b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
Size

1.8MB
MD5

09fbccb5e11238ae67408dcd79fb86f5
SHA1

f619ec621049529af1cb2c7fcd5931b19e39defe
SHA256

b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526
SHA512

3eb0f4947f1336acd25cdf4526ecc594e0940063ca7347616e1d169642e3682a167f87b79c5b7e6a4547bce914fff50c7bede735b29774dedada41b159cb83a3
SSDEEP

49152:TKJ0WR7AFPyyiSruXKpk3WFDL9zxnSCYjyJVJyNfyPtYuTt3eIM:TKlBAFPydSS6W6X9ln1YjQHiqPtXBeIM

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

Processes:

alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exemsdtc.exeOSE.EXEPerceptionSimulationService.exeperfhost.exelocator.exeSensorDataService.exesnmptrap.exespectrum.exessh-agent.exeTieringEngineService.exeAgentService.exevds.exevssvc.exewbengine.exeWmiApSrv.exeSearchIndexer.exe

pid	process
4052	alg.exe
4028	DiagnosticsHub.StandardCollector.Service.exe
1196	fxssvc.exe
3124	elevation_service.exe
1988	elevation_service.exe
2964	maintenanceservice.exe
4236	msdtc.exe
2880	OSE.EXE
2772	PerceptionSimulationService.exe
880	perfhost.exe
4220	locator.exe
2776	SensorDataService.exe
3604	snmptrap.exe
1848	spectrum.exe
464	ssh-agent.exe
1620	TieringEngineService.exe
3472	AgentService.exe
1644	vds.exe
4260	vssvc.exe
372	wbengine.exe
4864	WmiApSrv.exe
232	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 37 IoCs

Processes:

alg.exeDiagnosticsHub.StandardCollector.Service.exeb730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exemsdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\130029dec3a5208d.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\spectrum.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\wbengine.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\AgentService.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\locator.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\vssvc.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\dllhost.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe

Drops file in Program Files directory 64 IoCs

Processes:

b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exeDiagnosticsHub.StandardCollector.Service.exealg.exe

description	ioc	process
File created	C:\Program Files (x86)\Google\Temp\GUME5BC.tmp\goopdateres_hu.dll	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUME5BC.tmp\goopdateres_iw.dll	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUME5BC.tmp\GoogleCrashHandler.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUME5BC.tmp\goopdateres_fi.dll	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File created	C:\Program Files (x86)\Google\Temp\GUME5BC.tmp\goopdateres_fil.dll	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUME5BC.tmp\goopdateres_pt-PT.dll	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUME5BC.tmp\goopdateres_ar.dll	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File created	C:\Program Files (x86)\Google\Temp\GUME5BC.tmp\goopdateres_ml.dll	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe

Drops file in Windows directory 4 IoCs

Processes:

b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exemsdtc.exealg.exeDiagnosticsHub.StandardCollector.Service.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

spectrum.exeSensorDataService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TieringEngineService.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

SearchProtocolHost.exefxssvc.exeSearchIndexer.exeSearchFilterHost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e4cab2ae8adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a979bd2be8adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055d5ef28e8adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ab5b82be8adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001731332be8adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b937f228e8adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b423fe28e8adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

DiagnosticsHub.StandardCollector.Service.exe

pid	process
4028	DiagnosticsHub.StandardCollector.Service.exe
4028	DiagnosticsHub.StandardCollector.Service.exe
4028	DiagnosticsHub.StandardCollector.Service.exe
4028	DiagnosticsHub.StandardCollector.Service.exe
4028	DiagnosticsHub.StandardCollector.Service.exe
4028	DiagnosticsHub.StandardCollector.Service.exe
4028	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

652
652

pid	process
652
652

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exefxssvc.exeTieringEngineService.exeAgentService.exevssvc.exewbengine.exeSearchIndexer.exealg.exeDiagnosticsHub.StandardCollector.Service.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	3104	b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
Token: SeAuditPrivilege	1196	fxssvc.exe
Token: SeRestorePrivilege	1620	TieringEngineService.exe
Token: SeManageVolumePrivilege	1620	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3472	AgentService.exe
Token: SeBackupPrivilege	4260	vssvc.exe
Token: SeRestorePrivilege	4260	vssvc.exe
Token: SeAuditPrivilege	4260	vssvc.exe
Token: SeBackupPrivilege	372	wbengine.exe
Token: SeRestorePrivilege	372	wbengine.exe
Token: SeSecurityPrivilege	372	wbengine.exe
Token: 33	232	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	232	SearchIndexer.exe
Token: SeDebugPrivilege	4052	alg.exe
Token: SeDebugPrivilege	4052	alg.exe
Token: SeDebugPrivilege	4052	alg.exe
Token: SeDebugPrivilege	4028	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SearchIndexer.exe

description	pid	process	target process
PID 232 wrote to memory of 5864	232	SearchIndexer.exe	SearchProtocolHost.exe
PID 232 wrote to memory of 5864	232	SearchIndexer.exe	SearchProtocolHost.exe
PID 232 wrote to memory of 5928	232	SearchIndexer.exe	SearchFilterHost.exe
PID 232 wrote to memory of 5928	232	SearchIndexer.exe	SearchFilterHost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe
"C:\Users\Admin\AppData\Local\Temp\b730d0405e17c7a0d41912c422d0ba83586707acf760f626f717ff6992e19526.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4456

