expiro | d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6c

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
Size

5.1MB
MD5

3e3dc3d3109e15f6740176a2e0194b90
SHA1

c93db0aaf7297216fde8715d7a3d23514cfe6b79
SHA256

d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6c
SHA512

3f16d26d2ddbab46efc4f945501eeb670dfd95bf8bc37572d8f85a4097147ff9b72da8ba5e82a250f31b286b46286ecd2b94234c757f6efa17d7ad501ffd53b7
SSDEEP

98304:36ot44wGJGswP5FDe81lr9kY/mnlsdor1XwU/Ohz2WvJgd7x47t:36otLwGwP55pr9kCmlwe1Xf/Ohz2+Kc

Score

10^/10

expiro backdoor discovery evasion trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 9 IoCs

backdoor

resource	yara_rule
behavioral1/memory/3300-0-0x0000000000925000-0x00000000009BA000-memory.dmp	family_expiro1
behavioral1/memory/3300-1-0x0000000000400000-0x00000000009BA000-memory.dmp	family_expiro1
behavioral1/memory/1416-2-0x0000000000400000-0x00000000009BA000-memory.dmp	family_expiro1
behavioral1/memory/1416-4-0x0000000000400000-0x00000000009BA000-memory.dmp	family_expiro1
behavioral1/memory/3300-6-0x0000000000400000-0x00000000009BA000-memory.dmp	family_expiro1
behavioral1/memory/3300-5-0x0000000000925000-0x00000000009BA000-memory.dmp	family_expiro1
behavioral1/memory/1416-9-0x0000000000400000-0x00000000009BA000-memory.dmp	family_expiro1
behavioral1/memory/1416-11-0x0000000000400000-0x00000000009BA000-memory.dmp	family_expiro1
behavioral1/memory/1416-12-0x0000000000400000-0x00000000009BA000-memory.dmp	family_expiro1

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 6 IoCs

pid	Process
2380	alg.exe
3200	DiagnosticsHub.StandardCollector.Service.exe
3440	fxssvc.exe
4628	elevation_service.exe
4444	elevation_service.exe
3328	TrustedInstaller.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3756129449-3121373848-4276368241-1000	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3756129449-3121373848-4276368241-1000\EnableNotifications = "0"	alg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	alg.exe
File opened (read-only)	\??\K:	alg.exe
File opened (read-only)	\??\S:	alg.exe
File opened (read-only)	\??\T:	alg.exe
File opened (read-only)	\??\V:	alg.exe
File opened (read-only)	\??\E:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\X:	alg.exe
File opened (read-only)	\??\Z:	alg.exe
File opened (read-only)	\??\M:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\O:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\Y:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\I:	alg.exe
File opened (read-only)	\??\U:	alg.exe
File opened (read-only)	\??\Q:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\U:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\G:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\H:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\K:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\L:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\W:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\N:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\S:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\Z:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\H:	alg.exe
File opened (read-only)	\??\P:	alg.exe
File opened (read-only)	\??\J:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\R:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\V:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\X:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\I:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\G:	alg.exe
File opened (read-only)	\??\J:	alg.exe
File opened (read-only)	\??\L:	alg.exe
File opened (read-only)	\??\M:	alg.exe
File opened (read-only)	\??\N:	alg.exe
File opened (read-only)	\??\O:	alg.exe
File opened (read-only)	\??\Q:	alg.exe
File opened (read-only)	\??\R:	alg.exe
File opened (read-only)	\??\W:	alg.exe
File opened (read-only)	\??\Y:	alg.exe
File opened (read-only)	\??\P:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened (read-only)	\??\T:	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	alg.exe
File created	\??\c:\windows\system32\nakaegpe.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	alg.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	alg.exe
File opened for modification	\??\c:\windows\system32\vds.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\windows\system32\wbem\agjlghoh.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	alg.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	alg.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	alg.exe
File created	\??\c:\windows\system32\eheqahcf.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	alg.exe
File created	\??\c:\windows\system32\iglklman.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\windows\SysWOW64\oqdefapj.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	alg.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\windows\system32\aednaigk.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\windows\SysWOW64\bcijglpk.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\alg.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\windows\system32\khepclel.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\ohjbfeqg.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrmbroker.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\locator.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\windows\system32\agecgeln.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	alg.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	alg.exe
File created	\??\c:\windows\system32\ndfnppcj.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\windows\system32\eminhopo.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\system32\vds.exe	alg.exe
File created	\??\c:\windows\system32\diagsvcs\pgkpckik.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\plkcabec.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\pgildlkb.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\dotnet\ddnfppgh.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\hoagndoj.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\7-Zip\lncjookl.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\7-Zip\jgpijieg.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\7-Zip\nccafaqk.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	alg.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\7-Zip\gkooamha.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clmaedbq.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\kgacdccg.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\program files\google\chrome\Application\123.0.6312.123\jianggkh.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\program files\windows media player\olpndpke.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\hlepeenn.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\program files\google\chrome\Application\123.0.6312.123\elevation_service.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\source engine\ose.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\pijgofaf.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\kihlpche.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	\??\c:\program files\common files\microsoft shared\source engine\ejcgqabc.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nnbpngba.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	alg.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	alg.exe
File created	\??\c:\windows\servicing\dngifkhe.tmp	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3300	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
3300	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
3300	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
3300	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe
2380	alg.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1416	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
Token: SeAuditPrivilege	3440	fxssvc.exe
Token: SeTakeOwnershipPrivilege	2380	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 1416	3300	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe	82
PID 3300 wrote to memory of 1416	3300	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe	82
PID 3300 wrote to memory of 1416	3300	d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe	82

