umbral | dbe3ee56b5cc22b5309005a8624b7cc24f5f7260e9bc38d8d223875f2fb81ba4

Analysis

max time kernel
900s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sultan cracked.exe
Size

2.0MB
MD5

000142d2c4961a9715157529ee679f27
SHA1

e12ef916e551260a295cad737602c897781cc656
SHA256

dbe3ee56b5cc22b5309005a8624b7cc24f5f7260e9bc38d8d223875f2fb81ba4
SHA512

b76fbacdc4bc8172c948d2d68b2506e4c69b43d4462765dbdab37cbc773c081132b555ed072e39e5a5666f734d62374512d9ae4a0660bc90c8e7db0218bba0dc
SSDEEP

24576:Vof3ZI06UZjoiAuB2Tu6kbRTYnnk2FbMNyBo4kx929bL3Hnx1I88:a/Zsxu0zq5QnJB+kn3HnxW

Score

10^/10

umbral spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023f66-27.dat	family_umbral
behavioral2/memory/1760-34-0x0000016BFD580000-0x0000016BFD5C0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	sultan cracked.exe

Executes dropped EXE 24 IoCs

pid	Process
4756	ERNS X!TERS.exe
1760	svchost.exe
2492	alg.exe
924	DiagnosticsHub.StandardCollector.Service.exe
2632	fxssvc.exe
4740	elevation_service.exe
2860	elevation_service.exe
2020	maintenanceservice.exe
3492	msdtc.exe
736	OSE.EXE
4192	PerceptionSimulationService.exe
2872	perfhost.exe
672	locator.exe
3412	SensorDataService.exe
4904	snmptrap.exe
540	spectrum.exe
3936	ssh-agent.exe
4812	TieringEngineService.exe
3244	AgentService.exe
3676	vds.exe
4360	vssvc.exe
2948	wbengine.exe
3960	WmiApSrv.exe
1712	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
3	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	ssh-agent.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\spectrum.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\wbengine.exe	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\fxssvc.exe	locator.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	locator.exe
File opened for modification	C:\Windows\system32\dllhost.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ssh-agent.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\wbengine.exe	spectrum.exe
File opened for modification	C:\Windows\system32\locator.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\AgentService.exe	snmptrap.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	locator.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	locator.exe
File opened for modification	C:\Windows\system32\wbengine.exe	snmptrap.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ssh-agent.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ERNS X!TERS.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	spectrum.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	locator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	ERNS X!TERS.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	spectrum.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	locator.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	spectrum.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	locator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	locator.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	snmptrap.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	spectrum.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	ERNS X!TERS.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	msdtc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	locator.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	locator.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	locator.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	ERNS X!TERS.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	spectrum.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	snmptrap.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ERNS X!TERS.exe
File created	C:\Windows\0704.wav	ERNS X!TERS.exe
File created	C:\Windows\ACTIVADA.wav	ERNS X!TERS.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	locator.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ssh-agent.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	spectrum.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a2a82e96f9ddb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045b74de96f9ddb01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aaad07ea6f9ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002311cce16f9ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f20e29ea6f9ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a1bc5e16f9ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039029ae96f9ddb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000baed5ce86f9ddb01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a07447e86f9ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078a03deb6f9ddb01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe
4756	ERNS X!TERS.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4756	ERNS X!TERS.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4756	ERNS X!TERS.exe
Token: SeDebugPrivilege	1760	svchost.exe
Token: SeAuditPrivilege	2632	fxssvc.exe
Token: SeIncreaseQuotaPrivilege	1712	wmic.exe
Token: SeSecurityPrivilege	1712	wmic.exe
Token: SeTakeOwnershipPrivilege	1712	wmic.exe
Token: SeLoadDriverPrivilege	1712	wmic.exe
Token: SeSystemProfilePrivilege	1712	wmic.exe
Token: SeSystemtimePrivilege	1712	wmic.exe
Token: SeProfSingleProcessPrivilege	1712	wmic.exe
Token: SeIncBasePriorityPrivilege	1712	wmic.exe
Token: SeCreatePagefilePrivilege	1712	wmic.exe
Token: SeBackupPrivilege	1712	wmic.exe
Token: SeRestorePrivilege	1712	wmic.exe
Token: SeShutdownPrivilege	1712	wmic.exe
Token: SeDebugPrivilege	1712	wmic.exe
Token: SeSystemEnvironmentPrivilege	1712	wmic.exe
Token: SeRemoteShutdownPrivilege	1712	wmic.exe
Token: SeUndockPrivilege	1712	wmic.exe
Token: SeManageVolumePrivilege	1712	wmic.exe
Token: 33	1712	wmic.exe
Token: 34	1712	wmic.exe
Token: 35	1712	wmic.exe
Token: 36	1712	wmic.exe
Token: SeIncreaseQuotaPrivilege	1712	wmic.exe
Token: SeSecurityPrivilege	1712	wmic.exe
Token: SeTakeOwnershipPrivilege	1712	wmic.exe
Token: SeLoadDriverPrivilege	1712	wmic.exe
Token: SeSystemProfilePrivilege	1712	wmic.exe
Token: SeSystemtimePrivilege	1712	wmic.exe
Token: SeProfSingleProcessPrivilege	1712	wmic.exe
Token: SeIncBasePriorityPrivilege	1712	wmic.exe
Token: SeCreatePagefilePrivilege	1712	wmic.exe
Token: SeBackupPrivilege	1712	wmic.exe
Token: SeRestorePrivilege	1712	wmic.exe
Token: SeShutdownPrivilege	1712	wmic.exe
Token: SeDebugPrivilege	1712	wmic.exe
Token: SeSystemEnvironmentPrivilege	1712	wmic.exe
Token: SeRemoteShutdownPrivilege	1712	wmic.exe
Token: SeUndockPrivilege	1712	wmic.exe
Token: SeManageVolumePrivilege	1712	wmic.exe
Token: 33	1712	wmic.exe
Token: 34	1712	wmic.exe
Token: 35	1712	wmic.exe
Token: 36	1712	wmic.exe
Token: SeRestorePrivilege	4812	TieringEngineService.exe
Token: SeManageVolumePrivilege	4812	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3244	AgentService.exe
Token: SeBackupPrivilege	4360	vssvc.exe
Token: SeRestorePrivilege	4360	vssvc.exe
Token: SeAuditPrivilege	4360	vssvc.exe
Token: SeBackupPrivilege	2948	wbengine.exe
Token: SeRestorePrivilege	2948	wbengine.exe
Token: SeSecurityPrivilege	2948	wbengine.exe
Token: 33	1712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1712	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4756	ERNS X!TERS.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4756	1544	sultan cracked.exe	88
PID 1544 wrote to memory of 4756	1544	sultan cracked.exe	88
PID 1544 wrote to memory of 1760	1544	sultan cracked.exe	89
PID 1544 wrote to memory of 1760	1544	sultan cracked.exe	89
PID 1760 wrote to memory of 1712	1760	svchost.exe	99
PID 1760 wrote to memory of 1712	1760	svchost.exe	99
PID 4756 wrote to memory of 5716	4756	ERNS X!TERS.exe	119
PID 4756 wrote to memory of 5716	4756	ERNS X!TERS.exe	119
PID 1712 wrote to memory of 5744	1712	SearchIndexer.exe	120
PID 1712 wrote to memory of 5744	1712	SearchIndexer.exe	120
PID 5716 wrote to memory of 5752	5716	cmd.exe	121
PID 5716 wrote to memory of 5752	5716	cmd.exe	121
PID 5716 wrote to memory of 5768	5716	cmd.exe	122
PID 5716 wrote to memory of 5768	5716	cmd.exe	122
PID 5716 wrote to memory of 5776	5716	cmd.exe	123
PID 5716 wrote to memory of 5776	5716	cmd.exe	123
PID 1712 wrote to memory of 5860	1712	SearchIndexer.exe	124
PID 1712 wrote to memory of 5860	1712	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\sultan cracked.exe
"C:\Users\Admin\AppData\Local\Temp\sultan cracked.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\ERNS X!TERS.exe
  "C:\Users\Admin\AppData\Local\Temp\ERNS X!TERS.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ERNS X!TERS.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ERNS X!TERS.exe" MD5
      4⤵
      PID:5752
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:5768
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:5776
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1712