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1988

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4236

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2772

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:880

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2776

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3604

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1848

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:740

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:372

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:232

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
PID:5864

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
2⤵
- Modifies data under HKEY_USERS
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4436,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
1⤵
PID:5620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
Filesize
2.3MB

MD5
f2a40f4e7c211466e1880993be38b79f

SHA1
0941544fc81beaf6e3e0077cd305950c0ffbcab3

SHA256
fe03c7af7f5a89b7f4426e6cc9d21a34f4897bdc99f7958e178140f7abb5e9be

SHA512
b7d92dba753bab2ff22e70b11eeb15e19265097a54b7c966884fc9e337bb011e3c9d9ff2dd691f7a1bb2150b9e3f1a807c14ff565dddca737de0d94a7c2de5bf

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Filesize
797KB

MD5
4d8a51ca4f021b00f78578e980630220

SHA1
0c522e383252b071061f3b86a404957a800abf11

SHA256
a53ac70a41a48bf1cd3c0436844ec08b61e4ed619f72fa4f8bc06647aa475997

SHA512
7fefcd59fdcb1a81b13060ecfbfd4a7c2fa45610fddfaa134e1e3ff6a454e2659231ef1ea333e11235f86769d54e8c01fbc7b038c0dc06de702b1bc938a563cd

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
1.1MB

MD5
bc259124c6cc523e8a6bf30c5988c601

SHA1
475ca4c8c0520454c2c1a95529665d009de65c9d

SHA256
f37687f5d929969a0b2d3bbf3eaca254560251827607d337b890f8d6468fa2b5

SHA512
cc8107e4e90d4e2355d40c1e38e72cc016f97b7eea83ff199ce80450c65feced3b5dc113a291cd26d606181d203d28220884b82efaf1c32a9a3d602c03e6cab0

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
1.5MB

MD5
15fe34b893b4d57e3a8a9b381f44004c

SHA1
5a53b8f1709787d082ad7dace5ecb50972697781

SHA256
f1788656baf20bcd3bda97a007ff52c59aeb0030fe0fbcf045823f9e24410077

SHA512
8c74f81442fa2635bfb2a6004fb7f3e8037e98251e4ee9d72797c365450c2772d379df3604dda1200aea2c1a561a2a0f04ae5046a03883888b1c62fcadd53476

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
1.2MB

MD5
aa58be8dc1b94dd1abc41158f2bf7aa4

SHA1
490e73a390fe2fd03f19451f8969ced5ca020aa0

SHA256
f816e9f5cd8199b025652604c5b8b25b4ad391b7a309771a3d3a43539998446a

SHA512
f9be2c8ccaa9b8ea9cc7f3ce1aa9099e91dd92131b6272a2c261614244da11941e1d6ac2e778d78359084d236914801776374a82583cb93212905a0e6c7fe107

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
582KB

MD5
4c81bc3dc5ed93ce71a0f1ad0fcd66fd

SHA1
687b8df604b24a90bb8478db1248d08bf209adaf

SHA256
af3e775408c94b3fb87443403f3737b5743c3cb6e6835fdc0eebd455de822f8e

SHA512
a47febddf59c08cb15154b0574b90d301238d31a69cfc1e50f5efce6ed9b29f20a8c56b662e4667251bc9468c6e7836761c300bb2cb92bba79671b8f360e41fa

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Filesize
840KB

MD5
edc15c51aa99903617c024c2dc02d0b7

SHA1
58ae9da54edcf9a23691c77bcc322f66cf376c22

SHA256
f0a3ddcd5e8015a91c416f93fe833a7dee1388f9b7e6929381cf95132b6a2506

SHA512
64d30500b25c690cd4d508785be58c430d1c637e5ed0b46b0334ad31e98c46ec3df9cd9c950b0249e302bf17f5830b8dea8ebfcb193918aab4932e2800c80121

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Filesize
4.6MB

MD5
6f096c92242ff880e1decb650e1b8592

SHA1
68c342c2fadafa96a5227ea3607b97b4df1a7fa7

SHA256
01f66560ff7f71d55cf5c2b3b6bb016929488f51d7e05cc89a1f26e1b78619fc

SHA512
d1b9875ee3b2340816845e5c4c952b93869bda6f9f462eef8028a2d7e6c6d310a877496b61a90016704fa058b010dace0932b6520c275a19b0b59f3b35741a7c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Filesize
910KB

