b6f189d7e85aada9bf2d8e2dd2d3e99855b6dd8ed4c989ce276500849f27ec13

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
Size

3.1MB
MD5

4f6c25b0196f9fd0fbfd76c3bfe6f980
SHA1

c57b767159e0992cf0334030f2eb4098ce122c51
SHA256

b6f189d7e85aada9bf2d8e2dd2d3e99855b6dd8ed4c989ce276500849f27ec13
SHA512

7a399265ff26bd95030a73ac125dac572136a73fd9d9a5839ec4e371a13dd37d104ffb72ec4684e268601e8a30aeb93283b2223b0a2c51673caf2eeec5b2fee2
SSDEEP

98304:eHgNDfXQ1veFPk5FaoCRrgGUDx9l2/V0cETQ/I:DDfgZeVmCJWl9+Z

Score

7^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
3848	alg.exe
4908	DiagnosticsHub.StandardCollector.Service.exe
1868	fxssvc.exe
2228	elevation_service.exe
1188	elevation_service.exe
2444	maintenanceservice.exe
2296	msdtc.exe
4164	OSE.EXE
2812	PerceptionSimulationService.exe
3996	perfhost.exe
1316	locator.exe
3100	SensorDataService.exe
3956	snmptrap.exe
4568	spectrum.exe
1560	ssh-agent.exe
4076	TieringEngineService.exe
5084	AgentService.exe
3412	vds.exe
2816	vssvc.exe
4428	wbengine.exe
2464	WmiApSrv.exe
2276	SearchIndexer.exe
968	VCREDI~1.EXE
4108	msiexec.exe

Loads dropped DLL 2 IoCs

pid	Process
5596	MsiExec.exe
5596	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~1.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\spectrum.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\vssvc.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\System32\vds.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\msiexec.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\AgentService.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\locator.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\wbengine.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e1398eed521a4bb.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78812\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20240724050910507.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910898.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910882.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910523.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910867.0\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910867.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910914.0	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910523.0\msvcr80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910882.0\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910882.1\8.0.50727.42.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910914.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910523.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910851.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.cat	msiexec.exe
File created	C:\Windows\Installer\e57ce7f.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910523.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910898.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910617.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A49F249F-0C91-497F-86DF-B2585E8E76B7}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910523.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910882.1\8.0.50727.42.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910507.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910507.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910617.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910617.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910617.0\mfc80u.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910851.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ce7b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910617.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910882.0\8.0.50727.42.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910726.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910851.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910867.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910898.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID63D.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910914.0\8.0.50727.42.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID021.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910523.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80ITA.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910882.1	msiexec.exe
File created	C:\Windows\Installer\e57ce7b.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910617.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910851.0\vcomp.dll	msiexec.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\mfc80DEU.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240724050910507.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910617.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240724050910726.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat	msiexec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
912	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VCREDI~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008052faa387ddda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049de769687ddda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cd26e9787ddda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9eff7a387ddda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f87d369687ddda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d624ba487ddda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f658b69787ddda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\ProductName = "Microsoft Visual C++ 2005 Redistributable"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Version = "134268455"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B\VC_Redist	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\PackageCode = "FA1F9ADB128EB664EAA9BA3CE244C0B1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.42",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 2b0078003f0076005d003500320070005d003f004400700030005300440043006c0021007b006300560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F942F94A19C0F79468FD2B85E5E8677B\AdvertiseFlags = "388"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
4108	msiexec.exe
4108	msiexec.exe
3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
4908	DiagnosticsHub.StandardCollector.Service.exe
4908	DiagnosticsHub.StandardCollector.Service.exe
4908	DiagnosticsHub.StandardCollector.Service.exe
4908	DiagnosticsHub.StandardCollector.Service.exe
4908	DiagnosticsHub.StandardCollector.Service.exe
4908	DiagnosticsHub.StandardCollector.Service.exe
4908	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
648	Process not Found
648	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
Token: SeAuditPrivilege	1868	fxssvc.exe
Token: SeRestorePrivilege	4076	TieringEngineService.exe
Token: SeManageVolumePrivilege	4076	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5084	AgentService.exe
Token: SeBackupPrivilege	2816	vssvc.exe
Token: SeRestorePrivilege	2816	vssvc.exe
Token: SeAuditPrivilege	2816	vssvc.exe
Token: SeBackupPrivilege	4428	wbengine.exe
Token: SeRestorePrivilege	4428	wbengine.exe
Token: SeSecurityPrivilege	4428	wbengine.exe
Token: 33	2276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2276	SearchIndexer.exe
Token: SeShutdownPrivilege	912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	912	msiexec.exe
Token: SeSecurityPrivilege	4108	msiexec.exe
Token: SeCreateTokenPrivilege	912	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	912	msiexec.exe
Token: SeLockMemoryPrivilege	912	msiexec.exe
Token: SeIncreaseQuotaPrivilege	912	msiexec.exe
Token: SeMachineAccountPrivilege	912	msiexec.exe
Token: SeTcbPrivilege	912	msiexec.exe
Token: SeSecurityPrivilege	912	msiexec.exe
Token: SeTakeOwnershipPrivilege	912	msiexec.exe
Token: SeLoadDriverPrivilege	912	msiexec.exe
Token: SeSystemProfilePrivilege	912	msiexec.exe
Token: SeSystemtimePrivilege	912	msiexec.exe
Token: SeProfSingleProcessPrivilege	912	msiexec.exe
Token: SeIncBasePriorityPrivilege	912	msiexec.exe
Token: SeCreatePagefilePrivilege	912	msiexec.exe
Token: SeCreatePermanentPrivilege	912	msiexec.exe
Token: SeBackupPrivilege	912	msiexec.exe
Token: SeRestorePrivilege	912	msiexec.exe
Token: SeShutdownPrivilege	912	msiexec.exe
Token: SeDebugPrivilege	912	msiexec.exe
Token: SeAuditPrivilege	912	msiexec.exe
Token: SeSystemEnvironmentPrivilege	912	msiexec.exe
Token: SeChangeNotifyPrivilege	912	msiexec.exe
Token: SeRemoteShutdownPrivilege	912	msiexec.exe
Token: SeUndockPrivilege	912	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
912	msiexec.exe
912	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3888	2276	SearchIndexer.exe	115
PID 2276 wrote to memory of 3888	2276	SearchIndexer.exe	115
PID 2276 wrote to memory of 4188	2276	SearchIndexer.exe	117
PID 2276 wrote to memory of 4188	2276	SearchIndexer.exe	117
PID 3796 wrote to memory of 968	3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe	119
PID 3796 wrote to memory of 968	3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe	119
PID 3796 wrote to memory of 968	3796	4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe	119
PID 968 wrote to memory of 912	968	VCREDI~1.EXE	120
PID 968 wrote to memory of 912	968	VCREDI~1.EXE	120
PID 968 wrote to memory of 912	968	VCREDI~1.EXE	120
PID 4108 wrote to memory of 5176	4108	msiexec.exe	128
PID 4108 wrote to memory of 5176	4108	msiexec.exe	128
PID 4108 wrote to memory of 5596	4108	msiexec.exe	130
PID 4108 wrote to memory of 5596	4108	msiexec.exe	130
PID 4108 wrote to memory of 5596	4108	msiexec.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe
"C:\Users\Admin\AppData\Local\Temp\4f6c25b0196f9fd0fbfd76c3bfe6f980N.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i vcredist.msi
    3⤵
    - Enumerates connected drives
    - Event Triggered Execution: Installer Packages
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:912

