blustealer | 3ed0594f9fef04feeaec1abc8f1ad0b85c75df614ba09377e394321ccb16e586

Resubmissions

12-05-2023 14:28

230512-rtgxxadd83 10

12-05-2023 14:17

230512-rlq6lsfe9y 10

Analysis

max time kernel
1200s
max time network
1203s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-05-2023 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order.exe
Size

1.4MB
MD5

98ac95047944a90076ed642f2b56fc7f
SHA1

e34b95acbdbead3a7057f6e42673bed24aa573c9
SHA256

421845b1fbf3828e4f4fe3e7147f501a422bd6ae755e388a089c67d005770b58
SHA512

8d415d64193df913602752c3004a7a24d7bc0ab29129eda9a1e9653e7cbfbaccb5ada7a1aa4a8b4ea81ff7fc2696fea242caf722e655b43f41cdc952738c5f74
SSDEEP

24576:N8whh2b5/1L3Y5zhzKSYIb34DSNCZlk0pRIIV6Kkcd4UiivgEvyV1jBSH:w91Lo5zgSYUI24ZlkwRI+9WUiiv7vyX0

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 64 IoCs

pid	Process
460	Process not Found
1796	alg.exe
1076	aspnet_state.exe
1080	mscorsvw.exe
932	mscorsvw.exe
1188	mscorsvw.exe
544	mscorsvw.exe
268	dllhost.exe
1792	ehRecvr.exe
2044	ehsched.exe
316	elevation_service.exe
1940	IEEtwCollector.exe
1524	mscorsvw.exe
1096	GROOVE.EXE
2088	maintenanceservice.exe
2152	mscorsvw.exe
2352	mscorsvw.exe
2440	mscorsvw.exe
2536	mscorsvw.exe
2640	mscorsvw.exe
2752	mscorsvw.exe
2900	msdtc.exe
2980	msiexec.exe
2164	OSE.EXE
1516	OSPPSVC.EXE
1524	perfhost.exe
2188	locator.exe
2220	snmptrap.exe
2352	vds.exe
2524	mscorsvw.exe
2656	vssvc.exe
964	wbengine.exe
2712	WmiApSrv.exe
2916	wmpnetwk.exe
3008	SearchIndexer.exe
2776	mscorsvw.exe
2488	mscorsvw.exe
2268	mscorsvw.exe
2556	mscorsvw.exe
800	mscorsvw.exe
2624	mscorsvw.exe
2564	mscorsvw.exe
1380	mscorsvw.exe
1056	mscorsvw.exe
904	mscorsvw.exe
2696	mscorsvw.exe
1544	mscorsvw.exe
3012	mscorsvw.exe
1584	mscorsvw.exe
1808	mscorsvw.exe
2144	mscorsvw.exe
1716	mscorsvw.exe
2336	mscorsvw.exe
864	mscorsvw.exe
2584	mscorsvw.exe
3012	DllHost.exe
2892	DllHost.exe
972	mscorsvw.exe
2144	mscorsvw.exe
2260	mscorsvw.exe
2552	DllHost.exe
1948	mscorsvw.exe
108	DllHost.exe
2196	mscorsvw.exe

Loads dropped DLL 32 IoCs

pid	Process
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
2980	msiexec.exe
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
752	Process not Found
584	Process not Found
584	Process not Found
2144	mscorsvw.exe
2144	mscorsvw.exe
584	Process not Found
584	Process not Found
1948	mscorsvw.exe
1948	mscorsvw.exe
824	mscorsvw.exe
824	mscorsvw.exe
2456	mscorsvw.exe
2456	mscorsvw.exe
2604	mscorsvw.exe
2604	mscorsvw.exe
2700	mscorsvw.exe
2700	mscorsvw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FPRRZWTM\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTIFN44A\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2STIOPZK\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M3HSS2N\desktop.ini	DllHost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\msiexec.exe	vds.exe
File opened for modification	C:\Windows\system32\wbengine.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	vds.exe
File opened for modification	C:\Windows\system32\wbengine.exe	vds.exe
File opened for modification	C:\Windows\system32\msiexec.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	GROOVE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\vds.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	OSPPSVC.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	msdtc.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	locator.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	vds.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	WmiApSrv.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	GROOVE.EXE
File opened for modification	C:\Windows\system32\fxssvc.exe	msiexec.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	wmpnetwk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\dllhost.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\wbengine.exe	GROOVE.EXE
File opened for modification	C:\Windows\system32\fxssvc.exe	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\38e21f02decfa14c.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	alg.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	msiexec.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	snmptrap.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	OSPPSVC.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	vssvc.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	wmpnetwk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	locator.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\wbengine.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	WmiApSrv.exe
File opened for modification	C:\Windows\system32\msiexec.exe	wmpnetwk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	locator.exe
File opened for modification	C:\Windows\system32\msiexec.exe	WmiApSrv.exe
File opened for modification	C:\Windows\system32\locator.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\wbengine.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	vssvc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	WmiApSrv.exe
File opened for modification	C:\Windows\system32\wbengine.exe	wmpnetwk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	msiexec.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	vssvc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	vssvc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	Purchase Order.exe
File opened for modification	C:\Windows\System32\msdtc.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	OSPPSVC.EXE

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 736	1544	Purchase Order.exe	28
PID 736 set thread context of 1288	736	Purchase Order.exe	32