MD5
3113c907ddebbdc8df8cc89d660f99ec

SHA1
0746dc33b6bfcb36fd69ac484ff5c8f4d3b38ffc

SHA256
edf2768d355c9d7b0baca69f813048b79989f7b4e8d7b9453f9737d95320d8a0

SHA512
e9c3590ce9e4559673a66e5946c4ea97113023b8412c2fcfe6ef05eed772fe68b61c2849af2db05454f9129b89be3a5a5c11cff024b9c865ba29fef778c5fb43

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Filesize
24.0MB

MD5
ae4b8dcdd34dfbd8ef8c982dad5b0b34

SHA1
0c986fb61166b00a7f9bcc52f9c224075c7219c9

SHA256
ac669fb35a1dd252cd4d56124de6f3a5151b622ddc6816988d8aa9a820b0021f

SHA512
97063a3dd520cfde5e796621c6f14a4f1b162d02d1924e818400dac441d7beb45e9c6a99b2ee3dea0eefb3ab8d1f7255fa0f62bcb4a2d5cb76aea1812e7df4bc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Filesize
2.7MB

MD5
c730441b618e595d00bf989bf4cd256d

SHA1
8e4a8890c97dde143bab5278d5119c2e6fca84ac

SHA256
efe59d45b7dcd7e993b7df47269dc4b684d197714edfe31250d23118f86170db

SHA512
e42278aa987cd6c164ad0793fab475c7d3c06898c28d22e933b46cf70f817ff248f396cbb3301ce9f12ce43409f7bb186e65bbae8758e81ddefc00dd2902656d

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Filesize
1.1MB

MD5
b0ec5c25c89cffb7c679ecba771cfe4c

SHA1
9d004bef55c8c1371800e9e89b612623fb7c4104

SHA256
e52e29fb87a44fdc6fb71d7f4115f4fa166799266b4cf134a16f268392b42734

SHA512
cb06014260566b92be35c5608b81fbafc24eb277304cf54100cfdcdb48f8afd02c9c2b29c86bb5a0df52f68552fef32b72a59bae7e082fb93f93700e6dae1a5b

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Filesize
805KB

MD5
ff8195035d45f62a4dd1b25bed1f1314

SHA1
eef173fe588b1ad7a59adaf9c7c20820f5f14423

SHA256
35135b54f2f03085c6dfd3f6a6f62cf4e6d71cbe2a1ecb019c56ee40bf0a33cf

SHA512
5dbeea8d3ef8678a6e7d29242cb1377a151c7d1ade047e43786718c250493a58060a8bc29e78c51bf8e2069d0a81bd2acd239c772c958faed88de58d0a2afd1f

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Filesize
656KB

MD5
48bfc461010d9a7312336c838c9ecc6c

SHA1
ffe31f2b91d0eaa1e3bded536d3f484557728c36

SHA256
dd5268688d28e70364ea1897836724c3da00745aae2e0624aeed9544273f581f

SHA512
5f540ede4871bde5b873666393f5a0b05548f5a882f7e9179cf4cf99a5682c9c331be52bb91b9319ffa5c9bb5a4d804041e54609d11929c2724effb2ad75f21f

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
Filesize
5.4MB

MD5
8a22c6262e8e5baf2854455c8764a96f

SHA1
10d73ce9fd69ed8fefb34857c2c414b2b1ff50aa

SHA256
4d6603184beb256f3474f4f3a54f90f136630a12f7ba9aaa687145e64a443e77

SHA512
b9130b13c66d123677661b3f904f587785e1cd81404882b5f72eba185f67b305ddef34c78682444a0745c3a4eafed9de95705c59fe56789f8f44241d7618e2e6

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
Filesize
5.4MB

MD5
13f4b69f949e4ec85e5ce6a5f17f09bf

SHA1
e3252e503477d5689dc6694070c8c9746eccb2a8

SHA256
fa4a04c57f7dc4c6982cba7d10eb53711fedb1e8c2b9afbd759032ef8c45168e

SHA512
4c346a5250fcfaa5388308e13684680155b0dd965fa1acbc2a8b9d49072e0edcbab02df1ff636e5ecd1e515a131dd0c727d85f038f4b7e149fad494d93d5ffce

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
Filesize
2.0MB

MD5
1404b5ae4805d0519eca1577d67f3b50

SHA1
2a60a6e19109f660831863af39ac76affe08a104

SHA256
7864af7e9a4d321733a30bc8171c76925544705b9a6f753413d0edb3323f3fb5

SHA512
c504318938b8c18106303868ee1f06b3ac6d55fbe45859411f0c0b819c903063550d36c18814ec2588a281b87e4a8f631b6256100237b13c3b0acf0dc1456589

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
Filesize
2.2MB

MD5
654d3fa92fae0308df1bdce34baa56e5

SHA1
c064cd18c7ab34b9ea8af036d093c3a9a2f75d2c

SHA256
737f6cb17ffe9697beb6ac3c9cd01ac7f1ecc24806afb200b2ba1618468991c9

SHA512
f81782ccc79374de9ece6e1b97045f957ac416f43707fca58c4230b106603138cd47058f03125ef7958cbfb99f93d4776fb615cf46cc3bc0cbf83dcbe671e079

