blustealer | d4f62b8520f3f0e84b19769be0f7bcdc20e41af8cea048261f3e37c0428b22d7

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/05/2023, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order 202319876.exe
Size

1.5MB
MD5

a838a2013c038b3a5039cb9abb199922
SHA1

6a315d36c940cd95359cd4ef46c5688352a22a42
SHA256

d4f62b8520f3f0e84b19769be0f7bcdc20e41af8cea048261f3e37c0428b22d7
SHA512

8b80c742b598d0df74e5d7b57e5ceb386d74531572a41b02614651ef9f914367e00ef23c12548f9009500af8ca9d6085406d417fc405f6ca528222a77ea83cbe
SSDEEP

24576:Bq3UElwshsKgvyH1kz7iQ2Py9so+4XfbqQtTpSrwCDCSD85vvOn2rRAJdqfcd7AH:Q3UElf6Lk1y7iSFd5BvWn2WJdyk8P

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 52 IoCs

pid	Process
464	Process not Found
1160	alg.exe
564	aspnet_state.exe
1460	mscorsvw.exe
808	mscorsvw.exe
1860	mscorsvw.exe
700	mscorsvw.exe
1524	dllhost.exe
1428	ehRecvr.exe
1788	ehsched.exe
1644	elevation_service.exe
1628	IEEtwCollector.exe
892	GROOVE.EXE
2004	mscorsvw.exe
1756	maintenanceservice.exe
2108	msdtc.exe
2172	mscorsvw.exe
2272	msiexec.exe
2504	OSE.EXE
2548	OSPPSVC.EXE
2656	perfhost.exe
2688	mscorsvw.exe
2780	locator.exe
2904	mscorsvw.exe
2940	snmptrap.exe
2092	mscorsvw.exe
2148	vds.exe
2280	vssvc.exe
608	mscorsvw.exe
2592	wbengine.exe
2708	mscorsvw.exe
2788	WmiApSrv.exe
2976	wmpnetwk.exe
2948	mscorsvw.exe
2228	SearchIndexer.exe
1476	mscorsvw.exe
2764	mscorsvw.exe
2328	mscorsvw.exe
2952	mscorsvw.exe
2720	mscorsvw.exe
2104	mscorsvw.exe
2920	mscorsvw.exe
1852	mscorsvw.exe
2972	mscorsvw.exe
3020	mscorsvw.exe
1752	mscorsvw.exe
2100	mscorsvw.exe
2712	mscorsvw.exe
2260	mscorsvw.exe
2128	mscorsvw.exe
2776	mscorsvw.exe
2624	mscorsvw.exe

Loads dropped DLL 16 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
2272	msiexec.exe
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
740	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\system32\locator.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\System32\vds.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\system32\dllhost.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\babe37d87693df14.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\System32\alg.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\System32\msdtc.exe	Purchase Order 202319876.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 984	1400	Purchase Order 202319876.exe	27
PID 984 set thread context of 1840	984	Purchase Order 202319876.exe	30

