Overview

overview

7

Static

static

3

6da36817a9...33.exe

windows7-x64

7

6da36817a9...33.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2023 11:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6da36817a938a7c9cd3fc921c54270ada1d6e5a742dc759d089d2be7ad82ad33.exe

  • Size

    4.2MB

  • MD5

    bbc7ebaca03d2240677b641896e28b09

  • SHA1

    d2559a69d0e34fb8f01c1db65ddbdd494f7da2f3

  • SHA256

    6da36817a938a7c9cd3fc921c54270ada1d6e5a742dc759d089d2be7ad82ad33

  • SHA512

    779576891aaad1808560434880334c0b1d87b67fa580bab17d78f9b4c3755f6ee53f3375641edebcd0b8e514bcc130a35dd6955601fceef1ad2cc4b8eccdf995

  • SSDEEP

    49152:208OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJXb9emEPGKOPkQThMYRZnm7LBF:208vdsGaQNgS1r6eTnuFzqG7wRGpj3

Score
7/10
bootkitpersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 38 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\6da36817a938a7c9cd3fc921c54270ada1d6e5a742dc759d089d2be7ad82ad33.exe
    "C:\Users\Admin\AppData\Local\Temp\6da36817a938a7c9cd3fc921c54270ada1d6e5a742dc759d089d2be7ad82ad33.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1920
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2696
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2668
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2976
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:668
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3040
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 258 -NGENProcess 240 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 1e0 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1e8 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2784
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 244 -NGENProcess 25c -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1184
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 240 -NGENProcess 250 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2148
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1d4 -NGENProcess 26c -Pipe 244 -Comment "NGen Worker Process"
      2⤵
        PID:308
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1e0 -NGENProcess 24c -Pipe 1d4 -Comment "NGen Worker Process"
        2⤵
        • Executes dropped EXE
        PID:2980
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 250 -NGENProcess 274 -Pipe 258 -Comment "NGen Worker Process"
        2⤵
          PID:1264
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1e8 -NGENProcess 24c -Pipe 25c -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2120
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 264 -NGENProcess 27c -Pipe 250 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:1732
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 240 -NGENProcess 1e0 -Pipe 264 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2860
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 284 -NGENProcess 27c -Pipe 270 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:1156
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 284 -NGENProcess 240 -Pipe 1e8 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2068
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 28c -NGENProcess 27c -Pipe 278 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2760
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 27c -NGENProcess 24c -Pipe 290 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:956
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 268 -NGENProcess 294 -Pipe 28c -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2732
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 274 -NGENProcess 298 -Pipe 26c -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:1376
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 24c -NGENProcess 29c -Pipe 1e0 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:308
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 294 -NGENProcess 2a0 -Pipe 240 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2460
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 298 -NGENProcess 2a4 -Pipe 288 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:1264
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 2a8 -Pipe 284 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2060
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 2a0 -NGENProcess 2ac -Pipe 27c -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:928
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 284 -NGENProcess 220 -Pipe 1ec -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:1748
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 23c -NGENProcess 26c -Pipe 1d8 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:3024
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 254 -Pipe 284 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:1080
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 1d4 -NGENProcess 224 -Pipe 248 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2888
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 26c -NGENProcess 1c4 -Pipe 260 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2700
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c4 -NGENProcess 254 -Pipe 240 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:1496
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 1d4 -NGENProcess 268 -Pipe 244 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:344
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 26c -NGENProcess 280 -Pipe 2a0 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2060
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1d0 -NGENProcess 268 -Pipe 23c -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1068
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 268 -NGENProcess 220 -Pipe 1d4 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2556
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 268 -NGENProcess 1d0 -Pipe 1c4 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1092
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1d0 -NGENProcess 254 -Pipe 220 -Comment "NGen Worker Process"
          2⤵
          • Executes dropped EXE
          PID:2248
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 1d0 -NGENProcess 268 -Pipe 2a8 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2492
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 29c -NGENProcess 268 -Pipe 288 -Comment "NGen Worker Process"
          2⤵
            PID:2112
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2a4 -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2888
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 2b4 -Pipe 298 -Comment "NGen Worker Process"
            2⤵
              PID:1412
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 294 -NGENProcess 274 -Pipe 24c -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:3060
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 26c -NGENProcess 2bc -Pipe 224 -Comment "NGen Worker Process"
              2⤵
                PID:3056
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 26c -NGENProcess 280 -Pipe 274 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:1612
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2c0 -NGENProcess 280 -Pipe 29c -Comment "NGen Worker Process"
                2⤵
                  PID:1080
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c0 -NGENProcess 2bc -Pipe 2c4 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2208
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2c8 -NGENProcess 2bc -Pipe 268 -Comment "NGen Worker Process"
                  2⤵
                    PID:932
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2c8 -NGENProcess 280 -Pipe 2cc -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:2372
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 280 -NGENProcess 2a4 -Pipe 2bc -Comment "NGen Worker Process"
                    2⤵
                      PID:1420
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2b4 -NGENProcess 2dc -Pipe 2c8 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:3012
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    1⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:888
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"
                      2⤵
                      • Executes dropped EXE
                      PID:1116
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 238 -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"
                      2⤵
                      • Executes dropped EXE
                      PID:2764
                  • C:\Windows\system32\dllhost.exe
                    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                    1⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:1952
                  • C:\Windows\ehome\ehRecvr.exe
                    C:\Windows\ehome\ehRecvr.exe
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    PID:1108
                  • C:\Windows\ehome\ehsched.exe
                    C:\Windows\ehome\ehsched.exe
                    1⤵
                    • Executes dropped EXE
                    PID:3060
                  • C:\Windows\eHome\EhTray.exe
                    "C:\Windows\eHome\EhTray.exe" /nav:-2
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:848
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:3004
                  • C:\Windows\ehome\ehRec.exe
                    C:\Windows\ehome\ehRec.exe -Embedding
                    1⤵
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:952
                  • C:\Windows\system32\IEEtwCollector.exe
                    C:\Windows\system32\IEEtwCollector.exe /V
                    1⤵
                    • Executes dropped EXE
                    PID:2368
                  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    PID:900
                  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:1728
                  • C:\Windows\System32\msdtc.exe
                    C:\Windows\System32\msdtc.exe
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    PID:1712
                  • C:\Windows\system32\msiexec.exe
                    C:\Windows\system32\msiexec.exe /V
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2260
                  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                    1⤵
                    • Executes dropped EXE
                    PID:516
                  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                    1⤵
                    • Executes dropped EXE
                    PID:2768
                  • C:\Windows\SysWow64\perfhost.exe
                    C:\Windows\SysWow64\perfhost.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1976
                  • C:\Windows\system32\locator.exe
                    C:\Windows\system32\locator.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1656
                  • C:\Windows\System32\snmptrap.exe
                    C:\Windows\System32\snmptrap.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1636
                  • C:\Windows\System32\vds.exe
                    C:\Windows\System32\vds.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1852
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1060
                  • C:\Windows\system32\wbengine.exe
                    "C:\Windows\system32\wbengine.exe"
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1484
                  • C:\Windows\system32\wbem\WmiApSrv.exe
                    C:\Windows\system32\wbem\WmiApSrv.exe
                    1⤵
                    • Executes dropped EXE
                    PID:2312
                  • C:\Program Files\Windows Media Player\wmpnetwk.exe
                    "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1940
                  • C:\Windows\system32\SearchIndexer.exe
                    C:\Windows\system32\SearchIndexer.exe /Embedding
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2296
                    • C:\Windows\system32\SearchProtocolHost.exe
                      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-86725733-3001458681-3405935542-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-86725733-3001458681-3405935542-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                      2⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:1752
                    • C:\Windows\system32\SearchFilterHost.exe
                      "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                      2⤵
                      • Modifies data under HKEY_USERS
                      PID:1208
                    • C:\Windows\system32\SearchProtocolHost.exe
                      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                      2⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:2192