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2492

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5080

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2860

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3492

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4192

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:672

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3412

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4904

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3936

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4360

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5744
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

Filesize
2.3MB

MD5
e336de204a561c956842dc30eff61a95

SHA1
09ca40614efa2273704adb87e93e6dead41d443d

SHA256
a86d17bd20d717aed8cab1b0e01a30b6e7130b1854c1da0ed48c2cc50cb98b28

SHA512
dffb7d895c458fde13a9028c3bbaa7b79767fd8ae6abf2b598a0ddaa15921ae24a789bbcd65769702378ed1a418f7915cb64da328688c268ff906bf4ca9bde9c

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
d87f8badea68808c57086a12e62d1c45

SHA1
f7a6213b9bbc909b9ca7a5f5facb9ff0ab07d7b9

SHA256
1670a8cd94be28bbed325408878c3823f3c3977f6728ded01f8e4008b257f021

SHA512
19f1c170336406ef1a79be8fc0ac651bb84dc223819ad513d8cbe6978d74f359835705671f0efebeda35558c0788949724de7c2d63ac1efe1a7ed7b45bd8164b

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
1.7MB

MD5
c17cd8f19a329e988d8faac390f8a974

SHA1
1a5a4e808067c17d80db2a9ecd06f711bfc39d8a

SHA256
082ec4092b5128f429bbc6daec9e4086feafb941640c1b9febb9a6790a76b456

SHA512
0c4b542460eb1f47e7fc3132953b39545fb9fd7a7e71a9bdbd17d2757598ee3c3144cd05abf9e6bc5f1d0286fee6729f9031aa5c5d5ad63b36c24e13d0a2a9ac

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.5MB

MD5
12a164f8f1274979cd9f391975858673

SHA1
3052183d2122289ede0c2b4e0565d4346aaf09a4

SHA256
8e630c081d529a6aa21867f279d664f817652cf2a958b9a33fca5f83943665c2

SHA512
f9cfbb97eec4d514fc74e1e835b82589a74d62f4cd3a43d264cea23d31d538ca397f07baf53bccbbc6b3ace40a9bdcc1320d8ff27edae40e7e38a17b2a056d8e

