1ad0ff543542701cf58816ff9a7451d89b71e9aa23c95a8d39fccc600c3f6411

Analysis

max time kernel
49s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
Size

1.1MB
MD5

8fad5909fa55c7230235da604a6ea6b2
SHA1

4b8959103aad431f95e425431a14205999d5514e
SHA256

1ad0ff543542701cf58816ff9a7451d89b71e9aa23c95a8d39fccc600c3f6411
SHA512

525b3398460ec92cdb8b483eb215442a047bcbb93505914496045444ec87b731ae1249c8e6f6fcc0d3c0984704ac7dba799529fbc15c943a0773c415981a2ba4
SSDEEP

24576:sSi1SoCU5qJSr1eWPSCsP0MugC6eTFt/sBlDqgZQd6XKtiMJYiPU:ES7PLjeTn/snji6attJM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
464	Process not Found
2732	alg.exe
2848	aspnet_state.exe
2512	mscorsvw.exe
2708	mscorsvw.exe
2836	mscorsvw.exe
836	mscorsvw.exe
2136	ehRecvr.exe
1576	ehsched.exe
1260	elevation_service.exe
1492	IEEtwCollector.exe
2428	dllhost.exe
1740	GROOVE.EXE
2268	maintenanceservice.exe
2776	OSE.EXE
2800	OSPPSVC.EXE
2512	mscorsvw.exe
2528	mscorsvw.exe
2068	mscorsvw.exe
1736	mscorsvw.exe
656	mscorsvw.exe
2752	mscorsvw.exe
1800	mscorsvw.exe
1376	mscorsvw.exe

Loads dropped DLL 6 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\892379a01b98a6ad.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	alg.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{6ACB1BEA-21A1-4DC4-BECD-6A171F039D1A}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{6ACB1BEA-21A1-4DC4-BECD-6A171F039D1A}.crmlog	dllhost.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe

Modifies data under HKEY_USERS 30 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
704	ehRec.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2220	2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
Token: SeShutdownPrivilege	2836	mscorsvw.exe
Token: SeShutdownPrivilege	836	mscorsvw.exe
Token: 33	2256	EhTray.exe
Token: SeIncBasePriorityPrivilege	2256	EhTray.exe
Token: SeDebugPrivilege	704	ehRec.exe
Token: SeShutdownPrivilege	2836	mscorsvw.exe
Token: SeShutdownPrivilege	836	mscorsvw.exe
Token: SeShutdownPrivilege	2836	mscorsvw.exe
Token: SeShutdownPrivilege	2836	mscorsvw.exe
Token: SeShutdownPrivilege	836	mscorsvw.exe
Token: SeShutdownPrivilege	836	mscorsvw.exe
Token: 33	2256	EhTray.exe
Token: SeIncBasePriorityPrivilege	2256	EhTray.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2512	2836	mscorsvw.exe	45
PID 2836 wrote to memory of 2512	2836	mscorsvw.exe	45
PID 2836 wrote to memory of 2512	2836	mscorsvw.exe	45
PID 2836 wrote to memory of 2512	2836	mscorsvw.exe	45
PID 2836 wrote to memory of 2528	2836	mscorsvw.exe	46
PID 2836 wrote to memory of 2528	2836	mscorsvw.exe	46
PID 2836 wrote to memory of 2528	2836	mscorsvw.exe	46
PID 2836 wrote to memory of 2528	2836	mscorsvw.exe	46
PID 2836 wrote to memory of 2068	2836	mscorsvw.exe	47
PID 2836 wrote to memory of 2068	2836	mscorsvw.exe	47
PID 2836 wrote to memory of 2068	2836	mscorsvw.exe	47
PID 2836 wrote to memory of 2068	2836	mscorsvw.exe	47
PID 2836 wrote to memory of 1736	2836	mscorsvw.exe	50
PID 2836 wrote to memory of 1736	2836	mscorsvw.exe	50
PID 2836 wrote to memory of 1736	2836	mscorsvw.exe	50
PID 2836 wrote to memory of 1736	2836	mscorsvw.exe	50
PID 2836 wrote to memory of 656	2836	mscorsvw.exe	51
PID 2836 wrote to memory of 656	2836	mscorsvw.exe	51
PID 2836 wrote to memory of 656	2836	mscorsvw.exe	51
PID 2836 wrote to memory of 656	2836	mscorsvw.exe	51
PID 2836 wrote to memory of 2752	2836	mscorsvw.exe	52
PID 2836 wrote to memory of 2752	2836	mscorsvw.exe	52
PID 2836 wrote to memory of 2752	2836	mscorsvw.exe	52
PID 2836 wrote to memory of 2752	2836	mscorsvw.exe	52
PID 2836 wrote to memory of 1800	2836	mscorsvw.exe	53
PID 2836 wrote to memory of 1800	2836	mscorsvw.exe	53
PID 2836 wrote to memory of 1800	2836	mscorsvw.exe	53
PID 2836 wrote to memory of 1800	2836	mscorsvw.exe	53
PID 2836 wrote to memory of 1376	2836	mscorsvw.exe	54
PID 2836 wrote to memory of 1376	2836	mscorsvw.exe	54
PID 2836 wrote to memory of 1376	2836	mscorsvw.exe	54
PID 2836 wrote to memory of 1376	2836	mscorsvw.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2732