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	vds.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	locator.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	WmiApSrv.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	GROOVE.EXE
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	locator.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	snmptrap.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	msdtc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	OSPPSVC.EXE
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	GROOVE.EXE
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	vds.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	vssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	vssvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	WmiApSrv.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	vssvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	wmpnetwk.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	vds.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	WmiApSrv.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	wmpnetwk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	mscorsvw.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	vssvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	vds.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	vssvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	vssvc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	msdtc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	vssvc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	snmptrap.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	OSPPSVC.EXE
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	snmptrap.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPA7D.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Purchase Order.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1C67.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	GROOVE.EXE
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP82B8.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	locator.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	vssvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	wmpnetwk.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	msdtc.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	WmiApSrv.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	SearchIndexer.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1A86DD9C-C0DE-4B86-A82D-1CB36623E2BE}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	SearchIndexer.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index142.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	WmiApSrv.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	wmpnetwk.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	GROOVE.EXE
File opened for modification	C:\Windows\ehome\ehsched.exe	SearchIndexer.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP95EA.tmp\Microsoft.Office.Tools.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	vds.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	locator.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	SearchIndexer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	GROOVE.EXE
File opened for modification	C:\Windows\ehome\ehsched.exe	msdtc.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	vds.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	elevation_service.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	OSPPSVC.EXE
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Purchase Order.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-104 = "Jellyfish"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ehRecvr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-106 = "Tulips"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-105 = "Koala"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb040000000000000008000000000000000000000041a28227040000000000000008000000904b07d7ef84d90158192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform	OSPPSVC.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-108 = "Penguins"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-142 = "Wildlife"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-102 = "Desert"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{33FD8AD0-2C9E-4CBD-A77E-A909B2F48919}	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003017dfa1f084d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-107 = "Lighthouse"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-103 = "Hydrangeas"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
576	ehRec.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
736	Purchase Order.exe
316	elevation_service.exe
316	elevation_service.exe
316	elevation_service.exe
316	elevation_service.exe
316	elevation_service.exe
1096	GROOVE.EXE
1096	GROOVE.EXE
1096	GROOVE.EXE
1096	GROOVE.EXE
1096	GROOVE.EXE
1516	OSPPSVC.EXE
1516	OSPPSVC.EXE
1516	OSPPSVC.EXE
1516	OSPPSVC.EXE
1516	OSPPSVC.EXE
2352	vds.exe
2352	vds.exe
2352	vds.exe
2352	vds.exe
2352	vds.exe
2656	vssvc.exe
2656	vssvc.exe
2656	vssvc.exe
2656	vssvc.exe
2656	vssvc.exe
2712	WmiApSrv.exe
2712	WmiApSrv.exe
2712	WmiApSrv.exe
2712	WmiApSrv.exe
2712	WmiApSrv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	736	Purchase Order.exe
Token: SeShutdownPrivilege	1188	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	1188	mscorsvw.exe
Token: 33	1820	EhTray.exe
Token: SeIncBasePriorityPrivilege	1820	EhTray.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	1188	mscorsvw.exe
Token: SeShutdownPrivilege	1188	mscorsvw.exe
Token: SeDebugPrivilege	576	ehRec.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: 33	1820	EhTray.exe
Token: SeIncBasePriorityPrivilege	1820	EhTray.exe
Token: SeRestorePrivilege	2980	msiexec.exe
Token: SeTakeOwnershipPrivilege	2980	msiexec.exe
Token: SeSecurityPrivilege	2980	msiexec.exe
Token: SeBackupPrivilege	2656	vssvc.exe
Token: SeRestorePrivilege	2656	vssvc.exe
Token: SeAuditPrivilege	2656	vssvc.exe
Token: SeBackupPrivilege	964	wbengine.exe
Token: SeRestorePrivilege	964	wbengine.exe
Token: SeSecurityPrivilege	964	wbengine.exe
Token: 33	2916	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	2916	wmpnetwk.exe
Token: SeManageVolumePrivilege	3008	SearchIndexer.exe
Token: 33	3008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3008	SearchIndexer.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeDebugPrivilege	736	Purchase Order.exe
Token: SeDebugPrivilege	736	Purchase Order.exe
Token: SeDebugPrivilege	736	Purchase Order.exe
Token: SeDebugPrivilege	736	Purchase Order.exe
Token: SeDebugPrivilege	736	Purchase Order.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe
Token: SeShutdownPrivilege	544	mscorsvw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1820	EhTray.exe
1820	EhTray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1820	EhTray.exe
1820	EhTray.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
736	Purchase Order.exe
2440	SearchProtocolHost.exe
2440	SearchProtocolHost.exe
2440	SearchProtocolHost.exe
2440	SearchProtocolHost.exe
2440	SearchProtocolHost.exe
2440	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
2440	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe
524	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 1544 wrote to memory of 736	1544	Purchase Order.exe	28
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 736 wrote to memory of 1288	736	Purchase Order.exe	32
PID 544 wrote to memory of 1524	544	mscorsvw.exe	43
PID 544 wrote to memory of 1524	544	mscorsvw.exe	43
PID 544 wrote to memory of 1524	544	mscorsvw.exe	43
PID 544 wrote to memory of 2152	544	mscorsvw.exe	46
PID 544 wrote to memory of 2152	544	mscorsvw.exe	46
PID 544 wrote to memory of 2152	544	mscorsvw.exe	46
PID 1188 wrote to memory of 2352	1188	mscorsvw.exe	47
PID 1188 wrote to memory of 2352	1188	mscorsvw.exe	47
PID 1188 wrote to memory of 2352	1188	mscorsvw.exe	47
PID 1188 wrote to memory of 2352	1188	mscorsvw.exe	47
PID 1188 wrote to memory of 2440	1188	mscorsvw.exe	48
PID 1188 wrote to memory of 2440	1188	mscorsvw.exe	48
PID 1188 wrote to memory of 2440	1188	mscorsvw.exe	48
PID 1188 wrote to memory of 2440	1188	mscorsvw.exe	48
PID 1188 wrote to memory of 2536	1188	mscorsvw.exe	49
PID 1188 wrote to memory of 2536	1188	mscorsvw.exe	49
PID 1188 wrote to memory of 2536	1188	mscorsvw.exe	49
PID 1188 wrote to memory of 2536	1188	mscorsvw.exe	49
PID 1188 wrote to memory of 2640	1188	mscorsvw.exe	50
PID 1188 wrote to memory of 2640	1188	mscorsvw.exe	50
PID 1188 wrote to memory of 2640	1188	mscorsvw.exe	50
PID 1188 wrote to memory of 2640	1188	mscorsvw.exe	50
PID 1188 wrote to memory of 2752	1188	mscorsvw.exe	51
PID 1188 wrote to memory of 2752	1188	mscorsvw.exe	51
PID 1188 wrote to memory of 2752	1188	mscorsvw.exe	51
PID 1188 wrote to memory of 2752	1188	mscorsvw.exe	51
PID 1188 wrote to memory of 2524	1188	mscorsvw.exe	60
PID 1188 wrote to memory of 2524	1188	mscorsvw.exe	60
PID 1188 wrote to memory of 2524	1188	mscorsvw.exe	60
PID 1188 wrote to memory of 2524	1188	mscorsvw.exe	60
PID 1188 wrote to memory of 2776	1188	mscorsvw.exe	66
PID 1188 wrote to memory of 2776	1188	mscorsvw.exe	66
PID 1188 wrote to memory of 2776	1188	mscorsvw.exe	66
PID 1188 wrote to memory of 2776	1188	mscorsvw.exe	66
PID 1188 wrote to memory of 2488	1188	mscorsvw.exe	67
PID 1188 wrote to memory of 2488	1188	mscorsvw.exe	67
PID 1188 wrote to memory of 2488	1188	mscorsvw.exe	67
PID 1188 wrote to memory of 2488	1188	mscorsvw.exe	67
PID 3008 wrote to memory of 2440	3008	SearchIndexer.exe	68
PID 3008 wrote to memory of 2440	3008	SearchIndexer.exe	68
PID 3008 wrote to memory of 2440	3008	SearchIndexer.exe	68
PID 3008 wrote to memory of 1716	3008	SearchIndexer.exe	69
PID 3008 wrote to memory of 1716	3008	SearchIndexer.exe	69
PID 3008 wrote to memory of 1716	3008	SearchIndexer.exe	69
PID 1188 wrote to memory of 2268	1188	mscorsvw.exe	70
PID 1188 wrote to memory of 2268	1188	mscorsvw.exe	70

