
cc8038c0b412baac70c04b10d51b6e00c8fedb1b

SHA256
96fcb380b255b25c1cb64b3c458210145cea1f15869b66cfad4428a186d9e612

SHA512
3dfa3765225331c00ccb200bf809570ea27947f355fcc3ed44416c69f56c21e2c9b5341671617b69cb685f220e031a1fb4228f0b348398d96ab073ab97ee5713

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe
Filesize
1.2MB

MD5
f170a666eaf103c64c0902b4b6b6b521

SHA1
45bb990b0077dc566c46da0037016117de5e9858

SHA256
6edabeb3070b5efb9017719a53b85073ed37ee47ddef2921f424044fcd285662

SHA512
3e73d7e0ceb42c46e34db9a4aa79ea3254d06e589e1d1124f79e455b904eab74d336940ee60deeb320e9be8850df8c39c69c0be06a092c9021ad7aefb03c519c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Filesize
1.3MB

MD5
d3014932aaa8507cb7556084d9484469

SHA1
a1fc27924e69959d3977b036a03e488ace090e88

SHA256
346a761bfc9615715c4f29d18a046145ae85819e0838f350a5484aed52d38c36

SHA512
31796f895b587d0379bd6dd2b70e4ac2851eede7af5937b329a79fdcf16cbd8a70322c892ad7bd1c2390ab961794d85932106330b77d7e0af6a4c2069535c8ca

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Filesize
1.5MB

MD5
a24a7a05be719f17be27f21113f6e036

SHA1
d762edadd73c483742437e9b5ac212f2b97efd27

SHA256
66e20a3fb4c49b816b83ba6dfd30ae0c6d7c39cfc5acef421d6da0b76007a384

SHA512
354a6f20067298f7ac8fd9122f1786005a0d47f7b8ee0d99b78969106f7daab88b2d5b7b54ad222e4390ee97f602d8dd87b248e6a3735d2c2db495c24889492e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Filesize
1.6MB

MD5
067da6732a629f31490dd878dbc9b9e0

SHA1
daa37bbc68115624f0ed4e20332d988192313550

SHA256
7fb0ed4c8541d3a11ecc201a124f4d9151bef2593236c6ca4341c58e2134ba86

SHA512
c15cc727cd37b8e6bcb822efa4fc139962bbfda659a3a83a2cb848d8e8e5f9caf3febe338e590202748e10e8201ef1dc78ba8e8d2baee017a301bc08f163413b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Filesize
1.2MB

MD5
178c4194cead5cbd2ac43139e7872de7

SHA1
f5189e76fba582786cfd0c561e105e9ccafa6317

SHA256
32b1da139c7570019c1dd8256239d171615a416862fd90f91dd73b50186c1ded

SHA512
8a907d7ebb3f2c86bd65439c29fd2730a1f3977869c8f92d4aecb3e46d4f6516633856a9473f69c0299f0a2d43caa1e8bcd7ab342dc0818a4ff21cdd33df869a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Filesize
1.2MB

MD5
f1e9a513e3cced2481d5c572e8c8b470

SHA1
cd550dbd9ec6483b4e60ba272b58b5c1eb66b44d

SHA256
f51bd8ee500419e2db3ef8a65fd328448f16bc113de1fbd9af1b022f6b0eb217

SHA512
71fd1cccd4c31b96c07cb52ef32a2be9ebdd9d93301455f57d883d528a402264376bb16bdf5ac0bc2a21841338917c52d95d4bdaadee668019b8eb27c1e581aa

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Filesize
1.2MB

MD5
9540d48fcd99375f07d6ea6af095845d

SHA1
52f2a77053fd9edf70e557d7f236a5912b396dfc

SHA256
8e0b2790e56dd21bc3ad1fa3e43a9eacaa65912ca92195e2ce117e4451eb275c

SHA512
70ff4d22490a657170885244f454e4b2eb13510c696ff498d89566b5ed4176bee3568d4d56aaa7e8b752a2a3141de21d9c70a665765497e8970e04b91cece28a