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
Filesize
1.8MB

MD5
68531228f835f11c90a966140f03c3c8

SHA1
51d0a5f6720305cb20c879e5ee23c1d72f8a8bce

SHA256
8a5e3c1b84c598accd4233c88ed639a0f4806389c5cea56e401ba857c8450112

SHA512
189bc09e11b5714342e7020d6e8e54015e69c9bce1c83408007329054fa53670bec1de59f979828fa2b7b60c39d335852b6851f292778bd801b8d74045323768

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Filesize
1.7MB

MD5
1ffc5796ab3217ce916f169135af99ab

SHA1
1d3c243ee57434d6ab3adb82e9423090aec461a6

SHA256
1d329c6dd0640861e005556fdb7cebf08506e7f64c9a0e9c104961d6f08dd2cc

SHA512
e48a8e1732d5a1221756fd2a4a4ed59c3ab38640ea1e1f4848880926d4e9998a133ac1ea7dc19f7a273f5574ae8373eca9476cd847cfa046923de6417c18f63b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Filesize
581KB

MD5
91c8568c8edc12c8efa08118f4a7b091

SHA1
716bfe9924c6347471fec5cb68ad8da216873e95

SHA256
1a6bbb957beb0a9e698b71c136bed3079b81cb7b101c69e5daf04e8603f27b2d

SHA512
078608acb3088adb21eb3e1b8c36a940c32d5e69a8cb65cf8a6f214ea63d03628df55a24bf7df22d26b3e093678e6f41f51df365feb68bb4e96052a1b8353755

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Filesize
581KB

MD5
a26b732d69d474a49237bf7a23a796a6

SHA1
ec2f6cd3fca11279443a71d2bb70fb47c5d343c7

SHA256
070533af1c76f82068aa06cf1c3272d2bfe0ea15b7ca4c04f0e8bc8d3ffacdf3

SHA512
4c4c1453ed66e3ebd4384f92417ac95cfe336086022098cd6ed02071a3f3e536433c0a55b307e2080cd5416afbe0f1995139244cb1988ecb1ad30fc4e5f4916e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Filesize
581KB

MD5
8f71caa3ce84e9065b09dd4d641102d2

SHA1
f6d456cfde23cf3f1fea77fd7361a89cc19b619d

SHA256
0d25c703f0c8a1c572cb55e27af20a994cefece16ffeaa3e9c834211588d6c3c

SHA512
b63ca68544d620d9b7f2087071baf3d7ea4a41e3157f2b2e12625f228199412f25ec9b15372ccdc6e598f1a5c1878233790e47f546b2d2c7e9f6ba81bfa08fc7

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Filesize
601KB

MD5
351641f979d558076de43c719d7aa398

SHA1
054c32860233e36e3d553373ca21bda6341e5553

SHA256
13d83fbb3fa06f6a7ec816e31bd8b35a6125f4289b90379d31def33d27a93602

SHA512
fd9a63785dff5ecd3862ca6f6711c9170f8215628cd70ee25e592ac124871f54b52cbdb78442bdf7e09a726100b7338d95c54419ef949b0af8a365fbe12534d4

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe
Filesize
581KB

MD5
77b8e596f1f87734f18ee6679f6d9112

SHA1
24d1b859a7c29a4b511ec0abb70fa9ca8ab9ba98

SHA256
7a700bdae1538379a3d1f9a244a8b0aa683b0df1f114381e334d91c76b4870bb

SHA512
39e0a4aec584ac93c22b4fc0bd9f7d6b35f0497513ea8f86ad47e0d8044c37503e954db01ab472ebbfeafc84df0f42bf384e8cf4ce77066429a4adfa115df46d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Filesize
581KB

MD5
046325eb2f33f5475b7d87f389905dfe

SHA1
4c762fc391a15aec0688689cb4b6112bde80f9c6

SHA256
2f505b0356043b54f1324c22f4153656eaf0fd5993cc05396519adad3a78438b

SHA512
63396859d04276fa1e3415c4d839e616b4e59a60def0016e345eeb2c72399538d865dc9c65cd3ef9d0d87646b7d241ae1b976aa3207b858162d9d5bb2e3d44f4

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Filesize
581KB

MD5
d5bc8155ac9096bfdf6953d60cf46a04

SHA1
edae1529d1f02e148dc99d561ce297bfbf61ff26

SHA256
647e7e04fb6f9ba7408aacd3634236dc6502c036b5aea89cc8fb83392ef9c357

SHA512
d9db287626a96c08e00fb6ee8c9071bbc7ed86242488d021b67ab5e515c5e7dbaade6f20dc9f001f0d2ccf201a2578666e4e2a797e56927c35148e0a3cb44d9b

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe
Filesize
841KB

MD5
9bad4b61a9e3f49b9a898b09e60020fd

SHA1
f2a98ebc1585cabc5c7dbb4596ad6afb128a0c2a

SHA256
d0563be3333c1498489484ef0dd920e5f1b49bf03847ff498099cd9d5ef5d1fb

SHA512
dc8ee7743aeec119c0ccd4e50656b0658793979e60a8713facace4c4a29f5d9fec4222e3b418afcce28e21aa30ddc2f86c83c5eaeb988d661cf4298c2a8992d2