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1288

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1796

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1080

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 1e0 -NGENProcess 1e4 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1e0 -NGENProcess 1e4 -Pipe 1f4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 248 -NGENProcess 1e4 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 268 -NGENProcess 1e0 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 24c -NGENProcess 1fc -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 24c -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 250 -NGENProcess 274 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 268 -NGENProcess 260 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 288 -NGENProcess 24c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 120 -NGENProcess 290 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 28c -NGENProcess 278 -Pipe 120 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 28c -NGENProcess 290 -Pipe 184 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 29c -NGENProcess 28c -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 274 -NGENProcess 11c -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 1f4 -NGENProcess 254 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 270 -NGENProcess 2a4 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 270 -NGENProcess 29c -Pipe 1f4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 228 -NGENProcess 280 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 264 -NGENProcess 29c -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2b0 -NGENProcess 270 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2f4 -NGENProcess 2f8 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 2f4 -NGENProcess 304 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1716

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 170 -InterruptEvent 15c -NGENProcess 160 -Pipe 16c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 15c -NGENProcess 160 -Pipe 170 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 14c -InterruptEvent 1a4 -NGENProcess 1a0 -Pipe 180 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 178 -InterruptEvent 14c -NGENProcess 1f0 -Pipe 1a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 14c -InterruptEvent 204 -NGENProcess 1c8 -Pipe 200 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 204 -NGENProcess 14c -Pipe 1f8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 210 -NGENProcess 1c8 -Pipe 1fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1f0 -NGENProcess 178 -Pipe 1c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 1ec -NGENProcess 1fc -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 214 -NGENProcess 1b4 -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 1fc -NGENProcess 210 -Pipe 1f8 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 210 -NGENProcess 1e0 -Pipe 1b4 -Comment "NGen Worker Process"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 14c -NGENProcess 1f0 -Pipe 1fc -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 14c -InterruptEvent 1f0 -NGENProcess 1a0 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 1f0 -NGENProcess 14c -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 220 -NGENProcess 1c8 -Pipe 208 -Comment "NGen Worker Process"
  2⤵
  PID:1584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 14c -InterruptEvent 1f8 -NGENProcess 1ec -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2700

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:268

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1792

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:2044

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1820

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:316

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1940

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2088

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2164

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1516

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2188

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2220

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2712

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2647223082-2067913677-935928954-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2647223082-2067913677-935928954-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2440
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:1716
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:524
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:292
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2932
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2236
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2684
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2724
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2192
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2256
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
PID:3012

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
PID:2892

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
PID:108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
2dfc8e22c25c2a66ced0327294e015fb

SHA1
e86854ade5d9d0439e05ad9e4b77104c1f02a659

SHA256
067eda18f48caf4a4535340ce25a857f2d0af55f163df632c6ce54b836373284

SHA512
cf29ad03abdf865c07e93b7b37f3e95f1c04a6056d3b925a8811fc19d773cbf1f98f7e53111e7a141f06a4c4a2022bffded9510d860785c7d2fbd38b8484ad31

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
30.1MB

MD5
9069b66bced39277957a6dc9169a128e

SHA1
8d51d76a924f7f803dd6e09523af23e4788bb62e

SHA256
535ffeaba2079ed5d9fbfcdf30e481bd1fa42da04f8115a19c3f760b8edd6ee3

SHA512
23bea9a4c9b49c3269e71ca5ef3285f45f0e3c0af7747959250113123e69758540239ec26f7b0224a157bc055d432fe36421ef2244d3eaf325814bbcca09a38f

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
d97f4d6f61d29b9a3c6dec539a979575

SHA1
2774bd25ff8afa66945de3a3545fb59dbcef111b

SHA256
1ad220943994d21817bc6b4501cd2a810b418860c010f8f67999f2f52df43cc7

SHA512
e3af56ea4e91e6d454a001cb517f2a4771550dc8b9db290c3c65a668d0fa760238fbc6dd9b596237991d688af808f0811057fff4a83e62679c1e355c1d43d395

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
5.2MB

MD5
898a85459773fda395b832e4cbfe0883

SHA1
fca1711c50f0d0293d0754cca7864198b4afc39f

SHA256
af8073e9ff5253b01bdfcfb48c4ffd50d3b824be402f5bef4aee15ca9ac9dae0

SHA512
8459b089bab4e157a1c9df5a5276b1077614ed2c444ff73c71962a5c9f508ed4d1a4455f8428453fa004b96c9e08d95c4a33ac8943ab5253fca9b9dd97580de1