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
1.2MB

MD5
6a98e8c8530db1bb9f8cbf98eb7ef11b

SHA1
e2bac54e719204a7162cc92feb3d9fd7382596ad

SHA256
3ffdc35a148557aac4338c7b328e153cb265414a1947b335c7380011e07a7f55

SHA512
4e27178d01e88f7e44c8f53a20b0818b65c47c708793671f9b7499b883e9d24d585d1dbcfdb18df8dc03d365e5cea2f8c78e6296c91833fdcf1ed6a07c8f8441

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
1.2MB

MD5
b209a5e2afffa83b80c368266eb9ad0b

SHA1
61dc034d6823de438775f8c6273d7ce11b9d0f37

SHA256
f8da842f678f1dcc61814b96ff529cf01f9458b344fae241587914208a5f8e99

SHA512
7f3456b782495c4e59ddd21e6e219e33ab6d1fef425401577563e2d110361e18e156a328ba8ac472ab9b887ef26bff675a2c48c309c1160e4606b983cc3e8b9b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
1.4MB

MD5
cc9b2aafe801864c8f927e41000c1920

SHA1
f2bf2dd348df5e4c6e5e594850aa8d5fe6ab6089

SHA256
75a236b8ad7ac77e37efbc5053417ad004624d90d9f7ad8148386fe21e0bad4f

SHA512
67ac40d9249ea3264c3e1959fabbaf4e091ae0bf059c3e86293afe1f0b8d2d7c6142d9b9bf8ad889caf4bbcf50192d3ad99fb63e541ca83ef8179ba5bcc3caa8

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.6MB

MD5
4f7348a376cf296fda82a3651b5c9a24

SHA1
25c5e256e1d6947d87d4adc00294ae99ba856058

SHA256
f2dd33176142357427984fd259a796c4e5699c14da9b6e04df3cbd5595631bef

SHA512
2ba16c337be231554164c7de5df83c8a1dec537a9e4708014801147e8f9ac7a56c0d6e79f8677974a78640be277c94ea94556f523ea616c5a3e8f1778ac03c1c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Filesize
1.5MB

MD5
3c7a603988444fe9b30e36a7eb66c7cf

SHA1
f03788634684fd91d2fbc33f4a59dddcb3d356b0

SHA256
1cf5f32414b70e6e8f03e45429a5866feaf15e53c0fcae87f750090dbdd0d55e

SHA512
6101d68b3685e18fee8e61e97b580fa387b7bbc5835c6d10ff01f457805707ee8bd3676c2f7ae6744a30d730708c1391161773824a9ccd5285ed6d379038d01a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Filesize
24.0MB

MD5
e7395ffaa13fbbe15d577e67d2cc095d

SHA1
a49179dffe3291e8289303bb1382fe4abee8fd27

SHA256
197242243e184de2110f4fb1d1bf08b5d9c0767700f2cc46b0f0a3c3f22f8b42

SHA512
5d73d61bd20f4750985d4e181b860e5c8d4e1a263a14b42c359f947db6a4384fb7aa9c1aa568d912c75ba093aba50be21110d017837cacc72077ab767dba9390

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.7MB

MD5
89319ea925e1c1382099b6d78217c64e

SHA1
f2eb2ff4aa7bb2863544acc5a13c8bcdcfc64091

SHA256
dd3391aa69dc4b66198fc48b9472edb89d3cd284d34fd9db68079201349c4d9d

SHA512
ca713862c7069271326e2c632be8b9a9037f0c4e2e390ae8ac8181b8378f6c09fb0be6b8be0d62424d08feb9c2ed4646099e7a2079fc8a2c9b1850ce11be9bd4

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Filesize
1.1MB

MD5
942767eb24724e4bcb56046fe952317d

SHA1
658a1fed8c6512f0121f654a24fe4a9ff064f286

SHA256
afc89b952cac9814cd490e94592fbdf4203f0c4b4b0dfba286665123c63bb474

SHA512
995edbe7b65ad0f4f5d84f9109aa01011d0f427d6d766b1c6bba43fe316b1247abc29fe8d6871c6dfb94c21303c395ae694cc5d187b8cd116270a02b942c8539

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
bba70a6eb62d25b561597b74b5c666e0

SHA1
08a3919d744d86d35c9057c2e9ee570e97a7db7c

SHA256
10ee1931269ddd0952da94e46ce0806004bf21795f65bb3d32e983c8e12f5db9

SHA512
3be5f5ec258e37bf98e85e52d1b5fd3ca35c2fcdffcff3a1bc3516f46cc8b9bf397fede71408efd25e54deee1a5b3d85dd96f3da04469562da65f976df094759

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

Filesize
1.3MB

MD5
3d0dcd2333dc2d97198c2dbb2a327c5a

SHA1
aac4355ed721cbfa3ba06e41a6da2696a102e3ae

SHA256
e06a80d1adea8c24c199dc2e66c8a682cc70394614e581348aed553a7d164a54

SHA512
0eb2d02c8d0777fce552357e97793a8ccfebd2844bf037d67a423fc81b914b1c8cddc54ee2c4e9d84dea6b882c1130643c2b5515a24452af6d83336df766418e