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe
Filesize
581KB

MD5
6e1553f53ea3336698eb4f28d7f60fef

SHA1
28902b5663e355fd6e0a7ca96ddc82cdf446cc4d

SHA256
da1b40a306cdeb9fa18e2317a036531c15516c777a5f9f232124075859cffa43

SHA512
bebab8ba8d8472e986b716a73eb80bf126baa3030e0194be818a354bd7d70f22a9f7b6eff137e6f2ec7c9db4c3359d9d92b4829d6eae93580285b84dc6d79117

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Filesize
581KB

MD5
dde0c895fa47cb9a0ecbf9d24363724f

SHA1
372fc7f159192f7aca3ac467452cc453037b2da4

SHA256
7bdb37abee0a5798632deba66e184bc79dbfa2e3fe969547d217d0336afedcc2

SHA512
f88dcafd42872b8be86577a0ac6bf469202312608957a64ce2be684af1a764cbfa137440f346042d6a4592cab6f17101a52b6e0153e7f808c0ebfb004b4e65af

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Filesize
717KB

MD5
18155ce23c21e58a0a03b1128c2db312

SHA1
bfa4d66f28581e75c6485962c698950c3f10e42e

SHA256
bac5137130dd552a3ff2d7a31dc567774befc0f338ccc233ab170ec7c695e27a

SHA512
e415c1307a96d87b802f85ac833d3dcbed34a58f9adc7aa361d95551acd0b8157195409f27ed2626c1959855860fc10e2caad544c91cf26ec66b35ff7612dc26

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javah.exe
Filesize
581KB

MD5
3f08d69f336f0b515ce7dc23fa086cbf

SHA1
d6fc5b2376fd03e38d86bebc0a764361ab328727

SHA256
049c60027b108e3805349ebbd59ff04327d6a69013b0091e8f23137c4a8c4059

SHA512
76931dd01c6f16f0c6720883fdf452c095d15745fbcbc60479d1be3562bbdd0157373cf9470e6123adb80f0136f168d53bd733818cb4a15e267dfc02ec3b1812

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javap.exe
Filesize
581KB

MD5
f5acd39fcff20ce2631f6547602cccdc

SHA1
086007c9f62c6b8de8a7dffde7ffbbb68d25794a

SHA256
cfa59a4cb30db9ca7beae05252195d2ccdb7d5ca1c9406b9b4492f610f44609a

SHA512
9b629810857a4cab769588fc86b5c77f68485ae341fa775aa8d12f80a30ef025a46debe7f25546224394236fe5c40f4b4a05679021bd6514e874fd95ad452fc6

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Filesize
717KB

MD5
822b23e014ebe3412eec39b3b1eda9f3

SHA1
f1f802452b1cef765b7c5672c5bc4fbce8be3196

SHA256
b4bfdc85aceb71fb969173d1f4115641dc1a874258d74cf3bf8d89c2c759a778

SHA512
5e1efbce13a98d9733ca7d31b0c3994e0bf63139f0a835a2dd332f7c43497bd4416d51e3fcbd72ec2216950d2ed955b03ca8a9d1bc0409bd7c8da5183cd3f18e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Filesize
841KB

MD5
18a07f0a341505e1547693f59495e0fc

SHA1
d718db1dc1a8ffd1a8257cc6f9fb7584421288b6

SHA256
4d38d481680c28699952bc7cfcc3cbbd2644c7d16f3f968ea76148b4f51f9871

SHA512
cf7288d436b797baedc9661f1f1fb232a90f1c2ab7b912f2d4a7fcde6b0230909e6b2d83be961f246d2794e9aa8afa795b220300482399307245de94b0420192

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Filesize
1020KB

MD5
25c693ada49799e406a2016ec467148d

SHA1
9a24c79f57a54d44643d95b073aaad5736122a87

SHA256
d20f7dfab3105e714c86b87681ff4794041af8cd4dedec8511c7082700efcaa7

SHA512
ba9361d8899ef4f160de89f3057c41ec0f86f13c1d0d82f837152a401b0c76fc4162cbca0f214ae4c53cdcfb23aa75189b37c6da8f01c0bb8dd308759f3bd525

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Filesize
581KB

MD5
2da6d933483496b9e19bcddb5012470a

SHA1
c8c12a926770ba9dd50bd1ef0802e57129c3af4d

SHA256
b37ed8cb3f6592f2f61ea2312b7697dd523b18fe4ee85fde71b8249c6dd984d5

SHA512
7b28b66d7621d0ed4d345200bcbfa84d614b2d45330c149a785b4e1850b360c1d5a4a7325682c467f448a588e2f8b4df15867c906b65cbc18fc44a3d9f4f56f4

