blustealer | 9966abd2f2239c4ab9ef470ba0a76c3546645666976c45d7294214d283510140

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-04-2023 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order.exe
Size

1.3MB
MD5

293fdf1a86054e7f7ea5468093a32619
SHA1

556f35a6bc2f99c18eac6efc24772bcaea2c4dc7
SHA256

9966abd2f2239c4ab9ef470ba0a76c3546645666976c45d7294214d283510140
SHA512

dd89c55471e4573b14bc8b15fd5f268bc03f6c47d127bb3a07f70b3ff7ecf6c43f86eae13a2bf70d15baf9df2de198cbb5a18b287dff08027a7dbbb51d6d94df
SSDEEP

24576:dlDz26SjmWjOMnxBZL/gBDTOihq+6yYAJOxyaLYJydD4noK1kY2OdGJ306n2r6L:bDcmWKMx7L/oHOihz6y9JOx2Ig162OL

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 33 IoCs

pid	Process
464	Process not Found
1288	alg.exe
1644	aspnet_state.exe
1908	mscorsvw.exe
1944	mscorsvw.exe
964	mscorsvw.exe
320	mscorsvw.exe
840	dllhost.exe
1708	ehRecvr.exe
2040	ehsched.exe
1612	elevation_service.exe
544	mscorsvw.exe
1220	mscorsvw.exe
1944	IEEtwCollector.exe
2112	mscorsvw.exe
2208	GROOVE.EXE
2272	mscorsvw.exe
2392	mscorsvw.exe
2412	maintenanceservice.exe
2552	msdtc.exe
2836	msiexec.exe
2932	mscorsvw.exe
2956	OSE.EXE
3036	OSPPSVC.EXE
1256	perfhost.exe
2132	locator.exe
636	snmptrap.exe
2328	vds.exe
2400	vssvc.exe
2508	wbengine.exe
2748	WmiApSrv.exe
1792	wmpnetwk.exe
2824	SearchIndexer.exe

Loads dropped DLL 16 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
2836	msiexec.exe
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
768	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\locator.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\vssvc.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\159850c147bf3ad0.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	Purchase Order.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	Purchase Order.exe
File opened for modification	C:\Windows\System32\vds.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	Purchase Order.exe
File opened for modification	C:\Windows\System32\alg.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\dllhost.exe	Purchase Order.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\wbengine.exe	Purchase Order.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	Purchase Order.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 1116	1972	Purchase Order.exe	31
PID 1116 set thread context of 1660	1116	Purchase Order.exe	34