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
e481e50d0e177fa51e2464bebcb616a3

SHA1
1c1e14d5f835cc388344a61c56af8d1750a2e6d8

SHA256
c695de9cd978d900ecee2f5fa43011d2c044842ca4adf344e01b5a5327b3ee84

SHA512
fbbb7c70b9666dd2fe3af0551992c717dfdad6fbf3dbd5835e50709e0188e9930824cedd840d54cc4b43b09ae788b203c61fcbf70d37fa2bfc7fcdf64f584431

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
28ca577953947db96754a27bc4b44b6e

SHA1
9ad0b20cb7d7a49ffeeefb32f547966860f36418

SHA256
ba859acbe89370e9fb19e57f9c32536744031821614da542aa55be8a532d4e8c

SHA512
b981560408d0eb8a4c0df175be779b60c743e02959e687ee825d23d5def59114c835b059ea772b62a04f5718039877039c6ec0c8bf3e4e697d1e2555790b55da

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk

Filesize
8KB

MD5
b00916c29f3b9c781fb815227526fc31

SHA1
c7b9ea5e76a812e31d7172d9bc60786e063d316b

SHA256
ced28e0042bc5e4665b98dd1e5c757ce40bab1df4b4958aee90bb2c4b419042a

SHA512
095282b8d18cfc9c2f382b13eb87fa049a87c21d43d12f73287d0a83ead896a8ba4132ff7d1ced0e53635772a87b08a8dd501f349f510627988ad8af186c345e

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
c194b25c6f7750aefec4cafb5bd17959

SHA1
b10f795fd39e871a7bdf2234c8906a7143483cb9

SHA256
8849e045cc953e359023f082406b1eb5e840111cd067910387e8d33fabecd723

SHA512
42c90c533641c6df67d7a8dbe60bd0612463f583708fdd0bed10fd482f5f91ee2b1417bd1f11d96f88128b547cd47c1ef3042ca957f36342c0662d7b427d8d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

Filesize
512KB

MD5
abda99ce4b744b77c03a0935bd618208

SHA1
8f82658cb8923aa3cc4b39715bb483d6a2024dec

SHA256
9f906ca1ae3c0d0494f5671fc3d5bc1948d378b390791dad47cccbba1f7cadd3

SHA512
3109ccbc4e07cd579bee11ac47c99b4652444e44aae9101a4d6386dc7402acfeacf2fdb9ee986318a47174031d86c70ec544fe4bb07ec8c189aec7c1a24c903e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
805c3c24e1e18431e92c5b8a1e55cb1e

SHA1
8fe40a81ca256badba458156a5f1c9286c23dc81

SHA256
12a75c12648dd7b88f4b60432e4c0646d3c1cdb607b0faccd2d940cc2a6b6939

SHA512
e1432d1be9f2779385cec2882f8cb5437d9a12abc23390c2d9cb46e940e2ee08cda36538e5bfc4549b68892db45fc9d5139e4df0e40011aefa26ca2f168dfdcc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
805c3c24e1e18431e92c5b8a1e55cb1e

SHA1
8fe40a81ca256badba458156a5f1c9286c23dc81

SHA256
12a75c12648dd7b88f4b60432e4c0646d3c1cdb607b0faccd2d940cc2a6b6939

SHA512
e1432d1be9f2779385cec2882f8cb5437d9a12abc23390c2d9cb46e940e2ee08cda36538e5bfc4549b68892db45fc9d5139e4df0e40011aefa26ca2f168dfdcc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
53076232c13d8051affcf6d094e0be0f

SHA1
2ef486b4c80417a6f71c5bbfafef81b19ecf9457

SHA256
7ded8cf30bdf4938bf521e7e7235584945ef131f74c94ddc43e35ea759b8f67c

SHA512
4c16b49f6a07fcae455aea204740712f1fdeaa8dcb04156148187f84c3c3735671ca68da800942289a08998fc9564091885d5d66b19abbf489497365406a2374

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.3MB

MD5
3e3ce46de00919ffa805025d5c111c47

SHA1
d1e5af0a38dcfb623ac1b52936d8c0abbf0f85bc

SHA256
000083ca09268c6301c0f280d3dd3cebc89651e6893cd43233231e7f92a9fe9a

SHA512
8749d3b1dbbb34e7fc3dafa125d7f238ca52fee4a570f23333c8a018ffebb37406a83cb1f5e5884e3109b066cbf4d42c84ef8c16a4481430bcd12e6f03955277

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
dab4aa1c104065d479eff88b2ef7a104

SHA1
0da01c5250da4ab5a5c6240aa86dba2e2a41d5f7

SHA256
06413d535b9a37cf3eae33c176dd8477902f1603dcef9b9048018a4f056d6c2a

SHA512
6815404c0a4bbbe94d4dde619262ad787b900ceededed7e897ea49d52b2ae625ec34c069290a26a1f6e8118da45fdf9304700556b2f1f86df6a6cdc7ea7142ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
dab4aa1c104065d479eff88b2ef7a104

SHA1
0da01c5250da4ab5a5c6240aa86dba2e2a41d5f7

SHA256
06413d535b9a37cf3eae33c176dd8477902f1603dcef9b9048018a4f056d6c2a

SHA512
6815404c0a4bbbe94d4dde619262ad787b900ceededed7e897ea49d52b2ae625ec34c069290a26a1f6e8118da45fdf9304700556b2f1f86df6a6cdc7ea7142ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
dab4aa1c104065d479eff88b2ef7a104

SHA1
0da01c5250da4ab5a5c6240aa86dba2e2a41d5f7

SHA256
06413d535b9a37cf3eae33c176dd8477902f1603dcef9b9048018a4f056d6c2a

SHA512
6815404c0a4bbbe94d4dde619262ad787b900ceededed7e897ea49d52b2ae625ec34c069290a26a1f6e8118da45fdf9304700556b2f1f86df6a6cdc7ea7142ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
dab4aa1c104065d479eff88b2ef7a104