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	alg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	alg.exe

C:\Users\Admin\AppData\Local\Temp\d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
"C:\Users\Admin\AppData\Local\Temp\d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe
  C:\Users\Admin\AppData\Local\Temp\d08873d10eb9ddf5a57d7148a284bf1d9ae0794a571dcd6ff4cc9a7a88daae6cN.exe --crash-handler --database=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\129.0.6651.0\Crashpad --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=129.0.6651.0 --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x8206cc,0x8206d8,0x8206e4
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1416

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2380

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1676

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
1.9MB

MD5
41fda9dab775eca188cf19b9d5b98990

SHA1
5c3e12f6f6cd68dfaefdc0fff6267ccd88961895

SHA256
6127cca8c0c345c6407f3bebff66758f70dda8f8d1354fabb1db28044c613292

SHA512
dd80d027dc41975f44f504b380efcdbb2687299926b2dcea6a7fd8c85aa9b1483102a68a2b092fd7fa2665b3a050c01f736d7592d720675cb17795f2f7047ef8

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
940KB

MD5
1329e553c2d72e7f1f2acf8df9bf0446

SHA1
6e94db5373abb334fddfbdd1d8c5f13598a913c3

SHA256
ff3e6086c3f5df4dbe0834d19550331aaa42d662875aa8b01a9cc6a200fa28ba

SHA512
f2f2ee691e56f59a20e7ad638e237c7f5c2ef00e69eebb946377a39f6078c3ec65315e9d2436f4fd54b7cce039852b9d3e2a9f6f91b22c337126085aa30ff818

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.3MB

MD5
f406843cd0cb7ce5b9dfa76429772673

SHA1
d1c10af7a5d2fdf3301d351e470c84ba2d22d30c

SHA256
e7c22acf3735a5be451d1ed9620888b63b69a359097668943f1cfc8254c10cbc

SHA512
debbf01b93b3e8021435c89c28a027ab4d9dac274141612082f40eace1efdf2d71f8d5c71647e101da6a6632f235d8117b50e443fc421c653739fa5b36cc7a70

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.1MB

MD5
e62842f5c7d7339c72e2a0bcef2c6887

SHA1
c91ef4d83cee93b7b21acb9ae41509bc08bbd46a

SHA256
65974cb52bd15069901fa339ee7984b03e8949a0b82f920f4bea414156b0da6d

SHA512
3c3c64e8421ace242ec27ba755492557fe5010cdcd184cd262a3ee57cdb297c998599ff3835a1fc957f12cef2b0f10b08f66989967a15d0b7bf2af4715580895

