980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5

Analysis

max time kernel
80s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
Size

1.8MB
MD5

7471e4443fa07d6a6559d02566125bb5
SHA1

6cea70b5a70977a8c57510623166836667251733
SHA256

980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5
SHA512

e455d1f8d2de46cf9fde00937f58872eeaa0e3d67947091e9c87610504b19d3e91e3fb8b5a7a8d1a2dc6cc5261d27d62c1602b0d5519988eb2f7365f208edc33
SSDEEP

49152:Nx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAJ/snji6attJM:NvbjVkjjCAzJYEnW6at

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 48 IoCs

pid	Process
476	Process not Found
1164	alg.exe
2136	aspnet_state.exe
2640	mscorsvw.exe
1344	mscorsvw.exe
2712	mscorsvw.exe
1592	mscorsvw.exe
2092	ehRecvr.exe
536	ehsched.exe
448	elevation_service.exe
2032	IEEtwCollector.exe
1456	GROOVE.EXE
900	maintenanceservice.exe
1716	msdtc.exe
3008	msiexec.exe
2920	OSE.EXE
1660	OSPPSVC.EXE
2756	perfhost.exe
1616	locator.exe
1364	snmptrap.exe
2996	vds.exe
2644	vssvc.exe
2544	wbengine.exe
2984	WmiApSrv.exe
1208	wmpnetwk.exe
1744	SearchIndexer.exe
2104	dllhost.exe
2968	mscorsvw.exe
2028	mscorsvw.exe
1976	mscorsvw.exe
944	mscorsvw.exe
2836	mscorsvw.exe
1080	mscorsvw.exe
3032	mscorsvw.exe
1344	mscorsvw.exe
112	mscorsvw.exe
1700	mscorsvw.exe
2820	mscorsvw.exe
1580	mscorsvw.exe
1148	mscorsvw.exe
600	mscorsvw.exe
1756	mscorsvw.exe
1264	mscorsvw.exe
1816	mscorsvw.exe
1468	mscorsvw.exe
2588	mscorsvw.exe
1100	mscorsvw.exe
800	mscorsvw.exe