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaw.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Purchase Order 202319876.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe	Purchase Order 202319876.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{776E6CCE-6698-4B96-8580-D3DE23E1B969}.crmlog	dllhost.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Purchase Order 202319876.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Purchase Order 202319876.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Purchase Order 202319876.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{776E6CCE-6698-4B96-8580-D3DE23E1B969}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	Purchase Order 202319876.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	Purchase Order 202319876.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 57 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009058022f737ed901	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{CB0A0464-4C7C-42F1-854E-6F286966A7FE}	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmpnetwk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1552	ehRec.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe
984	Purchase Order 202319876.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	984	Purchase Order 202319876.exe
Token: SeShutdownPrivilege	1860	mscorsvw.exe
Token: SeShutdownPrivilege	700	mscorsvw.exe
Token: SeShutdownPrivilege	1860	mscorsvw.exe
Token: SeShutdownPrivilege	700	mscorsvw.exe
Token: 33	328	EhTray.exe
Token: SeIncBasePriorityPrivilege	328	EhTray.exe
Token: SeShutdownPrivilege	1860	mscorsvw.exe
Token: SeShutdownPrivilege	700	mscorsvw.exe
Token: SeShutdownPrivilege	1860	mscorsvw.exe
Token: SeShutdownPrivilege	700	mscorsvw.exe
Token: SeDebugPrivilege	1552	ehRec.exe
Token: 33	328	EhTray.exe
Token: SeIncBasePriorityPrivilege	328	EhTray.exe
Token: SeRestorePrivilege	2272	msiexec.exe
Token: SeTakeOwnershipPrivilege	2272	msiexec.exe
Token: SeSecurityPrivilege	2272	msiexec.exe
Token: SeShutdownPrivilege	700	mscorsvw.exe
Token: SeBackupPrivilege	2280	vssvc.exe
Token: SeRestorePrivilege	2280	vssvc.exe
Token: SeAuditPrivilege	2280	vssvc.exe
Token: SeBackupPrivilege	2592	wbengine.exe
Token: SeRestorePrivilege	2592	wbengine.exe
Token: SeSecurityPrivilege	2592	wbengine.exe
Token: SeManageVolumePrivilege	2228	SearchIndexer.exe
Token: 33	2228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2228	SearchIndexer.exe
Token: 33	2976	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	2976	wmpnetwk.exe
Token: SeDebugPrivilege	984	Purchase Order 202319876.exe
Token: SeDebugPrivilege	984	Purchase Order 202319876.exe
Token: SeDebugPrivilege	984	Purchase Order 202319876.exe
Token: SeDebugPrivilege	984	Purchase Order 202319876.exe
Token: SeDebugPrivilege	984	Purchase Order 202319876.exe
Token: SeShutdownPrivilege	1860	mscorsvw.exe
Token: SeShutdownPrivilege	700	mscorsvw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
328	EhTray.exe
328	EhTray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
328	EhTray.exe
328	EhTray.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
984	Purchase Order 202319876.exe
2852	SearchProtocolHost.exe
2852	SearchProtocolHost.exe
2852	SearchProtocolHost.exe
2852	SearchProtocolHost.exe
2852	SearchProtocolHost.exe
1752	SearchProtocolHost.exe
1752	SearchProtocolHost.exe
1752	SearchProtocolHost.exe
1752	SearchProtocolHost.exe
1752	SearchProtocolHost.exe
1752	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 1400 wrote to memory of 984	1400	Purchase Order 202319876.exe	27
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 984 wrote to memory of 1840	984	Purchase Order 202319876.exe	30
PID 700 wrote to memory of 2004	700	mscorsvw.exe	43
PID 700 wrote to memory of 2004	700	mscorsvw.exe	43
PID 700 wrote to memory of 2004	700	mscorsvw.exe	43
PID 700 wrote to memory of 2172	700	mscorsvw.exe	46
PID 700 wrote to memory of 2172	700	mscorsvw.exe	46
PID 700 wrote to memory of 2172	700	mscorsvw.exe	46
PID 1860 wrote to memory of 2688	1860	mscorsvw.exe	51
PID 1860 wrote to memory of 2688	1860	mscorsvw.exe	51
PID 1860 wrote to memory of 2688	1860	mscorsvw.exe	51
PID 1860 wrote to memory of 2688	1860	mscorsvw.exe	51
PID 1860 wrote to memory of 2904	1860	mscorsvw.exe	53
PID 1860 wrote to memory of 2904	1860	mscorsvw.exe	53
PID 1860 wrote to memory of 2904	1860	mscorsvw.exe	53
PID 1860 wrote to memory of 2904	1860	mscorsvw.exe	53
PID 1860 wrote to memory of 2092	1860	mscorsvw.exe	55
PID 1860 wrote to memory of 2092	1860	mscorsvw.exe	55
PID 1860 wrote to memory of 2092	1860	mscorsvw.exe	55
PID 1860 wrote to memory of 2092	1860	mscorsvw.exe	55
PID 1860 wrote to memory of 608	1860	mscorsvw.exe	58
PID 1860 wrote to memory of 608	1860	mscorsvw.exe	58
PID 1860 wrote to memory of 608	1860	mscorsvw.exe	58
PID 1860 wrote to memory of 608	1860	mscorsvw.exe	58
PID 1860 wrote to memory of 2708	1860	mscorsvw.exe	60
PID 1860 wrote to memory of 2708	1860	mscorsvw.exe	60
PID 1860 wrote to memory of 2708	1860	mscorsvw.exe	60
PID 1860 wrote to memory of 2708	1860	mscorsvw.exe	60
PID 1860 wrote to memory of 2948	1860	mscorsvw.exe	63
PID 1860 wrote to memory of 2948	1860	mscorsvw.exe	63
PID 1860 wrote to memory of 2948	1860	mscorsvw.exe	63
PID 1860 wrote to memory of 2948	1860	mscorsvw.exe	63
PID 2228 wrote to memory of 2852	2228	SearchIndexer.exe	65
PID 2228 wrote to memory of 2852	2228	SearchIndexer.exe	65
PID 2228 wrote to memory of 2852	2228	SearchIndexer.exe	65
PID 2228 wrote to memory of 1388	2228	SearchIndexer.exe	66
PID 2228 wrote to memory of 1388	2228	SearchIndexer.exe	66
PID 2228 wrote to memory of 1388	2228	SearchIndexer.exe	66
PID 1860 wrote to memory of 1476	1860	mscorsvw.exe	67
PID 1860 wrote to memory of 1476	1860	mscorsvw.exe	67
PID 1860 wrote to memory of 1476	1860	mscorsvw.exe	67
PID 1860 wrote to memory of 1476	1860	mscorsvw.exe	67
PID 1860 wrote to memory of 2764	1860	mscorsvw.exe	68
PID 1860 wrote to memory of 2764	1860	mscorsvw.exe	68
PID 1860 wrote to memory of 2764	1860	mscorsvw.exe	68
PID 1860 wrote to memory of 2764	1860	mscorsvw.exe	68
PID 1860 wrote to memory of 2328	1860	mscorsvw.exe	69
PID 1860 wrote to memory of 2328	1860	mscorsvw.exe	69

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order 202319876.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1840

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1160

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:564

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1460

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 250 -NGENProcess 258 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 248 -NGENProcess 1d4 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 250 -NGENProcess 260 -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 24c -NGENProcess 248 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 26c -NGENProcess 250 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 278 -NGENProcess 268 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 278 -NGENProcess 26c -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 270 -NGENProcess 268 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 270 -NGENProcess 278 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 260 -NGENProcess 268 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 260 -NGENProcess 270 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 260 -NGENProcess 28c -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 260 -NGENProcess 250 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 260 -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 26c -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 284 -NGENProcess 288 -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 284 -NGENProcess 260 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 284 -NGENProcess 2a4 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a0 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2a0 -NGENProcess 284 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2a0 -NGENProcess 294 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2624