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                    Filesize

                    1.4MB

                    MD5

                    082faa9cd3b0cd99ff6015c029b98e45

                    SHA1

                    2b2352c257e0c25f09fc0e02b585ed5884fe585a

                    SHA256

                    02a7339b89d78624a5114b237bf97f8965fb26b8582437eba84d80d902cb1e0a

                    SHA512

                    acdb79f82fc695be54f9d0d0f1e3b5a187ec07f87e8456ed1b49da2849ed9a1efa14e84a562c606f2c70cb43f570a669d642d2e406bedef97d4db99f58fc23df

                    Download Submit

                  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                    Filesize

                    30.1MB

                    MD5

                    5dbc7be39a55bfc4a60988c49b9c4f8e

                    SHA1

                    2941709f1dbadc04e7e79361f8edb61039a804f2

                    SHA256

                    cdd609cdc656c18e2b03405f0ea1f034f08b05655278447aca22ca18745455f1

                    SHA512

                    20aae5c458808c9ff784531d7a3fbbfe5bb8b4b2b7ed50c5528dd74d804b462ff813e57cee1a09ce3f304e6ae01f4adac633b1a85b14199ab0645d782132cd03

                    Download Submit

                  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                    Filesize

                    1.4MB

                    MD5

                    ab89b1eac50093f3d6ed9a30ccd60f9a

                    SHA1

                    16f95f8682764ace4df2416edc8bb79c25cb9c0a

                    SHA256

                    e15b1905e481074e2e25ee263e728861bcea3345cc89fcba8393c6a35e812727

                    SHA512

                    816c66e49ce4e4a135b69253a5eb2a850622084839ad926555837eac17c1c0e87ac9e9a0c7f53c608aab61a9782f595e9402e9d40f8c513d49ef917d32666ec8

                    Download Submit

                  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                    Filesize

                    5.2MB

                    MD5

                    cac5c2d3b6746c8ed57adc62e9858ceb

                    SHA1

                    a6f47ff8ce3779b496cab216983fde7f8926b833

                    SHA256

                    122ab43d11157f42a18912e45b18f6d48831fd9f6a85fc73198e3ca8a2f08fb1

                    SHA512

                    60c24385e1359b83d9d75474c82eac9d4534a726e885f75ad4d1a2c3b912db1fb6381960245427ac297525af9874550d30d921fa00fa0f974b320a8deb862e49

                    Download Submit

                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    Filesize

                    2.1MB

                    MD5

                    138ad2548a33333d0a748b9d2fc79254

                    SHA1

                    216898ba7bc749bcfb4b01463614ff5206f8043a

                    SHA256

                    5ed5deaff8d75becab47bb0f38538d810b411e2099d56ab58e120fc64ec96f61

                    SHA512

                    d758f73228acf1f309ddabffcafa2a8e95ffd7257189a9cf406c4281124e8ee665888006e9c82276a10681ccab572687fc8c45171d4637be451e903e77bf5d4c

                    Download Submit

                  • C:\Program Files\Windows Media Player\wmpnetwk.exe
                    Filesize

                    2.0MB

                    MD5

                    6bf91722448b3912b86fd17f0a39c60d

                    SHA1

                    8ff2e24e986a807e71c7e87f168ee8dbe156a697

                    SHA256

                    165fca9a4ca4c0b56c8801e3aebf89bbdf84b1171f8954f2cca7b63c1189edb6

                    SHA512

                    0babfbdd2752a132d8f1ef65c9be4c3c1f0068f6bf016212142361ea5220f2d18bc2c776c2f5d7b94b2f2d41ab89d851b3ef75d85d11501f5637d16579c23be3

                    Download Submit

                  • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                    Filesize

                    1024KB

                    MD5

                    12c996941beb748468b2674cfd764d2e

                    SHA1

                    c8a54cca8eade95a28eec3aa8e07dd20b3f8f265

                    SHA256

                    f339fea675a9113986dd3988ff1b1b3a8d5dace88fc463606e88dc71484c604e

                    SHA512

                    d132f2f49c7eb4f5805bcc29e359ba7926f1c478e99aec08c37208f5faee5e25ce182f3c18c7c1c850ededac43bccfb1938f2b5866b1f1ecf0a0f4514ff1e929