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe
Filesize
1.5MB

MD5
5c869aa8ff97d955e1820a210b451ea5

SHA1
4c3414845d85359ead0285877726cb1c6cdbe6bd

SHA256
8bfe0bb7df2c857c5f0ae58f4c821854d69e6752311d6e9debde2218b6be2fde

SHA512
ca6d731f48cc2b5c6d4ebd5f04751226a42ed03c7a2f4827665e551600431a468978380ec1e47c34b06673d951826d854a694b066ad539d997eada499101e6e0

Download Submit
C:\Program Files\dotnet\dotnet.exe
Filesize
701KB

MD5
f0cebdff3895160647e1db498377b596

SHA1
f2dd92fd317eba8f868a882e9ef1f6e71dd874c4

SHA256
3eedd1290a229062468b411046f18337a711445a06ce1039d1d67b5e7f123753

SHA512
d34b985ae1cb909a26e8f5e31bb0fdd075ae7e4709177653bbd0ed3546168bd983e928905943c5c5d85d1aeba1d846aab6a3d1b37c7afea71527a21aa671de97

Download Submit
C:\Windows\SysWOW64\perfhost.exe
Filesize
588KB

MD5
36656e885e064cb91fa4130b0564a3ab

SHA1
bedc9071f0daba2aae65cf6184522a0865c45771

SHA256
b188726f15b7bd21ac87f3de7da0e44086ad705cc8aa5f1605eead382ec26da1

SHA512
692dedaa34db35894c4349e417397c9b05685803d39ad699ee6cbf519e80224a727059b5a372e13befad9b9edc643c97ae46481ea8fdc31db9d3fb7f3aae6258

Download Submit
C:\Windows\System32\AgentService.exe
Filesize
1.7MB

MD5
e4c42a898a7f8b306a0397ea99dba841

SHA1
9c80db8834ac10571557f0cddb6609b20a6efabc

SHA256
31ac61e20870f0abcfe40109dc8516551c8a7fb1ac36c4c6900620ca195b269c

SHA512
c9d0cd49e4b6aab1f32aa071cebe96840fba9fd4067a1a48b01d5dddff9852430dbdeff632c5c4fba74a568c4166f314fe37e5d0583e53a49375f883ba08d1ce

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Filesize
659KB

MD5
ae6fc3ff609ea290221932b17bcadd0e

SHA1
7c9a14e0fb7c39b74612f8b8d6d44110839323cb

SHA256
86da63d1326470fd2d6ae474dd02cee757e4dbd2adccab9bb1a318367e075a85

SHA512
fc1a346ad6923dae7ba9c36b01ddd1bfc0c9697700120bcc16a9411663aa8ba8e61c920e7f0079dd67a01bcea531b29ee40fc73287032c8cf0b3c69fe0b797ff

Download Submit
C:\Windows\System32\FXSSVC.exe
Filesize
1.2MB

MD5
61ac2fef53aa3ba31efcd598e4568967

SHA1
698dc9ebc8acc3b7b2d61afdbcb6be211d660c09

SHA256
03dc4e87ea39986d2da4d14c651c60127ef2bf111b00e294b082190f883a75d4

SHA512
06d6e0ff30ac7d47fa86e22aee76154f1de8c28396d3857cbafacaee29bcb4182d8378a8d5cdf61c2eb4947db7603e5e3ce4069cd6a21e7c6a0dfb38e076a25d

Download Submit
C:\Windows\System32\Locator.exe
Filesize
578KB

MD5
1cbd8fd6543a5d0c9b1291aa81fc2001

SHA1
b8040f61af535d654e16de9885b0268313fcabfa

SHA256
521b45dadbd44e91f5f36f94992d8b87ebbc2346e87242d247f370ac49fcb4a0

SHA512
5e2e9fbbedcc95543e77a8bc03abb28627ae2781b24bdfd7b3b6e2549e713d96ef82bd6da8210788b4d33c9f9dfdeed7703cdf175ec2acea7fe196ce4189deee

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe
Filesize
940KB

MD5
9f2fa1cc362dcbe35e6c6e36e4bc89c3

SHA1
34dc80a9d90aae01370cfe7f5952f2f44f850fbb

SHA256
1aa3af3df27b328987d29b6479dfddffe5f283e34d167c9806a9b77b80e021f1

SHA512
f78df054dd09eeea60ca83ef61e935b65470e5a7e02e72ef6f3fdaf6b16e3d7b20a5cb911b6287f689095d83ce1d9f9a364ad4d7a4e03c8950dc21c4ba981ddf

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Filesize
671KB

MD5
2bf728ca2a0b42ecefd4e62fa6c4c650

SHA1
0b01b1f7db80efe2d52d845f29bc1ad8eff0c3b9

SHA256
12337b46bcfad8c36f6dc536b1775b36a1c574cc6538805ce0c640c40c054a10

SHA512
8531650b2f4bef609757ce9870adebd58ef9a363bc9f788b3055d8707f7751b0f9a69924d29f5dcb303d9c8169f2e4efcc135606dd7582912f2e4da3f6134a3a