Loads dropped DLL 15 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
3008	msiexec.exe
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
748	Process not Found
476	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\locator.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3d7fc658323b6587.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\System32\vds.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\System32\msdtc.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\vssvc.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	SearchProtocolHost.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	mscorsvw.exe
File opened for modification	C:\Windows\system32\dllhost.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM934.tmp\goopdateres_ur.dll	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{1187FFC4-7B4C-4060-83CA-88C53EC9AD16}\chrome_installer.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT935.tmp	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM934.tmp\goopdateres_fr.dll	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM934.tmp\goopdateres_hi.dll	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	mscorsvw.exe
File created	C:\Program Files (x86)\Google\Temp\GUM934.tmp\goopdateres_ca.dll	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{1187FFC4-7B4C-4060-83CA-88C53EC9AD16}\chrome_installer.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUM934.tmp\goopdateres_ml.dll	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File created	C:\Program Files (x86)\Google\Temp\GUM934.tmp\goopdateres_vi.dll	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	mscorsvw.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	mscorsvw.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	mscorsvw.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	alg.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A187B1D6-30AA-49A1-8BC7-96204830A671}.crmlog	dllhost.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A187B1D6-30AA-49A1-8BC7-96204830A671}.crmlog	dllhost.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10304 = "Move all the cards to the home cells using the free cells as placeholders. Stack the cards by suit and rank from lowest (ace) to highest (king)."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10054 = "Chess Titans"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10308 = "Mahjong Titans is a form of solitaire played with tiles instead of cards. Match pairs of tiles until all have been removed from the board in this classic game."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10300 = "Play the classic strategy game of Checkers against online opponents. Be the first to capture all your opponent’s pieces, or leave them with no more moves, to win the game."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\msconfig.exe,-126 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\migwiz\wet.dll,-590 = "Transfers files and settings from one computer to another"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\mip.exe,-292 = "Math Input Panel"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-308 = "Landscapes"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10309 = "Solitaire is the classic, single-player card game. The aim is to collect all the cards in runs of alternating red and black suit colors, from ace through king."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\mblctr.exe,-1008 = "Windows Mobility Center"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\sdcpl.dll,-100 = "Backup and restore your files and system. Monitor latest backup status and configuration."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10058 = "Purble Place"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\wucltux.dll,-2 = "Delivers software updates and drivers, and provides automatic updating options."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 010000000000000020dc2c96664eda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\OobeFldr.dll,-33057 = "Learn about Windows features and start using them."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10209 = "More Games from Microsoft"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10302 = "Compete with - and against - online opponents at the classic trick-taking, partnership card game of Spades. Score the most points to win."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from windows and other programs."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\DVD Maker\DVDMaker.exe,-61403 = "Windows DVD Maker"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Defragments your disks so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-113 = "Windows PowerShell Integrated Scripting Environment. Performs object-based (command-line) functions"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\NetProjW.dll,-511 = "Display your desktop on a network projector."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501 = "Connect to a Network Projector"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005 = "Desktop Gadget Gallery"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310 = "Data Sources (ODBC)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-105 = "Koala"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\Windows Sidebar\sidebar.exe,-1012 = "Add Desktop Gadgets that display personalized slideshows, news feeds, and other customized information."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10103 = "Internet Spades"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10102 = "Internet Backgammon"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{D7226D35-5859-40E2-AEC3-FE379D5F7982}	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\XpsRchVw.exe,-103 = "View, digitally sign, and set permissions for XPS documents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10055 = "FreeCell"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1916	ehRec.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2124	980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