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe

Filesize
6.6MB

MD5
ed396d2e18de70b041d4a7de8ebb8f57

SHA1
59b968b2c282c36ae1c0d08ad29a4d7327dc84b9

SHA256
72865329d869be0af17a40e81a1eecabae3d6cc1111a2e7bf6ad0ccc0ef0da7f

SHA512
1c4f2227db3849ad9f611add7063449b3dabf98512d6a8bb0809f06ecc785c06d01d65a838a3e26c27fa9b1a4bc71bc593bc2fdc15d0550931d4ed7743bebc17

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe

Filesize
6.6MB

MD5
0c95554fb6555c42049191f54f63a1fe

SHA1
c6a8208936d7b0cc96fbae44ce75f0e75bef1ea2

SHA256
20bd63a498bc99f91c84bdf24a882145183a6bdc2f2c7b1da78a4603ec00ec55

SHA512
920eaaea11fab57db668dc4997bff85dcb83727af231e8f8e42bc83d4e0da8fc8da0bcfbf7d53eae91196e861c468af2ceb9f58e2296611163fb659f696b79f3

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe

Filesize
1.9MB

MD5
ceff42ae9923cd8a6ec5f26d18511e49

SHA1
746cc0878c8c967c857e943e4daedf5d3cfa7f30

SHA256
4b7a297cc98f0ffae91c6669adb043e8dbf61f1335eac27af4a273f8ae77b3f2

SHA512
23e12200f982caf5ec5d9e6b95e487ef8c52fd953cc3556da27a222460815403d76186317ef5746684ffe77192ebf06a6e3546b15b055cbb5cb06767bb2bcf3d

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe

Filesize
3.3MB

MD5
1cdb0425af1f640a5afdf4c76007ef2a

SHA1
f5d05c78666e4a74d85fbcbfef1b8547ecd9805a

SHA256
d546989c13851d62741852cffee4490b03755da495341ac3c3d7087dc1614ee5

SHA512
7403783f37e3bfcb729caf4129e452d044b8d9659ec05c19f672147e7203028c753f8a5bf28e5e8825e2d6f2eb714b55fee7badb45778f19d709da052c939907

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

Filesize
2.3MB

MD5
c0160895351c2c0d1624a51b31fb31d4

SHA1
712778f26c4e03ff62e505d47e984cec03fda58c

SHA256
a39975c51fbe687d90e6af2581c9db43faab18d93f4b7941d65c9e554632e36f

SHA512
814ab6df3719ac1311aeb9a20d92d39934fb4d565d3eb87997af57c032171c0bcee53e41e007bf6fd3605a8b98b2e18e6594b051995de9e2ec1c232292221409

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe

Filesize
1.9MB

MD5
86911776c1e96948dc74454369057b85

SHA1
efbcb5734b004442a075c0f411690df5ac35c34d

SHA256
4ed9f7dab8cc7284d988eaf4cb2d715e3f38ec008e6336f67b6aeb10f523658c

SHA512
6eaf37370545230c37952dbf775f7b7a6c8e027d5ae0b964b8fee24bdae1916ff03e023932659756b18eed15da11f15f70e3f037200399faf65e84ed8b91cd9f

Download Submit
C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe

Filesize
2.1MB

MD5
4c99e00319023148efe886d732e52643

SHA1
a1a0380664756d194317eed86cd8d1958e907cfc

SHA256
fbbf3a247a92b60fe264d4d61599cfc83946dfae02ab29e2e58071da65287705

SHA512
984e73f9ad0838dd373a9a70dcce415b280f949b7ad0e1fbb43ecb2d8d957d6700ef4c96e53aace7e019aea3578d5b86dafd13fe1a1f8a8ea969ebfa5a2b3092

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.6MB

MD5
b77027431adaa4fd5a3759fb1b23ae83

SHA1
cf6e6e9f89b89a704a37fdc65023198869d1fe04

SHA256
686d24ec199485d4ece637a9561ce62bee02228b6a9ab0a261ee5d7bd9226583

SHA512
e087dd3e60c6117a5ec9995e27b657c5b72c8a272bdf6d582b34af41a12ea10e0d9d19f377d35a22561bbf59bf1788e2e4f19b38deec64e879d5b670ffd529b5

Download Submit
C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

Filesize
1.2MB

MD5
0b6ecde1827bfc9a97933cd236475700

SHA1
bd8d844fc531cf2a8ab7886af93719ea759ded77

SHA256
fe93cb48f8f677d56b9f590d75e43b16c08efaace52cc1821d4bde6df710fc3c

SHA512
dfd9b99c9ae45024b614aa38b5fd717a1ab1d75402b1fffaf86c0fbbbbdba871bff0e3f77d95533bf583a640c186b3ffb73cae38839c900585e886769508b2a2

Download Submit
C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

Filesize
1.2MB

MD5
c00409ff3581c30af0bc9887c5012803

SHA1
5d9ced01ad7833ef9f4590e7b9729f177ab370bb

SHA256
6a50c74c833c011cf0036dfa82425cf750d360d7e936ff1e102065b47337c0d5

SHA512
1420596da50798735cca2619d7523cb9472b96cbf301072f9d7b5358f2f942fcf6275fd3239e22d97114539b52cc23d7153fc0a28bcdc13c259e6af91991f374