                    Download Submit

                  • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log
                    Filesize

                    1024KB

                    MD5

                    0aaff7f9756860c4b3455e591a17a9df

                    SHA1

                    720d7785cff18cbcfd68f43295e4b310d8fd1071

                    SHA256

                    19451b915026e8dfb78fd1890865fb28ce58a3b7a4a0b82eb1974a9b42655d6f

                    SHA512

                    a8bb6300196823577cb766b0d37ab31cd3b84250f14f50cc460411a1a3017a49b14749e884a3c0f58f04aa4596ab50c72dae3f7c88813c9d9b3c2102525cffdc

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    1c5de8b683d8c17a962b16764b43696f

                    SHA1

                    2b853ab369cffdb22219d3ba3a3c6b5c9b499829

                    SHA256

                    8d21c1834c9e9cdaa2fd661fb763fd004271feac3b7cae5b26268e8bc859733f

                    SHA512

                    b77596825e46a5652e5623203a0ca87bfef690bb035fb24ff27357354f93362ef7d216bfbad6d66266d24d5f0832d90bfb0d54001992eb961b402c4df11026c4

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    1c5de8b683d8c17a962b16764b43696f

                    SHA1

                    2b853ab369cffdb22219d3ba3a3c6b5c9b499829

                    SHA256

                    8d21c1834c9e9cdaa2fd661fb763fd004271feac3b7cae5b26268e8bc859733f

                    SHA512

                    b77596825e46a5652e5623203a0ca87bfef690bb035fb24ff27357354f93362ef7d216bfbad6d66266d24d5f0832d90bfb0d54001992eb961b402c4df11026c4

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                    Filesize

                    872KB

                    MD5

                    ea836e455a2043d85c2b30ac114a50d0

                    SHA1

                    1ffb0bf0aa3e90ec22b7b3657d4755a43953a0bc

                    SHA256

                    e082e94016f858d10500c1303e1bcef69095cc80a6629ccc0b84ff716640c5c5

                    SHA512

                    9c04fa27cd22408e9034ab2f662ad299335e7cd981551fbc8c73e091a2149efa582270b982e5a28dadbd73efc8be1c5e916d0bcc887706b912de795964cef8ad

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                    Filesize

                    1.3MB

                    MD5

                    490b8551ba9bc3fd554cd40ed9ec7e71

                    SHA1

                    c2182d2d68ce6e1c49836422c7c0bad541bf4026

                    SHA256

                    2d3213d622bb93cfab6efdaecfec492eef04bfac4aacc88080d933ba7ea940d8

                    SHA512

                    a1c0d4f1aee629bf97a20b26ec1571921fa65daf3cd92c978df31943c24dca969cc0e799e0a8531366b4a64e4785c82c66c3e9886755f775d478499e227cb7e4

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    20e5475aa817629d1ce6d568ba39b48c

                    SHA1

                    ec0a46b3cb8419c34d445c899d7fac39476bbe29

                    SHA256

                    87a0c104231951934d027977ac460e3d32296b64df992b22788eaeee19ed1b0d

                    SHA512

                    7e1e33ce63c96138aa56e5976955f901741a389c4fee0aec32fc25881a825b0e7097368654f34b0b1cb833dbc0f3ca5eaf27ef33876cb2f115fb8d717e2c2f0a

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    20e5475aa817629d1ce6d568ba39b48c

                    SHA1

                    ec0a46b3cb8419c34d445c899d7fac39476bbe29

                    SHA256

                    87a0c104231951934d027977ac460e3d32296b64df992b22788eaeee19ed1b0d

                    SHA512

                    7e1e33ce63c96138aa56e5976955f901741a389c4fee0aec32fc25881a825b0e7097368654f34b0b1cb833dbc0f3ca5eaf27ef33876cb2f115fb8d717e2c2f0a

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    601813c8892e5b5281b146f8e166e04a

                    SHA1

                    d80de2042c67e8f0105ce76398127d048b22c98c

                    SHA256

                    7af313c6047fa3e97aa803dccd43e7f282cc52451100b11a2faa633a719babfc

                    SHA512

                    f59ffef80ac26ade00665c48cfef647d6019c8e4d23500834e918c0f1ff89f5c9f688acdb8faa54f2aff4593c4cabe681a6230f078b04e3c4ebd5f02b202ddd6

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    601813c8892e5b5281b146f8e166e04a

                    SHA1

                    d80de2042c67e8f0105ce76398127d048b22c98c

                    SHA256

                    7af313c6047fa3e97aa803dccd43e7f282cc52451100b11a2faa633a719babfc

                    SHA512

                    f59ffef80ac26ade00665c48cfef647d6019c8e4d23500834e918c0f1ff89f5c9f688acdb8faa54f2aff4593c4cabe681a6230f078b04e3c4ebd5f02b202ddd6

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                    Filesize

                    1003KB

                    MD5

                    cfe328e83da68e7babce160ea99055c4

                    SHA1

                    4f6ad518f7d887a1469290ea530d97fa9265bb2d

                    SHA256

                    7ea024006178295cb5a4ebbb2c558c8e7c2d7fe9dff48f7719a56eb2e8efc432

                    SHA512

                    a4c33a7bdebdcd2d73e9c1355558a94bfd41ebea0382924e7b549ccb07a928a96b00e20aa46c9931112a24ca54da4d6cadc4d779363e3d51393b7633885ff432

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    27a8840b07f03d00a20c654d09c4c526

                    SHA1

                    aeec7a9268b5888593349871c981c33c7522b12f

                    SHA256

                    346fd2f99cbe0895706fca4d6f582132fc8b879990d9a3036cde3fbd140fbaf3

                    SHA512

                    0164bcb34bde2b4998be664a0edf63d9a4497e6a8be447804f4801f4136b60a71464aa6b0cb7a2c4953a1afd9d5d6487203ffca07cb5189b7958e60f98e277e8