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Filesize
1.2MB

MD5
75c0b30504d5c932a1d0c7e59760bdbd

SHA1
ae6ac322be338a07d3b74871f071e05453814b43

SHA256
9b96e1936d850a1b9108159c2ed8400c4ab1afc18c28fa14aed3d506f962a2f6

SHA512
d2530b9b2752a1d2a825ac580a2777b6320dd3dc19bc147a5773b56f611d8f097ab9c056e97c13868190ced6629bbd3cffba7aef6fbd0a53467583dd94b1c705

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Filesize
1.2MB

MD5
771d8634ee0dd7601bca7e41b6c9659f

SHA1
64a7b1bba8ec1977013f8580f8680963aca614e2

SHA256
acc83295fe6021484246008188d2cdc7c6eb362a91f1a166f0a99e6c0a79f57b

SHA512
93ca9e865f9fa7e15fcb5163400b98bd7e815abd9926bfd9130503db67c5a3b912a0732dd8cc35402694e99959367f7c32b3744ba83569d7a92b312263c71ffe

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Filesize
1.2MB

MD5
5f1df245c0686838abcb85ce26f980c6

SHA1
b250f95859e1243b08178de5777e1e72ce403388

SHA256
6d2190ecd97b1bf45f48e96f2150c0700905a6a205c36e8c66acd5aa86b1e0cb

SHA512
f91a745b09ead9c6bc930e17ef9c8c4d9c6223eb2473995cc5358e40c07671b34706fe6a03a8118d016fd4d9fe173bdd9c269c5c6044c23ab1977b83215898c5

Download Submit
C:\Program Files\dotnet\dotnet.exe
Filesize
1.3MB

MD5
e98196e8ff054c4984c5bcf9eb9cc377

SHA1
8f21b41961d633e17069791a1d820dd2b21e89e9

SHA256
6f9fc4d6f7caf22c36ea9650078c18d2412004a4835df3eb208cf07a38380b44

SHA512
eab755da78eb870ac072d3118770ec108e36c7baf86903a3d0077588574011b1167a3c2f0ef8146b1fcd4e936f8ea910c7e01b6f43d6af29464f8e7a833594fc

Download Submit
C:\Windows\SysWOW64\perfhost.exe
Filesize
1.2MB

MD5
37f409cfebe04e498c2a0ea3f65cb7e5

SHA1
36ae0c9e3a8009ef17e1ba4d6db776e98e9e03ec

SHA256
7231dba6747ba03de630dcc42b04f0f4d4d7843a9ec95859262c3afdf0b77af2

SHA512
23953bb223cda5fd554859948fa216a63fbe4c98900e6da6efa9a4bb3667dc6a4c5dcfaf29a429586dd2b32d0f33f398d1bfac542111d73faa8a9ca403bc28a3

Download Submit
C:\Windows\System32\AgentService.exe
Filesize
1.7MB

MD5
90b0d7db052634dee17d610ff96b9e0f

SHA1
02204cd8b5b37737948f97da7d9e213b6db80423

SHA256
02f255f34ce6d0398ee7ccdef62b672b39ed28ddca6318c74cbd1778ea2b6b24

SHA512
387741175f74992683cc1641245aec888a76bcd9ba1b2c277a96bcfd848d814ad5a3c61008e4fbdaaee98248617499ddb83408b7546221d38990b177f98f76db

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Filesize
1.3MB

MD5
fb91bc3ce28ad7eadc657888829362dd

SHA1
304e12c32f839a460b81344518488600cf26fc14

SHA256
3fbea8cfb502b4511849e01a3cbb2a5e5d09e145f8fbe610de8744869d68b1b1

SHA512
e0c4ecb183c17f750b8b6d40623b25dc0063928586af81fc770aa4b2b3431fa90d36a36645841f75f0d4bf06f7078300a427e1766ba3400ae13788fe6540dcda