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3848

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2020

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1188

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2444

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2296

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3996

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3100

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4568

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1524

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4188

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 41A37E9F5C35F9553B6EBAFA3C214547
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57ce7e.rbs

Filesize
27KB

MD5
c3fb8ed264047e77416f5c5f0a6e37f8

SHA1
93b6981a4035e34e8b6e0b41ddb20bff3f8535b9

SHA256
6a2024c5d4454546dfe411cb4227e1b2316ff851155bca88186ec1d8fc00e4bc

SHA512
403fb97fd104d1b5b3aa6a4f0b2c5c30c5d8e5914a0fe606f4ae275bbc516b00eeea11a9a25ce994a4ce42523c01e6def83802a89f45ad72313f4b0a26337686

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
82efe2921b0a0df61011648708bed529

SHA1
50158cbc6fa9c2fd44818626fbcf16b3618d99b4

SHA256
a1fb4b694a9b6f80413e5b604efa743c6ac1621b25ded22db94f4356b707ce3b

SHA512
15eb303f3af5b080708a6b18696317b9e8684803fe04a54a93f2b50c2841875936f13c46f6950e00abbdbf538bb814d5941ccbcb1e3094190e7269fe98f46e38

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
789KB

MD5
c1d55a9ebb1600f3661b800d114ecedc

SHA1
a67cb67fda5a96a85f97c8044847d5fccc7a428a

SHA256
dc3961ea7bab91b97d9a193ce891caf78ab12be94b4b324bef8591d018efd0a3

SHA512
73ac67f987cc8c03b485e12ab56c5d5ed1ddc801c30058d182babb49223252e5a3c67fd86b4d16569da6cf266048941047cdf5267c143f3323ec720e981f71b3

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.1MB

MD5
f1771eb9d59ecd204f1ed97d6d9c637e

SHA1
762fe479a0251775ee60e9ed03d6f7ccedb22761

SHA256
3a1fcca3110e08ff7b837cec5f3f7ceafa32824c7845ebecd4849a7ae741fbde

SHA512
65afe3f9feb8c966217e6b46617371f49a6704931f79f153dd1d57440881616cd8719e185829e258f999cd7a04544acded269a031b5fcba1fe6e4aec9426fe40