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
410KB

MD5
722ac9934e191e2a5cdb97d86d7fcdac

SHA1
5617fe0b0d50cc8cbdb8683fd66e2e39cfe5f670

SHA256
0ad1c44d447fe48b9497270b810ba256334977cacc6f992531bdaa1b0db38478

SHA512
c643ceefec3a7a7b8609d4fa6f9c5a980a68916c3833b0bab1f21b03a0d24bd90f740d5f1ced3f9e79aed2bb9d94a3329d7c77f4cb92c21def8380c28faebecd

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
672KB

MD5
c76e2f0f15fe3557088f74447752759c

SHA1
72465bd587900ad7fd0551302a1276086e88e00a

SHA256
fbb9c3a95ed3d99a84a305a49d9db89a40bc6bf9ca4bee4eace057b779ee78b7

SHA512
820f322bd40491e88e5dceb9bb5cbe9fc0599121627d43e50a8c9e8dd1bc57220de9a22f03a640451beb1aca4a4fa286d3f40abc03dbfaba17abc7b49c4758e3

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.5MB

MD5
470353231752f163785d7a01ca26a77c

SHA1
18e41b25974fd8766ce3f610887303e2ddec1d5e

SHA256
5b7c6beeb999b2a16029b2d593b0a320fdcd725b0ba0513439ebb45b82266031

SHA512
589524c62a118e7ba1a83a50b66472d386197122a268a587bf7d726a2efad5ba608c434172cca281cb94ea572b6c1bbf51170391a01397ef53303be7a8e4979e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
742KB

MD5
2399111503e7bbfaed9f45af9a30b610

SHA1
280be7ea41bb7c94799795a7d86346279d885caa

SHA256
85b6d289af220f72ca58e7a74d5eab692d76b11e14bb4305d755d774941b318a

SHA512
b97e1abf88281c410d73bf519d14c876ed317f90e5bbe29aeac7b23263c698f5b925cc7d6a0c407945be10d6d806f610170ea9476c92c5cda720c3b426b21aed

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
23.8MB

MD5
dffeeb7118e8c2b41bd650be2b1ae853

SHA1
aea0cd1688260c30da35e02e4dba88660cc43faa

SHA256
c59dfdcf5bb655ac721583bbeafe59dfbbbaaa2965481466c0d3db8cc0be3985

SHA512
1b3ce66d26fea3e010e54ac5adf939e54429c59b269a95184b44461e71c1d7713a092f07924ba73f7bc9914ae3ba16f5355a8014be29aee3ece27445274dedcb

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.5MB

MD5
ddf85cde08f62565a381b2ba97a8b79f

SHA1
c964e0c4e254f615fe61a4317db11ac1c6f36e8d

SHA256
88d4bcd1bd280e624a1d1feb05b0243299e281e1e68cd6484f39dee185ce8300

SHA512
9736b732658f429f5c2a159257dcb2ebb1eaa3495a0b6e8d5fad43b174d3ce996d09cf60ea5d8862900691fccef1edd1d36658cb5fe8ec38a64ccb7aca7452fe

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.0MB

MD5
bf7b720b7bf412507218c0f8dce10d6d

SHA1
ad88418c05f0a3ff93391a4e8f712b0771920d9b

SHA256
b95c67c68bf5905eb35b1e7ffa69e53150e31ddcea0d2de4d3309bcf2f511ec3

SHA512
f68f2623dee6b2ba0912b42ba19f8cefd6af107467b7635fd1becf49ced159b1f7d16c2f9b27a57c9ecee7d42e6275546fc155d7cb5cb15c9c387b2a7eb5bb2d

Download Submit
C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log

Filesize
1KB

MD5
c1906281569ff0b58b804ceabdeee378

SHA1
c041a3afff4c7858c2dde03ec38074b0d9a51aa9

SHA256
3539dd67c422a7802c2b44c5d47ca3497fd1c0093503f9d829efccd420f2650d

SHA512
8c0d922ffb4ade8366e1f959ba0176c4032ec816bbb5ff2334486e24dfe52195587ae1b6ed3b26d7b2003e9dd71629864036c45e30f4caebb8b38162e88339d3