Download Submit
C:\Windows\System32\FXSSVC.exe
Filesize
1.2MB

MD5
ca4c61632cefeef26df7d21db080bd4e

SHA1
18a3ee543feda87f60ea82de5d37d41e40defacc

SHA256
5f542e00f79983c0d1169b958598b92982cd49d27a58ff299165287b9dd75ec7

SHA512
a59c16f31a9c28a06836ea286a56d79a2fc7e888f913a06d8894ac7a2caffe77e04a505df2f1a5bab66e258943840a43be68989dcbc62d0bec90afc67accaabf

Download Submit
C:\Windows\System32\Locator.exe
Filesize
1.2MB

MD5
b8b6bee19708362e8854e077a138a769

SHA1
bc2f7e6251767411e71616d122d24d4c7205c582

SHA256
8112ae7e551d801c8204fbcfc27927b523d785ae1b406c009d9a185ef2ac1682

SHA512
5944e91882b486fd0fd7e6ec4d6be92645c5344cb5b7a0bb8cd412dcf063a7459fc6d0ce01e8b534a55466adde1b356c81d70ac50a6ed7170460d7aa5fb612b9

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe
Filesize
1.6MB

MD5
bb19be9e26263c3f3477f209e49fc292

SHA1
8caf1fb61f8e5c4a466666b22b783c14e9256dd1

SHA256
5a873ac144fad9ace579a1bf48a2168db1864d66643085d5a52e164a11993946

SHA512
2fbc452c0e8ff79b450ec9a48eb4510b7ecccb7d862573e9571c192901a1e868db313e8946c3c6c59270e957e0f6673533b63b570db462722ceb7401528a54eb

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Filesize
1.3MB

MD5
9a6dc70c814b481eff181520479db4a8

SHA1
b0012494033d682ecfd3a6844143c1aa5d2a3611

SHA256
1f6a58e045553e708ad62e21b70c9af5231986094a7bdd703fe89eed8a1ad4ec

SHA512
40aace5796a24b922268f70688d978be0b5eb51f201955658cfdc0b6b298126379ec323f8b2fba1ba1714b92eeb9aec9e1cbb6e506ddcf869e46785f1ab87e09

Download Submit
C:\Windows\System32\SearchIndexer.exe
Filesize
1.4MB

MD5
54cd881c7b253d69e8726a08f5b7da81

SHA1
03532757deb71cb47a24516d7accb34e4db8fe3d

SHA256
6ec5eb7ad686b87dba835972e4b27698dbcd8efc285fe422a4fe3128fa68fb06

SHA512
997c372f20ddc1db10f42f399e2b435bcbee53fe3476b99166c12bd8b189ad50dd3fc7d2e4a6a768c3ab2258d4f07e0d9d3cd7ebba1d065a87a9e823c98508e5

Download Submit
C:\Windows\System32\SensorDataService.exe
Filesize
1.8MB

MD5
0d2403f8f0f5f2222e516d2e4ae593ec

SHA1
db8a72277d5042aca2e22a5bbaf7d69592ceb89e

SHA256
b80532467f6a8a7b7f7c631c182666d83a32c78d8bba6c42d0f85bf5e1442a50

SHA512
d464f3b45ec236e6fcf72e2e343866dcd94bf0ab8f07bf0e5a91b1bd44d7454ba9bd5736cc988d1b474f7d0da79ae3c5019dd41cc1ddfa659ae3d69236869d2c

Download Submit
C:\Windows\System32\Spectrum.exe
Filesize
1.4MB

MD5
f88325266134c27d386c56eed7243054

SHA1
f4011018dece68985a48755d173e0fc0d6d61d0f

SHA256
ece7dd539a8c4d83bdcb9fb81e9cdf3fe5fbb5aecef5ff6cbfc94bc0cfd8b34b

SHA512
cef8c8125ce37c8a999c8f3b33a792823fc005217d8a39f426cd008119a995c1ca35e9662948cc227a46782425a2dc874c42ea8ba66b9a4c218788c1e1b44bba