Token: SeShutdownPrivilege	2712	mscorsvw.exe
Token: SeShutdownPrivilege	1592	mscorsvw.exe
Token: 33	1148	EhTray.exe
Token: SeIncBasePriorityPrivilege	1148	EhTray.exe
Token: SeDebugPrivilege	1916	ehRec.exe
Token: 33	1148	EhTray.exe
Token: SeIncBasePriorityPrivilege	1148	EhTray.exe
Token: SeRestorePrivilege	3008	msiexec.exe
Token: SeTakeOwnershipPrivilege	3008	msiexec.exe
Token: SeSecurityPrivilege	3008	msiexec.exe
Token: SeBackupPrivilege	2644	vssvc.exe
Token: SeRestorePrivilege	2644	vssvc.exe
Token: SeAuditPrivilege	2644	vssvc.exe
Token: SeBackupPrivilege	2544	wbengine.exe
Token: SeRestorePrivilege	2544	wbengine.exe
Token: SeSecurityPrivilege	2544	wbengine.exe
Token: SeShutdownPrivilege	2712	mscorsvw.exe
Token: SeShutdownPrivilege	1592	mscorsvw.exe
Token: 33	1208	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	1208	wmpnetwk.exe
Token: SeManageVolumePrivilege	1744	SearchIndexer.exe
Token: 33	1744	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1744	SearchIndexer.exe
Token: SeShutdownPrivilege	2712	mscorsvw.exe
Token: SeShutdownPrivilege	2712	mscorsvw.exe
Token: SeShutdownPrivilege	1592	mscorsvw.exe
Token: SeShutdownPrivilege	1592	mscorsvw.exe
Token: SeDebugPrivilege	1164	alg.exe
Token: SeShutdownPrivilege	1592	mscorsvw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1148	EhTray.exe
1148	EhTray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1148	EhTray.exe
1148	EhTray.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1636	SearchProtocolHost.exe
1636	SearchProtocolHost.exe
1636	SearchProtocolHost.exe
1636	SearchProtocolHost.exe
1636	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe
1980	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1980	1744	SearchIndexer.exe	54
PID 1744 wrote to memory of 1980	1744	SearchIndexer.exe	54
PID 1744 wrote to memory of 1980	1744	SearchIndexer.exe	54
PID 1744 wrote to memory of 3004	1744	SearchIndexer.exe	53
PID 1744 wrote to memory of 3004	1744	SearchIndexer.exe	53
PID 1744 wrote to memory of 3004	1744	SearchIndexer.exe	53
PID 1592 wrote to memory of 2968	1592	mscorsvw.exe	58
PID 1592 wrote to memory of 2968	1592	mscorsvw.exe	58
PID 1592 wrote to memory of 2968	1592	mscorsvw.exe	58
PID 1744 wrote to memory of 1636	1744	SearchIndexer.exe	60
PID 1744 wrote to memory of 1636	1744	SearchIndexer.exe	60
PID 1744 wrote to memory of 1636	1744	SearchIndexer.exe	60
PID 1592 wrote to memory of 2028	1592	mscorsvw.exe	61
PID 1592 wrote to memory of 2028	1592	mscorsvw.exe	61
PID 1592 wrote to memory of 2028	1592	mscorsvw.exe	61
PID 1592 wrote to memory of 1976	1592	mscorsvw.exe	62
PID 1592 wrote to memory of 1976	1592	mscorsvw.exe	62
PID 1592 wrote to memory of 1976	1592	mscorsvw.exe	62
PID 2712 wrote to memory of 944	2712	mscorsvw.exe	63
PID 2712 wrote to memory of 944	2712	mscorsvw.exe	63
PID 2712 wrote to memory of 944	2712	mscorsvw.exe	63
PID 2712 wrote to memory of 944	2712	mscorsvw.exe	63
PID 2712 wrote to memory of 2836	2712	mscorsvw.exe	64
PID 2712 wrote to memory of 2836	2712	mscorsvw.exe	64
PID 2712 wrote to memory of 2836	2712	mscorsvw.exe	64
PID 2712 wrote to memory of 2836	2712	mscorsvw.exe	64
PID 2712 wrote to memory of 1080	2712	mscorsvw.exe	65
PID 2712 wrote to memory of 1080	2712	mscorsvw.exe	65
PID 2712 wrote to memory of 1080	2712	mscorsvw.exe	65
PID 2712 wrote to memory of 1080	2712	mscorsvw.exe	65
PID 2712 wrote to memory of 3032	2712	mscorsvw.exe	66
PID 2712 wrote to memory of 3032	2712	mscorsvw.exe	66
PID 2712 wrote to memory of 3032	2712	mscorsvw.exe	66
PID 2712 wrote to memory of 3032	2712	mscorsvw.exe	66
PID 2712 wrote to memory of 1344	2712	mscorsvw.exe	67
PID 2712 wrote to memory of 1344	2712	mscorsvw.exe	67
PID 2712 wrote to memory of 1344	2712	mscorsvw.exe	67
PID 2712 wrote to memory of 1344	2712	mscorsvw.exe	67
PID 2712 wrote to memory of 112	2712	mscorsvw.exe	68
PID 2712 wrote to memory of 112	2712	mscorsvw.exe	68
PID 2712 wrote to memory of 112	2712	mscorsvw.exe	68
PID 2712 wrote to memory of 112	2712	mscorsvw.exe	68
PID 2712 wrote to memory of 1700	2712	mscorsvw.exe	69
PID 2712 wrote to memory of 1700	2712	mscorsvw.exe	69
PID 2712 wrote to memory of 1700	2712	mscorsvw.exe	69
PID 2712 wrote to memory of 1700	2712	mscorsvw.exe	69
PID 2712 wrote to memory of 2820	2712	mscorsvw.exe	70
PID 2712 wrote to memory of 2820	2712	mscorsvw.exe	70
PID 2712 wrote to memory of 2820	2712	mscorsvw.exe	70
PID 2712 wrote to memory of 2820	2712	mscorsvw.exe	70
PID 2712 wrote to memory of 1580	2712	mscorsvw.exe	71
PID 2712 wrote to memory of 1580	2712	mscorsvw.exe	71
PID 2712 wrote to memory of 1580	2712	mscorsvw.exe	71
PID 2712 wrote to memory of 1580	2712	mscorsvw.exe	71
PID 2712 wrote to memory of 1148	2712	mscorsvw.exe	72
PID 2712 wrote to memory of 1148	2712	mscorsvw.exe	72
PID 2712 wrote to memory of 1148	2712	mscorsvw.exe	72
PID 2712 wrote to memory of 1148	2712	mscorsvw.exe	72
PID 2712 wrote to memory of 600	2712	mscorsvw.exe	73
PID 2712 wrote to memory of 600	2712	mscorsvw.exe	73
PID 2712 wrote to memory of 600	2712	mscorsvw.exe	73
PID 2712 wrote to memory of 600	2712	mscorsvw.exe	73
PID 2712 wrote to memory of 1756	2712	mscorsvw.exe	74
PID 2712 wrote to memory of 1756	2712	mscorsvw.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe
"C:\Users\Admin\AppData\Local\Temp\980941f681e49b4db3cd90ef63beb4a6606588260b9abe3edd4bbb0c66eb85b5.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1344