Download Submit
C:\Users\Admin\AppData\Local\jljkjddr\cjofhpbj.tmp

Filesize
629KB

MD5
25fdb885f2881c8acea3794b40802bc5

SHA1
08fbb505251dbf37cc952071f3b53c6ad3d805a3

SHA256
9cd60b07b2ab42eb75d9c592d606c486bb534563e2bfd77e14f88b66b192e932

SHA512
012e5b5f2d2fab325076b43819f733cd073d0965531f01a6fa219c4f839bbb5914323c30bdfbb0f21d8b54bc0485751fcce85ef4d48382bc3916e9ac3228ff57

Download Submit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Filesize
822KB

MD5
10ac00f30cab1c654c0f7d9ef83a2ad7

SHA1
e555ad05500693ccb578c29d8ff5a1ff66ae1c75

SHA256
fb7e76710a24e93f77da3f0a8f73e8d2680b1216c26a7530546280f8ef372ed1

SHA512
82d6899f88dea39234f5c9e34ca75792a96b2499679f0ed9a7729308612ee131c429d74f3407dfc51517ae203a6e45a759a738673afb98737a3ec3e13bb806ea

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
491KB

MD5
66037841f9b41d0f20589d098085678a

SHA1
ec8e2c3ff75debd4e0f1b25f89c09a70eb42f661

SHA256
792b018d63376b31c734333586b35aee041108c830362fe1d7d521c480f2a7b2

SHA512
72ff2fe706ffddcb1dce0bdcdbff0d0f92ea291e2c48a235a62e0f23f96bebd0a6ade9c5e276fe1f11402aa5f06027743b1d61aab786cb18c579dd4f90cea76c

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.0MB

MD5
062c92d696343564ee52324697fbb1d7

SHA1
986db80a63c59a22cef6e5f3a7acf16d6c9c2728

SHA256
351f2441ad501d2146768f2dc563f8d0665f5a444ce2020c8f80c689bda0b265

SHA512
84476256c17dec8e524bb2c71c0278be2f0ff91fe8f0ede59c8ad8c6df219eda823735a117ee31a46bc92b39600537b5d5fa85a6100370dae8a381d1666584e1

Download Submit
C:\Windows\System32\alg.exe

Filesize
493KB

MD5
9c693bd429724ad440928317de91d1b5

SHA1
a5154eb2bbfaeb25378a8343931384120765e203

SHA256
4fcf78faf3827593898652c15ed651d097384c7eac28d56d6289b929f4f248ec

SHA512
6254391af764dc2a396039121b39c64340534095985dd9db3f54f7de80ee1fd9de97770216832bb0c11db33f9ae19c1d76a706b4b8e22883e173d2a2c8b711bd

Download Submit
C:\Windows\servicing\TrustedInstaller.exe

Filesize
193KB

MD5
805418acd5280e97074bdadca4d95195

SHA1
a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6

SHA256
73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01

SHA512
630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
621KB

MD5
4a2ffe8dabfb5592f55d35bc9f7083f4

SHA1
e2e8ed11504a1fede785a776b140f0b904a3e22f

SHA256
45bd3f7930273161429d7e31cba06349239e8753a613d9d59a88f3c785e0c291

SHA512
881dbd244c9811696f88e6648fa160bffa602a362aba9f5ff6588a8278ef752407517847868a95f5060021e9eff9a320a96c62850435b59e371c0d2f3130f708

Download Submit
\??\c:\program files\common files\microsoft shared\source engine\ose.exe

Filesize
637KB

MD5
9627cd46c95e34775da5902833f401a5

SHA1
847b7e90fabef2f0e81e9c6751c0c46dc0c8ac80

SHA256
4ecef6edde11061bdc3a2dd3c95505b2a0c1473943cb456a0e5413a581f0468f

SHA512
e68e959e7ddf7292bc288f34d6ebcfcb9d006d13a78e34df9a6e2789320c86f1e2f8d3acb3bc2fdc89dd9e32fd3f7e08e72fd8eebc4d45140e24d5158bb0340a