Download Submit
C:\Windows\System32\TieringEngineService.exe
Filesize
1.5MB

MD5
62add1c70e04e96f4a3412dad584f59b

SHA1
3e129b240a97d8485ad4d47855b57a8467364bcc

SHA256
ce6556791f86f31ceb3700263eb9c74fc59015ae68ddefd98bb86d572f40537c

SHA512
05ad59fe573563ccc3d4754367d002a85b3cd67279f281ed2f6b946b438dee8bf835e805682f8085e917eadfbc8f29d2c197133a8d52114081679da4dad43b98

Download Submit
C:\Windows\System32\VSSVC.exe
Filesize
2.0MB

MD5
6fd922a5a8eecf4a2030c14b7c2bc123

SHA1
040103b61e23eff726c261afacd8d2317150ee01

SHA256
a5a7c776130b47024cabd32c73b35dfdb8c1ad676e42119c7de4ffb3933a7c15

SHA512
77e41d6d6244ca00c0addedbc348b9849b22258007122396c4bcb9d5d8dcfb8581c531820854e336ae4638ecd9130a2d1ce1ad88e23a70bb1d673408809d093f

Download Submit
C:\Windows\System32\alg.exe
Filesize
1.3MB

MD5
7385e95e7947c72327d700bd1390b050

SHA1
cd8ac4c220c95b3ab2e331c0165c1b0658af3140

SHA256
74af27140838195b0f94e18ac30654c6ff566d1e16b4da3458fdec3d64365137

SHA512
0003c525bc2c9801fb9b33166093e13f189ea1ccbac590cef70a5acf56d20e76f263b2f33bc05282dc21dcf718ff3effff090d1b072b1edb986d31d04a2c6b37

Download Submit
C:\Windows\System32\msdtc.exe
Filesize
1.3MB

MD5
89a5d40ef0cc576b65466c14e1eee8fb

SHA1
ae550e9919dbe834c0da216bb16226e2d6d1a82a

SHA256
d80d01067d7c2be95adca98a4828063585e7d8f785225b3b418e31d41aa0a1a5

SHA512
5423a38c560f6ad78758744dd9164e85440f1230e2d77592fe88daa614c02a335970eee11804342402a94b6e6b8d84ba104d93c806f6fa3554722da81e7107c7

Download Submit
C:\Windows\System32\snmptrap.exe
Filesize
1.2MB

MD5
259d26e36fd15226b0e9fbb296a04d3d

SHA1
f8345921172dd47322587223cd3117c6ade75bff

SHA256
f5a6eca0741e59a5357af62a0f31e647e1db8d33dd765d534bad34ff8a230a92

SHA512
8b1bb0946d3f118d537765626007486da8e39933e29191166010fa334ddf9990ea537164acb9b87873b0d9ac4c6fc2c0388d2667336f3d9cfd419783183239b9

Download Submit
C:\Windows\System32\vds.exe
Filesize
1.3MB

MD5
6a7e4f2848375cc57b537da479d23bd2

SHA1
e57650d9f4ab16a0bfb19a8ded8d4c51a9e2029d

SHA256
f32e72da0dc2ba0ddb74d998bdfede4bda304e3a43da150a9d17a46bf83c894a

SHA512
e23631cb89933c3bd7f96d3b6ccf8a144bb6e56909a7ef689061fa7af513a89822705c38045e1d456bfb7c0521f52a9f2f0059ae0349dc2cc86ace9dca8c5a43

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe
Filesize
1.4MB

MD5
c6c0325ca5ad358bfc705c76bedfb90e

SHA1
c39ccb11d9927710c3cad9f1d32bcfa3eead2347

SHA256
075bacfe8f13cce99766964db35091fdb9d6c3a19dd3b3b9fa74869daa1859a4

SHA512
335012eb9d00a8051101383a1f4420a8ba75d92b5fb343067fc922d6326ecff2c25ff42830bafd508a50b5170631f57de67b1027d3e9cd9edf5c9777c06ac1c7