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	Purchase Order.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Purchase Order.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Purchase Order.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	Purchase Order.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	Purchase Order.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	Purchase Order.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Purchase Order.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	Purchase Order.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	Purchase Order.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C600EE4F-5045-4DC7-8764-4F5FC8254494}.crmlog	dllhost.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Purchase Order.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Purchase Order.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C600EE4F-5045-4DC7-8764-4F5FC8254494}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	Purchase Order.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{164131ED-2621-4F39-9D7D-9B4AC27F57C8}	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\	wmpnetwk.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1972	Purchase Order.exe
1972	Purchase Order.exe
1972	Purchase Order.exe
1972	Purchase Order.exe
1620	ehRec.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe
1116	Purchase Order.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	Purchase Order.exe
Token: SeTakeOwnershipPrivilege	1116	Purchase Order.exe
Token: SeShutdownPrivilege	964	mscorsvw.exe
Token: SeShutdownPrivilege	320	mscorsvw.exe
Token: SeShutdownPrivilege	964	mscorsvw.exe
Token: SeShutdownPrivilege	964	mscorsvw.exe
Token: SeShutdownPrivilege	964	mscorsvw.exe
Token: SeShutdownPrivilege	320	mscorsvw.exe
Token: 33	1484	EhTray.exe
Token: SeIncBasePriorityPrivilege	1484	EhTray.exe
Token: SeShutdownPrivilege	320	mscorsvw.exe
Token: SeShutdownPrivilege	320	mscorsvw.exe
Token: SeDebugPrivilege	1620	ehRec.exe
Token: 33	1484	EhTray.exe
Token: SeIncBasePriorityPrivilege	1484	EhTray.exe
Token: SeRestorePrivilege	2836	msiexec.exe
Token: SeTakeOwnershipPrivilege	2836	msiexec.exe
Token: SeSecurityPrivilege	2836	msiexec.exe
Token: SeBackupPrivilege	2400	vssvc.exe
Token: SeRestorePrivilege	2400	vssvc.exe
Token: SeAuditPrivilege	2400	vssvc.exe
Token: SeBackupPrivilege	2508	wbengine.exe
Token: SeRestorePrivilege	2508	wbengine.exe
Token: SeSecurityPrivilege	2508	wbengine.exe
Token: SeManageVolumePrivilege	2824	SearchIndexer.exe
Token: 33	1792	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	1792	wmpnetwk.exe
Token: 33	2824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2824	SearchIndexer.exe
Token: SeDebugPrivilege	1116	Purchase Order.exe
Token: SeDebugPrivilege	1116	Purchase Order.exe
Token: SeDebugPrivilege	1116	Purchase Order.exe
Token: SeDebugPrivilege	1116	Purchase Order.exe
Token: SeDebugPrivilege	1116	Purchase Order.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1484	EhTray.exe
1484	EhTray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1484	EhTray.exe
1484	EhTray.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1116	Purchase Order.exe
2688	SearchProtocolHost.exe
2688	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 840	1972	Purchase Order.exe	27
PID 1972 wrote to memory of 840	1972	Purchase Order.exe	27
PID 1972 wrote to memory of 840	1972	Purchase Order.exe	27
PID 1972 wrote to memory of 840	1972	Purchase Order.exe	27
PID 1972 wrote to memory of 1792	1972	Purchase Order.exe	28
PID 1972 wrote to memory of 1792	1972	Purchase Order.exe	28
PID 1972 wrote to memory of 1792	1972	Purchase Order.exe	28
PID 1972 wrote to memory of 1792	1972	Purchase Order.exe	28
PID 1972 wrote to memory of 688	1972	Purchase Order.exe	29
PID 1972 wrote to memory of 688	1972	Purchase Order.exe	29
PID 1972 wrote to memory of 688	1972	Purchase Order.exe	29
PID 1972 wrote to memory of 688	1972	Purchase Order.exe	29
PID 1972 wrote to memory of 756	1972	Purchase Order.exe	30
PID 1972 wrote to memory of 756	1972	Purchase Order.exe	30
PID 1972 wrote to memory of 756	1972	Purchase Order.exe	30
PID 1972 wrote to memory of 756	1972	Purchase Order.exe	30
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1972 wrote to memory of 1116	1972	Purchase Order.exe	31
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 1116 wrote to memory of 1660	1116	Purchase Order.exe	34
PID 964 wrote to memory of 544	964	mscorsvw.exe	43
PID 964 wrote to memory of 544	964	mscorsvw.exe	43
PID 964 wrote to memory of 544	964	mscorsvw.exe	43
PID 964 wrote to memory of 544	964	mscorsvw.exe	43
PID 964 wrote to memory of 1220	964	mscorsvw.exe	46
PID 964 wrote to memory of 1220	964	mscorsvw.exe	46
PID 964 wrote to memory of 1220	964	mscorsvw.exe	46
PID 964 wrote to memory of 1220	964	mscorsvw.exe	46
PID 964 wrote to memory of 2112	964	mscorsvw.exe	48
PID 964 wrote to memory of 2112	964	mscorsvw.exe	48
PID 964 wrote to memory of 2112	964	mscorsvw.exe	48
PID 964 wrote to memory of 2112	964	mscorsvw.exe	48
PID 964 wrote to memory of 2272	964	mscorsvw.exe	50
PID 964 wrote to memory of 2272	964	mscorsvw.exe	50
PID 964 wrote to memory of 2272	964	mscorsvw.exe	50
PID 964 wrote to memory of 2272	964	mscorsvw.exe	50
PID 964 wrote to memory of 2392	964	mscorsvw.exe	51
PID 964 wrote to memory of 2392	964	mscorsvw.exe	51
PID 964 wrote to memory of 2392	964	mscorsvw.exe	51
PID 964 wrote to memory of 2392	964	mscorsvw.exe	51
PID 964 wrote to memory of 2932	964	mscorsvw.exe	55
PID 964 wrote to memory of 2932	964	mscorsvw.exe	55
PID 964 wrote to memory of 2932	964	mscorsvw.exe	55
PID 964 wrote to memory of 2932	964	mscorsvw.exe	55
PID 2824 wrote to memory of 2688	2824	SearchIndexer.exe	67
PID 2824 wrote to memory of 2688	2824	SearchIndexer.exe	67
PID 2824 wrote to memory of 2688	2824	SearchIndexer.exe	67
PID 2824 wrote to memory of 1684	2824	SearchIndexer.exe	68
PID 2824 wrote to memory of 1684	2824	SearchIndexer.exe	68
PID 2824 wrote to memory of 1684	2824	SearchIndexer.exe	68

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:840
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:688
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:756
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1660

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1288

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1908

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 248 -NGENProcess 1f0 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 240 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 264 -NGENProcess 254 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 264 -NGENProcess 25c -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2932

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:840

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1708

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:2040

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1484

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1944

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2956

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:636

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2748

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1563773381-2037468142-1146002597-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1563773381-2037468142-1146002597-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2688
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
51f03c3c6a5545c82d8bc0c0de651ae5

SHA1
ee41ba62de5528914e34acb2d95004c4fdcda130

SHA256
68e4843c16dfb624f7d0ef8a2d8d5ace26c6899921f3ebba85520cd60d55ad85

SHA512
42df41ff4a7defe96732d227209e4bb228d283f1b574b3bfa2e0b25105c3b7087c3f10f35266e61b72e824496c0a5055449a528c71e46f2c5080c8b9539d0d26

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
30.1MB

MD5
03ceeaaea59c656d940ae77edde9ca16

SHA1
3d61e6be725bec95c5b3ee482c7f9290bb774e88

SHA256
be6f4cf0ce33b1137cd9dc790f03eba368696d30544abada2a722a10acb59a92

SHA512
fc3cf41fb305ad8e85b4ad8464195a665a18af669ec920be1cb653c09ebb70f1faea05d4a59c0e91c068b77afc57da74985a22c85754c2c2372b8ba97a046e67

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
153babfdb047a78ad86553c41fb3a5fb