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 170 -InterruptEvent 15c -NGENProcess 160 -Pipe 16c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 15c -NGENProcess 160 -Pipe 170 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2172

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1524

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1428

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:1788

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:328

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1628

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:892

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2108

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2504

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2780

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2940

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2788

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3499517378-2376672570-1134980332-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3499517378-2376672570-1134980332-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2852
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:1388
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
a9a9915d4528d01a106bbc1aba6e66ce

SHA1
f1bbb65707508535cd1dd734fe75f631f65da6b6

SHA256
a6b0e79ea1912562989a6ad3cf291a8086ae3772260e7cd5c63115c82b0c2e20

SHA512
0f446ea71a49ae8c124ebcf5d9087fecfa3a9bd9745481bb36fe75a21a67afdb8533358af0050f0aca90ec9e89e0584d16b72c7c41ab90b31a98c2512d737364

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
30.1MB

MD5
4d7ae19bc9b5f58e8b1e90a40e76d0ee

SHA1
4b009813d61dd57ec56327fa03b393ef1d2d5b90

SHA256
f8570319221b4f7aa40defd7932520f608ab8b468f1076584f51c60cc87431f7

SHA512
35713c091de65bd32e239cc98fc3f2fbc0e95e673673ae23d45a0caae8c75d25240e978a8cb1e3cbce82c19dabd2a92d9c4c35663296cf4af01f0ab8620977d5

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
7e4448558d7610df6b0cdff379c2de3c

SHA1
37277690bee505c76ffc4a30102ebce584c593db

SHA256
5a84e085bdcf54077fa12e9d5f6b91cf534c75e9e28e0c904f1c8f9502d74963

SHA512
7c2e17175794e33595496724cd654d8bcdbf1c5873a570305ef35e48738e40aa4df2c4bf33613d3c9d6f5502cb05db082412c4660a4d26e1f43fa47ba2fb45a0

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
5.2MB

MD5
9ea83f1b075b9222642d15c7b9f36bd4

SHA1
0d195649119a9a4d4e3bc9f8ce6e4e161fcbea28

SHA256
6b56dc494dfdf481b0711ee5aa82cf8981ddfc0464915a3b3cc3d05bf1b9769c

SHA512
2727eec08829e516d69b423d508d306e90856714ff5b994c1f83a900616ae5d546d611e95bf2f126a015174ac2bece026663136317234cc7f1e3384bf96799de

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
65418ef12d2b4bda01229eb14290fdf4

SHA1
40adc44b40160fd4f48c49931fc7b5ffeee6d58e

SHA256
cff1e48228f76d0d2c581571b7273412f67b1b074c4caf2011ec6873c5fa0e86

SHA512
19f72973b7a2bbbeefca002fa928091e0bd1be449988fa2b45a1234acb98f5928f10cefc60431846609190910a552963f96662c0094304815e111d8ce4a04f36

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
97c6ee48ba0439193b41ae62baba567f

SHA1
1d40a8feb3ed950ce6e62be9f2fcb713e5a0ad56

SHA256
d77212a0b2f9be065e13d12c3a51c4aacd5b58b8f19d7265bd054148ccf663a6

SHA512
abc2335c853df0b4962a194fbdd6f5e9a540355fc668e9c8eaf45277046d3a9f3518b3812547730837df739b87376ef065d160207d0143b2f45d616641e44434

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
d29973db8cc9986b245bce0a21d3fa5b

SHA1
591fb6a0f026503992e830a354f44b4a9692a401

SHA256
cd6ea3a57abbed894ce5e6ce51f0132238e09fb13a624d17898a9e92323fdf6c

SHA512
9e7a605768eefaf8e254c2b26bc985becec0888d5403203bc8ae39220ac684e22d2b217eea0e5ab7a2588b7bf0ec73e4381239cbec50522f0ae3cbcea97194d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
56f569ca37770fd4f813268bd133482d

SHA1
4cd802fbce31c804f5d3c7672f4a95a8d117e315

SHA256
f33344321e6e1bfa9693cc525f5db0b244c0620bc3764173a0defbfe5c9e7a19

SHA512
80372be788a26c37f948b94372fe018d2e0e69756c584f98aa3e8489a1fd5e79accba70706922bb06b75d7b86b6e6660504711cdd0bcab196fab1dc96cd0bf7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
56f569ca37770fd4f813268bd133482d

SHA1
4cd802fbce31c804f5d3c7672f4a95a8d117e315

SHA256
f33344321e6e1bfa9693cc525f5db0b244c0620bc3764173a0defbfe5c9e7a19

SHA512
80372be788a26c37f948b94372fe018d2e0e69756c584f98aa3e8489a1fd5e79accba70706922bb06b75d7b86b6e6660504711cdd0bcab196fab1dc96cd0bf7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
0f0d736a3f8e4ea57f3f47088ed81ead