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
PID:2512

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 258 -NGENProcess 1e8 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 25c -NGENProcess 268 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 1e8 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 270 -NGENProcess 258 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 24c -NGENProcess 244 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 274 -NGENProcess 240 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 258 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 24c -NGENProcess 280 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:1632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 244 -NGENProcess 284 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 258 -NGENProcess 288 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:3024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 258 -NGENProcess 260 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 240 -NGENProcess 288 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 290 -NGENProcess 280 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:1628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 298 -NGENProcess 260 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  PID:328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 240 -NGENProcess 29c -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 288 -NGENProcess 260 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:1676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2a4 -NGENProcess 298 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:1620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 240 -NGENProcess 2a8 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 29c -NGENProcess 298 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 1e8 -NGENProcess 2b0 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  PID:2164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 2b0 -NGENProcess 280 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  PID:296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2a4 -NGENProcess 2b8 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 244 -NGENProcess 1f0 -Pipe 1c4 -Comment "NGen Worker Process"
  2⤵
  PID:556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2d4 -NGENProcess 28c -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 1d0 -NGENProcess 2dc -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2c4 -NGENProcess 2e0 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:2248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2c0 -NGENProcess 2dc -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:1320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2dc -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:2812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2e0 -NGENProcess 2f0 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:1620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 2c0 -NGENProcess 2f4 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2cc -NGENProcess 2f8 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  PID:1568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 28c -NGENProcess 2f8 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  PID:320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 300 -NGENProcess 2fc -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2f4 -NGENProcess 304 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 308 -NGENProcess 2fc -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:2244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2c0 -NGENProcess 2fc -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:1944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2dc -NGENProcess 310 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:744

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 170 -InterruptEvent 158 -NGENProcess 160 -Pipe 16c -Comment "NGen Worker Process"
  2⤵
  PID:1096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 168 -InterruptEvent 1e0 -NGENProcess 1e8 -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  PID:2520

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2136

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:1576

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1260

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2428

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1740

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2268

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2776

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
74KB

MD5
2b525533d5628566ec450d01dde03588

SHA1
8c8efe715a4bbd4c45341adf058fa2a9071b51eb

SHA256
c6a81a99e6c64624e8452d66b3fee5bd4ac20446f7942408e6c38d165eaf9b2f

SHA512
48c29102800c8049ab65a7a02d97659bcac57b673bfe065d5e8dfc5e67a29130cbe20d064ea6b1cf99802a6522f2b29d2b1557c1f3d67ea0dc1bbf880ac07765

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
34KB

MD5
768bbc399b155e3d5f2cb7eb8c194a5e

SHA1
2b95cf55ea1046886f0627f3dd0d471910a640ab

SHA256
60f3bcdd0042a675a0b0068f83b552909a81ed59c69beb571e4656b840f305d1

SHA512
daff1d70f2e115f35b20f991f2068bd83682d3a96c4b5b0d2a55f938385881fd04826f78249108adf318885d28732550a3d053e0ddb726242d60e905b136b4ac

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
174KB

MD5
e606ed89e6dc3f5abb58a37e5d71646e

SHA1
06c317463c75421a451eb4c25bf81289dab84980

SHA256
7a7ce120c4b6f0b6cf661f2fd4d26ea012babe9a45b98af7a729e06fb9f9cddf

SHA512
900451beb5d68fb626c26937f03936a7f47397c326160ce1df4a5d62eb2c6c84fc416f90fad3051ed1846cb527f721ec257e398357cf0fd678e4ef8707222853

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
58KB

MD5
0af5e38c226194341fa653b50e451852

SHA1
16f37437b14288b45bec117ef6410d02e8508767

SHA256
201f24248a10b15369656d28a05a31375e4aa9387b62bb0f6374909da465d87f

SHA512
53a652566389f6c2bd9111da8c69f342462dd23be7cba88598da58a64f2f6736ce230f599b1f0b5c6f8e0b1b622bf3782f2c78e33b026d2bd8e3dc1870e5f44e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
20KB

MD5
2170d14b9385927ea71fe5c5c0188c68

SHA1
b1012d9d59754b81bb95ece3ac6201f07d823764

SHA256
3af85c229b7fdea9f01da280395d0f66efc9f5a12bfa761785b2c5cfe6891302

SHA512
2da92043847addba66ad3a2895a58f6dc44858419dbdd5eb9e2832d2cd5d8ec8855a9df04420f2705f85aff03d221fdc2fad7a1f35e5af2fd94bf17137e09afd

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
24KB

MD5
0255a677299de7e1b8b86fed5001c013

SHA1
53c289f355c7190dead592714e0536c298384238

SHA256
c07e0c2fad20761fc58ee98db8926184f893b75f3eb8daeebba58e25ca46196c

SHA512
664843ae661ea8044d6c94ef13df1a22f37c88b6fbc4b28417ed30228e41551e9bd2914d720daddc19f493297f155da0ac7593e1251dc136fe9292ce2068afef

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
186KB

MD5
10c7dd0b6e2973c787f15e5a93cd820a

SHA1
9549d510721d98ad9d438a3aa3eab982d903048c

SHA256
8b8db9f0bdc21c75588b53eee7e24f83021e84c664e4ca00ee7043aac2245ffa

SHA512
8ad6219428b09ec18027e4e6ad2b3ad4eb814847929575436de3e5b45f1658f038d07494121ce958bf22fb78f4b6c90637ef17734e6885e418a95d202f70a631

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
89KB

MD5
8398ba975d83a95efdd32b5a6590de15

SHA1
621c89f4dd014a6423fc6cebf5c07222d20710e8

SHA256
e46c5418e3b0b9b340aadadaaca34bdd739ab20ff8b9c7d30f3416d97d40b768

SHA512
aadd9bd95edc08bfd51d21b4b492167dd4ee5ee0b59d6ee2551fd9f085b34f5b20cef275ab2e88785026932a0a4b98d2e3e6f043bb89ec682986dc2b969e062a