SHA1
0da01c5250da4ab5a5c6240aa86dba2e2a41d5f7

SHA256
06413d535b9a37cf3eae33c176dd8477902f1603dcef9b9048018a4f056d6c2a

SHA512
6815404c0a4bbbe94d4dde619262ad787b900ceededed7e897ea49d52b2ae625ec34c069290a26a1f6e8118da45fdf9304700556b2f1f86df6a6cdc7ea7142ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
3b0e98a3e49e5e2e4d97ddb3d80cec49

SHA1
4f2191a60fe13c77abc25fdfb3745f8b762e8aa4

SHA256
123ad0978ebbeb28d1838bb969f51d5eeca60150570b196ce1827693441c0c94

SHA512
76c5bccb07080182ed05d8121c5b8a1b32afdbd15c2984329bef5c02a28eff3999b5386f2ed983aed7d6353f1c48f98ba418cab97931ee900a254078c1881763

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
0fe35adb1f3bf7c4c6e90f3311cdba51

SHA1
a221062a4c054f311b27fa11f8792e1fbf825069

SHA256
be44c7ac7d67c0312f4df7754e01772aa5967b0040e5910e37dce87f92275cc5

SHA512
870855c53d039efb090abc2d8b6ca4a9aa476445becb16ae4ba35a7fd32e1a37992ab58b2fd9d5dfe336901db6436e3eba2edee748385387fa2bef86a0f36bcb

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
0fe35adb1f3bf7c4c6e90f3311cdba51

SHA1
a221062a4c054f311b27fa11f8792e1fbf825069

SHA256
be44c7ac7d67c0312f4df7754e01772aa5967b0040e5910e37dce87f92275cc5

SHA512
870855c53d039efb090abc2d8b6ca4a9aa476445becb16ae4ba35a7fd32e1a37992ab58b2fd9d5dfe336901db6436e3eba2edee748385387fa2bef86a0f36bcb

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
e7d767b6c783026dc1a072c751c8efa6

SHA1
2ba4a3304898cc988b6e3de13de8af4c832262ff

SHA256
0d92c2f5ec12ae3957f37eabfbb04c1be2ba57ad4b5dc4a300b87220895feb2f

SHA512
b5db4ac48cc4282a4d40ad1226b0913ad78935f3b66954c4d1e1e92413bcd1459819e8d9c5a2c1ad5e0a90d31c97342c806bb2b47901f38e0dc3fdc7820bb78c

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
271f74d75d611c76be62e90c95ec6c59

SHA1
ad9b7ab84b3b1c7aa4b311995b60b214a79e148e

SHA256
793dd448db6e7231b4c9a019eeb59719c59ea1948e7ad196a4687e102e8ccde4

SHA512
635bacdfd9b194eebbc8e9ed94a4e900aa00e79b99c8332bbec1fa0bc1b7d7583e87cf34a4c1ef37b18cf81136c8e82764814aa2d8894829682559cc6f6b2cbc

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
08cc0bf279709eba756e0667ff57d733

SHA1
377b800fe732645f705d905294325b7808b6688a

SHA256
d965138d9ba78e4e4cb4216f8876ecfe456762fc57bd26e5ab3489cfbe02c1d0

SHA512
40b5b0c5adb333499b208f135401348a5da5772359872563d91f9f5a6a192dfa9b1df398f3c598256b1911e075e25ba7f80baca583040cccbad94fb642f323ce

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
84b63db594e2e48f5edbae7154f944e6

SHA1
4db2b46e6e5a8ed608881c0616e6cb9e1a8226cd

SHA256
b40482b0bafb038ba6b17740b17e030cba90b91289848863d3ebfc538158947a

SHA512
8163484aba4c1cea1907fdef044e93c4480911ce8c2c0fd14920743b0055019e874eb4e9dcd74e01ada395c5bfaae68b908cfa5d222461727b6ec6ba999b1df0

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.1MB

MD5
2ca6145e85e38b72522c76a8f90cf4b6

SHA1
eff09843c22a40b2ce5eba068d5608b195e9b208

SHA256
9182c95b6d1aceb0bf1f8f1a102b3d4ca9a88e59eb0ec61be409df863faf4a24

SHA512
4cd856f8a5207c9204476dc0e7e4cdd976555380bc082b926d0d4ffea54781b33ea8718daedf190bce534a794ceef741d63878e0d1527a9bd1706d3b36265715

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.1MB

MD5
747e8d89effc38ee8b4a7d87cef86999

SHA1
b4800ffd3594d630781d1b0d32757bc945c6db15

SHA256
06976d5aca1b0bd17eb9d8ff2b2ec99e6beca1f0530968095904add221b13896

SHA512
693fdcd754f704e1378441638b2cb73e366c633e9e049b4ec802cc23547a56bc788663fb272f9ba05abc8555338969f7f726b265c0e16a4ef2c11b08602cbff7

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
cefb44cdd1828277d31a652c47167c0e

SHA1
746744e541fc6c26c5baa9859c70fb0dd53e2dfa

SHA256
e2bbb2572dccd653f5acb19058a2c3d4798a258be1dfca82c4978abfcf341698

SHA512
e6e9f212ceaacbdc68f5452deb2ae9a6737aaad4034233e64b832585439b5bc8de043ef2c472c328b0ddfc0bdd65d9373b01f8ff983c4c1291b2921aeebd7507

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
0438b79e287f7057e17f9080c9f0369e

SHA1
73dd003f2764e5895c2fbf7e29264727f4065e36

SHA256
2eb948c38a913030a991bbb5c183bcd6789e98f85bf220fd17c7fcac3656109e

SHA512
a89424ee49f16614ea8689f7f0a1ddc1555cb81bd19e49e4d52884b7f64cd932bb29c1225632749e725bad31eb0bab08f61989ce3b6add45e8142349d2d8394a

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
d2347f559669e0b23f8b14217369c04c