Download Submit
\??\c:\windows\system32\Appvclient.exe

Filesize
1.1MB

MD5
9fb156abd83c4089f7b26c3424b1ef78

SHA1
5ce9972c597bad95cb5f54f0608585b9dad2eb16

SHA256
f545b1f8ac7f932403e865411126c25c1477a49f26eb1280d1c2c8c4f604f656

SHA512
c65807fab9ce5ae2452f230e8aed10438099ddb65983a20316637a2962141f73b4bab93710a78e894167476e59fa71e1ae91521535a13936dbb6822ef7f5dcc7

Download Submit
\??\c:\windows\system32\locator.exe

Filesize
410KB

MD5
170b61267681f0ca8900d2bac156d902

SHA1
836969491165606db4f7bb2922ccc050ecb13680

SHA256
0b6626aa4e6eadaaa7f59ab048cfb36ac0d9007ad6bba68f20517cea2f6c66c8

SHA512
e4523e6ede996386af6826e7852c55cb0f7028cf819390d76acaff73ed74ef6b2d6f8bb38248e052a51ec6494de6dbf7e278a399a3f7a3b1f3302459a3127f9d

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
544KB

MD5
a7bf20fd699535352528d6bff335f98c

SHA1
95a5f95ec5a3094432b13d5e2fb6e032d6a2a326

SHA256
0a9d87e83f4777f473ce1228514c06d50aedcb6c2ed05fe01ea17bb25df12967

SHA512
2a667f71ca8005f31017530a37c455ba81c72bf3dda2df1e67441e9336cc2a49828801b5131c41622bce8022afe8844a223394fa744424e193a84c869d19e6a0

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
467KB

MD5
e4e05ac88dcb1a1b4344929bbb4324e5

SHA1
1d7906ad0521276dc13d74a50fe2893fd6d5e8c4

SHA256
44cbcde2a1e34e6a11901b2edbe8c9eafe650e611da49e6e7f369657a96149c9

SHA512
43260d34628b30c14a41b2d3f34ae85be94dbea392cf9a9f53a944be1837b669a3b1730af0c02e8d036b4112948ed44e6442b69ff4d63fe8652b956f9f03f7b1

Download Submit
\??\c:\windows\system32\openssh\ssh-agent.exe

Filesize
772KB

MD5
b5149d6a7a8022508b6d7061ad816dd8

SHA1
79b502adc6d99b35f9564e9fdfc70ab93f4a96aa

SHA256
aacaef5a17d3f50ecaa5467d3c6365318f0ae8bd9493a68a700c8c9f92947b20

SHA512
d83349f3f1421a86dcef9aa0a41b54fb119eea4beaa08b1b0e9d4fe6849a4701190c7f0759c04323a04f819e8bc61b47004e36ac24ccb403171080e70a1e5159

Download Submit
\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe

Filesize
503KB

MD5
7b125f31199f7a600acf8e66ab233e5b

SHA1
72b1f164170954adb78de481d33ee63b33ca507e

SHA256
7911db76a02aff120df00cd0e6da0cd2a273ed1c1e485a8f07e493ae05d9192d

SHA512
b40e1e75219994e8b6e8c194e4f648539aca24a5dc3239b88f1b7def7cf3d67a916d4f45397d2b8203e221b7c4198acc3471b50118be087f8700acaeab9432c4

Download Submit
\??\c:\windows\system32\sensordataservice.exe

Filesize
1.6MB

MD5
a581b76a3e2f6939503e095d387874a6

SHA1
a31f05bcc33c4adc095a18109665db70712de72e

SHA256
336f294aa093c8db1ddede677f62b4bfd42dacf1f63f250ac3cca529a223eb6b

SHA512
f1eb581f52bf1a822070a3da31d42cd0eb2fcbd26ea4326256385816c9406fd84cd763bc0c2641dcbbcfc7edbb512c054b47deb9812fd8245e806ff3cd1dc4bb