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
91KB

MD5
9a6b0b19e592dae7ac1d4ae9f8bd7364

SHA1
2f71ef8f04b8b1d4d23e082d7308348d3c177ffd

SHA256
e67dc0e1bc146badb1b5db3d25cc891a8e82217af1c9ceb4010a55f8d8705525

SHA512
91990e7c51d502162bb7f9b2c8bd83662f2ec59c25c121939787ae10033592950e0b2c017018b0f25ca6c6b6f4f7e81a50afede9c2ace2ad3a44f6293d1ecbb7

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
127KB

MD5
55505195126d5ae01db365b65081a920

SHA1
ddd9bf9e5f28178425ba52671af627b509f7f0ec

SHA256
87659661968bbaa3730e5b41aabe1e06faa18b790949721f5dca431c9573d4d9

SHA512
7a7f9c62864b07b980fae8d2dab062c8c0566dd214f384e3ea97f9294db25a702a6f69ab409539fe8c7ab06418f4d656584b9cb7d0cf823f51c3e9f908bc19b6

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
45KB

MD5
8da190a1de8cecaf7124f1cd8d5729a9

SHA1
bba3417e284cb4aa67a637713da56f901f211e4e

SHA256
fe8b7929da32b03f6f0e541427e87c1675da1d21e655ba57f3ccf80f54564046

SHA512
8542083f0d17e9a0c32b6db77a63029b20d6d259e50c2117ef8fb2d0b543ef53aabda6a1e050a4f2cf86815607bb9b426de861d1b5f40a0017911e983c75666b

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
26KB

MD5
e01009671d2171f3db6d6724a3cc03b6

SHA1
d023ef8f3e95cdea0a7fd39229166e0f0d5b84e3

SHA256
04af0bd81684398ea6fb62578cd5712173839e634e21f39011a278b0478587e1

SHA512
6b021f626554391d0e0fab06a428e0a66a8afe5cb359756f007a8b54fb209ec3c8ff85a838fa3bfbbde6abfdceec20a9157043685fd906ae9066f661ab3a1c54

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
5KB

MD5
10c9b19df8973a6cf207ea091bbcd997

SHA1
fdccf4aa4b93316384466e4179992d48dfe753e5

SHA256
8d26dbcfbc689f1cdab0a74d9a559cf6daf4f0b97943aa617a0a0c3aa81282fe

SHA512
710dbcdf8ed10803ed4daddd0cfcd85246c6f6d91195a5fb3e4710f0eb280a9d7ba350f54081c4ed55a79616c18c3a60305987eccef4a7e206fa0d5fb86490a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
49KB

MD5
912e28b39d42956359dce1b227809887

SHA1
6b903344fa3ce5b429350dd259ed316749a479df

SHA256
105db9178f9280f6492f620fad8bb25f295d7b90c7c31c43ed4b010ae956b816

SHA512
6b20856ac1417185d1b551f3820b922a29d36246f8cb73c754237c62b996245012e106d190c8d69e42bb98fb094c12f7891bc219cfc69e49301128980eb3f504

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
61KB

MD5
9de62886a720b509cb719a5cd301656e

SHA1
724917b91fe28f507c8a3978bc4c8aaf23baf6e4

SHA256
9cd846efbf7928064c310f8ed6432f73f939faf0a33e6b044f705fb76a24a4a6

SHA512
68c5e1a4cf84a94e7eeb24339a5a25a1fbdb32fd6be291dfde3a262bcce46f214bf3673bdf83e2d2d27fbcebc727dd5acee8eb15907b220ebc3b94192430abdb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
59KB

MD5
cc11496581cb590fa6046efcbd9a1ddc

SHA1
0007da0baf5ac436f2607a860c17f015aef0e575

SHA256
d3525b80b86ecfdba85c2bd27a00831e9e6d6f64f2c2d361e0ca5f828fffc379

SHA512
7f783ecd71a4c82cca6e0f784b7f91e949e042c617165d6ba9b18513818898a38c010f55018bcd14739585418564632ee54f107292ec52cda138943fe050a413

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
29KB

MD5
407d000d2962017d413f5e796ad1b0e7

SHA1
7b0552525276cfe54a62e39f306c92cca16374d4

SHA256
a46f81337c17e0bb118ed53ba0512efd72b4209606b03ea2faf8bdea38189c3e

SHA512
99cf235710c472cbd32d235051373bf6d89d5216c33c8a4f1788887f95d1a2d5d689c60fbc9c71363327565d0c739ae05dd5ad6be0e18e5016948830c0f25178

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
12KB

MD5
f1a0b714273e88ca48ce6e90777620a4

SHA1
0d37d817d887c6da57bdb371a37cffbb8aefdcdb

SHA256
c27a0454478afa706998866f46b84eaf600e4c7a9174be9ff65a701537b5a6ad

SHA512
968e944dcdbb5f1e37d6515ef66a849e9c60142bb4eeec91913110b8ef2ef8cc22003b27f1f882ba235d8de9f431678770721a922933d404d53769c77f2ffe7d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
61KB

MD5
560db7ee122c03b0d2a453d76dc0b0d2

SHA1
68a9c2b0a3c9a9809d64a208b249d22441591be4

SHA256
c35f92f3886bc783d8e87ea7d9c0d5a025466448805de3b095177471a67b88c9

SHA512
82cb5a7458f1b3f2d74109336afac86f0a6f204dbf091c4fd5392c94b20f9e34dd02757b285b611f8cc0f11bae77bc58b01389f9aaba806e65bc5e90d979e906