                    Download Submit

                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
                    Filesize

                    8KB

                    MD5

                    337cc8df8367aeb3ff4b4109fe6fec53

                    SHA1

                    e473578c7352fd86014d5b605e3123e996bc755e

                    SHA256

                    89c87856446309de241053aad1ef7eebe2bd356e156e1ab0dfe3bc2f73dc2b5d

                    SHA512

                    3e4833dc4629ca8ba12eaf87524644d0c46abe5dd4b1de914b422c310a9e645da34f31a29c5e9a9b19734d8182ce9e97caa311d3d8515affc8f3bc5dbb2a5393

                    Download Submit

                  • C:\Windows\SysWOW64\perfhost.exe
                    Filesize

                    1.2MB

                    MD5

                    305e47594e97dced8f6fa33c1d16a015

                    SHA1

                    30cee7b42a85aafd49f190eb9083e0abb34ff0d0

                    SHA256

                    fc5aeaf2e41ae63a5c0a22fb79cfec39dcbece858715c8aba7d6a3271ef4cab5

                    SHA512

                    bf6bfafdeca6320a72f1ed1961b5f2d4b65b13a04088659ff9a0bb3a618b6b1b8dde55f0d1394558654e25b751cb0d998b4590b4dea78a0cbbabcf385cd209ec

                    Download Submit

                  • C:\Windows\System32\Locator.exe
                    Filesize

                    1.2MB

                    MD5

                    41efdd2d86d6c572f0795b9638eda271

                    SHA1

                    882851c9ece4ed2707b90774bf852feab4c06cb1

                    SHA256

                    981945c912461e52d8e50890b730b6c09a8af62369ed4c980ccbcb141d485574

                    SHA512

                    a10a0d9ec5815232f00c5334b00c189ca90b5ccb67d89089bb0a455204eb3d83ef197e226c3060920409bf1fee5c7d7b5288229d38b16a8742161d2bae634619

                    Download Submit

                  • C:\Windows\System32\SearchIndexer.exe
                    Filesize

                    1.1MB

                    MD5

                    35bfbd1b3bdc3eca82d1012e3ffb4de0

                    SHA1

                    df971784c7e3b08371cff40bce3b3622cbd90b4f

                    SHA256

                    46ed17475ca92f121d23e971923269e1597f0de01263f72dbb6cc4c3a19a80d5

                    SHA512

                    49b4ed894452ae7840963d32fca779f3235687b8e2f163e1bceee06ebeeda4c9983928e9239159570afe1965753bc41c7005dc4d97f44bd2bd4a0c37839a8fa7

                    Download Submit

                  • C:\Windows\System32\VSSVC.exe
                    Filesize

                    2.1MB

                    MD5

                    a3861f76376ef057b1bea313143e42b0

                    SHA1

                    90bdc7f657eee9161072128ee795a3e2859e661a

                    SHA256

                    7a8bad8533dfc561d2a41310ee54d9c6f5ca6d3be7d4457182760af1928e2205

                    SHA512

                    05ca85d64236fc1d96586865af528dbdefaae8ac092a62c1a22d9a4484077aa8d01f1bd895d5a1ff28fda57cbab83a0465194ffebe8dafb9a3ef48d4af3d02e5

                    Download Submit

                  • C:\Windows\System32\alg.exe
                    Filesize

                    1.3MB

                    MD5

                    08ade5fce1d47874f07a7a07b13e8cbc

                    SHA1

                    14d7612f9dd25beca737d3944c25fbd317a9f61a

                    SHA256

                    6b8a902eb03ce342f4001660703447665323600a4e74d1242205e0caef992369

                    SHA512

                    9505f4840bff3761930e0896e846a8c727897421d073ccc68dcbf5edc73f9216e9f55e29944d530ac71bb1167a52b742aaa4683a4ce8ab41600fa9e413751a2a

                    Download Submit

                  • C:\Windows\System32\dllhost.exe
                    Filesize

                    1.2MB

                    MD5

                    f8aefd14b2034227482b73cfc74a2da5

                    SHA1

                    5eb55f01ea8c8496dd3dfa7bf601854ea15b8ed5

                    SHA256

                    901636a7211a00cb3a52b159354abafba25e734705abb33a4f44085ae6be0870

                    SHA512

                    be09eaba6d740793626b144590d2f568f6f13a6b448f2c9615ee73a3d5e99330c23d8d2c21e8341a50ae6282488b75a2b4c9fe946f8b13bfd68130b4eddaaf19

                    Download Submit

                  • C:\Windows\System32\ieetwcollector.exe
                    Filesize

                    1.3MB

                    MD5

                    cc2c7788b10b8f25fa50974f724c9da6

                    SHA1

                    28257951ea21b7702f3e9a362fc16f1e78b6c49a

                    SHA256

                    550e0d8d9b066dae70f26964f5ce6fc0828d4628454b8710c42936b6b5cfc07e

                    SHA512

                    6d09457f2b11002323c8439e7002847e0c57e5f64c58a7da4fd627b8789106b7c3a5ff44ad8078806df7bf33e82f85b0e2bda133f710d1df790568648b241624

                    Download Submit

                  • C:\Windows\System32\msdtc.exe
                    Filesize

                    1.4MB

                    MD5

                    b3e85fc280a9d3b8ee6cf56350b49b10

                    SHA1

                    499763461c3f190bd8e9354e0e2c3900471985de

                    SHA256

                    47a810aadbf0cf55968ab4d58c4654baed0ef833caa6f0fa79df4ba3d1a6fb7e

                    SHA512

                    fd7a90cc48967a3cb61f1bb089cf23ef07fcbc22a6e186aed10d66efeda3c5f93a0def0f641d0405038478f23fca78daab087328d0a45497ad4aaacb95142c81