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
4afd85b5ec9ba9b4a34d62e43a6d0108

SHA1
f5daeb2f778a7211cf36d91674d2087c38b898d9

SHA256
22e888549012e79ea6595996a36b6cf64e84877b5be164383edca54f428c5b3e

SHA512
29d96de24d54f79e126a70a97de399b8d6c2338fd81bbce2d38cd3c399fc0cb1a8b17dbaf81eb4aab0386d787df51a563b43fdbb5c44fdaa3afc5cb6c553fbfd

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
99156abe3fb99870828a5a8c7d33af1e

SHA1
59f428c78dfdd218ddffcd6fc3b379526428a7f5

SHA256
6c6bf35c8988da79c9f1fb93b1b4ec6457742270ed40cb88fbe1336d891c491d

SHA512
b32388330d437cdc37ef80d2ab31976b7b69c46ba5c35bf21ca93ab1b4b76b09a6fe4321840701219bbf9ceba539337d4fb9b6f912b840403540017637ca8c96

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
582KB

MD5
96cada863e1d457181d45c071beaae7e

SHA1
6f80e19fe4848ac5968a0f84b9611aede41286e9

SHA256
063b504c780edad11e22e869ae08d61df6b8846bb0827829ba0af74dd9fbeaca

SHA512
df67e8aed8f525f6ea20e324d09ce026ba1867b06435b3ae4c988c267ea59fbe42b258ac077c587d226fc117628a1137e449ced12db15a2b3036e2c35e5dbd43

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
840KB

MD5
3c63c723e40608238df3655c1f441516

SHA1
db85180e99a5dae93ca3ad582aa68fe369ed22b9

SHA256
f4f96cdd662b58d0dc96e7fe83307ad9598c967ca3a8554a9388aafd204b47ea

SHA512
6270a7ef303f6f25961de424ab656295ad9a0ee1ff30975095ea918a4fddbedff916c8beec2b0a2d5164a9d57f548de90c3884055578db814cd9b475b43fe019

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
86ae34b92b79a6f938e1f78bbbf49fed

SHA1
684e470ac654e12569edc6086ce95e927eff87b8

SHA256
251bbb0ae4782196c9b64fbb3cd58de118ae61747199906139582b6d86d8ac35

SHA512
89e6f764cc2c7e09e7053a32ef93bb8c23c83a8a8fe95c53d1a2b2d39b9a55be3eba8a2e6b747f94b71dc8ef4e835b7f97cba4d12a648327407d22b79df9e909

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
910KB

MD5
cf1a1c4f8f2df8ff1e021450da16b471

SHA1
4f3ce749c2a77c7c56b15b0da59f4e6d26bd1896

SHA256
8e4a187a098da99a6ff0b686d3b128d04c73d290736276ead3037c63e72792ae

SHA512
12606ff64d2678c9ae8ba6febcca50d64c3ad1f82b0da247e44ecbfabdcd8ac777d3b22c6d3a76c6a6b145e18d970258da3d084408529db021b7d451f2c3d2b3

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
927bc4883f485b0fc1f110f8f11a2def

SHA1
b5f456fd2b5d78b459e7f882003c994062e8feac

SHA256
d423df4014b638c1fed454e0f554fff9751d9bbe9aee631c42a9beb88a45f358

SHA512
6a23c18a8291605f9fcf56ed7ff6486b4768a3f29ac0d982a01538ed47e9817b95b57183fdfe821d922957c702c0935fd0cd25159e12f9e0ecadc45bde6b10c0

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
6f91b88c625663e4ae6b51d3884a7861

SHA1
d46d5318e65ddc203a22155abfa3e81903a41d38

SHA256
83da77dc906976094e368b62f8097211ed8598adf2854fc8ccecd39a3e33058e

SHA512
b88142e0101ea5e28aed7866b9be69a6e757c3a16f649891e433f2722f478b982f19bf117dd145fa37f2880cdef8a3b56cbc633bc9030bc161cf130c2b99e940

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
e378b25e1edf53369398f178c143fd1f

SHA1
700ff795925c75f1cb8b58646b44f117116feec4

SHA256
4132f494a416ab5cd2eab63073ecf7a910f16698701dc0f323cded907f9978a4

SHA512
e865bd931281ee376ed799e9caa7dfb1d9104807a3c5bd3fabc0a8ebd6086c4bafdf44d6d9893f92701915ee777e34c6d569053fc957424702834f02f3875eeb

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
805KB

MD5
31b1169009f5c61b0d90a4f15d53c07e

SHA1
2da0ab3b50625d95181f148ad449ab7c05d451d7

SHA256
13057d25b0b63c145125b661eaf6c64f8963c77fe8bdea3403846a2b9a4f5c41

SHA512
89c4863ac0197b386292cd3a440afbf840dcf964ceb524c924ea754bb0bc74a5360b804206061d7dcc5b31b555e5d2054f16e801d4ebf444bd3f2c3266a64114