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
92KB

MD5
89b3e2d4cbbf6306eb70f50e041ea4ca

SHA1
0e73be23d4b6e880ade826ec3f57edbe5a415406

SHA256
2127a9a054681bad0f5ec3ce482d9a199288f9c23b0c4ae7229243c18afc5527

SHA512
2be8ffc459d0544e42a563af5572917279e334c76258479d65cdc259f8cd6c92455b44de071dd8f396378fa36e408001c67dabadebeefc2a734172c109cc2b4e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
45KB

MD5
2e14c4ca30a2144f772e20ee53b046ca

SHA1
4d2b9019765ee8183ec2535a3d3fd73e60ea23a5

SHA256
d47bca8fadcc5f8452546f2e187f0e5a06820f026a9d48a89c536f29745ec62b

SHA512
52033ff2360db42fc8c6b56224899313b4526ec891626563c4ecc8102e146f8c86bba503fdb6526a9b7271a81c1a901e66a016e90f562157ac8d6706394d887a

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
92KB

MD5
3cee97daea5e9705b3d33d348b7ef0bb

SHA1
54aaee37129e32cd5a3470d73f45174ea0da7344

SHA256
30268c60683cea4e43e2f1c4bd7e12651e47940aaafe298c63e0c5ee717bb934

SHA512
928d47f08095c3aa7b8c9687a6405d677dabc66f43f729eaa79467183b5a29e9ab10d42b1f7079c4765d3c57e3e99978fe9b7b9e896c889609f13101c3c2b00f

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
67KB

MD5
86f5267053edc28080856d69d08dd776

SHA1
4018acbb99d5e779e57638768e14ea54f4e1d563

SHA256
5f9213fe14c8312b64a2e160476aa9de9160fa91f8ac093f9a3784cd8d37152a

SHA512
51ece5c2d63025472d284de8a1b2b89b61c9c19f98228d13969b47fc9d1f470098dce959a025bd334334669b151ad6bd3e2d76ff792ee9fddcf09c9bcda11a5c

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
19KB

MD5
364a659c6b39f662f9faa9fc3097283c

SHA1
2dfdf5f323bba0502bf90b7ed450e649ab3fbfc0

SHA256
09f48db788da802096faac5a80c1f048720a7a30662dbd316ac0c32b40c35f7f

SHA512
89e5c4f726fe4af6e6e0419321b6d11860fde4e1d78d7f7bddccd49333d2235ea0a74e6306f79c6b435a86c67f5acaa285d801b8032d0c295190200c6ad9a375

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1KB

MD5
5982a78215df185c04e8ea4c9694e4d6

SHA1
411fd5195267dd56efa7ef1543992656ce696cee

SHA256
8fc30a6a1ca84d0a95f9a44d8542399038a2f1bf3dfdb43528e8107cf21d1a90

SHA512
8a9eea41c149d0722814bf14248e3065d6f10521a08b77f0e9371cb954ff5e366ffe75998a6e7cca33b2165eba70b9045689c41054cd3f05f38871ef11d858b6

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
7KB

MD5
e5ae4ac5bbff8ff157db4029df1a1139

SHA1
1321a268b106747ed20463b2e74d3bab3786b383

SHA256
ad072ebba8a3bb6f9b2fb221f8aa216bcfa7b6f7d92c9daa65b77a3313374031

SHA512
1bc3e6758c59891ecb55e124053f635873960b1c595cdf8f116d8532e67ce22eba750b32ae84e37c5218439b3bd90b93e2e4808341b87413ce518da7029bf768

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
60KB

MD5
c3ac2ef5b888c006847b566eee7e6c1e

SHA1
8b4416d785b89035969fb69b10f76824d4bb613d

SHA256
959fe2ec8dec996fcd0b2ac9c329b66188b38709aeb70308c1f1ef59581fa59f

SHA512
55f3435a29569909be6445d28b1cb0fb6b299fa2d686016a43f417ea583db0b8d9860d7bf8e35bef525ec872a7d05fa02dff1bb8cf30c8ee6170ced4afcb5eb4

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
107KB

MD5
fd29cf4afe7ef942112300d1171d03ec

SHA1
b66c866dce939aa4896389d12300b776ec259b5c

SHA256
7cf16e0f509aee46602f906164adf1bc7beda1070bf74e210d33ede0bad4d4b9

SHA512
ab5f506c14be21c8e5094b8cbbf7ddc2bb50bf90e39cff41cce758fe6463b0ce459106e82f456b551ba820233982eb66bf12cc3671a692bc114924c0bc4d282d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
24KB

MD5
b175d52f93c308e4b539aa9cfe6b0a54

SHA1
cdad40462b2b1a10724d8600afc2da0f7a5d18dc

SHA256
c03a241cb2d7b5ada71633f278bf10bdbb9bd016b749818ec4c30cdb06cb36f9

SHA512
0a8129641e5544855f2341dd099465159ef39fa6340cb404becdd85507c2739bf5bd295e51e50d9c746bc67e0fe5d742f903850c6fcd6838b28b2da0d5f62f47

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
34KB

MD5
61f19c4d46a6fbbaf569b0956803a542

SHA1
826ad33c4adb0f2f96108c080bfe0e7fb7180082

SHA256
129273f47115c36a7ba19b716f1b89454db3fe9042ebfec7dd070c36b0e87832

SHA512
5405a298182b27568dba8c0ecdf6e151f7c73df45d5819bb18c139c98ec10e3c8ba8f0466e40749be63856099cbb73facbbccb9c373c6cd9beb1f9cf65e0212e

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
14KB

MD5
d69a0dc03d7f90f47c6f9ecc75e0dce8

SHA1
9ed36509dd1a102ff2a33761b0cad4e605e84d33

SHA256
f0fbeba7e6c7c6c4c1fb9e34a080164bf76b15f6c40d90eabf385f4cd5771142

SHA512
9aac708fc0411be027b207da7720094aa5df8b476f3bf43c1d782ceeca68af85b1fa8e59603f39543c33dd713d1ce4f1458bb97e5db242dfd997559bdab30885