                    Download Submit

                  • C:\Windows\System32\msiexec.exe
                    Filesize

                    1.3MB

                    MD5

                    9a2468538fe8a93fabdf95732636d856

                    SHA1

                    8bb68681dfb6af34eb7157cffa44cc57cc0b847e

                    SHA256

                    5770b455eef5ab8ddda380851df9be1ec823efe60ea567c7acc36ebaf53b0862

                    SHA512

                    322da0528fd2958584ef685b26d5fc55fe9aed5a0c6ee9483b797ccd0f285064203b42dd2e48ce2862fdd2e36763aabc949f7082823431f9cbfd02ded8fcd9fc

                    Download Submit

                  • C:\Windows\System32\snmptrap.exe
                    Filesize

                    1.2MB

                    MD5

                    701d2c670193edaae21d5f6065311baf

                    SHA1

                    9d3401d7398da1adb473848d71565bfd1044c9f0

                    SHA256

                    ee61135b37cbb6b964efb3d1801e6039daf290dccc42e0d3750d350381085b9e

                    SHA512

                    d664d1fb53876514eb4b8fc610f4437132588a84f9c9f1b1f234df628dfeeede8916559e92faef7f743e30cf141492be3115b3e8dbb05809aa49ff9e65f4567e

                    Download Submit

                  • C:\Windows\System32\vds.exe
                    Filesize

                    1.7MB

                    MD5

                    038e9b708dd6a6dc1502072a2a4bce76

                    SHA1

                    d13f832a1891f4e32992a341a323fa634ff870a4

                    SHA256

                    4d2a8ec56c78d0216aba511bce1e23f69cdd76d4e30307c64da82f611cb5efb3

                    SHA512

                    64b7984a626f501e6e4e4fb5f02e5372ec648612f1bc17de2008ceea93fd1c52f5df612c0528d40772324cf292a35e2d6c86a78978d961f5445a22a7d364b244

                    Download Submit

                  • C:\Windows\System32\wbem\WmiApSrv.exe
                    Filesize

                    1.4MB

                    MD5

                    f26e02c304fad21c40f129dcb2853929

                    SHA1

                    3b04ae354f63dc1ca858721dacaeb711e8068611

                    SHA256

                    6cddc34311b2e3c89ac23215bac41850b0b63b58c1f3c0c76b10e331ad14f40a

                    SHA512

                    83004960a31c6bfffcd721ebf11d4f69d97a435b746c64c5458cfd13238e88866016c85bf55dfe45a789acbc0f0f121d9e34a5ef70c28b9eb95b8628deb0666c

                    Download Submit

                  • C:\Windows\System32\wbengine.exe
                    Filesize

                    2.0MB

                    MD5

                    73214d8278111139efdb43ed3418e763

                    SHA1

                    c2ee4f058a4979b2a5c98728369434bb501ece11

                    SHA256

                    9d35f6cf32ac270faee941803041bd843647894b2bcaae2f008e56fb5024dae8

                    SHA512

                    46e8492f2824651a3ae83c97cdf41e08c82efdf6aba4c27cbf1b002ea0f8c18772bbb06848e8b61be02c7298969b08e29a29e5c3d490d5784ded7e2adb7cd60f

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
                    Filesize

                    148KB

                    MD5

                    ac901cf97363425059a50d1398e3454b

                    SHA1

                    2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

                    SHA256

                    f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

                    SHA512

                    6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                    Filesize

                    34KB

                    MD5

                    c26b034a8d6ab845b41ed6e8a8d6001d

                    SHA1

                    3a55774cf22d3244d30f9eb5e26c0a6792a3e493

                    SHA256

                    620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

                    SHA512

                    483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                    Filesize

                    109KB

                    MD5

                    0fd0f978e977a4122b64ae8f8541de54

                    SHA1

                    153d3390416fdeba1b150816cbbf968e355dc64f

                    SHA256

                    211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60

                    SHA512

                    ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                    Filesize

                    41KB

                    MD5

                    3c269caf88ccaf71660d8dc6c56f4873

                    SHA1

                    f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

                    SHA256

                    de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

                    SHA512

                    bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                    Filesize

                    210KB

                    MD5

                    4f40997b51420653706cb0958086cd2d

                    SHA1

                    0069b956d17ce7d782a0e054995317f2f621b502

                    SHA256

                    8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

                    SHA512

                    e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                    Filesize

                    53KB

                    MD5

                    e3a7a2b65afd8ab8b154fdc7897595c3

                    SHA1

                    b21eefd6e23231470b5cf0bd0d7363879a2ed228

                    SHA256

                    e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845

                    SHA512

                    6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                    Filesize

                    28KB

                    MD5

                    aefc3f3c8e7499bad4d05284e8abd16c

                    SHA1

                    7ab718bde7fdb2d878d8725dc843cfeba44a71f7

                    SHA256

                    4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

                    SHA512

                    1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                    Filesize

                    27KB

                    MD5

                    9c60454398ce4bce7a52cbda4a45d364

                    SHA1

                    da1e5de264a6f6051b332f8f32fa876d297bf620

                    SHA256

                    edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

                    SHA512

                    533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                    Filesize

                    130KB

                    MD5

                    2735d2ab103beb0f7c1fbd6971838274

                    SHA1

                    6063646bc072546798bf8bf347425834f2bfad71

                    SHA256

                    f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

                    SHA512

                    fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                    Filesize

                    59KB

                    MD5

                    8c69bbdfbc8cc3fa3fa5edcd79901e94

                    SHA1

                    b8028f0f557692221d5c0160ec6ce414b2bdf19b

                    SHA256

                    a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

                    SHA512

                    825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

                    Download Submit

                  • C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                    Filesize