SHA1
9d85220ff23e910e769e62c812236283f84ef087

SHA256
b73c575ed707bfd35b4266168cd006438e714ac3f168d2202099851b57fc970d

SHA512
b1f0cbc2a87e190c602d0393f7ac49af8f92c7c4aedeed3226484375f5296172170b7f91aacd033b7a5442e2409433622ff3db31071c216e01cb51197aa3b43c

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
5.2MB

MD5
a971b6f0c469c9945a4245a24b31922c

SHA1
95238915944234f9b34f7f7a4f25fbc67803728a

SHA256
1d213ed0b9a0df1fcb26c8cd971014142272a67b0e32931d72e7fa96211d933b

SHA512
24e2433b8868a4c55cef34fea206b9fe56e02f66cca5e52fb596b55c49ef703c2dab9d87ab0dc0e23aa4870af53ad058fc0fd2d7e7bab23821e01461703ae762

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
0f84a04f4d043377cff413aa8ac4c39a

SHA1
77504d726743f60ff9c881ba3bb42a53d1c64140

SHA256
277da2c92a5687427a2670a4a93197a9ed896255843992bd631dc4f7aa705c25

SHA512
49fb4a2585786bfad4025a648ec682ca859971e45a76c0a128f6afeb8b03323f34bc4866521f4a9c66768dbbbe9960d3d1f9f771cd399320ee7d0cb78ff78635

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
fc7fe823feb75de0a9340b82ce1eceaf

SHA1
cbb0e6437eab1ff49e06a3ec05a9b1fd75c62e3e

SHA256
a8d99b8b356634cd9498d2f11994a387dc54e8f84ef34417e6ac4e402c2c1e03

SHA512
56a34cb905b91928b6815c9d766c6b0dc05012cb05add20fc5dd35268f0795c9961af11c128c2ce23c00e889b20559966405e9d5cf3c1684413f005ea0ac5b53

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
db00eba02cdd2eadb056f64e63d3f6e4

SHA1
793ff1fb71239093af61d34f5e69ac1550842482

SHA256
1def3fabc184cc09761c5987a01358840cf126b30a17d3bacbd5906275c94f44

SHA512
b2504024342805748bcbe54b21d664560df24470b121115b6af0770ef44fc14193e4d19f0fe01f23be7451fdca85e61397c9746edcbddf2e7650e62c8f9065a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
54bf63a1148d08b34f504ae9ae460533

SHA1
e4623a2a74249405c11a173674c363b388526e55

SHA256
9cdf955f96a5fdb240aad9a5a200ffd3ef880c8f089827fc15a916b0da119397

SHA512
1d4aa1fcdc36c9c8e17beb3a10f948711e1c982a69e45a23a0bdf9035b14609f88bf85ab212356f8c9a5979b92c452c528d938334ea04634ed1cc65d86b404a7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
54bf63a1148d08b34f504ae9ae460533

SHA1
e4623a2a74249405c11a173674c363b388526e55

SHA256
9cdf955f96a5fdb240aad9a5a200ffd3ef880c8f089827fc15a916b0da119397

SHA512
1d4aa1fcdc36c9c8e17beb3a10f948711e1c982a69e45a23a0bdf9035b14609f88bf85ab212356f8c9a5979b92c452c528d938334ea04634ed1cc65d86b404a7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
89e9edcd2cc4f981a1c77b379daf641f

SHA1
c2ec88d9cbb6bd40ab164efff8c6bf1c06f386c6

SHA256
f9094ae5d38a90b183fd8da9212bdca0cd4a01128c24c35dcf979c0983399877

SHA512
f44c6fec8609a2234e081139a26807cdfb356449c189f7cb8dd3ec82c5d070b8f65d18843480124172fdb2f7f9ec84b8fef3c55ccb19fe66ef1bb0b879b2f4c7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.3MB

MD5
170b5babd87e271214355f70a2847fd9

SHA1
2ef32a5491ec333abf479ff3d2395fdd259f72ad

SHA256
73331b10237759014bee908edaa3bade9835a95bbea1c0a162503c3743679a33

SHA512
36100fbd75b77fcb803bfa6915f891f911fd5f9f938a730293c078b510bc580ffda2ed74c101fa78a1e0713e114656beb89df1dbc91c1189be5b8ddc42bfb40e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
df385b4632c6f2dc389aa5562aad7e52

SHA1
2c57f53d654a15fe9b443e4a2073c69e57aa96ae

SHA256
02538944db1bbaef2933a1286cd0179eaf69872152ef4ad1fbcb8c5544b17807

SHA512
30aebbc867cc889f747510177f4bb2cc3786989d4943331934090e40d65ca13c9270ae8abda7a5880e0c7d12436397c6e3f5841f6a3dac8faae55f32de6ba107

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
df385b4632c6f2dc389aa5562aad7e52

SHA1
2c57f53d654a15fe9b443e4a2073c69e57aa96ae

SHA256
02538944db1bbaef2933a1286cd0179eaf69872152ef4ad1fbcb8c5544b17807

SHA512
30aebbc867cc889f747510177f4bb2cc3786989d4943331934090e40d65ca13c9270ae8abda7a5880e0c7d12436397c6e3f5841f6a3dac8faae55f32de6ba107

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
888b5e51f1f4e2acf0be297d1e1840c7