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
20KB

MD5
7544480da6e6bcbe3959ad73ec9b194f

SHA1
bb6475b70dd0d74f54d2646987f4db3b052d1c65

SHA256
5fa6c62d085cbaf2b3d960bec34034fcbd5ef6b63236092d069080dad0e0ce07

SHA512
8861bd3924992001da2e217d961c1c96d14f35e33981e7ee7ca5975d627bcd0daf94bcbf58224d9189e44739d7f4166e1269e6e0186bff084364f9c135fb7cba

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
89KB

MD5
9cdd35beb258c47b5292fba7b5712049

SHA1
0b329345ddfb0bdc96f82e8b3216437ee85a563a

SHA256
c58ab951858a637dae22a80466836809e80ffbd6cd1b0e77ca85663010297dc6

SHA512
e00268c411690ce7ff394d12b01abc7ce1b42f9fbe915d6d0ebbc67d610430b292672d54f4334a798e96cc144a4d5b6eae65403559bc33db05ca05b8b2cc8b8d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
54KB

MD5
88a67899425d96a14b49a74aeb5e6b7e

SHA1
00412bc3e242affa3f1c668abf4cbf659efbf4b5

SHA256
af10f9751a0b13d1e598f99dcdb2ae8e2cf9c6a375aa0ef845e08347803a2c7a

SHA512
c70ccca63314ce2429933fd7b846e7f4dc1a340cd243d040b27954923560f68f29e3edcae17a243b43436ae1bb0c3f290da3f6fc058200ab8ea7a187c8ec5aae

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
18KB

MD5
9e86ba521e976d4d40f8dfbf14a3c148

SHA1
0ef31e684702599a638ac1c7b37f3ce4881242ec

SHA256
762fa13eb7e76edbe0b4bb2af675f86fe8a183857d7e20cc49dd43c13e1e51b7

SHA512
12053b7f0f80fba3e16da3401d587c816df986ebb23d56962dec4f41baf4598fc76aa60a7a7ae557ae8ac4b8267bc4b165094becb330f4204c7b590ab90e8eb2

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
75KB

MD5
cc2bacdd1479b2d397f0cb6bcc81ce73

SHA1
d2dd2a3d834196a77a4ae8f83a64e93c80f925cd

SHA256
9edf4bbaf3bdf8abb549291254f6dd1a94fc8c3cfdbd86c88cb9d5ea572daac9

SHA512
18762814a29ce86ad9f6e1f6af33cc4cf5b565462270b3975584962109ddae3b5f03875e7bff4f270cf6112fc50398145c25deed472322eefdc7fade1a15dbac

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
58KB

MD5
fd199ca57c4bcf2f3dcd27135abb5b82

SHA1
c79454986c59ff645d06620d7db673be6dc2818b

SHA256
308462b7e2779a38d7110f48b5d3f62056fad08ea7b532ebf768c565862b5fb7

SHA512
c6ebf4175fa01c1160053c81544169ed384bc3f8216e915a69747481eaa73fc75421adf13e26c31fcc1a8a6ee2980d5bf574dee1ea51f8ab973b8e71fc89227f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
45KB

MD5
95baa269ee550e818ccf2a0f2b466a78

SHA1
3ee36d985bd9c83a65688fb7bb60c799a16e1b14

SHA256
bc0c39eaaefcdb54118cb0b1e3e963468000563e585a72c7a05bee0fe91ce0ab

SHA512
3de8fd678d02e278f612c4cc556a2e6e2a161290cf554afabf50c2c12c180adf7f99bbeca41762dfbaf965990f680fc70b43af6825d5e0fd67799b43efb75d1f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
165KB

MD5
3b9b3179c7c32c2cad7a15f8d3b67a8f

SHA1
195555ce5de02a7a0b2ce8b528da8d947095c8d5

SHA256
b9cfb98465b0e6a10d2d68607feeced2a8817afaf8def0e9c20aba9e2bbc3620

SHA512
f999f21e989d7d6298b9bbeff650f462de61ea31de360c806fbdabd56e735ed0b9ebc81250d47c6ad34551f02880ff187c748887b86c4c86f8144182cb04cbc3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
92KB

MD5
167caf3e8b9a6f310a4bd1f499ebe060

SHA1
921aa8bbc0a8e53b8456c61e510d190088653f33

SHA256
4931658caff2292c110be0a72c945ba0e59598572d81b867d0cc61f32c511543

SHA512
6573daa9bcfb914bf111af1bdb83c439154e646534fb2c919bf7b39a802eea71d9a90c1a198a31daa978430343aa118acec9bfdb85aa869b5a2cbb4ef47be30a

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
54KB

MD5
9b3a83b4b15063e4f380e3fb5bcc7368

SHA1
fc0af76d57180a0ce07eef6b7f0be28fe78c0111

SHA256
0e77d085ccdfb34770aeeddbbd280ff14917b4364e2886df8f4136e73a19b808

SHA512
a349a83767de994c22b8076ed54e48a0fbab793e8cd0d4b9e13b9aeaa5e2cf5febc68f21c5f2eaca5a4a337d29c979dcb74bd6cafcd087a8c9e2f658376090e6

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
21KB

MD5
4cacd0aa80723d667741c306d8ad212b

SHA1
e74df7bd4eb5433ee9554f70ee7819f02fcafc0a

SHA256
1e1531b94ce9b0369483914737be2535464720d4fa3d636cd2fa1994da31e0a2

SHA512
93bc482904507312d80694ac374730360cb662ecfc65ff4f6405994d3176cd5977c5a3e04ee1c619056ce19e577096bfad6dad4a6233c5e64fd135077d8da660