Download Submit
C:\Program Files\Java\jdk-1.8\bin\idlj.exe

Filesize
1.2MB

MD5
dff0be8de1ede2f767f6d591e5699621

SHA1
412107374fc7213295f6c28e868707f574d20784

SHA256
b127ea6d1efa192ea2505c029fca89542db1e614c1b97575b6156ba2fc4019f0

SHA512
b653da5d1304616488c7d3bca933999c47b4d83c68300b01a7fa5a2c81e1d738dce2bf6daf56aa1972643e64b6df0e791a28557b3de2327f7cea89ef3fcfbbda

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

Filesize
1.2MB

MD5
10e9c8417f4e06cc06f5805bab13e7d5

SHA1
aa3ebdfa91676b4374666dbaf439d7c9d351af88

SHA256
3edbe4cffc10329f46717bef8e1c8f8b9ed5cb6f5dbdc072fc8ae959ee822196

SHA512
e34595f8e80e728fc5a9002d972bd0a59b9a040ece9936b345d92a913d0a565943f9fbb7ab03344b287d1fbf00bfe48656daf772d913f51110c8536f367618c0

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jar.exe

Filesize
1.2MB

MD5
a20385ac626f83946da8f114efbc0d20

SHA1
cc31ae19d4d6925538da4babd35c08ee2fe19ff4

SHA256
b219124ad1f00718f6ccfc4e1d16f7881eba0bd477f9dcae648d210d54a039da

SHA512
45c6dfcb0e3a2e4cf766a6cfafe12d9a44773388817543bb956a179cc50ef3a83dc769fb3c693fbb2a1e2894468228528c4d533d4746e54e9357c9038b3cf934

Download Submit
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

Filesize
1.2MB

MD5
d77388b5e2dfc29252201f0c12794a63

SHA1
352addebeda60ca428c17396fedfcb17d9502b30

SHA256
906c1bf7a83d13e9e1c75914b96e878ac081c4ea072f46961bbf161361fb9fcf

SHA512
6d6a35cef0caf1b29a6cc9210974e924ea4e471bc542138cf108fb509bccaf71c551e24ce39522ab42bb0491ca58c1d07ad04d843c0dc5972b3d8b96452322bd

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

Filesize
1.2MB

MD5
34472afb2cc7164a46ca96c8d41ccabe

SHA1
ef11fa525bfaa49609d0c7da5115aa2271da7b55

SHA256
a0574a6328fa661c3c7319b0a92be78329899f2e3a4fc321090d6cc6531b9a03

SHA512
70135b1299b2bf52bbb624dc0890c407f4bc39f724071cd39fdcd8538dfc05be0812a5fe5f4a2b1377fc8b89d4d0f40a41a070a202f756a62b3e39ac161fbf19

Download Submit
C:\Program Files\Java\jdk-1.8\bin\java.exe

Filesize
1.4MB

MD5
cead29255903618411a1d6418b2d03bb

SHA1
24ad9fc19c79c68ade41fcfb360e7a778814d5bc

SHA256
274a3f606c83a86d4bb2546e067a42ec3c88d8a7f15bfce631f9592205306b44

SHA512
12b926bc93ffd9604503b9f51193b2688df8e1f18b3ba3ca03cdbb7e5f17589f2db60c83f5df1cc48012e42e06823bbcda822a39049f0fd838e7dcaa6f409d42

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javac.exe

Filesize
1.2MB

MD5
c7f09a7a99c30c61766192eaca1cd015

SHA1
d4624a3bbe6668f9f3d024e4cf423011fc93ccae

SHA256
0235de9270eb7feeefb373a590f6c37f055e96de1b5ba1f57c1f247cb6e50085

SHA512
bd1b55672fbadc1436d8c48728b8d09db7c87b0b0c4b4fd9a4de7309700f6f7f6015980e4425ea3fd1e2d2fe1b7b80774005ae6d4dfe759a67ceebbba263309d

Download Submit
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

Filesize
1.2MB

MD5
b57225b3b544333d3f6e710cd68cf7fb

SHA1
ec17f9f1fb1575bb873b00d7a863d829f0284117

SHA256
7401d3da06582097530c8c36cfcf0bbbecbdf694527e9086e5d63a301052d8a6

SHA512
9fdeff02fd3e748b98d7fdd032ed7d47f2b73541287f30bdabf9010eaf468bb7dee5eb1099e16e8987f403e4da38182f80b93990556d979bdb05954004a09201

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.5MB

MD5
a8290d1c0b1c23727c099f907e159619

SHA1
e105e656e069dafa47bed9d051d7c931ba27bab7

SHA256
7c8a5d9bac06be56ac94bedd6952c7ade871268e86ee38e91538be3944029766

SHA512
17750b993137efd6df873a190d7acdd734a9171334728580587628268ac90aecbc552ff15e79210c5e6029ab89a4e33f8157e0a744a7e058639cc3d97e86b4a1

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
1.3MB

MD5
387f5433149bf3472cb8a211d32f32b6

SHA1
ebdabad43af9d9d90468a7e95e64ab4f906701d2

SHA256
32ecf76156eed4b8b7a46c8d97e39d488a6077592e89c0d604a5257e42b49b37

SHA512
ec23b94b486ed4302e0c7a1707eecb5c13530a15f1ad663aae66b46fca72637e9e96b01a8367248e98c48721e089de26668241265cf70f46639db864d26942af