SHA1
4712b63d6286272417dce2867a4fb7b92e2278d4

SHA256
9a73c1a87fd03de21f8dcdaf130d819c6e33d673c67f379eaf8a084229d3a7a3

SHA512
07adff429c777b112019a1932ee84d554af1ec50f2aa419799e7bf056dfef09eace8e83112076a134322bb32e8299d186ff5b73588b6379931525652c242cb8d

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
888b5e51f1f4e2acf0be297d1e1840c7

SHA1
4712b63d6286272417dce2867a4fb7b92e2278d4

SHA256
9a73c1a87fd03de21f8dcdaf130d819c6e33d673c67f379eaf8a084229d3a7a3

SHA512
07adff429c777b112019a1932ee84d554af1ec50f2aa419799e7bf056dfef09eace8e83112076a134322bb32e8299d186ff5b73588b6379931525652c242cb8d

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
73d9484b20e2e1a24e6bf66fd14e0746

SHA1
6fa6ea4d1a6ebd8eb899b15f0a62991e4a414cd1

SHA256
02e4d3d110c86577bb267d72d7bbee6dd8f25c6cbba5ae8aa334cd22e9d84850

SHA512
1a8205f88ef65e15eecea4d0062c51e3b875f1aa36ed9ae10eba68000cb91d731fd44cef7661a2f78e20e8ad3dd53f5a46b888e926ee17dedde1857ded2d33d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
cdab136e8e9066f7d49bd9ccbcd0930a

SHA1
b277609d88d38960c23e16de8618bf257e823949

SHA256
9584503bd7ff91c8a13c72198c7fc5ccd478a34e5d2de27f5355459af9966ddd

SHA512
fce1edd0a2362bf8f5e433e87e693c7954ed7ea5f99360defd60a7a55122971a5c742064a87fe6de3c12d5b2c603983bcec29e5f45edf9e8a40f0a8376d02bd8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
cdab136e8e9066f7d49bd9ccbcd0930a

SHA1
b277609d88d38960c23e16de8618bf257e823949

SHA256
9584503bd7ff91c8a13c72198c7fc5ccd478a34e5d2de27f5355459af9966ddd

SHA512
fce1edd0a2362bf8f5e433e87e693c7954ed7ea5f99360defd60a7a55122971a5c742064a87fe6de3c12d5b2c603983bcec29e5f45edf9e8a40f0a8376d02bd8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
cdab136e8e9066f7d49bd9ccbcd0930a

SHA1
b277609d88d38960c23e16de8618bf257e823949

SHA256
9584503bd7ff91c8a13c72198c7fc5ccd478a34e5d2de27f5355459af9966ddd

SHA512
fce1edd0a2362bf8f5e433e87e693c7954ed7ea5f99360defd60a7a55122971a5c742064a87fe6de3c12d5b2c603983bcec29e5f45edf9e8a40f0a8376d02bd8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
cdab136e8e9066f7d49bd9ccbcd0930a

SHA1
b277609d88d38960c23e16de8618bf257e823949

SHA256
9584503bd7ff91c8a13c72198c7fc5ccd478a34e5d2de27f5355459af9966ddd

SHA512
fce1edd0a2362bf8f5e433e87e693c7954ed7ea5f99360defd60a7a55122971a5c742064a87fe6de3c12d5b2c603983bcec29e5f45edf9e8a40f0a8376d02bd8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
cdab136e8e9066f7d49bd9ccbcd0930a

SHA1
b277609d88d38960c23e16de8618bf257e823949

SHA256
9584503bd7ff91c8a13c72198c7fc5ccd478a34e5d2de27f5355459af9966ddd

SHA512
fce1edd0a2362bf8f5e433e87e693c7954ed7ea5f99360defd60a7a55122971a5c742064a87fe6de3c12d5b2c603983bcec29e5f45edf9e8a40f0a8376d02bd8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
cdab136e8e9066f7d49bd9ccbcd0930a

SHA1
b277609d88d38960c23e16de8618bf257e823949

SHA256
9584503bd7ff91c8a13c72198c7fc5ccd478a34e5d2de27f5355459af9966ddd

SHA512
fce1edd0a2362bf8f5e433e87e693c7954ed7ea5f99360defd60a7a55122971a5c742064a87fe6de3c12d5b2c603983bcec29e5f45edf9e8a40f0a8376d02bd8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
cdab136e8e9066f7d49bd9ccbcd0930a

SHA1
b277609d88d38960c23e16de8618bf257e823949

SHA256
9584503bd7ff91c8a13c72198c7fc5ccd478a34e5d2de27f5355459af9966ddd

SHA512
fce1edd0a2362bf8f5e433e87e693c7954ed7ea5f99360defd60a7a55122971a5c742064a87fe6de3c12d5b2c603983bcec29e5f45edf9e8a40f0a8376d02bd8

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
cdab136e8e9066f7d49bd9ccbcd0930a

SHA1
b277609d88d38960c23e16de8618bf257e823949

SHA256
9584503bd7ff91c8a13c72198c7fc5ccd478a34e5d2de27f5355459af9966ddd

SHA512
fce1edd0a2362bf8f5e433e87e693c7954ed7ea5f99360defd60a7a55122971a5c742064a87fe6de3c12d5b2c603983bcec29e5f45edf9e8a40f0a8376d02bd8

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
550f18ceb16f75d5fe145e8d2f03250a