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
59KB

MD5
7269d0fc96a8af49ebf575b2c2669f49

SHA1
b2da63fd3fc1ca18cecfa86febbf07ed14982f6e

SHA256
9714b1c906f229b3779f20fb31cb66e1ae8f5210c5c51957c36c74b32ecdbbe2

SHA512
733a93c202255e8e6688a95256a68fc29f2f5ad0d864689b4195cbe7a577945b982da1da723228463939da0a7965903ed53564cf0292d421296ab18f91acc227

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
33KB

MD5
55adc3e0a1d788424de26fc109ae9ad3

SHA1
4135c9e7a706056114ff380b09bb7782343d0f0a

SHA256
dc99b4c140c899159f75db484685a56bd40572427c5fbc5bec6a275b31505fe2

SHA512
59d1b56870d69efc93eef85fca8d941e31264c466d7262165ace3c533cd92e09182e6862a191be4f172307c1fe389e8879cfd0f78177c6e6ab70274f42304658

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
b01e66f74ea28315bb9ac33518e7559b

SHA1
add86e7e178ac88e25af526368316c736783abf2

SHA256
5050c6dbdfcf5fc2a0eabcb533fe394f9135c795a2ee3e8c3d74f16a5ca4a3cb

SHA512
0f02db36850ce36ff2a16dfc101322263d6fedee417b2d8c2960bd5dbf0d8a20a86fa14fc23b6bbfaa3e7069443e38e94c27704bfecc441c65973b4b11c9a6f3

Download Submit
C:\Windows\System32\alg.exe

Filesize
35KB

MD5
33b3b854f58898b0450bf216631dd036

SHA1
6338d3ed9a4ade20eea0a84df96f5559df195f92

SHA256
f94b1a3a2d2862e86a67f48024255ae212e60350853392c1d7abb06a6d033996

SHA512
08bd3ac07b36b687144b16acb1b42b91acfef3a201aa0f9712662bb8071696ad735165aa8255729780a5e44d8fd1aaa5699ae612521c0a6162ac7ac7d54bf889

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
24KB

MD5
7e94f803437a7704cf5ad9054dde9c80

SHA1
c972dae603eb551db2ecde50e3a38a67ec731498

SHA256
6f60f3fadaebbc82a6aabeb3d914cc2e3bd0d1163b1750a7188e6d0316998e2e

SHA512
39a1a4825266dbf45a91cb400e55a1e49498d46275f80545af2a7914d4907ddd993ee077ddd4ba40797f104cca48c7f9edaabe2ef73fc94d10f4a9cc6db15af7

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
64KB

MD5
01148dd1369f7d68d7c5437b2dceb381

SHA1
72700499f95b24c271954faff1c17dd108762643

SHA256
c309598779850ecda92e588bab3f7c7c9e30702a0ef61088b08045cd6afd2266

SHA512
b33dd33b5bfba3c1d867c26252d975db718fadc7b50cf0e894cdb1bb8f37073ada8a480836a18c5cab24f6d0ffe064b9146701cad785ca39400fd37a5ac54f51

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

Filesize
148KB

MD5
ac901cf97363425059a50d1398e3454b

SHA1
2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

SHA256
f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

SHA512
6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Filesize
41KB

MD5
3c269caf88ccaf71660d8dc6c56f4873

SHA1
f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

SHA256
de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

SHA512
bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Filesize
210KB

MD5
4f40997b51420653706cb0958086cd2d

SHA1
0069b956d17ce7d782a0e054995317f2f621b502

SHA256
8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

SHA512
e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
59KB

MD5
8c69bbdfbc8cc3fa3fa5edcd79901e94

SHA1
b8028f0f557692221d5c0160ec6ce414b2bdf19b

SHA256
a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

SHA512
825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Filesize
42KB

MD5
71d4273e5b77cf01239a5d4f29e064fc

SHA1
e8876dea4e4c4c099e27234742016be3c80d8b62

SHA256
f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

SHA512
41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

Download Submit
C:\Windows\ehome\ehRecvr.exe

Filesize
194KB

MD5
b137f26b8fe8c39f40766cfcafee7a11

SHA1
610edc6e8bebb223dfa3041777bafd72a9c6f335

SHA256
134e9a9bd78f9c2c1773ab196734d27280a1ff7b4e62966291e51d3e749ee701

SHA512
978d84b4dbd97ba9a4d2444bb46ea7fa8af8739e6f9a1d8daee27a905745f97828482e56e0ec0fd8ef492d4d707c80f5cfe38ea6eb7a29e3a79065644fbed31e

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
16KB

MD5
2f8d69c81659b9cd5484eb28fa5540f7

SHA1
f001accdbed713f0b93e97d52e942795a4e3f284

SHA256
9ef8a4473df7c07f65f3d1065406f53d0793eae365e112586d573edfcb5a8441

SHA512
cd1b8a42369b3726fb32cd6bbda305f95a05fe04d58def47eba7108e070fb55a0f525d54c56145bf22be1041626731a26194c997969fd0de3b05414dc5683168

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
111KB

MD5
b1a159868159b777a03fc9b565f86fb9

SHA1
f2ad45d4557961858912a7ca5dc6bfd562f8ff3b

SHA256
4293fa7bc38418fbb4f694cb6bce5415e6d6de3972f45e8cc68c7a3c8f4cfcfa

SHA512
8a95bd4ffd3f308d328b298003bdb29532824855376561056c9bbc8155151bbeb9fb1fb690c7667cf616b4f18a8a0b1a62ebaa7a7a6de1f3be9904294414fc0b