SHA1
36171b4af28cf2c8e79f1cc5c65d9c12869a91f0

SHA256
beaef108637c44517a7711eaa065efcddeec655c63b063b862a351d4ef0f2f1f

SHA512
ce3c31a1cc1b5b26aea53be2bafa6ce5728d23d82e4e1442a28ff118cd9aeb79a92fadfa4633617542612c07e97cea5c03e32f27274997543eee28d44b5e804d

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
47b0afb2917653786e9961f04d1f2779

SHA1
c49ebd554267446d2c3e3061af9c2ebe63bd8494

SHA256
6fd356a28b2159b6f2b1883273db6fa6d5b221dc45813079cc8aa1dfea872051

SHA512
5ee2f64c9995938acc6523ffe8fc98a427b0616724634d3c1977cfc3e94f90c8dd4854f716759e8b9339561374988bc2f68ce1bf89bc0bfa501eae86c4cc51f5

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
51519143df32f0b2513e836605f2ae93

SHA1
c717c34a2f9c06c4a0a1a5bcd495bc4bc8daae33

SHA256
b3771b7d377e0ef3e9fd164509310e940dfccc49527e9039621a4701e8db7930

SHA512
627cf6915a00a49faeb9aa158d2d008989fc31e2a87f832ee24246463112529b5a2a9b79b0f31975050f7866fcabf963fa4841853cf32e5fdeccd6a19e7ad77a

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
bc91df348f40f32e69643529009e8be1

SHA1
fd58e65416108e86a6bb676b0d49fdaf4c8c3ef2

SHA256
946f31500752be48909e118e5dd27b7bce172aa0d29fa4267d6154517b8618ea

SHA512
1d9ab972c1b7e7905de9fd701195c4b10feac96cc3753243cfadfdfda8b7fb6466b00710fc8812b7f73d07728083ad5e5489c20706b8231aa9ad8741248c152a

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.7MB

MD5
2b24f39130d9adbad71fdda9aafc0ca5

SHA1
0dd76b7f7ef221ec645c41c060c056b4abfb8e63

SHA256
987e6d3cb198245c7dadd1a81e24d6abcc199cf62da62ed198bef44551f9df77

SHA512
a139410c5396bb2e7e315ce47cbe80aa499c21b2c78ad9fe6d91c2eb1baa12bccea14d29f98745425589c8bd1cae0475ee935e59d7dd03127f19eaae9dcd0059

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
f4e285e726ca2e10ad43131f58642703

SHA1
3c8258ed801b4fea1e00e656e15c8f152ad710ae

SHA256
4ceb211f6e6d85be90c85324d1d9a3a4219114f0e666c517a6b435b2d7a38b25

SHA512
51c3f3291e7c659097f62b1a110bf19c651da760e206716af36c3344229c1be5c1352d80156088aa8e251e7573ad4db771e7fc6095f7c4f7d464006280d0260b

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
c20e52b1b5e421c3e0b61fb8e3311575

SHA1
dee364d346867468e021afa9412fbab675c536b2

SHA256
24dce6097dc40683178a40d7663d19e47aaf03d4711f7ab1a6f0294d823466bf

SHA512
ff2a3a07bf6e8805cc37420efadadd31a834daa4add1bef02695ddeac37b89f965dc839c19d1b17f7800c99c8d813f88a1711e4480bc0e51527dd0a4a8656b59

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
691993f7d545328a3004adbfff81950b

SHA1
c033af2997849ec1be0d150bdb28868b3dd31640

SHA256
a060211ea4b678a810f1e408eae22d4aff6e185a2546d7a71c0db32775dd634d

SHA512
2eaceace175cd4b3aec6940756c63f629ca6799061bbd783ce6cfb21387b459e6e72b3c3ec1822e9500726844c17e1415e094a206d70645be715ac7f94be6ffd

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
2fc964008416b3ed406efdefb0ad4c3a

SHA1
e68a6de414fba16ccfe0dce87a139b1fcb8b3c11

SHA256
92203b6a5925bdc59d9b35306b9abedce06740989ebd34c30107b71666745c0c

SHA512
8606a56422bb23e6a87b75a9435cedebeb18170adf234c7c67fc4c230634e3fcd475742ee97c713f03e81b8dbf30434cbe8409b4882bb824e829734bd524d778

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.3MB

MD5
51519143df32f0b2513e836605f2ae93

SHA1
c717c34a2f9c06c4a0a1a5bcd495bc4bc8daae33

SHA256
b3771b7d377e0ef3e9fd164509310e940dfccc49527e9039621a4701e8db7930

SHA512
627cf6915a00a49faeb9aa158d2d008989fc31e2a87f832ee24246463112529b5a2a9b79b0f31975050f7866fcabf963fa4841853cf32e5fdeccd6a19e7ad77a

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
28ca577953947db96754a27bc4b44b6e

SHA1
9ad0b20cb7d7a49ffeeefb32f547966860f36418

SHA256
ba859acbe89370e9fb19e57f9c32536744031821614da542aa55be8a532d4e8c

SHA512
b981560408d0eb8a4c0df175be779b60c743e02959e687ee825d23d5def59114c835b059ea772b62a04f5718039877039c6ec0c8bf3e4e697d1e2555790b55da

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
28ca577953947db96754a27bc4b44b6e

SHA1
9ad0b20cb7d7a49ffeeefb32f547966860f36418

SHA256
ba859acbe89370e9fb19e57f9c32536744031821614da542aa55be8a532d4e8c

SHA512
b981560408d0eb8a4c0df175be779b60c743e02959e687ee825d23d5def59114c835b059ea772b62a04f5718039877039c6ec0c8bf3e4e697d1e2555790b55da

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
805c3c24e1e18431e92c5b8a1e55cb1e

SHA1
8fe40a81ca256badba458156a5f1c9286c23dc81

SHA256
12a75c12648dd7b88f4b60432e4c0646d3c1cdb607b0faccd2d940cc2a6b6939

SHA512
e1432d1be9f2779385cec2882f8cb5437d9a12abc23390c2d9cb46e940e2ee08cda36538e5bfc4549b68892db45fc9d5139e4df0e40011aefa26ca2f168dfdcc