Download Submit
C:\Users\Admin\AppData\Local\Temp\ERNS X!TERS.exe

Filesize
1.8MB

MD5
8c110834053f57e14ced24c9e8b135c0

SHA1
e244e2a297059871cb28b75b1ea755d356ae60ec

SHA256
63ad8f6ab5596ed4ea35936d726fdecf520d5f70d6a976c765d8c59341f1e118

SHA512
77c25c6f2cb8aa004760c845358074bf2995382965578048ca7be3b32a10646983dfef6dda3ccbc022b7546bd12da5eb293406c39ba44e7679879750c0ac58b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
230KB

MD5
e8b96113d79f611db9ef00ef0a3f9dfe

SHA1
2b1031c270cbb9aa3f0f60f41aca340c43540e6a

SHA256
4611c4fed4d9baf0bff00023a23a5e039208452da1460c4d0ea0ff90a04ec54e

SHA512
7121fe3982912f345ac07bbe823ccc04e5a03d9d4097ac167e3aa5544803aef31a76cc9395337b3d0f8483e626e9567f113bb89db8c60375fa84ba65a50f1f7d

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
fe7b2e56192f51000e83811a70f8ad57

SHA1
1e89419605e4a83f3685e891c042172f7e975b1b

SHA256
76cfd14c817fab0d835881b2e10e2a6628a08d6b64e011254861ca6a389c5ac1

SHA512
f5403187f8a42c726ccc51b2c42426004bda6814b39ceaf389bbfe5a2e9838994cfcc9493129a59e22b140683789a77cb8124899fe6d750accf9875ae25692dd

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
c490fb20a01274aa73c97fda625fb6cb

SHA1
9d6f7dd6e72b6127cefdd6f9e0b442955664ab89

SHA256
294d0fc6238d5cf5963610242c97382e521ea4975b236b965d455fafa8962527

SHA512
12dbc1d8b721ff86f23a26b6e8e8d660d3e712db15d124c263d9d1d362ca4c82781cac12ac49ed8e039bb8394801fafa5472feb9090886ac3d3f0c1b11e18750

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
b536899cd8f2958d8ad2d99bca11f2c0

SHA1
a0ee83036e515ad733e65b62df27ddb2fdc04f52

SHA256
92f456b5862ceffc34c93ef8dbd70b124b644525d27d1da7e2025c1b7cdee878

SHA512
8cc160ce72914a7de9f187f96d75cb1b80bd1ebd49eca28c5d2bd82a6ca2da2eaa3eb5dde6474069f7afce88b8e8b4fc091a1416b303070d3edc3913d72cd530

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
88946294920de302e7863a253d763967

SHA1
9f67cee9b3bd87f23dbe1ff0fa494c346cf67334

SHA256
3d7941a2bfc91fba733f73a48fdc507dd9859d3c149becdafcaea598f8fe470e

SHA512
4d798a9b3815e57183ec156680f03cdbd951b2fc25c6999486ff0cda055bbfb8812047a389312da97fa3973a5adc36d9ee8ee536224f3811e43319f38ce4f58d

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
76833817b04e95403a4e1c24d794a5fc

SHA1
3759c49eccbcf7b7a9f214ec0a8cf121d033e7d7

SHA256
fa29d320549f448d2071aba2401947e66c2d2dd26e04fe124768962757334002

SHA512
edef4e7a8b1b890345b91316cab56e71445807fcacfcb88ab014c3511861e7c8405da513808b916d07773ca05482352b88d8708f40c790d5a4a719e1d6429ac8

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.5MB

MD5
be065e8b837bf01ec4677df01c02a685

SHA1
cd089fbc4a7ba10e00b77843269995e8be0806b8

SHA256
ffc45a640055c574e8d73288230179f019ee173fb569622ef239976d665f9f5b

SHA512
6544c75b275ddf509429efd337abc7c200ec489e6ff1a5e37d1b21600a6a0bac5df4d0c73eb183fea9eca03b300dde71020c4344e45a001626aff717278cbc6b

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
21a0d43b1b54622f2b0a2a96fe11230f

SHA1
97bdd129a2953d9efabcbb4559299f548375f202

SHA256
4af20886ac8664c1d9909efd42a55a908c68c851f98b56546362db771e35b400

SHA512
4d1f6042d44cff066a21f45d039b708e68affa1628cab969df1a9c2dce8d53ef47883d1550c62432f072587112141fa8c06f2491366f4d371346f8f95563a2aa

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
ff9f836bbbab804d6a08b81d2a945337

SHA1
ebeb99bd40703861aa6234f8229935cc19c16627

SHA256
671048ecd390062ee82ba0789e5cdebee2472e7ba8d595082835dbdf8f13bb69

SHA512
c057e9bb38ca4335ff45e480ca31b4baec2e6bfd654440d003588afe7f9e16a8a9c3ea79ce617e669d0fc7c3082bd8135d600917a3e7385dd1144130d07173d2

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
2b703cabc7bd5efd57be9719a6978b88

SHA1
fad3e90bf119268e5bb7b02df44e5e8fc953341b

SHA256
53c643afa9257f5d6813d199df083eb59f0cf8d51ba8d159a34ab3e374a88ec8

SHA512
1dd6e426a8f7a2906f1bc6c73a48d06c730b8d025d4a97ba2262f2de9bc110bd9a2a59b765d1b6f1081b549f5d914225b6518e157b2c492369a3dc2117b7df2d