Download Submit
C:\Windows\System32\wbengine.exe
Filesize
2.1MB

MD5
15a88e9a43db9752ba47948e5c9edefc

SHA1
b1ec3fd88944651e7c95edb3d4e155344cc88a67

SHA256
1aa2c26c66228c26fb88a9e3f396f3d0a25684d49268f796be0fecd754fe68e5

SHA512
ee24c0cf5db0dace539602a3d0463a9ddbdd6cd42a37d453359b314430861f99b9f0331a952a6cf4fe5f6ce07e165a6a8ae4b4dbcad54679378f7eb67d96face

Download Submit
C:\odt\office2016setup.exe
Filesize
5.6MB

MD5
c5b19ff5c99691b9aa5ff840db1816c8

SHA1
66ebb78dddb8353299a476f88ba04ccd60643a55

SHA256
29522d780702744396954030568344847aceaf72a0e580ad82f46b24d20cb1d5

SHA512
964e7d74a703793ce936256968729cc36dbc6066fd7b1223d412840dcb107cd4029350f82b91ae05a93ac557f35fc0511632b1eb12a9f6c56bf86e1f7fd5e669

Download Submit
memory/368-407-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/368-297-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/620-60-0x0000000140000000-0x000000014020D000-memory.dmp

Filesize
2.1MB

Download
memory/620-58-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/620-62-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/620-64-0x0000000140000000-0x000000014020D000-memory.dmp

Filesize
2.1MB

Download
memory/620-52-0x0000000002260000-0x00000000022C0000-memory.dmp

Filesize
384KB

Download
memory/672-420-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/928-300-0x0000000140000000-0x00000001401D8000-memory.dmp

Filesize
1.8MB

Download
memory/928-419-0x0000000140000000-0x00000001401D8000-memory.dmp

Filesize
1.8MB

Download
memory/960-433-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1124-369-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1124-381-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/1436-521-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/1436-323-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/1572-14-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/1572-24-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/1572-15-0x0000000000730000-0x0000000000790000-memory.dmp

Filesize
384KB

Download
memory/1572-117-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/2160-524-0x0000000140000000-0x0000000140225000-memory.dmp

Filesize
2.1MB

Download
memory/2160-366-0x0000000140000000-0x0000000140225000-memory.dmp

Filesize
2.1MB

Download
memory/2680-269-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2680-256-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2680-257-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Filesize
384KB

Download
memory/2948-408-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3564-184-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/3564-28-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/3564-37-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/3564-36-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4028-194-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/4028-40-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/4028-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/4028-46-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/4052-213-0x0000000140000000-0x0000000140212000-memory.dmp

Filesize
2.1MB

Download
memory/4052-67-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/4052-73-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/4052-75-0x0000000140000000-0x0000000140212000-memory.dmp

Filesize
2.1MB

Download
memory/4292-523-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/4292-346-0x0000000140000000-0x0000000140245000-memory.dmp

Filesize
2.3MB

Download
memory/4488-527-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4488-384-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/4524-334-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4524-522-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4552-528-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4552-396-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4592-395-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/4592-283-0x0000000140000000-0x00000001401EE000-memory.dmp

Filesize
1.9MB

Download
memory/4664-432-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4664-311-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4664-520-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/4768-6-0x00000000024A0000-0x0000000002507000-memory.dmp

Filesize
412KB

Download
memory/4768-7-0x00000000024A0000-0x0000000002507000-memory.dmp

Filesize
412KB

Download
memory/4768-1-0x00000000024A0000-0x0000000002507000-memory.dmp

Filesize
412KB

Download
memory/4768-23-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/4768-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/4796-246-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/4796-252-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/4796-357-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/4796-245-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/4924-383-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4924-271-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download