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
11KB

MD5
969390b0ec130c75cb964ecab5c1efa0

SHA1
07b41eff4b66a30f4574af2a796fe5a961d1dc52

SHA256
1609f7c01e389464cef85d9a080fbe9b9e08c45d4bcb55ab72facc36c3bc7b0a

SHA512
d12e18386a519a1f95a2df0df03850f843c460e74cf7bf1edf3f182c6269ce467e1a9b75080f3dc4979fcc5d9dd5c4af5ee89463582882c9ff408376cdf6fc04

Download Submit
C:\Windows\system32\IEEtwCollector.exe

Filesize
176KB

MD5
5c5330e570764c49798f7253dbbbea3c

SHA1
a03bfd8b05fd7db3eda6f0f80c8c7d2854906423

SHA256
ca71b5271f7f65a80c0e3051c3de3a8fc88eeee2bca3f2017915cd8a111634fc

SHA512
d9e4c8b881db1e74fbd94c7bf9bd8bc999542895816495173fd87bfe20d4e9f3f43cf14bb09d783691267f3d357c81cc7905a64a690b035dd341699179657ea6

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
112KB

MD5
ee9e964fd92e3562a8c2a073dc05d01f

SHA1
79bf20dc3b4e8ac6c54e5eed5a856c4a20e5fa20

SHA256
bb4fb030fc93e0e9c8b7dacc0d73fc04975980ab285d974ebc8e6e58cbbbf617

SHA512
be9fc0d6fd4b0492af7fc40f88ad7a29415d2a1e5ad5f6cbe795e3de594a7b3bb29389f43b1cf4ef9921961f8389a8269e6a15df387fad482b025b189dde244e

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
16KB

MD5
c574bd3fd6c8d47999c5c879b5ebaba6

SHA1
3620637971b73693ee78f41740a593895a161d40

SHA256
13a9f7e6381c6b1030dad3b859e53233dbe523c72686a11c88cb3d7a32054b72

SHA512
49484a1bced18d5a229beb933b51757679e86579bf3d0710dc02783bfe1be06b1d32bddab92abeb2904230aaad5239d4db8d86874bc929b05302898a6bb269b8

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
27KB

MD5
5613c418ae79aadd5dd8217b43000532

SHA1
83af8222ec937d80479bbd1996a2670ad521140c

SHA256
5b00be8f90f739e4132576542e722f01cd7c8ebe6f2f04021189a6ba766b79eb

SHA512
8de5e9482eecd97073ed0975b983a5c768912219cf108cf5f49f2c2b70ca145e6f21ec74f7f1db44fa1c3d87de48abbedbfc16b07d14d7adaa18ec7be56566ec

Download Submit
\Windows\System32\alg.exe

Filesize
73KB

MD5
2b6666efd8f0441cde8b125961dddcc5

SHA1
d60c1cf15834936e0e73ecd063c1f859a91512e7

SHA256
4d19e774c76ab2d6ae794b53e8fc08f2b0609b6fd927e7aa3f80fe15e78e02ae

SHA512
052382461391c0f6231df105ffea5697434499eb46b25691a1747012e57308d095e379abc602a1becb509de7a720d1b3b248b36dafefc071ebc69a628097dbf0

Download Submit
\Windows\System32\dllhost.exe

Filesize
131KB

MD5
fd0c5ac854fcf76561c05282b2931e5f

SHA1
45b3327cd67890071f0698ce48232807844b1ae0

SHA256
8b081165b18e5dffbef78687988cc7345c3dc6b415c4c3e1f51fe44e272ce6d9

SHA512
4ca2d36bd51d13dc1b42b3da677d0039d1fce3789829e9ebdb800c6f07ac69e1a191eb25a8186af9e2c795446e8d3c0054917114403f16ca7d77b31c6dd29fe5

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
72KB

MD5
be8a2303dc699617a4afd401db306ac3

SHA1
5bb5f35c3f08ebd8134f5f0864c2fc7cf47e1c34

SHA256
0381b2f22ff396212c6b583a07d71fcdc2fea91b45ce0207e33ef2309f618e00

SHA512
ae7e9756eaf31cc41779aa95faa6731f725725f604fc0d813b909e31893a013ffb2a3a5cae0810e7e09eec41732caa9048be426454a7630320fc211b46696523

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
30KB

MD5
16d7efb030b4331f3280cb8c3ba89677

SHA1
51daca6a7e8c9ea1abe39f27053e445732e39455

SHA256
6a0171328a2ca07df8d0933099db743d19f165812703109e7112185f937ea1c1

SHA512
8f931651fed116e6172f17e29114b2afbcb12bd5eb4db06cfa2051a8a8f709760a80c76c40067f0ecdf21a486cdeec9a37403b752857e09d94b255be7e800b19

Download Submit
\Windows\ehome\ehsched.exe

Filesize
31KB

MD5
c48e512bbb49fdbaf74022008a741dfc

SHA1
e50cc5512b5d13e2e52b26b4e57f664974a6bbda

SHA256
f4d8065c97f7bac8a8fe57a6bd3b386f3c5b3477cf782ca4ad8e937e7bf90b46

SHA512
4ebde7f9bd7ef3b59a69f1f9d420e94eb728ff22b601eb31311d2e05ae1071760a6ceff610ca377010c313eb2950dc72e76e8f115ff18b8c7a1acec721dee29f

Download Submit
memory/704-142-0x000007FEF4990000-0x000007FEF532D000-memory.dmp

Filesize
9.6MB

Download
memory/704-210-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/704-230-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/704-160-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/704-144-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/704-197-0x000007FEF4990000-0x000007FEF532D000-memory.dmp