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
1dbe305513d8b6a9f428b4c961009525

SHA1
c9bce0e92a8509fec15f43b5035ae43bad4711bc

SHA256
e8a7ffc92e76ca84f7deea64ce9f9d2f131865baa731d2c11bd8a46a6aa989a3

SHA512
2469b880339bf0af942b7ca45affe6eab2f8c7d44f571b8db1859819f8a0173fffb4d8207becc88ed76955b248523813baef4c8d7ec3e16f780e0e70defc7ad4

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
5160b936df277babaa71a1c08eddf17c

SHA1
d02ad61d9b60ce2d6768c044392fd7138b3b93e3

SHA256
1e30a84ab229a5218a828f65252f039cd41ee063cb20407e6dfb3a557b799127

SHA512
6b793f61245c5f780f627f3d14f3251119272448a416b65c8833c758f51c72cf1c32eca01a3de7472ca56befd5cbcade0d2aa3ea9f89249be94ab2dc8fb2c202

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
945fee434846dd7f38ba8931af862147

SHA1
65f14855006d654d69c32bfeafb447c4e8944656

SHA256
966b52ab983de5a1cc689e0f6c644e1a72ae8e5d6597e7fe04113636728f4874

SHA512
beead8a9a30c8cb88785ac8ef942259b271c90eca389fc6a0b1699463aa163038da7ccb8238bdd46defbb64b69dbe7284a94f7275f6a93800a32bbf024849e92

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
60254355d78ae86db4ec9fb3fd042ce9

SHA1
f2a1ceeaff3a9dd904de7b4ac3f236bc933d2868

SHA256
643ce5ba9e0a04d8f7f55fbf06b6e66447ab06ca4735c0060f7a84b33d36166a

SHA512
2f37cbfda37303155848e6094830ebff7f15442627d035643eb58abb3f2eb324c5c8b7f8ecdf73541ab9be95a96eeed1c835b4154b84538a34ec693b90c68918

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
577c6bcdf59eb8ad566470f53ede044b

SHA1
10fe77c9843d73d3ca12f86e853c64833de55774

SHA256
ff91dc32b8fac2d807cb2a0357aef2198f8d8ea30c3d949f4f4f49949d4c5b79

SHA512
16c1f61dab82898dc1bd897bc9db955b88bdfaa640e1b78d74027c402dafa525740f0769c39bb14e4a23195659f6011271913cc2662acc7eb32f4851544a48ea

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
8bd4170e337297bf89b7e56c09d51555

SHA1
f88214e9b556be1cc93ce7572f6d895042fc4b98

SHA256
9cdabc437c0705ebf5458647c4067cee518e3d4aa724eb9f3e5081b5688eacb0

SHA512
49b97713f79605fd6315a1e79f0bc612c3c78e3426b440474aade2023c7527df75b70d0e3a85942b4b1522f686fb065b9bc430fdf18c060e1e87ffde2a5516bc

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
e32c02ac6747d233b36226d720b4c6dc

SHA1
dbfc0cfcaf08aa5cb4f6207fa41a671df87f57ec

SHA256
6b76ef5d3a686e8f28d3af2e491d51680516c5d7183c3c2496019f1a05c5bf37

SHA512
03662c0af21172747cabc52e082c03a0e98a9ce58ed9c8d13ba01f753a94f5ced90f2b14ae98eac54aefc6019459604f6563454cdd670b941d3abd2b07325e09

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
1602e7775a6f76ed38fff798336a04f3

SHA1
8e2455a88c80e06eb9269f2cf3ebe5ace5514b66

SHA256
b7049e1dc0192ddcb02391e91740e219d40c66af241be33f31ebe214145108c6

SHA512
99fb9f0afd0daaf65ae9f02b001281fccbb9511a19529b0a292032c35219b8d022b7942de9ca1a253b7eeb2bcd39de0be40c6404835d32538ce65017135e8549

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
8510dcecb7c5b05efdf89fbf58018abd

SHA1
8384ed6aa09d378afa07fb7dda0dda361122e0f1

SHA256
775b7a4c17aa0e7fef33dde8b6491d4652fe986829152380caded94fbfa4404c

SHA512
e92d23151d6b338b08b89caae96a37e49fe582d1d46249341a670b1c21e919114c194030dd3cfad83ac522dfd4c5c9d4996c44effeb6bb3d5b470c63a11caab5

Download Submit
C:\Windows\system32\AppVClient.exe

Filesize
1.3MB

MD5
9e11df96be6f5c5dc3d6b4c65fa30814

SHA1
e74bf26aa93546772e826580f7ab125cda9acbd2

SHA256
1067a467afece5fa40af3a1039db9974430432ccc39c94ea4fd37202b0bc70ee

SHA512
f8aab6771db7c43d7355f6cce75b0b729902333c392e7ee4b35f1a02f793976ea733ac504d9712e4db5b44e03dcc94ee8984943d8552d5393cc9f9add78fb2c7