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
656KB

MD5
7a00b4658048f18b95ba4012f63836c1

SHA1
696285e3f8c08cdf5d215a84988a5ea6bab7467a

SHA256
ce6f5d8ad7344dcc3902ca67b4d478589fa6f84a7043afe6536cf49ffd5cf4bb

SHA512
dad4f12e38e03ffebb40cafab3ec4c683f2869ddcab95ce8107ef77f2b2edaa5cc3cb3ecee4d8ba045104cc84d9fcdde5bae984081ba08d1442aeb42a8389729

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe

Filesize
4.6MB

MD5
1c9597184cd3c89bcf34cb35af977f5b

SHA1
4bb25369ec56593ba8595b1e34454590821eca74

SHA256
0de05ed60ee28166da825c9ddd275b3bcde4833441aa90b72043483c4bb6742b

SHA512
85a137658b3efafb01d38c594413eb2e3c801d7ef2540dac717c9daa0e8f7e560d36755e4a174cab5b415f9bd4cddc5358b2b3e25114c3f8010b1c39d83989ef

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe

Filesize
4.6MB

MD5
425e4f97127a940a3a5f8a1dab9f9185

SHA1
25aab039f3c4612a9bddc4f51a8b2a65a2f9b835

SHA256
29e89955f3fe7ca1c4fb76eb90bedd0b99dd77c6184aa1fb36fc333b0e0b242b

SHA512
3ea52148d2b1f26c54b6cd79cb9a8971a8568748130136c680f62073f536fa06e3f5c2cc614c4f8ade089cdfa14c02feb1cebe6cab3fb5a7e6ef77d27af59b22

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe

Filesize
1.9MB

MD5
1aa8f5ddfbd8106d6420718ecb2ec0c4

SHA1
573c775fa243dc6d443baf84648fc0245d5e3a2d

SHA256
b2b5ed4d6f6e6eea0a0030b114aecd0b7b747c157bcbdc44e9d127f970049516

SHA512
1b464f9914e734d94a9607fbbf6cdbb21f555778cdda7470425badf66472e9d670635c3d25fa673daf7aab0ca4b95ea060c348253304e287d5961b10feb46c6e

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

Filesize
2.1MB

MD5
5a6ffd4115476d6fc7b3fbe4890f4d1b

SHA1
629bef4c06716143130eb92622221c9be422e829

SHA256
83a3eb49c1be9ef1cd0650cacb312608e6956f5a9df08ae2c7a24ee05f51541f

SHA512
43d15cbb144700e5e5386b1c7816b41a1ef0c0e3f7954e4ed1a40e7f860e67c00730df54d03e38a7082fc1b9f19ac250c19f95684757c8b2a243039c01e9cc1f

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe

Filesize
1.8MB

MD5
c361e2acb73c364f84ddd078559ea521

SHA1
5769e650efa9e8e208e53b2507533eb1722f6e01

SHA256
77c139cc0f1c48bae08e372295b66978b4db25eedab669cd53cc25f2fe4d7562

SHA512
d0e714bdaa657377cdadbb17b32d8905666a7f98676f594317590ec558a73396672e10800df64499e3143097827bbf2474ba4f6ffd51fac21257835f50b1e02f

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.6MB

MD5
6abe661b6d5db1bdf405fcbb28e68275

SHA1
07d8aed41cdc4281b3e00c6d07651ccaa77deb6c

SHA256
f5b4866c0df52a089565c1f0a557bf93bc6099d9e9fdf4fe12fb2674925c9393

SHA512
612a9f1573c9d44a87b8b92d1298d60fe26ed6e379f7685598cd413cf3452e939e14629f3f9fe18e1925623dfae946c66d017e973efaf221c05b4d6c65a4a400

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
581KB

MD5
e53fbe296619cb350d8da45346bf441a

SHA1
576ed84be651bd8ee3a15d29284eab7c1575718e

SHA256
d75757aac9bae6fdc3bf3897fbd8ca3b0491d118defcbc226daadd6580440737

SHA512
e65a5c0752c250f4ea1f814e6aa23d652349ec4d26d8077968a2ff3572769336e63324317d5c3eed5881677a78aa8e62d21f231ec987d525ef42bf4b0d07a540

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
581KB

MD5
99122a224e719e13257f9bfaebdbfe22

SHA1
959e86c5e5940d65710a3931cf102e71287d8c87

SHA256
19f47ea3e579bdc725c254d2e459e9fa031479c1efd437196b1157ee19058d76

SHA512
e2a6e07f50da84befa23cf0b4ed234a77964a55cc979be98190df03d45f68919c6aecbbac9ce0c7f103562b39e329cc7c83b79707c4c4656c7767497aa22c07e