SHA1
bb31e368907566ef14d9a1d1496f5cf7cb664ee3

SHA256
12606d5f9700da2001d1994aa81f11712986fc66900d7be7087ffc9479ee660a

SHA512
5c4b38f0b9f4c63c1297f1212c7747d72f47d85a21ec1c59c3667eeb4c19afd464fe3e0c68ff4a1efce9e90b86f59e0d5e35de99f457e5cd6b6a6cf8d3cee960

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.3MB

MD5
cebedb5cbc82ec94c9a3352fe79614bf

SHA1
cb1e359077ff9f8218daccfa6324ec0bc7f4b906

SHA256
e13c3fb9df86f53865f9ced9a8bcf22cc2a0a02e462f52e5bdde4e986d5e42d8

SHA512
29de71c1c03a9f7c74d50e833b059345918afb23ff39a94847487f6c8afe5e6101bf5c261608e23d8d4c0332034177438519bdf87cc8f0796d9bec5e25923b19

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
0cb855e32c86b86c5f862ef95bfa2e47

SHA1
ee928173243f10ea3142db1ce95523576d3f0242

SHA256
7799a2a1719c803ffa2d7565b583b0d3562b12030ca8a1aa6bddcbf099663cbf

SHA512
093215f9ff5efe457cad5599984830d27a17f6a19f1268cb37fa9de4e297e0536596daf76b81cc051aa69c6895b124d737f9a8d6e141633f9ab8130f4880e168

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
0cb855e32c86b86c5f862ef95bfa2e47

SHA1
ee928173243f10ea3142db1ce95523576d3f0242

SHA256
7799a2a1719c803ffa2d7565b583b0d3562b12030ca8a1aa6bddcbf099663cbf

SHA512
093215f9ff5efe457cad5599984830d27a17f6a19f1268cb37fa9de4e297e0536596daf76b81cc051aa69c6895b124d737f9a8d6e141633f9ab8130f4880e168

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
0cb855e32c86b86c5f862ef95bfa2e47

SHA1
ee928173243f10ea3142db1ce95523576d3f0242

SHA256
7799a2a1719c803ffa2d7565b583b0d3562b12030ca8a1aa6bddcbf099663cbf

SHA512
093215f9ff5efe457cad5599984830d27a17f6a19f1268cb37fa9de4e297e0536596daf76b81cc051aa69c6895b124d737f9a8d6e141633f9ab8130f4880e168

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
0cb855e32c86b86c5f862ef95bfa2e47

SHA1
ee928173243f10ea3142db1ce95523576d3f0242

SHA256
7799a2a1719c803ffa2d7565b583b0d3562b12030ca8a1aa6bddcbf099663cbf

SHA512
093215f9ff5efe457cad5599984830d27a17f6a19f1268cb37fa9de4e297e0536596daf76b81cc051aa69c6895b124d737f9a8d6e141633f9ab8130f4880e168

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
c2545a72c42739cb4b12f70bd3cd2fd9

SHA1
7c9751788d2efa530f527f6995c81fde47a0ed29

SHA256
b98ebcf95d733b754606ef316e62246fd4c957a8eda3e3d4e75a8a59cd9556c4

SHA512
5fe3237dc7ca8167c65b77e766e25b6bc2f4465eceaefe673dba1e81edb69733a38dd4520f7e23277cb637102f4e9238a6052c2b1f5f0999052bd2eff57ee6ff

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
c2545a72c42739cb4b12f70bd3cd2fd9

SHA1
7c9751788d2efa530f527f6995c81fde47a0ed29

SHA256
b98ebcf95d733b754606ef316e62246fd4c957a8eda3e3d4e75a8a59cd9556c4

SHA512
5fe3237dc7ca8167c65b77e766e25b6bc2f4465eceaefe673dba1e81edb69733a38dd4520f7e23277cb637102f4e9238a6052c2b1f5f0999052bd2eff57ee6ff

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
af61360de364ed30d7996d4f88ec34b6

SHA1
ed75cb9476c068e4d2f73c621189b510cbed09dd

SHA256
2215636915a39191cfd1c57c14f62762db0f7256e9b3aa5aa8209703a227d4cd

SHA512
17a6c2857ed64e2e0ae3bcad0112562c65b3263b592812a3f4ae95a635788b79027ca730284548ff7f60ef1c62eeeffaf22b2143659d0dbc186d2723b0398818

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
860d6331f67d2274e87b6506b3e19db2

SHA1
86d57679089072a29933a13756b4101a9663c68e

SHA256
89a0bcdc7acdfafee983b41d2f42a41c5fd97a8eae13c05ada211cdb10917095

SHA512
527612c97ca13df6278ef81dca3bb6b6d1d7d0f7a30a4a471d4a11b31ab6ae5a223a9a2c0f945f81c0caad03d98db711a4530e1cad05aea6bdc124d9a082d932

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
53814a744eb38faf7b69497852486a79

SHA1
efc7910988b76396c73435d91e3da2b1d42c1e94

SHA256
91e17b29abe2df618b8143c3bfb0ea01e088ca82637df5881974b25a1fb7d3d3

SHA512
08843bb09adc1d3add1eaf2021d7178ad757a9fa37a3731bc3dcc06f6521d6714b8f47ef133170769ec0389afae1a4e129355c664820042a319a23d0909634a0

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
e8652aaa46c01332573ce42e8ad0ab35