SHA1
2e5a245d28a25c01f73177d0ab03d72ad5337166

SHA256
61b9cff94d6063c26dca305310fdf82831caaa4dbb0cfed01bcf3686174bdd93

SHA512
689d74003fed2123f621ba5dc86ee956887147f79537c29ea488037097c5d471dbbf4174dda900572a0c3f1fc3ee79eac0208ad73dbb659d6a1a963b665baad7

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
d3984aaa8cd7e86adb9957bb0af129cd

SHA1
9eb31a81b2b363a69227748ca37698aea4019a97

SHA256
71bcef9956ecb6e5906fcdd4171eed3cdffe167b122268d5e71083aacf1b80a5

SHA512
ff778784a940773a62d40bb0f1d7c35ecd5f3460ee9202152a1aae59f09b4d730d098c4efbff9e06adde63d2986517a4ac49a1c18ba58b60ea50e3b991492093

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.1MB

MD5
22d366695dabc2b7445642f0f9f121af

SHA1
fed32894e150fa06516b77df847afb5bb09daf43

SHA256
d432580220193ccdc5402236717c03d0af995f62f9f2e6355ea8241727e8e5a5

SHA512
e93f3ea53e4ea433006ac38135feb56fabfe2ac3863855b7b2384c86d31b1297b40bbda68a85033da7c8d90eae7aa6fc8b66f62e950fb6546c1d0ec3656ff95e

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.1MB

MD5
8449926f87d72d9c3a63d26566b6604b

SHA1
1001f5cbb77203a9de2f091dbaa90acc5c8e8f01

SHA256
f18493bf6c7685de54a9eb16db5d3b3082b901557b219b79a0112dd9474008e0

SHA512
c235a76c58a390785a568eec88f9f9df848fa263191d883cfe6a6b7537db3496ca5717852dd6bd02b1483263ca662e2479b6e6948925753d0b251d5d34b26d28

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
734b7c2e37818c1fda25d594985b587d

SHA1
72faed64f3371df5df5183613875ed6ec1e17b63

SHA256
cbcbb19bebb6303e1d336e84ec4cbc88276437a45ce7bfa9524a1d062a904806

SHA512
35927ec26d7fe6238ffde1a01be779296027b94d22a0ab70d06ab675770445347d743d07b134a942646fea31af43379405ee83681508a40a318c28cb036809b6

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
7b170fae502fcdded84d2ce72da5c447

SHA1
c43c2458aa51cf3d6749f6db0c4d4cf5b68dd0a8

SHA256
469f746afae84064d8735e55b01bf1781f63ecc7bc2c577347da5674ed5ae29c

SHA512
5e9e82551388e7a9e128233fb198e679a8cb801885676bcaf34bf78520c119a01f9016a7974a3b7ef62dffe72e53bdc46ed9635114554689a62a654ce97f185d

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
b94f571cd2ab8caab3266df149f82c41

SHA1
d1bec9cbfcc70e2bf115c8f396f37e4c94d82f91

SHA256
c6438240ddf2538191629d77dd5d89a6608469f4088acbe7b269f63527e09332

SHA512
187f6fb92380941a7710b1c67b59ddbd236dd3d6a2caddf7a2e6e62959beea4e6be9f21ad0bc9132811d3ab201b36e66e522530e7be5c76be74c7762758c5a21

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
ff6f5e4980d7bbb2be45be0286cab497

SHA1
aabf926de52d50ac08c13ecd0b57ccb4bfcb691d

SHA256
00667ecedaf37758953731e05dba59e80768419ceeb480cb418f8519ccfc9407

SHA512
f13dd8c5ddc3bb79a3f279ed7308c316cef24f4ad2ca074341e496a18a6d830a7d52c4896368008248c60a976d18939fb7fb303492464e06adae4ffb5035d24c

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
ac76cf264fcce8a59070193a06dd0bc4

SHA1
89a6767a684833c6060a9456873cccea62744199

SHA256
47873caeda2e4543193b87e650ef5abf51a60286f20182e42732deafd9c362af

SHA512
5d1e13be8f072b0f3084888501a27b76078677bbaaddb2c7e357fe8e0d09ac76035a145c1608e2ce752059381876e732da509383ac9ebae1e09ab57536d78045

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
cdab85f4b545718db016e49568056e92

SHA1
1eda28d6948519aa819ff720f0c0684f310bd0fc

SHA256
085bfcf4681939e5d3a0f54e88deccc5bad92c6673d284429a63a62b957b6b6a

SHA512
ad237de8fe008c40865d3aa298c9d229926c8994753a11c633599c15fae7263cf6a5fb6b531eca68a37678a87ee33af2a63ef95ee27e4cf5c7dfb7cb1f375ca9

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.7MB

MD5
f96e31de3558c07f7fd8d17c780638ea

SHA1
0599a856efd43763907c5b6d3b09496b905b0f89

SHA256
3f8aad3df87cb20d318828df9160fcfeef6a412acdbf12d010b5bb73f7023624

SHA512
eb8ba9713a3edebc3b92680234177f1d27ba5d3abab3a09c9d521c26750ba21f897dd65e5cc0ff7df4900babd6a1c9bc4f34783a4d56c289344f646be52c7dc6

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
69be6be171d8932174883f1881a69d38