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
581KB

MD5
2db598aa6f6b59b60c23da61fc1e1b15

SHA1
740a4fe3636220b4247682aa2fc105c6e9e2fbf4

SHA256
08b4b50ae250ef0a966dfd5033ee1630d4ea8a68b1f74dd6a7f4f488f49fe28e

SHA512
07123ee4cbe69c3b665e242d011c862477fb50e5953dc51e9d6c33b1578b2851100bf50b7a7a088c6290db1484a72dc5e78777bd5ffbb20cb0c57f68f208c65c

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
601KB

MD5
8470b016c9fe812c2834144694dff837

SHA1
661b16a6be0495780e0a91e1fb9a691ccfd1b9b9

SHA256
14fcfc59e9b7ef3491f7e76b865d76f73ad8875aa280c000397a85f66a1fbaef

SHA512
4ebcb5c44712636ac09ed8b972804b7b6febdd3aeefea6a20022a1effacc5683b93a6f2d30de828cf51520452a12568e4853f5da19fb3b9870b68bb955d51160

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
581KB

MD5
a2b51b3ebe776d5dafc3b60ebe78029f

SHA1
5d0fcb0bdda00454e62da0a82a09a3e0dbf1476d

SHA256
853cba0ba5933d721fa84625ba74806c41d8f74b462437046aea6265038c189d

SHA512
ad6783159ae16ad383132fb7369a9324f8f9c9feb83d2d9c1e36dacf36617b22dae785471dc987174d72f9d8935c876ec3aeeaab52d909aaf319ad6a58ffcaca

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
581KB

MD5
228e38016af4cbff3cd7fd1dee0eee78

SHA1
094f9d359f8c4d78cc083ba7c51597bb00247588

SHA256
e3c1c9a2a6e6a54167cdb7b14228be7b5fcf79c9bfa6d86b7162c5cf798cc2ff

SHA512
dcb06b2eb03e2e4309293364d312dc54b38465d40dc84c78ce9a00a2d657f22abffd110f036d14a8b513093d18ed7f976594905525d15e264f7c66a968a1460c

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
bba0136c24412012079ea3945473598e

SHA1
98262f1262a77af75fcd95d9c7625eee67fd5cbf

SHA256
6e43dd3d53d69d86a6c12fc9a9e5884963278f15549a3bd2e3f08a9c1c2775d6

SHA512
3fa04554fad0a4a67356503351831805714e1ee3e4f9bcea4635959894b3d7bb9dcade7c50d863d7867cdef904b7f858af2501e6bdd5244182f1f8ca113dbc26

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
701KB

MD5
f6926e1b9728f737ce943449a5db1612

SHA1
b2eadc89de07826d0bc4348af69ec18470474c25

SHA256
53982b591c1a93cf67fd469c61e38f619195c66075e2b07b9261592bee7e2f41

SHA512
dd4305f2b3b225a485b56c88a45785a09df35664e25c4c352c476289b1eda2ebbfeb5afba778d19e369a2f8a438cb231a545e6e53627421f6639d69ee0f63448

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE

Filesize
2.5MB

MD5
f031c0d2b460209b47b91c46a3d202fe

SHA1
95040f80b0d203e1abaec4e06e0ec0e01c507d03

SHA256
492826e1aacd984a00dd67a438386e4de883cc923cb1f25e265525a4cf70ed7b

SHA512
18840649d19c5310d274bac69010514872a554bb5ecadb4af5fa3667ad1a6bf9d644b31393edbc1b60ace6eff907c79c078f8213948cf90fa4d1529c68ccc629

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab

Filesize
245KB

MD5
00d3bf1c1e82eee48fdf3361dd860e19

SHA1
b2f45cd2791ce178b45b06a95e7f58f298512d6d

SHA256
f2ce7873a39f7f8a2a2cd888a6b2f0a25f62bb3c475ee73cfe54988982ef65de

SHA512
cf5c06c4052b103d0a339d5535db2d8a9f069e928ee8c985f03e321b7e1977ff2f2200ad15671d6e93b9c706bea7586cd3df11fdbaaaf8c63a0ea4291431bca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi

Filesize
2.4MB

MD5
b31b234cb0f534069ba32aaaeacd7b2d

SHA1
d6f90459f8bdbf7e75cc85affe9b137dc5e304e2

SHA256
b5a652a1025f194f59e1349a1f26709d7ff7760067439b2d52d988a55d9340f0

SHA512
138cb14f6018d3bddd78012c5b36a591fe70d1b2b7f9d3774230639302401be57e1a4d6098c66a83c47e67138ac6dbe79f64548e4c317bb804a4e9a3ffdf94ea

Download Submit
C:\Windows\Installer\MSID021.tmp

Filesize
24KB

MD5
7bfa56d222ecc4267e10c01462c6d0d9

SHA1
9b3236a45673ff3bb89df3e690784b673ae02038

SHA256
6eeb255e1d5333a7b4f1b62e36afa1bea5cfd6c7e32058bb3a9efebc4d9f2ad6

SHA512
10cec6bfd08a8b7cac1acbc3627cb014554ba71f44eb4bfe5b1471b81d6d292fd83a352d553af0de75fc1668a1f13d7f6f6c7bf1c6524117f363a3a7fc9b09e9