SHA1
3c4a12358725fdacd27e80fb7b487de82e72e16e

SHA256
ab5344b09750bfc923f8e8a7a8817cc773c57538bb70504730c8db48ade03aa8

SHA512
0e4f658e101bd291eae9225649d3a8f455690de1bd56ec14f9e3050a4262e8232f8ee80711bdc5ebe5439dc7c2a984e573f2407968482512f692a9c61bba9791

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.1MB

MD5
1291f9cda3b9a9fe1f1e239bccc4341e

SHA1
cba33d4cccf5ffd33ef675b84fae25e6ebc411ed

SHA256
2f3cf9a2656c4f5dbda1361fb1a05dbbcfdccc48b983b82f167d1640b7fb852b

SHA512
a8714215b545349085c6e0b843fbd05c06ce7b8588566cefbf48b02e905970abde552ee64b5e124b8c85656cccf79a135a0c70060d76030168bb07fa68a76868

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.1MB

MD5
436f9f0e3840bef68909d448e422395f

SHA1
2d0a9b7dda76b2631cc3b394db66a7e552729e51

SHA256
f60a20ff7f3d7dd949c57da4865ebd3ec364aa284a2fc30fc344ff61eac1b39e

SHA512
a7d37cde98193b892b9fcf33388753b466deefc408efe661e79fff957c4b313c06bc2efbb3f5a59b0fb756ccdfcc22ce6f7206b25066d8b779009f827044455d

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
c4046ce9123ef6a30ef46eda92e66ab3

SHA1
1871902456e7ad4d577b2dd8dbcf118e55e80a26

SHA256
b3692fa9217501a5bc49deda2a03076b2b36a3407c0bb4184348ab1aaa89e396

SHA512
54e795cca169a6b4c2d4e63c4bf3e22bd3b64c6123f184524093da798db3854781e967ae7f4947dd996b967dfe373f0e357d47d5aff1c88ecca15e5b0cf94f4c

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
4ccf7c38c67049295295d2c2ff094d24

SHA1
9a7f58c6183669a0c0b7491da532ec52dd20f7e0

SHA256
a4c15896bf93bd0c3b7363e45ab4229854194e60bd02914b742d33240ce1e577

SHA512
57cd13f5116a94aa44765d14be389b748f875e239f9f0a8385004a71b06fecb074715681574f88f79e163a1e8227ad05f6c6cdbcfe077b83e6c69e89f52e0ef7

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
df542f42b29e8c73682c1dd196db94e4

SHA1
3371a9da7b148e14c60be1396fe9e6b782593d6c

SHA256
8c743c25427f42047c9ec8b935154beae8ab3bbb31cf8093ea652bce1ff1674f

SHA512
c41c511c23838f6fac6076c6c6985a1d5cffcbab8e6655c3551ac00d9182fb64435b8ac01a3aead3ac88f63abdbba2ffdc9ecc94179e56c9e5a6b6eee145f9b3

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
af87bafd4474ffac42facf4ca5a7ca8e

SHA1
17f0175e2e5a7e37f68186c6216316896ed6f4f3

SHA256
d555e742067a5d52631840c38adfb92b27103941c53a3963acd54a26bdec8e2d

SHA512
31ce7e0cc24449c344bc946051b866f8eb8fa8e53dde5e288808c53a0186466e928c1570f1a175287bade2b71cacac1648a0c593a79dd87ab5a109f10047d168

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
54daf3cdf7ae447e8c0f5519e5ff1de4

SHA1
4c8fa0114e07998adf6242c413bb77a4ecc39be2

SHA256
3b0bfbb44043aa16651e201a86a97b25bb6a785f66bdba6d33cddde79b47c292

SHA512
0f25a586f1492926dc77d1df25f2875482dc2cd21f32b4542884dd34ab6b01ac0fe1567a6c95deab79fb4ff6787d97ce6efa9429a44429edb136117338fadf34

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
4e033e363a92ad8ac7136752ac59ca0a

SHA1
33f27d497a19a4a79d8c10c7c0433842a79ccd08

SHA256
f95694e3226f8c15bd085f4fc92ba4baf4d73285a29570d853e64d2a6c345e4c

SHA512
280a778a8ec99322cfe0039666ec21956bc1615398c72cdc9c70e79a0745df39b33112a8fcdc483103def8a6e164de5281c8f9bced69d79f197442412a1e5e57

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.7MB

MD5
b1d193814705d64b2c43d6e85d8ccac9

SHA1
041b8bc0d42cd7d964d9aef4c62a7290fd21a56e

SHA256
903921284d2ac7af9df9c599c2597cceb575e7bf6e8a2e3096972b2da09d1135

SHA512
7147765af465d5045e370d40ff12950936ad2775172494399184b64f7af26e8b273547b7324474a3e1d5540c294cc42235ce936fcf3f10a24b6e20a7e107ca28

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
631f8f1ded1fa9e72f8f6719a16aed63

SHA1
3bf1ad6eaf1b38ff084317fb2406660ee1492fe0

SHA256
4f89c523b4ad5e6c540817dc925557e4fc45083c29f4c312286c9e4d611bdf11

SHA512
95828ee14adb949d5b16beedf7dcc75b601f77c336e671159538368e0e0ffad09e1c68430b516a4098a93b744f399d10df1dfb3550152c90a28979e25f7c8380

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
970117144003fb568f0703f9f1bffc98