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1148

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2032

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1456

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:900

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:448

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1660

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1616

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
  2⤵
  - Modifies data under HKEY_USERS
  PID:3004
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1980
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3470981204-343661084-3367201002-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3470981204-343661084-3367201002-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1636

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2920

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1716

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:536

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2092

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 158 -NGENProcess 15c -Pipe 168 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 164 -InterruptEvent 158 -NGENProcess 15c -Pipe 168 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 1d8 -NGENProcess 1e0 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1c8 -NGENProcess 1d0 -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 240 -NGENProcess 248 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 244 -NGENProcess 23c -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 248 -NGENProcess 238 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 240 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 240 -NGENProcess 230 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 258 -NGENProcess 254 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d0 -NGENProcess 234 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 250 -NGENProcess 230 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 238 -NGENProcess 268 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 258 -NGENProcess 234 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 248 -NGENProcess 270 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 278 -NGENProcess 268 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 250 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 248 -NGENProcess 284 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 234 -NGENProcess 250 -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 270 -NGENProcess 27c -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 184 -NGENProcess 234 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 2f0 -NGENProcess 284 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:1672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 248 -NGENProcess 2f4 -Pipe 184 -Comment "NGen Worker Process"
  2⤵
  PID:2352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 2dc -NGENProcess 284 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:1020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 284 -NGENProcess 2dc -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:1880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2d0 -NGENProcess 29c -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:1852

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
218KB

MD5
51734edaf69b368183fa54ff5db37ce3

SHA1
1ed3e1a60dd9b2e9204413aa1083dc06524cef65

SHA256
5c02313e471fc61404af9ea9ac042168ab0cfc26fac42e25b68362bf2811945c

SHA512
6f1fc8354e5310178c4b42d6db57d66c060883a8850598ae4c6ef61c2ef7d578e0b1d2b0472ed280b2ecb45301fc24b5cf9c1467ee9786d78de3a47e80fecba0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
312KB

MD5
29778abc28c3968b6a052eb92bf40b12

SHA1
6261d0ac4275004dcf7490615fbcf735d34a2ae9

SHA256
ad6779bd48cf72146dae972b9b7fa2abe98838cbfdb9c84a48e93a419c2da82a

SHA512
989d982110f1ee4defdebf92a983e137973f8d058760850d412f7e3544719e520a0afd00032c5a8d69cd8c36b20d20def2cd16ec2c0577ad0ef7b09d290ab1e9

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

Filesize
155KB

MD5
3861f88ef7ea81525d487bf68b586de8

SHA1
6febb3ea795b9f86174d011b83796db09eefbc08

SHA256
ebc93c4e557ec7306f019acb4a52b80e648a596692d8c1561bd19675717d6c0a

SHA512
8edf701302e03083050ca6b5113843caa0257b5ecce00f7a653df8ed6bbcceb7c089ed5dcd49e04beee09562ef5da64d232a3162b5b56880817e687d0871e468

Download Submit
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe

Filesize
189KB

MD5
6b14c7e2f802587085f3d569498a2460

SHA1
335b4799994cdb3fa9e79aabda79cecc5cd3d119

SHA256
4e54fc3808e4bcac5467e30707bed250c02580f7d84f4c74ba5d2f3556cea3d2

SHA512
c9b74f44e800a0ea7e8aebfb194b20421b408756e5a90d364886f39f63fbefba20cf08842b45a5021830f5f52beb2b78816d9c86c2d455f16c5ec3d94f8164b4

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
295KB

MD5
99309397cea509d4e52b330d4a1dd7a8

SHA1
242b0d558cead8059ff996931109edc924999829

SHA256
aeec985af228266c90d18daab909166dc5261a44a7aad06766814234a5bc29b9

SHA512
e662a8ac21c3c972f60d21a1dc70d115052c22929b5387077dab8c61e82ed5bc571e27ea40ea917bd392f435e70eed29021bf737daaa74e3866baa94b78455f4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
712KB

MD5
6ed9a7da07e828ee63681ac8d564a411

SHA1
baf3238dc6989e6baa8bdef5cc172a910a8dda8b

SHA256
120ad4647ba20f03e64874775c58eebc5b0c9fda2b65559b1fb3dc5a7497585b

SHA512
5429bdad5ecee40715766fb9836621b283b818e3a3d8c28af4e4899e8cf094c8912969c30b4453cf54eec9c9df34551f168ef8bfbee0dd27d3745bc34c93bce8

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
415KB

MD5
5383c7f9fe7efdaff8bd69d8c8ea5e42

SHA1
43d4e81cfc02367e4f1e401654e7992258be10b7

SHA256
76d624d6ed66e9aee74ef265bbb1f7cb11322b5ad3ae567529af91c290e93c7e

SHA512
5af1dc7142cc71e11dfa26e74c231e5a4147876e85b631a9d7d8338baf7b9d1176125acdf07be48a44d1d4a6e37a9306a84018788c2442bf179351db9d8939dd