Filesize
9.6MB

Download
memory/704-198-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/704-311-0x0000000000D40000-0x0000000000DC0000-memory.dmp

Filesize
512KB

Download
memory/704-151-0x000007FEF4990000-0x000007FEF532D000-memory.dmp

Filesize
9.6MB

Download
memory/836-75-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/1260-119-0x0000000000330000-0x0000000000390000-memory.dmp

Filesize
384KB

Download
memory/1260-120-0x0000000000330000-0x0000000000390000-memory.dmp

Filesize
384KB

Download
memory/1260-116-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1260-194-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1260-112-0x0000000000330000-0x0000000000390000-memory.dmp

Filesize
384KB

Download
memory/1492-126-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/1492-146-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/1492-154-0x0000000140000000-0x00000001400AE000-memory.dmp

Filesize
696KB

Download
memory/1576-98-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download
memory/1576-105-0x0000000000860000-0x00000000008C0000-memory.dmp

Filesize
384KB

Download
memory/1576-169-0x0000000140000000-0x00000001400B2000-memory.dmp

Filesize
712KB

Download
memory/1576-97-0x0000000140000000-0x00000001400B2000-memory.dmp

Filesize
712KB

Download
memory/1740-167-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1740-211-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1740-171-0x00000000002F0000-0x0000000000357000-memory.dmp

Filesize
412KB

Download
memory/2068-320-0x00000000005E0000-0x0000000000647000-memory.dmp

Filesize
412KB

Download
memory/2136-96-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/2136-184-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/2136-158-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2136-84-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/2136-90-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/2136-83-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2136-99-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/2136-108-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/2220-138-0x00000000001D0000-0x0000000000230000-memory.dmp

Filesize
384KB

Download
memory/2220-1-0x0000000140000000-0x0000000140125000-memory.dmp

Filesize
1.1MB

Download
memory/2220-136-0x0000000140000000-0x0000000140125000-memory.dmp

Filesize
1.1MB

Download
memory/2220-0-0x00000000001D0000-0x0000000000230000-memory.dmp

Filesize
384KB

Download
memory/2220-74-0x0000000140000000-0x0000000140125000-memory.dmp

Filesize
1.1MB

Download
memory/2220-8-0x00000000001D0000-0x0000000000230000-memory.dmp

Filesize
384KB

Download
memory/2220-7-0x00000000001D0000-0x0000000000230000-memory.dmp

Filesize
384KB

Download
memory/2268-192-0x00000000009F0000-0x0000000000A50000-memory.dmp

Filesize
384KB

Download
memory/2268-191-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/2268-186-0x00000000009F0000-0x0000000000A50000-memory.dmp

Filesize
384KB

Download
memory/2268-176-0x0000000140000000-0x00000001400CA000-memory.dmp

Filesize
808KB

Download
memory/2428-156-0x00000000001D0000-0x0000000000230000-memory.dmp

Filesize
384KB

Download
memory/2428-200-0x0000000100000000-0x0000000100095000-memory.dmp

Filesize
596KB

Download
memory/2428-148-0x0000000100000000-0x0000000100095000-memory.dmp

Filesize
596KB

Download
memory/2512-299-0x0000000072DF0000-0x00000000734DE000-memory.dmp

Filesize
6.9MB

Download
memory/2512-226-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2512-298-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2512-30-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2512-31-0x00000000002D0000-0x0000000000337000-memory.dmp

Filesize
412KB

Download
memory/2512-36-0x00000000002D0000-0x0000000000337000-memory.dmp

Filesize
412KB

Download
memory/2512-56-0x0000000010000000-0x000000001009F000-memory.dmp

Filesize
636KB

Download
memory/2512-255-0x0000000072DF0000-0x00000000734DE000-memory.dmp

Filesize
6.9MB

Download
memory/2512-234-0x00000000002F0000-0x0000000000357000-memory.dmp

Filesize
412KB

Download
memory/2528-314-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2528-317-0x0000000072DF0000-0x00000000734DE000-memory.dmp

Filesize
6.9MB

Download
memory/2528-296-0x0000000072DF0000-0x00000000734DE000-memory.dmp

Filesize
6.9MB

Download
memory/2528-295-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/2708-72-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/2708-45-0x0000000010000000-0x00000000100A7000-memory.dmp

Filesize
668KB

Download
memory/2732-21-0x00000000007A0000-0x0000000000800000-memory.dmp

Filesize
384KB

Download
memory/2732-92-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/2732-15-0x00000000007A0000-0x0000000000800000-memory.dmp

Filesize
384KB

Download
memory/2732-14-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/2776-195-0x000000002E000000-0x000000002E0B5000-memory.dmp

Filesize
724KB

Download
memory/2776-236-0x000000002E000000-0x000000002E0B5000-memory.dmp

Filesize
724KB

Download
memory/2800-212-0x0000000000810000-0x0000000000870000-memory.dmp

Filesize
384KB

Download
memory/2800-213-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2800-321-0x0000000074278000-0x000000007428D000-memory.dmp

Filesize
84KB

Download
memory/2800-237-0x0000000074278000-0x000000007428D000-memory.dmp

Filesize
84KB

Download
memory/2800-294-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2800-202-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2836-64-0x00000000004B0000-0x0000000000517000-memory.dmp

Filesize
412KB

Download
memory/2836-123-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2836-58-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2836-59-0x00000000004B0000-0x0000000000517000-memory.dmp

Filesize
412KB

Download
memory/2848-27-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download
memory/2848-106-0x0000000140000000-0x000000014009D000-memory.dmp

Filesize
628KB

Download