SHA1
a8bc5174856f687620852a526b3b6323fd31f1d9

SHA256
bead36bdd58f4bcd1a7f1322da2c070bb4f4f549a98b2a8e2eb722ce46e14f7d

SHA512
523f664541d0c0e7de9a66a1689d30427f05ba87eca5a43130192b6ef334d274c5d49e604ca98b7e337c51cd0823e4861b9adaa093b66e43ef8df7e9e085093d

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
a0f3f9ac874009a7a9ca4fdf8278b610

SHA1
6ec72a139034eff303cf9a6b85c7e3dab0186a22

SHA256
395afb8d961b834b6cdf00ae076c5a5fca560b946091ae13c61cc7223a926f01

SHA512
7a9ab314df58e1e2b838160b439ebf8d9d59ec8dd49208ad686660f2e562ff32b3c937d131d95104119be4ccd0bbc637ff163c1a6f7772c785ecff26af116158

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
5fb6d6ea74aa2ed53e174df57d308b0f

SHA1
b51a51e7f3fa0346fd100de2e373b5881462e058

SHA256
072e03106f34c454e70ed5d4b063ad6ab7b3121cb5ad2c977cf4e9846912b781

SHA512
03290871884f1de22037fe3c94ca1100827d6188b92da44c36eee6ebb167054b0056f3060f9b020e3689952397d619cb21653a4c3d9df2186fe54082986e3bbd

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.3MB

MD5
54daf3cdf7ae447e8c0f5519e5ff1de4

SHA1
4c8fa0114e07998adf6242c413bb77a4ecc39be2

SHA256
3b0bfbb44043aa16651e201a86a97b25bb6a785f66bdba6d33cddde79b47c292

SHA512
0f25a586f1492926dc77d1df25f2875482dc2cd21f32b4542884dd34ab6b01ac0fe1567a6c95deab79fb4ff6787d97ce6efa9429a44429edb136117338fadf34

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
97c6ee48ba0439193b41ae62baba567f

SHA1
1d40a8feb3ed950ce6e62be9f2fcb713e5a0ad56

SHA256
d77212a0b2f9be065e13d12c3a51c4aacd5b58b8f19d7265bd054148ccf663a6

SHA512
abc2335c853df0b4962a194fbdd6f5e9a540355fc668e9c8eaf45277046d3a9f3518b3812547730837df739b87376ef065d160207d0143b2f45d616641e44434

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
97c6ee48ba0439193b41ae62baba567f

SHA1
1d40a8feb3ed950ce6e62be9f2fcb713e5a0ad56

SHA256
d77212a0b2f9be065e13d12c3a51c4aacd5b58b8f19d7265bd054148ccf663a6

SHA512
abc2335c853df0b4962a194fbdd6f5e9a540355fc668e9c8eaf45277046d3a9f3518b3812547730837df739b87376ef065d160207d0143b2f45d616641e44434

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
56f569ca37770fd4f813268bd133482d

SHA1
4cd802fbce31c804f5d3c7672f4a95a8d117e315

SHA256
f33344321e6e1bfa9693cc525f5db0b244c0620bc3764173a0defbfe5c9e7a19

SHA512
80372be788a26c37f948b94372fe018d2e0e69756c584f98aa3e8489a1fd5e79accba70706922bb06b75d7b86b6e6660504711cdd0bcab196fab1dc96cd0bf7e

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.3MB

MD5
cebedb5cbc82ec94c9a3352fe79614bf

SHA1
cb1e359077ff9f8218daccfa6324ec0bc7f4b906

SHA256
e13c3fb9df86f53865f9ced9a8bcf22cc2a0a02e462f52e5bdde4e986d5e42d8

SHA512
29de71c1c03a9f7c74d50e833b059345918afb23ff39a94847487f6c8afe5e6101bf5c261608e23d8d4c0332034177438519bdf87cc8f0796d9bec5e25923b19

Download Submit
\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
e8652aaa46c01332573ce42e8ad0ab35

SHA1
3c4a12358725fdacd27e80fb7b487de82e72e16e

SHA256
ab5344b09750bfc923f8e8a7a8817cc773c57538bb70504730c8db48ade03aa8

SHA512
0e4f658e101bd291eae9225649d3a8f455690de1bd56ec14f9e3050a4262e8232f8ee80711bdc5ebe5439dc7c2a984e573f2407968482512f692a9c61bba9791

Download Submit
\Windows\System32\alg.exe

Filesize
1.3MB

MD5
c4046ce9123ef6a30ef46eda92e66ab3

SHA1
1871902456e7ad4d577b2dd8dbcf118e55e80a26

SHA256
b3692fa9217501a5bc49deda2a03076b2b36a3407c0bb4184348ab1aaa89e396

SHA512
54e795cca169a6b4c2d4e63c4bf3e22bd3b64c6123f184524093da798db3854781e967ae7f4947dd996b967dfe373f0e357d47d5aff1c88ecca15e5b0cf94f4c

Download Submit
\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
4ccf7c38c67049295295d2c2ff094d24

SHA1
9a7f58c6183669a0c0b7491da532ec52dd20f7e0

SHA256
a4c15896bf93bd0c3b7363e45ab4229854194e60bd02914b742d33240ce1e577

SHA512
57cd13f5116a94aa44765d14be389b748f875e239f9f0a8385004a71b06fecb074715681574f88f79e163a1e8227ad05f6c6cdbcfe077b83e6c69e89f52e0ef7