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
152KB

MD5
ca63f6cde1511f97ce2458691171be9b

SHA1
fcf3089d229a1d85a2a1edb0f9344ee230613116

SHA256
a2dbd13a25952bb167f29d9de78e55993eebc492c74cd9ff3a97d80746b4fff4

SHA512
3f25eaebaf0d401c37c4018299fa3e21af66a4f5c711ae864ebb47ad24be260387bd804c2df3e969f9a8be7b64f6c89048e55efc7e3c77237f85ab6fdc653db2

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
136KB

MD5
c8d8f3233beca672e1908e09f2bf5df4

SHA1
fb8869b81899c01c2e4ad6ef38ae072358b4e41c

SHA256
f5b3561246384bfa99fe1e7c14e840730372d247d6ddcb4db3dc1b63045d8c5e

SHA512
6ed0a788e356e9b35ae48887464f56504d872bce52f446f8b95173773bca63f35d437b0d6c5c46078c3f1352bb2be7f7118f15c64faebf4be6eab932d2484379

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
130KB

MD5
98a50dc021b25ee21812700305bd1dc0

SHA1
2b55f6d02f4a3435888dc55c34304c9fe2182f63

SHA256
bc944c2e0e60f0b7d5f58c4a84944729afefa4df4d73e3cc6d3bd1c2f0ef8d97

SHA512
7dfb352cb1ec63070fa03e921fe6d28fa83ad0a055c93e590841e14ca4ec7878cd6e0570b9f008680677cd47165c6d5d4f9448615715aeaeb10c0330febf1451

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
130KB

MD5
8a50ed84182914d549d1be1e6e000411

SHA1
7870baa1486ca99dcf7f88e33bc2f3b6c70b3a18

SHA256
9213c44b9fe076784a45f2925e47f7b6de87b3ddc13e0bf12de78754c3ca6127

SHA512
09ed935e0200dc0d80a2701c777d7795f5cfe380fe9b7bb924ab7afc1fb5557e47c9d18d7d26418ba1ce0300ac01af3e6556e63f2c38a0875d6283089e698b59

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
216KB

MD5
b240718b473d5d77c9f956e43a8fb93f

SHA1
8f38bd63df5bcb929e1afd2cc8f1eaeb64e345dc

SHA256
d5d9c602311fb8e2782446f9b66b21d8b6997f0ebc3ab8fc91f0d1a510fcf4fb

SHA512
475b2be3dcf1a33a981ba8f2e8f08f695e0408858193345df83889f56cab9a4f489bf5f533b1cd6867c00df535ee337a69938c46f02f73975ba1a3bdf5412383

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
427KB

MD5
0740093a4ca6a02fac30e557b8313363

SHA1
8f0ef0a0ae94a12ada1590f043b1612e5c8cb3c7

SHA256
e990292d62814ba3ec97df987adc5cc6138b0aa9528b22f88ff1f2c48aa319c1

SHA512
d71a32461f2c9b4f5c10086e620e4eeccf55e367c046d500f8c3188048a7cf310b2bd60f8156942b8969ab694d1d3c76d8984f438cd72977bac64f3e20df1051

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
96KB

MD5
c7ca6819d40abaf1e3a98fe8be039ae6

SHA1
d103e80f50394bd1b87bfd0ece3811b7f9ae1721

SHA256
65fe8b9a8a1c2def4ddc54cc31742ec693616e5e850fe4b44f01ae8240322bcf

SHA512
2b14f4e3fa04bc1a12a7ba55bc8256dbbf48f6b74e63b17bcab4984c37ff28cfe854b2eff2a99ebdb50b01dcc0eb4355cb948e487799897cfd90a82c0a05d456

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
170KB

MD5
0ca31aae69865e4b7c5625867a739c97

SHA1
118b757812de6efc7377ae3f856d825e4a4396fb

SHA256
6765923ed3e1847fc1e324a6cd75a6f057e0cafd1f21c9974fc4bdb93acf598b

SHA512
517b27c7a6b6693b9049868ae8bd28f625b112f86961b949c4aa4f3936edf423a190153f1c3e3d87bedf26901c156784b04b10626c891390ed15333bc2b2f52d

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
148KB

MD5
021c22867a8d5237ae095b1d34271a06

SHA1
88f2b164f31f816dcff5d1d336be4fbb012a797e

SHA256
99e22db205a90ba2570e27d72737bb338bbd8e4056f8e13fdb7ed5524582ff57

SHA512
24bea60f146ddd1739900485626be0974516a235c40fbe4bcd52a42b58213a66f0f88753073a2842bfb2f76b86e3dbeaafaa1772ae4f0ccf3c27df0374ee8ffd