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
588KB

MD5
a617992ff98faecad116f005bceff8dc

SHA1
03b80661bfbc945895f9de8de6f018b6dd9021b5

SHA256
e257387519f63561dba664710d3dabe304d5cae3b28cafb97dc09dc2b2bb1c7c

SHA512
6b18aab5da4fa0755e1ddbb44d8c49196f04f18f42556941926cb50f9e2ee468b6f3be62c1efde36f2877c0e6c7e2aaedc9f5cd6ff88adea70efd45e0fecc2ec

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
02988ae2de4d646b66e4359fd4d77f70

SHA1
462e12962079579115cd44db57e0bfaf89b89b51

SHA256
31fa46a158237749d41fc1185bb6d83131d4461eeb6f168a1252ef2f79db3775

SHA512
5f03d0e9ae148680ed631580cd2686e6e2824f3bf14ec998bb1b8147873cf6f8ea734d064acdc65651b42d3ad540573c90cfc289b31dc0f6324c3084b56f04e5

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
659KB

MD5
99f49311414da010ba4f5fb0e6048c1a

SHA1
83be0bc0e4dfce9e11fbee9ad70a8e30a653b0d1

SHA256
9952725ace981843e017185dec35a8a7a84240309e3ab26ed80b15ceacc17d13

SHA512
4788c738179ef5a237f2f2952fca0996b0984b1e5d27912e51129d286c7307db8c1b219d6d9536c789661ad160745504f0f654336839db9fdf06d8399eff7769

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
06119a157dcabb53282d31d004e1403e

SHA1
91f99194a2fb1802f328440c1d86c5196c2fe86d

SHA256
b19d3cc027dd6c6a9d16a8678e0dc982e029b801f3e72780ce8b25c025d9df37

SHA512
15f6683642db8dc810668acd108a9bcf8f9272100f64aacea9cd13e5e6383580ac053c3472c5389b5f22f61e1ac0d30fdd867db5068fbce8e6a5b170d714efaa

Download Submit
C:\Windows\System32\Locator.exe

Filesize
578KB

MD5
93269b3cee22c58a92b3982f8b1bac3d

SHA1
4bfa1677638491e6ed4fe862faffba23cbd35e6e

SHA256
274dcb02c1fb4c773e026933505567c11d3ee2ecad8a2956902a921f07388737

SHA512
6e46f69d870a3eb7333aa7c251bcdcab662e0aa13bbb2740518598c65378f4e4e7bb75e961cd4a790fc2a2170e00efa1b0166d725441bf98737edc4656f7381a

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
940KB

MD5
71dd3c9f1e08656867fd2c8f79555532

SHA1
2e18c254b682b472ef4d36c0afc3ee1db73d1bea

SHA256
bcd87e8f7718267724edf983893cb1534395aa4e57794e298592decbc9b2d7ca

SHA512
544463e35cf9947978c386ddae3b3d785d51e9601401eca903542801c8168a984a476f4b463c261560eb8aaa61965df771e2e591f100fa045c82bd660722d61f

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
671KB

MD5
8fbcc225c6255f7c28302f1f51405f54

SHA1
3f19cf9c9363cee82aad60f3b85d75b3c999d9e0

SHA256
350c404b02d358e4697f1e77e809de73c0e2923f94e34514dd719210d9720c17

SHA512
d2759df381a9911f2b84b8b7a215486a66aa122ab830bab2e14907b4a71277500053a1016a8e9cb410a103e4bfa11bc254bcb918b7159ed64743acd6651d4ab0

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
1e2f04f5192bc2bd6ff63608b0c08516

SHA1
d5c639a2561fb4d6feb8da87077d0a8e4705f695

SHA256
bf08185dd034e6658ca7e8bcfa3a37da15d43014f42eaf376a2f3781acf15aa9

SHA512
7a91518fcd6defd058f8236117d6f2a1e0277e2d0e05f277e42582e7afc3bc5df43d83aa813a7cc4373b86dc80bf2cd1cf1de13e4462efd0fc93d68d413e89da

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
7c7cac7dd7aa46e2513d2cb9728cc4ba

SHA1
86cd02fcfcf80b07a493bfc43c622c19bc899ce5

SHA256
68f1fdcb40161788f01bc8ba01dd6cef8f4d3ec44b8402036880e390ff3e9ae4

SHA512
101a096f30525ce61a564c3cb21693a26c827917ae9718cbd4e5839e24140fbbc7b9f5b4720cedf78d77c054b538ad14722c8c73651976d48eaddbd9a29e5f5e

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
9d7cd7f3be8c6e376ee84dd82996ca5a