SHA1
7b38cfd353140941477f7f65bb196b35f33d8481

SHA256
3250b28b8e90161d9e9f20d2f71f9f844144fe07561684a3116619a4def52109

SHA512
a989617cbf6716d0cb8056960f9ac6f8f0af5bd7c05fade0d998f02e5e922fd61ecbe6c2e8586a5e0b01821fea02f29545b2f782af1b8dc57f798269513ed437

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
e2f241647abbe9457a88fc0cdd8eda9f

SHA1
e67a5cae7de51ea546e3ec963bc5e8133f049eec

SHA256
f6ef1d07389c21528e15ec776deeeaf1159116a77b43274dda8192a63f82cbf6

SHA512
73236cbbf79ec5cfca832e62ceaa5123a95fab204e500760867c4f286125e96fcbefed4661e5c5429fdf61869b99fe7804df7c1c26274a60786980c56604e830

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
413c9d8648d0c9919913abc69af6ff69

SHA1
53413500a6fdd906a5bb86a2ba87c95fd4f262fd

SHA256
471d71bb31aeecd65b4446c9a40592742221df81c438f62cc81fb3b1ad0b8f42

SHA512
47413ac115766951349c74c043479ea2c7ed3bdaa7a10d7e1ca9a5bd6aa3d5cad48b5ea4c7881bed932036b8a9d6a3fb8439567b860cb698e3c90c7d795bea60

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
e3d966b4ef9fa99a1cbdcf8bc177ee0a

SHA1
ad87c62f47f8afa141af4935ca434ed126df2fca

SHA256
4e296b69cd0522cacfd1e7f43a287412e28d8c8b09558da280297c47d04a8916

SHA512
ded55094329cf501d71cee90c7ce7327fbf4ad122bbd21b053dfa7a627a8a73b08b3d9e77d8f0837033928d268840da48e77dd4b338d2bbb26d4f4845f1e21cf

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.3MB

MD5
ac76cf264fcce8a59070193a06dd0bc4

SHA1
89a6767a684833c6060a9456873cccea62744199

SHA256
47873caeda2e4543193b87e650ef5abf51a60286f20182e42732deafd9c362af

SHA512
5d1e13be8f072b0f3084888501a27b76078677bbaaddb2c7e357fe8e0d09ac76035a145c1608e2ce752059381876e732da509383ac9ebae1e09ab57536d78045

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
fc7fe823feb75de0a9340b82ce1eceaf

SHA1
cbb0e6437eab1ff49e06a3ec05a9b1fd75c62e3e

SHA256
a8d99b8b356634cd9498d2f11994a387dc54e8f84ef34417e6ac4e402c2c1e03

SHA512
56a34cb905b91928b6815c9d766c6b0dc05012cb05add20fc5dd35268f0795c9961af11c128c2ce23c00e889b20559966405e9d5cf3c1684413f005ea0ac5b53

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
fc7fe823feb75de0a9340b82ce1eceaf

SHA1
cbb0e6437eab1ff49e06a3ec05a9b1fd75c62e3e

SHA256
a8d99b8b356634cd9498d2f11994a387dc54e8f84ef34417e6ac4e402c2c1e03

SHA512
56a34cb905b91928b6815c9d766c6b0dc05012cb05add20fc5dd35268f0795c9961af11c128c2ce23c00e889b20559966405e9d5cf3c1684413f005ea0ac5b53

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
54bf63a1148d08b34f504ae9ae460533

SHA1
e4623a2a74249405c11a173674c363b388526e55

SHA256
9cdf955f96a5fdb240aad9a5a200ffd3ef880c8f089827fc15a916b0da119397

SHA512
1d4aa1fcdc36c9c8e17beb3a10f948711e1c982a69e45a23a0bdf9035b14609f88bf85ab212356f8c9a5979b92c452c528d938334ea04634ed1cc65d86b404a7

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.3MB

MD5
170b5babd87e271214355f70a2847fd9

SHA1
2ef32a5491ec333abf479ff3d2395fdd259f72ad

SHA256
73331b10237759014bee908edaa3bade9835a95bbea1c0a162503c3743679a33

SHA512
36100fbd75b77fcb803bfa6915f891f911fd5f9f938a730293c078b510bc580ffda2ed74c101fa78a1e0713e114656beb89df1dbc91c1189be5b8ddc42bfb40e

Download Submit
\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
d3984aaa8cd7e86adb9957bb0af129cd

SHA1
9eb31a81b2b363a69227748ca37698aea4019a97

SHA256
71bcef9956ecb6e5906fcdd4171eed3cdffe167b122268d5e71083aacf1b80a5

SHA512
ff778784a940773a62d40bb0f1d7c35ecd5f3460ee9202152a1aae59f09b4d730d098c4efbff9e06adde63d2986517a4ac49a1c18ba58b60ea50e3b991492093

Download Submit
\Windows\System32\alg.exe

Filesize
1.3MB

MD5
734b7c2e37818c1fda25d594985b587d

SHA1
72faed64f3371df5df5183613875ed6ec1e17b63

SHA256
cbcbb19bebb6303e1d336e84ec4cbc88276437a45ce7bfa9524a1d062a904806

SHA512
35927ec26d7fe6238ffde1a01be779296027b94d22a0ab70d06ab675770445347d743d07b134a942646fea31af43379405ee83681508a40a318c28cb036809b6

Download Submit
\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
7b170fae502fcdded84d2ce72da5c447