                    42KB

                    MD5

                    71d4273e5b77cf01239a5d4f29e064fc

                    SHA1

                    e8876dea4e4c4c099e27234742016be3c80d8b62

                    SHA256

                    f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

                    SHA512

                    41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

                    Download Submit

                  • C:\Windows\ehome\ehrecvr.exe
                    Filesize

                    1.2MB

                    MD5

                    bed46fbb41c4e55de5c290b3a15c1479

                    SHA1

                    9a3d5a124e27d478b9fab250818dacfca692fcc1

                    SHA256

                    cbe2210d4e83f497f2b51a805257acfbc0061138040f159231ab1130d5bf0a02

                    SHA512

                    71f19164e3a81e6c43baf66b8cad7d57e1d951f27ff82c1371d640bf0b154131cfa4d311239f04aacdf1a1aa7e2cd8493fe503ad28bada42af96dd136ce87898

                    Download Submit

                  • C:\Windows\ehome\ehsched.exe
                    Filesize

                    1.3MB

                    MD5

                    f9e0687c5a4ba46efa75bfbc7a0cdf1f

                    SHA1

                    1fe7f93d91de96e63ac059c5a50d6e65a44c9eaa

                    SHA256

                    af4f0b9dea2907b4004f48c0fa0941aade9708056a62163737925a3f4d9691ed

                    SHA512

                    30f202e93c3f0eab533b2c1d55d4d0b1830f1ee832396a8736a39a1c9ed0e37d929f52b14ace5d7d9b8ad7bb957c6121f0cdc3d39c7b8a9fa74e2642040ad2e0

                    Download Submit

                  • C:\Windows\system32\msiexec.exe
                    Filesize

                    1.3MB

                    MD5

                    9a2468538fe8a93fabdf95732636d856

                    SHA1

                    8bb68681dfb6af34eb7157cffa44cc57cc0b847e

                    SHA256

                    5770b455eef5ab8ddda380851df9be1ec823efe60ea567c7acc36ebaf53b0862

                    SHA512

                    322da0528fd2958584ef685b26d5fc55fe9aed5a0c6ee9483b797ccd0f285064203b42dd2e48ce2862fdd2e36763aabc949f7082823431f9cbfd02ded8fcd9fc

                    Download Submit

                  • \Program Files\Windows Media Player\wmpnetwk.exe
                    Filesize

                    2.0MB

                    MD5

                    6bf91722448b3912b86fd17f0a39c60d

                    SHA1

                    8ff2e24e986a807e71c7e87f168ee8dbe156a697

                    SHA256

                    165fca9a4ca4c0b56c8801e3aebf89bbdf84b1171f8954f2cca7b63c1189edb6

                    SHA512

                    0babfbdd2752a132d8f1ef65c9be4c3c1f0068f6bf016212142361ea5220f2d18bc2c776c2f5d7b94b2f2d41ab89d851b3ef75d85d11501f5637d16579c23be3

                    Download Submit

                  • \Program Files\Windows Media Player\wmpnetwk.exe
                    Filesize

                    2.0MB

                    MD5

                    6bf91722448b3912b86fd17f0a39c60d

                    SHA1

                    8ff2e24e986a807e71c7e87f168ee8dbe156a697

                    SHA256

                    165fca9a4ca4c0b56c8801e3aebf89bbdf84b1171f8954f2cca7b63c1189edb6

                    SHA512

                    0babfbdd2752a132d8f1ef65c9be4c3c1f0068f6bf016212142361ea5220f2d18bc2c776c2f5d7b94b2f2d41ab89d851b3ef75d85d11501f5637d16579c23be3

                    Download Submit

                  • \Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll
                    Filesize

                    74KB

                    MD5

                    2814acbd607ba47bdbcdf6ac3076ee95

                    SHA1

                    50ab892071bed2bb2365ca1d4bf5594e71c6b13b

                    SHA256

                    5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67

                    SHA512

                    34c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498

                    Download Submit

                  • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                    Filesize

                    1.3MB

                    MD5

                    1c5de8b683d8c17a962b16764b43696f

                    SHA1

                    2b853ab369cffdb22219d3ba3a3c6b5c9b499829

                    SHA256

                    8d21c1834c9e9cdaa2fd661fb763fd004271feac3b7cae5b26268e8bc859733f

                    SHA512

                    b77596825e46a5652e5623203a0ca87bfef690bb035fb24ff27357354f93362ef7d216bfbad6d66266d24d5f0832d90bfb0d54001992eb961b402c4df11026c4

                    Download Submit

                  • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                    Filesize

                    1.3MB

                    MD5

                    490b8551ba9bc3fd554cd40ed9ec7e71

                    SHA1

                    c2182d2d68ce6e1c49836422c7c0bad541bf4026

                    SHA256

                    2d3213d622bb93cfab6efdaecfec492eef04bfac4aacc88080d933ba7ea940d8

                    SHA512

                    a1c0d4f1aee629bf97a20b26ec1571921fa65daf3cd92c978df31943c24dca969cc0e799e0a8531366b4a64e4785c82c66c3e9886755f775d478499e227cb7e4

                    Download Submit

                  • \Windows\System32\Locator.exe
                    Filesize

                    1.2MB

                    MD5

                    41efdd2d86d6c572f0795b9638eda271

                    SHA1

                    882851c9ece4ed2707b90774bf852feab4c06cb1

                    SHA256

                    981945c912461e52d8e50890b730b6c09a8af62369ed4c980ccbcb141d485574

                    SHA512

                    a10a0d9ec5815232f00c5334b00c189ca90b5ccb67d89089bb0a455204eb3d83ef197e226c3060920409bf1fee5c7d7b5288229d38b16a8742161d2bae634619

                    Download Submit

                  • \Windows\System32\alg.exe
                    Filesize

                    1.3MB

                    MD5

                    08ade5fce1d47874f07a7a07b13e8cbc

                    SHA1

                    14d7612f9dd25beca737d3944c25fbd317a9f61a

                    SHA256

                    6b8a902eb03ce342f4001660703447665323600a4e74d1242205e0caef992369

                    SHA512

                    9505f4840bff3761930e0896e846a8c727897421d073ccc68dcbf5edc73f9216e9f55e29944d530ac71bb1167a52b742aaa4683a4ce8ab41600fa9e413751a2a