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
df542f42b29e8c73682c1dd196db94e4

SHA1
3371a9da7b148e14c60be1396fe9e6b782593d6c

SHA256
8c743c25427f42047c9ec8b935154beae8ab3bbb31cf8093ea652bce1ff1674f

SHA512
c41c511c23838f6fac6076c6c6985a1d5cffcbab8e6655c3551ac00d9182fb64435b8ac01a3aead3ac88f63abdbba2ffdc9ecc94179e56c9e5a6b6eee145f9b3

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
af87bafd4474ffac42facf4ca5a7ca8e

SHA1
17f0175e2e5a7e37f68186c6216316896ed6f4f3

SHA256
d555e742067a5d52631840c38adfb92b27103941c53a3963acd54a26bdec8e2d

SHA512
31ce7e0cc24449c344bc946051b866f8eb8fa8e53dde5e288808c53a0186466e928c1570f1a175287bade2b71cacac1648a0c593a79dd87ab5a109f10047d168

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
54daf3cdf7ae447e8c0f5519e5ff1de4

SHA1
4c8fa0114e07998adf6242c413bb77a4ecc39be2

SHA256
3b0bfbb44043aa16651e201a86a97b25bb6a785f66bdba6d33cddde79b47c292

SHA512
0f25a586f1492926dc77d1df25f2875482dc2cd21f32b4542884dd34ab6b01ac0fe1567a6c95deab79fb4ff6787d97ce6efa9429a44429edb136117338fadf34

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
54daf3cdf7ae447e8c0f5519e5ff1de4

SHA1
4c8fa0114e07998adf6242c413bb77a4ecc39be2

SHA256
3b0bfbb44043aa16651e201a86a97b25bb6a785f66bdba6d33cddde79b47c292

SHA512
0f25a586f1492926dc77d1df25f2875482dc2cd21f32b4542884dd34ab6b01ac0fe1567a6c95deab79fb4ff6787d97ce6efa9429a44429edb136117338fadf34

Download Submit
\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
4e033e363a92ad8ac7136752ac59ca0a

SHA1
33f27d497a19a4a79d8c10c7c0433842a79ccd08

SHA256
f95694e3226f8c15bd085f4fc92ba4baf4d73285a29570d853e64d2a6c345e4c

SHA512
280a778a8ec99322cfe0039666ec21956bc1615398c72cdc9c70e79a0745df39b33112a8fcdc483103def8a6e164de5281c8f9bced69d79f197442412a1e5e57

Download Submit
\Windows\System32\vds.exe

Filesize
1.7MB

MD5
b1d193814705d64b2c43d6e85d8ccac9

SHA1
041b8bc0d42cd7d964d9aef4c62a7290fd21a56e

SHA256
903921284d2ac7af9df9c599c2597cceb575e7bf6e8a2e3096972b2da09d1135

SHA512
7147765af465d5045e370d40ff12950936ad2775172494399184b64f7af26e8b273547b7324474a3e1d5540c294cc42235ce936fcf3f10a24b6e20a7e107ca28

Download Submit
\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
631f8f1ded1fa9e72f8f6719a16aed63

SHA1
3bf1ad6eaf1b38ff084317fb2406660ee1492fe0

SHA256
4f89c523b4ad5e6c540817dc925557e4fc45083c29f4c312286c9e4d611bdf11

SHA512
95828ee14adb949d5b16beedf7dcc75b601f77c336e671159538368e0e0ffad09e1c68430b516a4098a93b744f399d10df1dfb3550152c90a28979e25f7c8380

Download Submit
\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
970117144003fb568f0703f9f1bffc98

SHA1
a8bc5174856f687620852a526b3b6323fd31f1d9

SHA256
bead36bdd58f4bcd1a7f1322da2c070bb4f4f549a98b2a8e2eb722ce46e14f7d

SHA512
523f664541d0c0e7de9a66a1689d30427f05ba87eca5a43130192b6ef334d274c5d49e604ca98b7e337c51cd0823e4861b9adaa093b66e43ef8df7e9e085093d

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
a0f3f9ac874009a7a9ca4fdf8278b610

SHA1
6ec72a139034eff303cf9a6b85c7e3dab0186a22

SHA256
395afb8d961b834b6cdf00ae076c5a5fca560b946091ae13c61cc7223a926f01

SHA512
7a9ab314df58e1e2b838160b439ebf8d9d59ec8dd49208ad686660f2e562ff32b3c937d131d95104119be4ccd0bbc637ff163c1a6f7772c785ecff26af116158

Download Submit
\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
5fb6d6ea74aa2ed53e174df57d308b0f

SHA1
b51a51e7f3fa0346fd100de2e373b5881462e058

SHA256
072e03106f34c454e70ed5d4b063ad6ab7b3121cb5ad2c977cf4e9846912b781

SHA512
03290871884f1de22037fe3c94ca1100827d6188b92da44c36eee6ebb167054b0056f3060f9b020e3689952397d619cb21653a4c3d9df2186fe54082986e3bbd

Download Submit
memory/564-98-0x0000000140000000-0x00000001401F4000-memory.dmp

Filesize
2.0MB

Download
memory/564-372-0x0000000140000000-0x00000001401F4000-memory.dmp

Filesize
2.0MB

Download
memory/608-413-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/608-432-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/700-145-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/808-124-0x0000000010000000-0x00000000101FE000-memory.dmp