Download Submit
C:\Windows\System32\SearchIndexer.exe
Filesize
1.4MB

MD5
09f8a6fd12f58059d7978a7468779d13

SHA1
533fc787153d2ddf2ae913bab4bf10749cf02f88

SHA256
ea8ad4738acdbb30dffee5295e0d89e995d790c3ec7670e4e8d6295b365b72a7

SHA512
136f4105231b4f54c8ad781522a1f5f76e31fc9f662924da4284ac16d6377a70ce6d4cc239d4df1f1e73c9bc4abfe7e4265cc6632211dc3d9d2dbc9ff61b0f59

Download Submit
C:\Windows\System32\SensorDataService.exe
Filesize
1.8MB

MD5
50558af2323687a748a486caf6b6f74b

SHA1
40a56c66952cd9be575d6cd97ea79ea2e6b6d690

SHA256
a973f879605c76231bf0ca78e03d550829ccd1ad90f4e8aad02534a82a489ff4

SHA512
53ab57334bc7b906ab95eea1f3a60206689800b91e9920a7f9b9a5f8b9e3bf00bfcf9368afc708239f0a79ef4b6bb407b2c27bdacd5d2448c498ac1252b089e2

Download Submit
C:\Windows\System32\Spectrum.exe
Filesize
1.4MB

MD5
da414be6e96bd0737aa6d738d97041eb

SHA1
3f2851dccdf228c3441161a45ee254c0d78954b1

SHA256
acd66996c167326308706deb97cc3451f621c5304c4c4a532f7a51bae1cfebfa

SHA512
fc4e2970067a97fd7ea5a2e3855d76819af620e64e3c899acab400dbe4941a4dddc581d6b7178485988429ed66c248653707e40acd18e1e845b6e3a2023f5c2a

Download Submit
C:\Windows\System32\TieringEngineService.exe
Filesize
885KB

MD5
d706136997c06bf300c31b1d4921dc0c

SHA1
5c37e5e9a01e8e6081a335b16d438aaf5b96eda7

SHA256
9714683bd9c6877a66f2ffe0896b79083378af3209496da2b08eab0184871cfe

SHA512
75e1e3882f8ffe0a20f9769c17de5f9d366c5c660031683987db3c0c01f7dedf6a336dd6891ca0cdcac7f8c9094635fdf5a9489559f2b1a178f3d6aefe0ef144

Download Submit
C:\Windows\System32\VSSVC.exe
Filesize
2.0MB

MD5
471e3b7996a810e63f052b9289456165

SHA1
fa21b0895a34b3e1f5433d423671c332e956c648

SHA256
42d7eaf9e83be97be03568ec66fc8e5a3e47568173f417a98dd5bccc5598e63d

SHA512
0eb5cff84017caf9e8ff11220ee301f8f60348cde4f4e40396d256c4f0e9e0f1dbbc3771c24bf9cef19015470b12bfce6663ec70964951bd8d1e78868e003805

Download Submit
C:\Windows\System32\alg.exe
Filesize
661KB

MD5
734f683f33cfb4d01a6e27b4eff1c1ab

SHA1
d881bbb86391bf5c630ca156ab387e68a9a3e8b2

SHA256
442d494acfdf160ebff7ca6056aa676a07f41a64a5d4c4230b8b19717290c689

SHA512
aecd2ae4c4fdeda80cb07ebab5888118c37060d14368adda7f3a89a79cfe8ffa7d918e02921b82e26898fe5be26c1616eeb837fa902a3c25e737795f40ff51a7

Download Submit
C:\Windows\System32\msdtc.exe
Filesize
712KB

MD5
ef947028135d0ee827dd3eedb80df1f4

SHA1
3c044a08796977b0b9a62a9a20d8b339c4b0e617

SHA256
819e8f47e8b4ed7f147d3512f6b30b650668aa494e1df703a63865f9e3f0c7f8

SHA512
b1122eea70898141cc0d0daa2252172e08b358a9cdf02606ad8e7d475e1ace8e86bcd5f65dcdc53d0453fbe22bb143c77189bc81950df15890ccd29ca377dea8

Download Submit
C:\Windows\System32\snmptrap.exe
Filesize
584KB

MD5
346868ceab5e418faf699830f3e41bac

SHA1
48da3e95eeca5c2f089001b2fdbaed4657ef36c3

SHA256
a76aed362b14712424576c5cbbdec8004c63a882aa0ae6ebc8c970701956cfdc

SHA512
c62226b98eeb54f8564bfa64a5282cfa11058dc1e3d67a77dc1e395fe87fbd641fb7008363582ca73631b2e7fe57ddf3c23de6b0a0c8d7d8fa00cd98213b46c1

Download Submit
C:\Windows\System32\vds.exe
Filesize
1.3MB

MD5
7e83f0e3b56137748b00b67880ddb6ec

SHA1
a8497b19d570495359ca0b09a367094eff63cd67

SHA256
72d6ec6894b9e56121d7ee1cc604b42490dda8a5784dbee2af15da50d60bc2c5

SHA512
e59888bbad646c399d84b7e814a37a5beb4e072f9d881c480db7adb0cdd72a2cdfad59195493feb34b0e7097312d5551d259fea32eb279fb16fd8f5c7eb31ff9