Download Submit
C:\Windows\system32\SgrmBroker.exe

Filesize
1.5MB

MD5
b453a9a784f0eec36af0fc451e51434b

SHA1
8d334175636b324a375abb9e9ac10042b4ba2724

SHA256
29e1aca8e5e97f070b77c414c6496367ebed65941641c5f0492f0b3cbfedb959

SHA512
2e2b7d6a3183b832ec8ca652a7ac71aaa4bd3d7936113e4053a622dbbaa53f315cfad4a7490322d948f893e31c049ff80d15a0b06c0a30be6186636786255816

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.2MB

MD5
417d125ca2fc869dc943e56419f5c38f

SHA1
5b9086ada256923fd0985ad2feacf2d8f5e56bda

SHA256
ea6905efec59e6e0d085e36725f7c0be2ba455b6cdf3e034610daa821ffcbe4b

SHA512
b830fdc73c31fd6cf6a51ca0eacee88f61065011463baa53f5581d1fa86560e0c613c2b746da612fc5d84334635ff453601c93a3daecb3ea6c0fb81d2a130cf8

Download Submit
memory/540-473-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/540-201-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/672-291-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/672-165-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/736-134-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/736-254-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/924-176-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/924-50-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/924-57-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/924-56-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/1544-0-0x00007FF968755000-0x00007FF968756000-memory.dmp

Filesize
4KB

Download
memory/1544-1-0x00007FF9684A0000-0x00007FF968E41000-memory.dmp

Filesize
9.6MB

Download
memory/1544-3-0x00007FF9684A0000-0x00007FF968E41000-memory.dmp

Filesize
9.6MB

Download
memory/1544-59-0x00007FF9684A0000-0x00007FF968E41000-memory.dmp

Filesize
9.6MB

Download
memory/1712-308-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1712-517-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/1760-34-0x0000016BFD580000-0x0000016BFD5C0000-memory.dmp

Filesize
256KB

Download
memory/2020-95-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Filesize
384KB

Download
memory/2020-101-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Filesize
384KB

Download
memory/2020-111-0x0000000140000000-0x0000000140174000-memory.dmp

Filesize
1.5MB

Download
memory/2020-108-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Filesize
384KB

Download
memory/2020-103-0x0000000140000000-0x0000000140174000-memory.dmp

Filesize
1.5MB

Download
memory/2492-164-0x0000000140000000-0x0000000140148000-memory.dmp

Filesize
1.3MB

Download
memory/2492-42-0x0000000140000000-0x0000000140148000-memory.dmp

Filesize
1.3MB

Download
memory/2492-36-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/2492-43-0x00000000006D0000-0x0000000000730000-memory.dmp

Filesize
384KB

Download
memory/2632-106-0x0000000000520000-0x0000000000580000-memory.dmp

Filesize
384KB

Download
memory/2632-62-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2632-63-0x0000000000520000-0x0000000000580000-memory.dmp

Filesize
384KB

Download
memory/2632-69-0x0000000000520000-0x0000000000580000-memory.dmp

Filesize
384KB

Download
memory/2632-110-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2860-213-0x0000000140000000-0x0000000140266000-memory.dmp

Filesize
2.4MB

Download
memory/2860-90-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/2860-84-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/2860-92-0x0000000140000000-0x0000000140266000-memory.dmp

Filesize
2.4MB

Download
memory/2872-280-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2872-151-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2948-515-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/2948-696-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/2948-281-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3244-240-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3244-244-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3412-177-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3412-307-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3412-507-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3492-239-0x0000000140000000-0x0000000140157000-memory.dmp

Filesize
1.3MB

Download
memory/3492-114-0x0000000000530000-0x0000000000590000-memory.dmp

Filesize
384KB

Download
memory/3492-113-0x0000000140000000-0x0000000140157000-memory.dmp

Filesize
1.3MB

Download
memory/3676-512-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3676-255-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3936-214-0x0000000140000000-0x00000001401A1000-memory.dmp

Filesize
1.6MB

Download
memory/3936-491-0x0000000140000000-0x00000001401A1000-memory.dmp

Filesize
1.6MB

Download
memory/3960-292-0x0000000140000000-0x0000000140164000-memory.dmp

Filesize
1.4MB

Download
memory/3960-516-0x0000000140000000-0x0000000140164000-memory.dmp

Filesize
1.4MB

Download
memory/4192-266-0x0000000140000000-0x0000000140149000-memory.dmp

Filesize
1.3MB

Download
memory/4192-149-0x0000000140000000-0x0000000140149000-memory.dmp

Filesize
1.3MB

Download
memory/4360-267-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4360-513-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4740-82-0x0000000140000000-0x000000014025F000-memory.dmp

Filesize
2.4MB

Download
memory/4740-200-0x0000000140000000-0x000000014025F000-memory.dmp

Filesize
2.4MB

Download
memory/4740-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Filesize
384KB

Download
memory/4740-79-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Filesize
384KB

Download
memory/4756-11-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/4756-20-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/4756-19-0x0000000140000000-0x00000001401CE000-memory.dmp

Filesize
1.8MB

Download
memory/4756-133-0x0000000140000000-0x00000001401CE000-memory.dmp

Filesize
1.8MB

Download
memory/4812-228-0x0000000140000000-0x0000000140180000-memory.dmp

Filesize
1.5MB

Download
memory/4812-504-0x0000000140000000-0x0000000140180000-memory.dmp

Filesize
1.5MB

Download
memory/4904-189-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/4904-410-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download