                    Download Submit

                  • \Windows\System32\dllhost.exe
                    Filesize

                    1.2MB

                    MD5

                    f8aefd14b2034227482b73cfc74a2da5

                    SHA1

                    5eb55f01ea8c8496dd3dfa7bf601854ea15b8ed5

                    SHA256

                    901636a7211a00cb3a52b159354abafba25e734705abb33a4f44085ae6be0870

                    SHA512

                    be09eaba6d740793626b144590d2f568f6f13a6b448f2c9615ee73a3d5e99330c23d8d2c21e8341a50ae6282488b75a2b4c9fe946f8b13bfd68130b4eddaaf19

                    Download Submit

                  • \Windows\System32\ieetwcollector.exe
                    Filesize

                    1.3MB

                    MD5

                    cc2c7788b10b8f25fa50974f724c9da6

                    SHA1

                    28257951ea21b7702f3e9a362fc16f1e78b6c49a

                    SHA256

                    550e0d8d9b066dae70f26964f5ce6fc0828d4628454b8710c42936b6b5cfc07e

                    SHA512

                    6d09457f2b11002323c8439e7002847e0c57e5f64c58a7da4fd627b8789106b7c3a5ff44ad8078806df7bf33e82f85b0e2bda133f710d1df790568648b241624

                    Download Submit

                  • \Windows\System32\msdtc.exe
                    Filesize

                    1.4MB

                    MD5

                    b3e85fc280a9d3b8ee6cf56350b49b10

                    SHA1

                    499763461c3f190bd8e9354e0e2c3900471985de

                    SHA256

                    47a810aadbf0cf55968ab4d58c4654baed0ef833caa6f0fa79df4ba3d1a6fb7e

                    SHA512

                    fd7a90cc48967a3cb61f1bb089cf23ef07fcbc22a6e186aed10d66efeda3c5f93a0def0f641d0405038478f23fca78daab087328d0a45497ad4aaacb95142c81

                    Download Submit

                  • \Windows\System32\msiexec.exe
                    Filesize

                    1.3MB

                    MD5

                    9a2468538fe8a93fabdf95732636d856

                    SHA1

                    8bb68681dfb6af34eb7157cffa44cc57cc0b847e

                    SHA256

                    5770b455eef5ab8ddda380851df9be1ec823efe60ea567c7acc36ebaf53b0862

                    SHA512

                    322da0528fd2958584ef685b26d5fc55fe9aed5a0c6ee9483b797ccd0f285064203b42dd2e48ce2862fdd2e36763aabc949f7082823431f9cbfd02ded8fcd9fc

                    Download Submit

                  • \Windows\System32\msiexec.exe
                    Filesize

                    1.3MB

                    MD5

                    9a2468538fe8a93fabdf95732636d856

                    SHA1

                    8bb68681dfb6af34eb7157cffa44cc57cc0b847e

                    SHA256

                    5770b455eef5ab8ddda380851df9be1ec823efe60ea567c7acc36ebaf53b0862

                    SHA512

                    322da0528fd2958584ef685b26d5fc55fe9aed5a0c6ee9483b797ccd0f285064203b42dd2e48ce2862fdd2e36763aabc949f7082823431f9cbfd02ded8fcd9fc

                    Download Submit

                  • \Windows\System32\snmptrap.exe
                    Filesize

                    1.2MB

                    MD5

                    701d2c670193edaae21d5f6065311baf

                    SHA1

                    9d3401d7398da1adb473848d71565bfd1044c9f0

                    SHA256

                    ee61135b37cbb6b964efb3d1801e6039daf290dccc42e0d3750d350381085b9e

                    SHA512

                    d664d1fb53876514eb4b8fc610f4437132588a84f9c9f1b1f234df628dfeeede8916559e92faef7f743e30cf141492be3115b3e8dbb05809aa49ff9e65f4567e

                    Download Submit

                  • \Windows\System32\wbem\WmiApSrv.exe
                    Filesize

                    1.4MB

                    MD5

                    f26e02c304fad21c40f129dcb2853929

                    SHA1

                    3b04ae354f63dc1ca858721dacaeb711e8068611

                    SHA256

                    6cddc34311b2e3c89ac23215bac41850b0b63b58c1f3c0c76b10e331ad14f40a

                    SHA512

                    83004960a31c6bfffcd721ebf11d4f69d97a435b746c64c5458cfd13238e88866016c85bf55dfe45a789acbc0f0f121d9e34a5ef70c28b9eb95b8628deb0666c

                    Download Submit

                  • \Windows\System32\wbengine.exe
                    Filesize

                    2.0MB

                    MD5

                    73214d8278111139efdb43ed3418e763

                    SHA1

                    c2ee4f058a4979b2a5c98728369434bb501ece11

                    SHA256

                    9d35f6cf32ac270faee941803041bd843647894b2bcaae2f008e56fb5024dae8

                    SHA512

                    46e8492f2824651a3ae83c97cdf41e08c82efdf6aba4c27cbf1b002ea0f8c18772bbb06848e8b61be02c7298969b08e29a29e5c3d490d5784ded7e2adb7cd60f

                    Download Submit

                  • \Windows\ehome\ehrecvr.exe
                    Filesize

                    1.2MB

                    MD5

                    bed46fbb41c4e55de5c290b3a15c1479

                    SHA1

                    9a3d5a124e27d478b9fab250818dacfca692fcc1

                    SHA256

                    cbe2210d4e83f497f2b51a805257acfbc0061138040f159231ab1130d5bf0a02

                    SHA512

                    71f19164e3a81e6c43baf66b8cad7d57e1d951f27ff82c1371d640bf0b154131cfa4d311239f04aacdf1a1aa7e2cd8493fe503ad28bada42af96dd136ce87898