SHA1
d1ba520d09c4233e35bef2d96b212702e42c1f07

SHA256
73d1509687aaa0cbc314e18264a280195e9fcb9943fbde9817be2826b3bb91d7

SHA512
ea65d0db7601d59a03992dd2f4da03978615e5f20de3914628110e59a7191abe0b6387d13edb4719ce8422d3f8807115c08a82401c67683b6418a85450e2445b

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
885KB

MD5
d23fe76dbb2539d7c54ca49260e2cecd

SHA1
d3fe15874c86a54f5ea905cf2c23300c47009426

SHA256
7a549d0cb206648a0da4df3818cc0362ced36eca344cebe09015527f36892361

SHA512
11ab7c6d5efa5885f38923db91e0b8db5bfefdc6130c6f24436f4b5b20d5f7b113026272f3bab11e8dfc9378659eef12404c39dfda2d98c7d04e576cd30d4a37

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
64ec13632afea7f78105f4067c895d7d

SHA1
2eaf5c8a9c95914c205fd90459a0b5e0b69cfb79

SHA256
f789df1d9ae2ec98a8b37f705e6ea7996d0adc4804185fc1c590e4f69b2e666f

SHA512
20923994b37c42a14ad537e46f21bcca0b709eb2ea98bdf020601f588c4f4946027f361a942671c0c59970277f70ad64437f1afed60e60c0cd9306a2fa3bf752

Download Submit
C:\Windows\System32\alg.exe

Filesize
661KB

MD5
b607344c674d927e55b3a79963e0c977

SHA1
a2e06ddd88ff0100e08b2e38eb063931e7547cd4

SHA256
cbe1aca6fd11210feb441a85de9f1c99af226065604d6050563d27b37c0ec118

SHA512
cebab45fb19571c4093ce4a1c7ff5db5e767395832af96c241a59fb030f9a09a805519f1ef4471cdcc4a0b66ae78630fd30af39e965b22edc47b3139acf7f192

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
712KB

MD5
4333991245db2da23625bae9487a1281

SHA1
495d256cd79d6cb246baf3c1ef654c313d14d5c0

SHA256
209f876540de02ac80e8a99b95cdf5b5e3e6665b09fc80ddd0e7d2f90c58981d

SHA512
6abf9f4be18ecefd5a5ec10e262c4050e8e11f8ea6447f30ca15910e0ad93f22ec5c98a009a7656f782ae74a038e7e0ea344f244fa5183195d2ad9ee7d879dfb

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
635KB

MD5
0b4169958c6cb1a169a14e3fe917642f

SHA1
1daf504ba0ab3e9d1e6bb97643c440e22a50ae70

SHA256
c364cd06c163aac3e3d9e7eb7616530e2562620330c03629d719b52c5557ab10

SHA512
f7fc129a252c97dae2a17d3d142c5e9c92f435681cf954e1b9f7a0f33a9bf6eaadf830058ae48dfee29ea7afc32b23f7039e491e17fcae285d2fa784050a21b5

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
584KB

MD5
a9f306c95b205d12e01b9d916a7bab6f

SHA1
81e8fa1bc7a9aec9e9e065d9a2b13b3d677466b3

SHA256
b5218b1151950778b684cadd409acf84ed6bf8a64a244875a0317da471355ebd

SHA512
b177e56cdf87190eb9918e5fe02075ef06f7d618e02db40af505bbd5fbac6fc8cf9c9a7bce87ea7527eb38345de3b404e5bc76bc16796ab17362ec11c7a7df82

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
27e86726035b0b9f03ac3e6d8d629689

SHA1
39e5068f799f4085663aa8a5311d26d5e4b52176

SHA256
6cd39182ad640e83a33441e25ffc16c0728cb663ddd68ed537c857b2f2d296bd

SHA512
8d8486a95911cead1084fbd597773ad93f291433ef96e0437fc9a9482bb20d27c4ee7d2a25e4a6b3702918e843abea72eae0452ddfb2861ed0f527657b5e1850

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
772KB

MD5
058fbbd0ceca361eb608ed18ddfa4efa

SHA1
cce3bd76de6db20d4540247c576bd9e8387a4710

SHA256
229cb7bf1bfc1ec83cb31777f55ba4f621756dcfe18ab3f7351e566002d980bd

SHA512
c8fcb0506e1f4fa2f99d5c135908bc886d0e765127bbb8624d62281e77ea1c4f9ce3310dcf083101e228af9deca0f1230aaa01794fedd633de8411f3db134a2f

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
bdab4cfd38129bbe500cc268f3a34f4a

SHA1
db28f0ee0bf4a45a07287ae7f227071d94450300

SHA256
50f4f1ece9aee55e6795af4ac1047c6a349d9a15f65363b31ebbd7f9f0ff551d

SHA512
537ea868778298b1c03903c9ca5de6cb9b404fd17c0dc7e2b71ae290ed204daeef5b9b9a58ccb22275c39ad225464089cf370d8c0f9481aa3cda536a10d59bbc