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe
Filesize
772KB

MD5
5c48418479389a2df2aa79720c09d201

SHA1
fee37cbc1c5b93fd47beeb6d1a53425b2f45d5c5

SHA256
b7eb24a0f77942941debc9733ce9ebd6fde4f849e9543bc49cceca809d3d47ed

SHA512
4a62d5e76d66caefe99e0f0ed967031c9b030811d20cc15cfad0d8bec045fa265d73aa3568d37d9776dc8f03e3f713998ed527967d97b457f2321bfd2df7bf5f

Download Submit
C:\Windows\System32\wbengine.exe
Filesize
2.1MB

MD5
51438e68172b5598f713e6c5fccf4ba7

SHA1
7275f6942a1f6e1cb62276648452986fe9ad6e3c

SHA256
42e3463b3dee901379d2c26b16d3a5180049f300ce43396f2fd28cace15843e3

SHA512
a268d240789a85606831d7ca4529b95236c5ad0f8261e40cd1df8d98df4ce72f6a34d45ccbb3d98109d30021346be7b464d0ad225939701c18310da6f53c2614

Download Submit
C:\Windows\system32\AppVClient.exe
Filesize
1.3MB

MD5
d970934be7bb362be4f01ad15fad0628

SHA1
d88649bd7d5300ec13f71022d73141327538a401

SHA256
f446d13d59553db8879dc7f45db449f2a9604f568a63b9fc19810b33410ddcbe

SHA512
d1d8f1c90fca5710388fd8e99b93a58ef75cc7adb84c2f1250cc15fc9fca4a56bdc0ca27479c23cff8468360a55157f95f013fb60f41ee4fbf9480c6e92dffc8

Download Submit
C:\Windows\system32\SgrmBroker.exe
Filesize
877KB

MD5
dc60d7ec1c6145f5103dd002f0df8f21

SHA1
5968a822cd222130fe3bb0f74df74550c0604e20

SHA256
182b08a0f284272410f740c5f1d4501383f0cb8d10fb4627747230bac0a50453

SHA512
6bd4d414609c1c8e949d627a272d960076ac5bb0351cc7cb4b7b485d03c461e8b9263b8c53c24c2aba92fa6f85068b0c76d8f58e69252ca6c1426c43ec667298

Download Submit
C:\Windows\system32\msiexec.exe
Filesize
635KB

MD5
61752052558e1fd2bc5318bdfbf677f8

SHA1
dfe6cb3eddf5db1db6cf8da1131860f6bfa280e7

SHA256
1fae0b0d458b6ed3a47d665b615c78e894dbfa6b3a0df9d00a552341e40d2b62

SHA512
c821fc52dcdb6c3b39157c5815b4b7505b60e7af1762d694f52ff6fdd945ae079ac8737c25668587fd452fdb3f63d83da5288b6dd172d8f6da2efb768a16565c

Download Submit
memory/232-335-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/232-763-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/372-761-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/372-310-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/464-753-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/464-248-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/880-309-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/880-197-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/1196-38-0x0000000000A00000-0x0000000000A60000-memory.dmp

Filesize
384KB

Download
memory/1196-48-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1196-44-0x0000000000A00000-0x0000000000A60000-memory.dmp

Filesize
384KB

Download
memory/1196-130-0x0000000000A00000-0x0000000000A60000-memory.dmp

Filesize
384KB

Download
memory/1196-129-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1620-755-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/1620-259-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/1644-286-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/1644-756-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/1848-672-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1848-235-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1988-132-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1988-138-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1988-140-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1988-247-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/2772-297-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2772-193-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2776-671-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2776-334-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2776-211-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2880-285-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2880-170-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2964-156-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2964-154-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Filesize
384KB

Download
memory/2964-149-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Filesize
384KB

Download
memory/2964-151-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2964-143-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Filesize
384KB

Download
memory/3104-8-0x0000000000630000-0x0000000000697000-memory.dmp

Filesize
412KB

Download
memory/3104-192-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/3104-1-0x0000000000630000-0x0000000000697000-memory.dmp

Filesize
412KB

Download
memory/3104-581-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/3104-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/3124-118-0x0000000000740000-0x00000000007A0000-memory.dmp

Filesize
384KB

Download
memory/3124-117-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/3124-124-0x0000000000740000-0x00000000007A0000-memory.dmp

Filesize
384KB

Download
memory/3124-234-0x0000000140000000-0x000000014024B000-memory.dmp

Filesize
2.3MB

Download
memory/3472-271-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3472-283-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3604-506-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/3604-223-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/4028-35-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/4028-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/4028-34-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4052-20-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4052-199-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/4052-21-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/4052-12-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/4220-208-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4220-321-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/4236-158-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/4236-159-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/4236-270-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/4260-298-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4260-757-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4864-762-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/4864-322-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download