                    Download Submit

                  • \Windows\ehome\ehsched.exe
                    Filesize

                    1.3MB

                    MD5

                    f9e0687c5a4ba46efa75bfbc7a0cdf1f

                    SHA1

                    1fe7f93d91de96e63ac059c5a50d6e65a44c9eaa

                    SHA256

                    af4f0b9dea2907b4004f48c0fa0941aade9708056a62163737925a3f4d9691ed

                    SHA512

                    30f202e93c3f0eab533b2c1d55d4d0b1830f1ee832396a8736a39a1c9ed0e37d929f52b14ace5d7d9b8ad7bb957c6121f0cdc3d39c7b8a9fa74e2642040ad2e0

                    Download Submit

                  • memory/308-592-0x0000000071D40000-0x000000007242E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/308-593-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/668-69-0x0000000010000000-0x00000000101FE000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/668-47-0x0000000010000000-0x00000000101FE000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/868-66-0x0000000000C50000-0x0000000000CB6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/868-65-0x0000000000C50000-0x0000000000CB6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/868-132-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/868-59-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/868-60-0x0000000000C50000-0x0000000000CB6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/888-83-0x0000000000A80000-0x0000000000AE0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/888-145-0x0000000140000000-0x0000000140205000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/888-79-0x0000000140000000-0x0000000140205000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/888-75-0x0000000000A80000-0x0000000000AE0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/900-164-0x000000002E000000-0x000000002FE1E000-memory.dmp

                    Filesize

                    30.1MB

                    Download

                  • memory/900-167-0x0000000000B20000-0x0000000000B86000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/952-150-0x000007FEF4040000-0x000007FEF49DD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/952-152-0x000007FEF4040000-0x000007FEF49DD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/952-153-0x0000000000D30000-0x0000000000DB0000-memory.dmp

                    Filesize

                    512KB

                    Download

                  • memory/952-503-0x000007FEF4040000-0x000007FEF49DD000-memory.dmp

                    Filesize

                    9.6MB

                    Download

                  • memory/1108-126-0x0000000001430000-0x0000000001431000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1108-116-0x0000000000170000-0x00000000001D0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/1108-166-0x0000000140000000-0x000000014013C000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1108-109-0x0000000140000000-0x000000014013C000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1108-120-0x0000000000B40000-0x0000000000B50000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1108-119-0x0000000000B30000-0x0000000000B40000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1108-190-0x0000000001430000-0x0000000001431000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1108-110-0x0000000000170000-0x00000000001D0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/1184-565-0x0000000071D40000-0x000000007242E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/1184-566-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/1184-567-0x0000000000230000-0x0000000000296000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/1728-184-0x0000000140000000-0x0000000140221000-memory.dmp

                    Filesize

                    2.1MB

                    Download

                  • memory/1728-185-0x0000000000F90000-0x0000000000FF0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/1728-173-0x0000000140000000-0x0000000140221000-memory.dmp

                    Filesize

                    2.1MB

                    Download

                  • memory/1728-178-0x0000000000F90000-0x0000000000FF0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/1920-94-0x00000000029D0000-0x00000000029DA000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/1920-84-0x00000000029D0000-0x00000000029DA000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/1920-1-0x0000000000840000-0x00000000008A6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/1920-16-0x00000000029D0000-0x00000000029DA000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/1920-19-0x00000000029D0000-0x00000000029DA000-memory.dmp

                    Filesize

                    40KB

                    Download

                  • memory/1920-77-0x0000000000400000-0x0000000000837000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/1920-7-0x0000000000840000-0x00000000008A6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/1920-0-0x0000000000400000-0x0000000000837000-memory.dmp

                    Filesize

                    4.2MB

                    Download

                  • memory/1952-154-0x0000000100000000-0x00000001001EC000-memory.dmp

                    Filesize

                    1.9MB

                    Download

                  • memory/1952-95-0x0000000000880000-0x00000000008E0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/1952-99-0x0000000100000000-0x00000001001EC000-memory.dmp

                    Filesize

                    1.9MB

                    Download

                  • memory/1952-102-0x0000000000880000-0x00000000008E0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/2032-526-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2032-528-0x0000000071D40000-0x000000007242E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2032-529-0x0000000000370000-0x00000000003D6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2148-581-0x00000000002C0000-0x0000000000326000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2148-580-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2148-579-0x0000000071D40000-0x000000007242E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2368-155-0x0000000140000000-0x0000000140205000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2368-502-0x0000000140000000-0x0000000140205000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2608-540-0x0000000071D40000-0x000000007242E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2608-541-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2608-542-0x00000000006E0000-0x0000000000746000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2668-108-0x0000000140000000-0x00000001401F4000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2668-35-0x0000000000320000-0x0000000000380000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/2668-28-0x0000000000320000-0x0000000000380000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/2668-27-0x0000000140000000-0x00000001401F4000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2696-103-0x0000000100000000-0x00000001001FB000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2696-20-0x0000000100000000-0x00000001001FB000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2784-555-0x0000000000390000-0x00000000003F6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2784-554-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2784-553-0x0000000071D40000-0x000000007242E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2976-40-0x0000000010000000-0x00000000101F6000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/2976-70-0x0000000010000000-0x00000000101F6000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/3004-137-0x00000000004B0000-0x0000000000510000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/3004-144-0x00000000004B0000-0x0000000000510000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/3004-138-0x0000000140000000-0x0000000140237000-memory.dmp

                    Filesize

                    2.2MB

                    Download

                  • memory/3040-515-0x0000000000360000-0x00000000003C6000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/3040-514-0x0000000000400000-0x00000000005FF000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/3040-527-0x0000000071D40000-0x000000007242E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/3060-170-0x0000000140000000-0x0000000140209000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/3060-123-0x0000000000840000-0x00000000008A0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/3060-498-0x0000000000840000-0x00000000008A0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/3060-497-0x0000000140000000-0x0000000140209000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/3060-131-0x0000000000840000-0x00000000008A0000-memory.dmp

                    Filesize

                    384KB

                    Download

                  • memory/3060-124-0x0000000140000000-0x0000000140209000-memory.dmp

                    Filesize

                    2.0MB

                    Download