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
fa56909fc81fe82e9a3a76ff9231152c

SHA1
f04008c9c553617f3e42992127f14286fa678c25

SHA256
ad35043c03a85414933977d4a958a552b9e32ea6d2b474ed727daf60184d437d

SHA512
0bb5d61a12dc6cfd347ca15d1e35ab6a455abd14ef66398afe85166ff2c439cca87509a9c0278d2b650449f7d52186bd38cc0df49d82426cdd18c629ad5af3b5

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
877KB

MD5
dd207413f593e850f55946662cd2daef

SHA1
ba7bcd61c6b7ac79727c3bec1b5ad9d6bcd2242a

SHA256
facb25f42116421da5c81c06e7ff686cdf7f48d8d0f5135e30a29380bcda6b77

SHA512
b39ee727d1ddd7a9665dfcc8a3b3d64f9f261f1c68e6e10a0d85139af0ba08d913aa99a6b1e2c73ebeee77276164bdd8928a32410142b50f6523277dd361f677

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
54bedaa7e2c2f99d5eacb6b7197a2d60

SHA1
ef050f37a65049c078a24882fe68c7d26de3aaa5

SHA256
6946c5cc5d4b937d466e2b1829b2e20440afe9d05b75ec4bf55a08a84036446d

SHA512
6e80edcbe8072c93b2aad0534cf3dc6de9c0494b0e2d537e4cf0746871afcfef2e2f6ad28b94cf1bc3da8c2685226b24291dd4cc7af63fc5a62321916a76239c

Download Submit
\??\Volume{196fffd5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3cc6941e-e11e-4c0b-b677-4f710a11081f}_OnDiskSnapshotProp

Filesize
6KB

MD5
5a7c0e9ae3cf78ef28384c341fb8d2d6

SHA1
7cf1a1f0472733e5c004fff6212c36d5712f2b9e

SHA256
a44e3e53305d55d558f8dfb58b2593dcd2451f72344c1769a37751078e7018a7

SHA512
aa2061c82dddec539aea5c7c4d748b60b24f16aa086f2aed606b96cd95b2572a32ded306154cb7063d7d8e2b4aac60966932c8641944e3d0e13651c5c8ba7002

Download Submit
memory/1188-64-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1188-180-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1188-70-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/1188-73-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1316-254-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/1316-141-0x0000000140000000-0x0000000140095000-memory.dmp

Filesize
596KB

Download
memory/1560-488-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/1560-187-0x0000000140000000-0x0000000140102000-memory.dmp

Filesize
1.0MB

Download
memory/1868-37-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/1868-43-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/1868-46-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/1868-49-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/1868-50-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2228-61-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/2228-167-0x0000000140000000-0x0000000140234000-memory.dmp

Filesize
2.2MB

Download
memory/2228-59-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/2228-53-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/2276-604-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2276-276-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2296-91-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2296-92-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/2296-203-0x0000000140000000-0x00000001400B9000-memory.dmp

Filesize
740KB

Download
memory/2444-84-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2444-82-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Filesize
384KB

Download
memory/2444-87-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Filesize
384KB

Download
memory/2444-89-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/2444-75-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Filesize
384KB

Download
memory/2464-255-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2464-603-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2812-230-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2812-126-0x0000000140000000-0x00000001400AB000-memory.dmp

Filesize
684KB

Download
memory/2816-231-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2816-535-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/3100-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3100-494-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3100-144-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3412-219-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3412-531-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3796-2-0x00000000006B0000-0x0000000000717000-memory.dmp

Filesize
412KB

Download
memory/3796-8-0x00000000006B0000-0x0000000000717000-memory.dmp

Filesize
412KB

Download
memory/3796-0-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/3796-81-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/3796-661-0x0000000001000000-0x0000000001320000-memory.dmp

Filesize
3.1MB

Download
memory/3848-103-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/3848-20-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/3848-13-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/3848-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Filesize
680KB

Download
memory/3956-156-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/3956-441-0x0000000140000000-0x0000000140096000-memory.dmp

Filesize
600KB

Download
memory/3996-131-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3996-242-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4076-192-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4076-497-0x0000000140000000-0x00000001400E2000-memory.dmp

Filesize
904KB

Download
memory/4108-478-0x0000000140000000-0x00000001400A5000-memory.dmp

Filesize
660KB

Download
memory/4108-704-0x0000000140000000-0x00000001400A5000-memory.dmp

Filesize
660KB

Download
memory/4164-110-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4164-218-0x0000000140000000-0x00000001400CF000-memory.dmp

Filesize
828KB

Download
memory/4428-249-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4428-558-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/4568-168-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4568-477-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/4908-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4908-129-0x0000000140000000-0x00000001400A9000-memory.dmp

Filesize
676KB

Download
memory/4908-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/4908-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/5084-204-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/5084-216-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download