Download Submit
\??\c:\windows\system32\sgrmbroker.exe

Filesize
709KB

MD5
153199bf2d8de8386d6fbe7dae624abd

SHA1
5f631c33ead90ba825ef167acd5162f56b3da6e5

SHA256
008fd340a020bb47a47d5bf7d7ce65e319ac2ae89b03a3f1c4b73935d670fb34

SHA512
17a40bf42c21a5b7f2adbca57676919cab2e425561dca0ef7ca1a2df261c6feaa4e3a35b81b1f83eb61d12d07ab23c076314dcbb39cf45a9c914f592d0799e0a

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
416KB

MD5
8a14155e79bfffc18214c8b73e9380e6

SHA1
9169750af700c0f616f3a7cda0b87500a5124ff0

SHA256
0a328cb4a949dad01b4d433e3a03d6b81255ef5c2a3cff3f01e5ca0842a30050

SHA512
9268d118fa7f0e265a3c878691f30825de861fb730974fb89defc688786b84e8895e9e74ce3288caca72a4bc281ea570a40d162076b62cb3e7e750eb806ff75e

Download Submit
\??\c:\windows\system32\spectrum.exe

Filesize
1.2MB

MD5
58f488bcf786ed98012b85495f0721f0

SHA1
a19e960a0109bfe027d385d8f3ea8b8d2d01f561

SHA256
bbbbf07e00ba8a4e12d649bf54afab4897283ff0f12c3a9f802d76b94059c551

SHA512
019aec55445a9fb3c46c6e5b6e49e3474f1bb2d1ec4d70a2030888ce3d27fc9d3bf54e869ce7971c7e04c8fba98f0cfa4a38ec77dd733a69d4ec97787fd1627a

Download Submit
\??\c:\windows\system32\tieringengineservice.exe

Filesize
717KB

MD5
617e9c9296af63924ba56c5618a64c6f

SHA1
c669354f7da085b7a8a9eebd21221742c4f320ee

SHA256
3d31c6e2355e6d37a3f9eb0648a7ede66724609d7c588d7bffce7ac6f4db86e3

SHA512
726bf88ce8c7f8f59e4ff266de993fe88e7097d511ad9164e460549ec300c9e1876785f8312f28a044be0e8715687aca1afcc846b2900b67ecccbfe1885ffcad

Download Submit
\??\c:\windows\syswow64\perfhost.exe

Filesize
420KB

MD5
1ba05cf982feb0da16ad9f06c4b8f0d7

SHA1
fbfbb64ae8aeb530f7328a5134dc97ce1f4bfa9a

SHA256
a4bda1242d9fdaae8bc9ff598d55cdcc50bbd5fee1216ca027951a0fde0e6653

SHA512
19a315e683518ef7acbd778538ad69774f0e5003fd476f93f6913d3981a20baf16641c7643665c6965d4af982fec47b2dcdbd8d64c4e56b1f0844f01ad10359e

Download Submit
memory/1416-9-0x0000000000400000-0x00000000009BA000-memory.dmp

Filesize
5.7MB

Download
memory/1416-4-0x0000000000400000-0x00000000009BA000-memory.dmp

Filesize
5.7MB

Download
memory/1416-2-0x0000000000400000-0x00000000009BA000-memory.dmp

Filesize
5.7MB

Download
memory/1416-12-0x0000000000400000-0x00000000009BA000-memory.dmp

Filesize
5.7MB

Download
memory/1416-11-0x0000000000400000-0x00000000009BA000-memory.dmp

Filesize
5.7MB

Download
memory/2380-69-0x000000014000D000-0x000000014001B000-memory.dmp

Filesize
56KB

Download
memory/2380-68-0x0000000140000000-0x0000000140137000-memory.dmp

Filesize
1.2MB

Download
memory/2380-32-0x000000014000D000-0x000000014001B000-memory.dmp

Filesize
56KB

Download
memory/3200-49-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/3200-83-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/3300-5-0x0000000000925000-0x00000000009BA000-memory.dmp

Filesize
596KB

Download
memory/3300-6-0x0000000000400000-0x00000000009BA000-memory.dmp

Filesize
5.7MB

Download
memory/3300-0-0x0000000000925000-0x00000000009BA000-memory.dmp

Filesize
596KB

Download
memory/3300-1-0x0000000000400000-0x00000000009BA000-memory.dmp

Filesize
5.7MB

Download