SHA1
c43c2458aa51cf3d6749f6db0c4d4cf5b68dd0a8

SHA256
469f746afae84064d8735e55b01bf1781f63ecc7bc2c577347da5674ed5ae29c

SHA512
5e9e82551388e7a9e128233fb198e679a8cb801885676bcaf34bf78520c119a01f9016a7974a3b7ef62dffe72e53bdc46ed9635114554689a62a654ce97f185d

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
b94f571cd2ab8caab3266df149f82c41

SHA1
d1bec9cbfcc70e2bf115c8f396f37e4c94d82f91

SHA256
c6438240ddf2538191629d77dd5d89a6608469f4088acbe7b269f63527e09332

SHA512
187f6fb92380941a7710b1c67b59ddbd236dd3d6a2caddf7a2e6e62959beea4e6be9f21ad0bc9132811d3ab201b36e66e522530e7be5c76be74c7762758c5a21

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
ff6f5e4980d7bbb2be45be0286cab497

SHA1
aabf926de52d50ac08c13ecd0b57ccb4bfcb691d

SHA256
00667ecedaf37758953731e05dba59e80768419ceeb480cb418f8519ccfc9407

SHA512
f13dd8c5ddc3bb79a3f279ed7308c316cef24f4ad2ca074341e496a18a6d830a7d52c4896368008248c60a976d18939fb7fb303492464e06adae4ffb5035d24c

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
ac76cf264fcce8a59070193a06dd0bc4

SHA1
89a6767a684833c6060a9456873cccea62744199

SHA256
47873caeda2e4543193b87e650ef5abf51a60286f20182e42732deafd9c362af

SHA512
5d1e13be8f072b0f3084888501a27b76078677bbaaddb2c7e357fe8e0d09ac76035a145c1608e2ce752059381876e732da509383ac9ebae1e09ab57536d78045

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
ac76cf264fcce8a59070193a06dd0bc4

SHA1
89a6767a684833c6060a9456873cccea62744199

SHA256
47873caeda2e4543193b87e650ef5abf51a60286f20182e42732deafd9c362af

SHA512
5d1e13be8f072b0f3084888501a27b76078677bbaaddb2c7e357fe8e0d09ac76035a145c1608e2ce752059381876e732da509383ac9ebae1e09ab57536d78045

Download Submit
\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
cdab85f4b545718db016e49568056e92

SHA1
1eda28d6948519aa819ff720f0c0684f310bd0fc

SHA256
085bfcf4681939e5d3a0f54e88deccc5bad92c6673d284429a63a62b957b6b6a

SHA512
ad237de8fe008c40865d3aa298c9d229926c8994753a11c633599c15fae7263cf6a5fb6b531eca68a37678a87ee33af2a63ef95ee27e4cf5c7dfb7cb1f375ca9

Download Submit
\Windows\System32\vds.exe

Filesize
1.7MB

MD5
f96e31de3558c07f7fd8d17c780638ea

SHA1
0599a856efd43763907c5b6d3b09496b905b0f89

SHA256
3f8aad3df87cb20d318828df9160fcfeef6a412acdbf12d010b5bb73f7023624

SHA512
eb8ba9713a3edebc3b92680234177f1d27ba5d3abab3a09c9d521c26750ba21f897dd65e5cc0ff7df4900babd6a1c9bc4f34783a4d56c289344f646be52c7dc6

Download Submit
\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
69be6be171d8932174883f1881a69d38

SHA1
7b38cfd353140941477f7f65bb196b35f33d8481

SHA256
3250b28b8e90161d9e9f20d2f71f9f844144fe07561684a3116619a4def52109

SHA512
a989617cbf6716d0cb8056960f9ac6f8f0af5bd7c05fade0d998f02e5e922fd61ecbe6c2e8586a5e0b01821fea02f29545b2f782af1b8dc57f798269513ed437

Download Submit
\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
e2f241647abbe9457a88fc0cdd8eda9f

SHA1
e67a5cae7de51ea546e3ec963bc5e8133f049eec

SHA256
f6ef1d07389c21528e15ec776deeeaf1159116a77b43274dda8192a63f82cbf6

SHA512
73236cbbf79ec5cfca832e62ceaa5123a95fab204e500760867c4f286125e96fcbefed4661e5c5429fdf61869b99fe7804df7c1c26274a60786980c56604e830

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
413c9d8648d0c9919913abc69af6ff69

SHA1
53413500a6fdd906a5bb86a2ba87c95fd4f262fd

SHA256
471d71bb31aeecd65b4446c9a40592742221df81c438f62cc81fb3b1ad0b8f42

SHA512
47413ac115766951349c74c043479ea2c7ed3bdaa7a10d7e1ca9a5bd6aa3d5cad48b5ea4c7881bed932036b8a9d6a3fb8439567b860cb698e3c90c7d795bea60

Download Submit
\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
e3d966b4ef9fa99a1cbdcf8bc177ee0a

SHA1
ad87c62f47f8afa141af4935ca434ed126df2fca

SHA256
4e296b69cd0522cacfd1e7f43a287412e28d8c8b09558da280297c47d04a8916

SHA512
ded55094329cf501d71cee90c7ce7327fbf4ad122bbd21b053dfa7a627a8a73b08b3d9e77d8f0837033928d268840da48e77dd4b338d2bbb26d4f4845f1e21cf

Download Submit
memory/320-168-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/544-206-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/544-182-0x00000000006E0000-0x0000000000746000-memory.dmp