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.3MB

MD5
3e3ce46de00919ffa805025d5c111c47

SHA1
d1e5af0a38dcfb623ac1b52936d8c0abbf0f85bc

SHA256
000083ca09268c6301c0f280d3dd3cebc89651e6893cd43233231e7f92a9fe9a

SHA512
8749d3b1dbbb34e7fc3dafa125d7f238ca52fee4a570f23333c8a018ffebb37406a83cb1f5e5884e3109b066cbf4d42c84ef8c16a4481430bcd12e6f03955277

Download Submit
\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
84b63db594e2e48f5edbae7154f944e6

SHA1
4db2b46e6e5a8ed608881c0616e6cb9e1a8226cd

SHA256
b40482b0bafb038ba6b17740b17e030cba90b91289848863d3ebfc538158947a

SHA512
8163484aba4c1cea1907fdef044e93c4480911ce8c2c0fd14920743b0055019e874eb4e9dcd74e01ada395c5bfaae68b908cfa5d222461727b6ec6ba999b1df0

Download Submit
\Windows\System32\alg.exe

Filesize
1.3MB

MD5
cefb44cdd1828277d31a652c47167c0e

SHA1
746744e541fc6c26c5baa9859c70fb0dd53e2dfa

SHA256
e2bbb2572dccd653f5acb19058a2c3d4798a258be1dfca82c4978abfcf341698

SHA512
e6e9f212ceaacbdc68f5452deb2ae9a6737aaad4034233e64b832585439b5bc8de043ef2c472c328b0ddfc0bdd65d9373b01f8ff983c4c1291b2921aeebd7507

Download Submit
\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
0438b79e287f7057e17f9080c9f0369e

SHA1
73dd003f2764e5895c2fbf7e29264727f4065e36

SHA256
2eb948c38a913030a991bbb5c183bcd6789e98f85bf220fd17c7fcac3656109e

SHA512
a89424ee49f16614ea8689f7f0a1ddc1555cb81bd19e49e4d52884b7f64cd932bb29c1225632749e725bad31eb0bab08f61989ce3b6add45e8142349d2d8394a

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
d2347f559669e0b23f8b14217369c04c

SHA1
36171b4af28cf2c8e79f1cc5c65d9c12869a91f0

SHA256
beaef108637c44517a7711eaa065efcddeec655c63b063b862a351d4ef0f2f1f

SHA512
ce3c31a1cc1b5b26aea53be2bafa6ce5728d23d82e4e1442a28ff118cd9aeb79a92fadfa4633617542612c07e97cea5c03e32f27274997543eee28d44b5e804d

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
47b0afb2917653786e9961f04d1f2779

SHA1
c49ebd554267446d2c3e3061af9c2ebe63bd8494

SHA256
6fd356a28b2159b6f2b1883273db6fa6d5b221dc45813079cc8aa1dfea872051

SHA512
5ee2f64c9995938acc6523ffe8fc98a427b0616724634d3c1977cfc3e94f90c8dd4854f716759e8b9339561374988bc2f68ce1bf89bc0bfa501eae86c4cc51f5

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
51519143df32f0b2513e836605f2ae93

SHA1
c717c34a2f9c06c4a0a1a5bcd495bc4bc8daae33

SHA256
b3771b7d377e0ef3e9fd164509310e940dfccc49527e9039621a4701e8db7930

SHA512
627cf6915a00a49faeb9aa158d2d008989fc31e2a87f832ee24246463112529b5a2a9b79b0f31975050f7866fcabf963fa4841853cf32e5fdeccd6a19e7ad77a

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
51519143df32f0b2513e836605f2ae93

SHA1
c717c34a2f9c06c4a0a1a5bcd495bc4bc8daae33

SHA256
b3771b7d377e0ef3e9fd164509310e940dfccc49527e9039621a4701e8db7930

SHA512
627cf6915a00a49faeb9aa158d2d008989fc31e2a87f832ee24246463112529b5a2a9b79b0f31975050f7866fcabf963fa4841853cf32e5fdeccd6a19e7ad77a

Download Submit
\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
bc91df348f40f32e69643529009e8be1

SHA1
fd58e65416108e86a6bb676b0d49fdaf4c8c3ef2

SHA256
946f31500752be48909e118e5dd27b7bce172aa0d29fa4267d6154517b8618ea

SHA512
1d9ab972c1b7e7905de9fd701195c4b10feac96cc3753243cfadfdfda8b7fb6466b00710fc8812b7f73d07728083ad5e5489c20706b8231aa9ad8741248c152a

Download Submit
\Windows\System32\vds.exe

Filesize
1.7MB

MD5
2b24f39130d9adbad71fdda9aafc0ca5

SHA1
0dd76b7f7ef221ec645c41c060c056b4abfb8e63

SHA256
987e6d3cb198245c7dadd1a81e24d6abcc199cf62da62ed198bef44551f9df77

SHA512
a139410c5396bb2e7e315ce47cbe80aa499c21b2c78ad9fe6d91c2eb1baa12bccea14d29f98745425589c8bd1cae0475ee935e59d7dd03127f19eaae9dcd0059

Download Submit
\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
f4e285e726ca2e10ad43131f58642703

SHA1
3c8258ed801b4fea1e00e656e15c8f152ad710ae

SHA256
4ceb211f6e6d85be90c85324d1d9a3a4219114f0e666c517a6b435b2d7a38b25

SHA512
51c3f3291e7c659097f62b1a110bf19c651da760e206716af36c3344229c1be5c1352d80156088aa8e251e7573ad4db771e7fc6095f7c4f7d464006280d0260b

Download Submit
\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
c20e52b1b5e421c3e0b61fb8e3311575

SHA1
dee364d346867468e021afa9412fbab675c536b2

SHA256
24dce6097dc40683178a40d7663d19e47aaf03d4711f7ab1a6f0294d823466bf

SHA512
ff2a3a07bf6e8805cc37420efadadd31a834daa4add1bef02695ddeac37b89f965dc839c19d1b17f7800c99c8d813f88a1711e4480bc0e51527dd0a4a8656b59