Filesize
2.0MB

Download
memory/892-579-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/892-221-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/984-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/984-75-0x0000000000870000-0x00000000008D6000-memory.dmp

Filesize
408KB

Download
memory/984-67-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/984-69-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/984-63-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/984-327-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/984-62-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/984-70-0x0000000000870000-0x00000000008D6000-memory.dmp

Filesize
408KB

Download
memory/984-87-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/984-61-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1160-329-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/1160-91-0x0000000000270000-0x00000000002D0000-memory.dmp

Filesize
384KB

Download
memory/1160-89-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/1160-83-0x0000000000270000-0x00000000002D0000-memory.dmp

Filesize
384KB

Download
memory/1400-65-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/1400-55-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/1400-56-0x0000000000560000-0x0000000000576000-memory.dmp

Filesize
88KB

Download
memory/1400-57-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/1400-58-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/1400-59-0x0000000009EB0000-0x0000000009FE8000-memory.dmp

Filesize
1.2MB

Download
memory/1400-54-0x0000000001060000-0x00000000011E0000-memory.dmp

Filesize
1.5MB

Download
memory/1400-60-0x000000000CFF0000-0x000000000D1A0000-memory.dmp

Filesize
1.7MB

Download
memory/1428-153-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1428-159-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1428-201-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/1428-168-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/1428-457-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1428-169-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1428-165-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Filesize
64KB

Download
memory/1460-120-0x0000000010000000-0x00000000101F6000-memory.dmp

Filesize
2.0MB

Download
memory/1524-167-0x0000000100000000-0x00000001001EC000-memory.dmp

Filesize
1.9MB

Download
memory/1552-263-0x0000000000D90000-0x0000000000E10000-memory.dmp

Filesize
512KB

Download
memory/1552-339-0x0000000000D90000-0x0000000000E10000-memory.dmp

Filesize
512KB

Download
memory/1552-209-0x0000000000D90000-0x0000000000E10000-memory.dmp

Filesize
512KB

Download
memory/1628-208-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1628-191-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/1644-624-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1644-180-0x0000000000220000-0x0000000000280000-memory.dmp

Filesize
384KB

Download
memory/1644-186-0x0000000000220000-0x0000000000280000-memory.dmp

Filesize
384KB

Download
memory/1644-205-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1756-238-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/1756-254-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/1788-172-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/1788-175-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1788-552-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/1840-126-0x0000000004510000-0x0000000004550000-memory.dmp

Filesize
256KB

Download
memory/1840-101-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1840-119-0x0000000004450000-0x000000000450C000-memory.dmp

Filesize
752KB

Download
memory/1840-100-0x0000000000220000-0x0000000000286000-memory.dmp

Filesize
408KB

Download
memory/1840-102-0x0000000000220000-0x0000000000286000-memory.dmp

Filesize
408KB

Download
memory/1840-107-0x0000000000220000-0x0000000000286000-memory.dmp

Filesize
408KB

Download
memory/1840-104-0x0000000000220000-0x0000000000286000-memory.dmp

Filesize
408KB

Download
memory/1860-148-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/1860-125-0x0000000000600000-0x0000000000666000-memory.dmp

Filesize
408KB

Download
memory/1860-131-0x0000000000600000-0x0000000000666000-memory.dmp

Filesize
408KB

Download
memory/2004-236-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2004-270-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2092-423-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2092-379-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2108-261-0x0000000140000000-0x000000014020D000-memory.dmp

Filesize
2.1MB

Download
memory/2148-382-0x0000000100000000-0x000000010026B000-memory.dmp

Filesize
2.4MB

Download
memory/2172-307-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2172-264-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2228-581-0x0000000100000000-0x0000000100123000-memory.dmp

Filesize
1.1MB

Download
memory/2272-271-0x0000000100000000-0x0000000100209000-memory.dmp

Filesize
2.0MB

Download
memory/2272-714-0x0000000100000000-0x0000000100209000-memory.dmp

Filesize
2.0MB

Download
memory/2272-289-0x00000000005E0000-0x00000000007E9000-memory.dmp

Filesize
2.0MB

Download
memory/2280-411-0x0000000100000000-0x0000000100219000-memory.dmp

Filesize
2.1MB

Download
memory/2504-292-0x000000002E000000-0x000000002E20C000-memory.dmp

Filesize
2.0MB

Download
memory/2548-334-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2592-468-0x0000000100000000-0x0000000100202000-memory.dmp

Filesize
2.0MB

Download
memory/2656-337-0x0000000001000000-0x00000000011ED000-memory.dmp

Filesize
1.9MB

Download
memory/2688-331-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2688-346-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2708-466-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2780-340-0x0000000100000000-0x00000001001EC000-memory.dmp

Filesize
1.9MB

Download
memory/2788-471-0x0000000100000000-0x000000010021B000-memory.dmp

Filesize
2.1MB

Download
memory/2904-373-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2940-376-0x0000000100000000-0x00000001001ED000-memory.dmp

Filesize
1.9MB

Download
memory/2948-561-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2976-462-0x0000000100000000-0x000000010020A000-memory.dmp

Filesize
2.0MB

Download