Filesize
408KB

Download
memory/636-384-0x0000000100000000-0x00000001001ED000-memory.dmp

Filesize
1.9MB

Download
memory/840-165-0x0000000100000000-0x00000001001EC000-memory.dmp

Filesize
1.9MB

Download
memory/964-122-0x0000000000670000-0x00000000006D6000-memory.dmp

Filesize
408KB

Download
memory/964-138-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/964-127-0x0000000000670000-0x00000000006D6000-memory.dmp

Filesize
408KB

Download
memory/1116-74-0x00000000007B0000-0x0000000000816000-memory.dmp

Filesize
408KB

Download
memory/1116-294-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1116-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1116-63-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1116-69-0x00000000007B0000-0x0000000000816000-memory.dmp

Filesize
408KB

Download
memory/1116-68-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1116-66-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1116-61-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1116-90-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1116-62-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1220-208-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/1220-226-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/1256-365-0x0000000001000000-0x00000000011ED000-memory.dmp

Filesize
1.9MB

Download
memory/1288-295-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/1288-92-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/1288-88-0x0000000000910000-0x0000000000970000-memory.dmp

Filesize
384KB

Download
memory/1288-82-0x0000000000910000-0x0000000000970000-memory.dmp

Filesize
384KB

Download
memory/1612-181-0x00000000003E0000-0x0000000000440000-memory.dmp

Filesize
384KB

Download
memory/1612-309-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1612-204-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1620-313-0x0000000000B60000-0x0000000000BE0000-memory.dmp

Filesize
512KB

Download
memory/1620-210-0x0000000000B60000-0x0000000000BE0000-memory.dmp

Filesize
512KB

Download
memory/1620-310-0x0000000000B60000-0x0000000000BE0000-memory.dmp

Filesize
512KB

Download
memory/1620-290-0x0000000000B60000-0x0000000000BE0000-memory.dmp

Filesize
512KB

Download
memory/1620-306-0x0000000000B60000-0x0000000000BE0000-memory.dmp

Filesize
512KB

Download
memory/1644-111-0x0000000140000000-0x00000001401F4000-memory.dmp

Filesize
2.0MB

Download
memory/1660-117-0x0000000000AF0000-0x0000000000BAC000-memory.dmp

Filesize
752KB

Download
memory/1660-102-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1660-110-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1660-108-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1660-106-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1660-105-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1708-202-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/1708-150-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1708-172-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1708-166-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/1708-307-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1708-163-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/1708-156-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1792-443-0x0000000100000000-0x000000010020A000-memory.dmp

Filesize
2.0MB

Download
memory/1908-114-0x0000000010000000-0x00000000101F6000-memory.dmp

Filesize
2.0MB

Download
memory/1944-323-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1944-238-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1944-137-0x0000000010000000-0x00000000101FE000-memory.dmp

Filesize
2.0MB

Download
memory/1972-54-0x0000000000120000-0x000000000027A000-memory.dmp

Filesize
1.4MB

Download
memory/1972-60-0x000000000A300000-0x000000000A4B0000-memory.dmp

Filesize
1.7MB

Download
memory/1972-57-0x0000000000610000-0x0000000000650000-memory.dmp

Filesize
256KB

Download
memory/1972-58-0x00000000005F0000-0x00000000005FC000-memory.dmp

Filesize
48KB

Download
memory/1972-59-0x0000000005AD0000-0x0000000005C08000-memory.dmp

Filesize
1.2MB

Download
memory/1972-55-0x0000000000610000-0x0000000000650000-memory.dmp

Filesize
256KB

Download
memory/1972-56-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2040-414-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2040-175-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2040-308-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2040-174-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/2040-161-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/2112-244-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2112-255-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2132-368-0x0000000100000000-0x00000001001EC000-memory.dmp

Filesize
1.9MB

Download
memory/2208-243-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2208-311-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2272-275-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2328-403-0x0000000100000000-0x000000010026B000-memory.dmp

Filesize
2.4MB

Download
memory/2392-274-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2392-312-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2400-406-0x0000000100000000-0x0000000100219000-memory.dmp

Filesize
2.1MB

Download
memory/2412-293-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2412-279-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2508-417-0x0000000100000000-0x0000000100202000-memory.dmp

Filesize
2.0MB

Download
memory/2552-289-0x0000000140000000-0x000000014020D000-memory.dmp

Filesize
2.1MB

Download
memory/2748-441-0x0000000100000000-0x000000010021B000-memory.dmp

Filesize
2.1MB

Download
memory/2824-458-0x0000000100000000-0x0000000100123000-memory.dmp

Filesize
1.1MB

Download
memory/2836-327-0x0000000000660000-0x0000000000869000-memory.dmp

Filesize
2.0MB

Download
memory/2836-658-0x0000000100000000-0x0000000100209000-memory.dmp

Filesize
2.0MB

Download
memory/2836-651-0x0000000000660000-0x0000000000869000-memory.dmp

Filesize
2.0MB

Download
memory/2836-330-0x0000000100000000-0x0000000100209000-memory.dmp

Filesize
2.0MB

Download
memory/2932-350-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2932-684-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2956-353-0x000000002E000000-0x000000002E20C000-memory.dmp

Filesize
2.0MB

Download
memory/3036-355-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/3036-685-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download