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
691993f7d545328a3004adbfff81950b

SHA1
c033af2997849ec1be0d150bdb28868b3dd31640

SHA256
a060211ea4b678a810f1e408eae22d4aff6e185a2546d7a71c0db32775dd634d

SHA512
2eaceace175cd4b3aec6940756c63f629ca6799061bbd783ce6cfb21387b459e6e72b3c3ec1822e9500726844c17e1415e094a206d70645be715ac7f94be6ffd

Download Submit
\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
2fc964008416b3ed406efdefb0ad4c3a

SHA1
e68a6de414fba16ccfe0dce87a139b1fcb8b3c11

SHA256
92203b6a5925bdc59d9b35306b9abedce06740989ebd34c30107b71666745c0c

SHA512
8606a56422bb23e6a87b75a9435cedebeb18170adf234c7c67fc4c230634e3fcd475742ee97c713f03e81b8dbf30434cbe8409b4882bb824e829734bd524d778

Download Submit
memory/268-158-0x0000000100000000-0x00000001001EC000-memory.dmp

Filesize
1.9MB

Download
memory/316-198-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/316-302-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/316-184-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/316-178-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/544-154-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/576-199-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/576-303-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/576-250-0x0000000000BB0000-0x0000000000C30000-memory.dmp

Filesize
512KB

Download
memory/736-66-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/736-62-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/736-74-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/736-75-0x0000000000230000-0x0000000000296000-memory.dmp

Filesize
408KB

Download
memory/736-69-0x0000000000230000-0x0000000000296000-memory.dmp

Filesize
408KB

Download
memory/736-68-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/736-61-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/736-248-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/736-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/736-63-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/932-134-0x0000000010000000-0x00000000101FE000-memory.dmp

Filesize
2.0MB

Download
memory/964-446-0x0000000100000000-0x0000000100202000-memory.dmp

Filesize
2.0MB

Download
memory/1076-97-0x0000000140000000-0x00000001401F4000-memory.dmp

Filesize
2.0MB

Download
memory/1076-249-0x0000000140000000-0x00000001401F4000-memory.dmp

Filesize
2.0MB

Download
memory/1080-105-0x0000000010000000-0x00000000101F6000-memory.dmp

Filesize
2.0MB

Download
memory/1096-229-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1188-130-0x0000000000600000-0x0000000000666000-memory.dmp

Filesize
408KB

Download
memory/1188-133-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/1188-124-0x0000000000600000-0x0000000000666000-memory.dmp

Filesize
408KB

Download
memory/1288-116-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1288-111-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1288-113-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1288-126-0x0000000000D10000-0x0000000000DCC000-memory.dmp

Filesize
752KB

Download
memory/1288-110-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1288-109-0x0000000000090000-0x00000000000F6000-memory.dmp

Filesize
408KB

Download
memory/1516-369-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1524-224-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1524-389-0x0000000001000000-0x00000000011ED000-memory.dmp

Filesize
1.9MB

Download
memory/1524-247-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1544-56-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/1544-54-0x0000000000B90000-0x0000000000CF6000-memory.dmp

Filesize
1.4MB

Download
memory/1544-58-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/1544-59-0x0000000008160000-0x0000000008298000-memory.dmp

Filesize
1.2MB

Download
memory/1544-60-0x00000000084A0000-0x0000000008650000-memory.dmp

Filesize
1.7MB

Download
memory/1544-55-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download
memory/1544-57-0x0000000000A40000-0x0000000000A80000-memory.dmp

Filesize
256KB

Download
memory/1792-167-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/1792-160-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1792-266-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/1792-197-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/1792-157-0x0000000000870000-0x00000000008D0000-memory.dmp

Filesize
384KB

Download
memory/1792-150-0x0000000000870000-0x00000000008D0000-memory.dmp

Filesize
384KB

Download
memory/1792-164-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/1796-83-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1796-96-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/1796-89-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/1940-189-0x0000000000850000-0x00000000008B0000-memory.dmp

Filesize
384KB

Download
memory/1940-200-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1940-304-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2044-168-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2044-165-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2044-329-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2044-173-0x0000000000830000-0x0000000000890000-memory.dmp

Filesize
384KB

Download
memory/2044-284-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/2088-243-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2152-244-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2152-255-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2164-368-0x000000002E000000-0x000000002E20C000-memory.dmp

Filesize
2.0MB

Download
memory/2188-391-0x0000000100000000-0x00000001001EC000-memory.dmp

Filesize
1.9MB

Download
memory/2220-394-0x0000000100000000-0x00000001001ED000-memory.dmp

Filesize
1.9MB

Download
memory/2352-267-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2352-418-0x0000000100000000-0x000000010026B000-memory.dmp

Filesize
2.4MB

Download
memory/2352-278-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2440-288-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2488-656-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2524-631-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2536-287-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2536-318-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2640-312-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2640-305-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2656-421-0x0000000100000000-0x0000000100219000-memory.dmp

Filesize
2.1MB

Download
memory/2712-449-0x0000000100000000-0x000000010021B000-memory.dmp

Filesize
2.1MB

Download
memory/2752-430-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2776-645-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2900-347-0x0000000140000000-0x000000014020D000-memory.dmp

Filesize
2.1MB

Download
memory/2916-470-0x0000000100000000-0x000000010020A000-memory.dmp

Filesize
2.0MB

Download
memory/2980-345-0x00000000005C0000-0x00000000007C9000-memory.dmp

Filesize
2.0MB

Download
memory/2980-343-0x0000000100000000-0x0000000100209000-memory.dmp

Filesize
2.0MB

Download
memory/2980-657-0x0000000100000000-0x0000000100209000-memory.dmp

Filesize
2.0MB

Download
memory/2980-658-0x00000000005C0000-0x00000000007C9000-memory.dmp

Filesize
2.0MB

Download
memory/3008-471-0x0000000100000000-0x0000000100123000-memory.dmp

Filesize
1.1MB

Download