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
910KB

MD5
1a02a2cce415f9ce99b6c4e0f91b2825

SHA1
dafcd2a49c5a01181d2e210b39393cf4171cf3ba

SHA256
d5c5580288167cb6c2b5ac6b5d063bda7734dd433beac377b398f19f1801ec44

SHA512
3296e2328b15623a900d8f2c9559bcf6346e3a8572414014d735c5f2674f56ca100be08bd8df2b92d7816ca5013253e93e5c5ec10d84fbd835bd9d2b15322117

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
96KB

MD5
e876a590a6e93ab958e34ad360352ff4

SHA1
c7b38a0d5c4c3cff2768ed8a5c3e224685c2d49e

SHA256
669f4a196e90de61fd4f02eeb2a691cefb8fbd69087fead867deefa3e59247a3

SHA512
96048013f6bad6d960dbcbc9a646b761600c1796e1937fbf646a5a8065abbd7c765ef0f31d8aad2f5ed06ff85afcf585f6a8576d3a524cd8f923891042e8c3c5

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
112KB

MD5
ab9ef769dd2504a99db82dc22caa4659

SHA1
1e46e360f344c0c0355842a63c8f89e0eec0bef7

SHA256
ae3496064a3106e9c9fac8eec4a72dcad6bed7c402fe7a4accb11272dfb041c6

SHA512
3845b2e719cc1ff91c62edbe75389380932de0aaa856f8060017e6ced5bf757a5e641c500e338faca1b3c29531c91db076772a881d635403993a134a5cb90cd0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe

Filesize
92KB

MD5
925a3909e32ce8485fdac6115b9ed278

SHA1
32ee369295434bcea99cc17e5c89d406af3f3291

SHA256
7adcef5852bab114984b1cf5e2deb8f031642e795d4f2415f7dd7a1a50358d12

SHA512
0a022e7af526fac0dbc990361fedad872a29571c8faec8262bf5a99848e88dbeb38977ca1f26ff3fc865c87355d92c51a91cd4a91b05b74e82ec71f6e965b8d5

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
97KB

MD5
81c7fa79a07e46009ff204608ba723b2

SHA1
2648f77c78270f378f73433f82ce3497ed3c5d28

SHA256
19b7b0baf6e5c7ac05408311c2824f9e74068bf68faef8efbbd88846206898fd

SHA512
64dc8bfbd656c39d75446e7fd77856e90ef6877be4bd68042cc5b227df0411e42a352322b9843247a209252e3b8bd61ef14873c5ed1fcf8385e86dcadb2962d6

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
40KB

MD5
b9d249cc35770da915fa4724c560f840

SHA1
5bb2e0a89faa5805f06aa687a66ddd3c6a2cc788

SHA256
69a707a92b045218766394470951fce8963b3f1bee148523618e3f8d72b7e1db

SHA512
2685b9487ad5683d884ac21c757e122f25c11cad599d58a14d53df6008c3f9c2c5f94994145726c40014f4feef4a8ff6f7c03dace9571b31dcc55eb8ab8f1dbf

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.000

Filesize
240B

MD5
7ca2da6f1e7bca562d7d9376700a912f

SHA1
67feaa004013eee76282e3b3fc196279f2577dcb

SHA256
04fd7654331261ff9ec331c31b238ba7770f082abfb817d7881813ec02084a4e

SHA512
4f2f67dee86af03dae15145649f5eb65cd158686381d26005b91aab89f017b692289050f0b1def00f8c2e724aedba4025db0baa6b55f76d402ded8006c48b38d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
850KB

MD5
ba4c1361b28211aa60691ded654976bb

SHA1
ae0f36f0e8cde5ebbcbce1ca4b5874347e953dcd

SHA256
25f75f720af38fce89417e553fe531523fc4ab9cea6d03089c7919725f83d97b

SHA512
05cd0c6501ec7b1c0743f6f65884deca893ca7379362e9804ef3b634156f1976a132769bc1b5bde3b661121be81cafe5b14f894734b1c26cbd1a25b991e8dbb2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
782KB

MD5
a429ea2e75bee699f552a35f4aaededd

SHA1
b1923b31279a175e9e0ad1aba274eb7f82d5138a

SHA256
2c2c8fa7b1751c5ef0b19e19255935b62f0102f52f2141b040517d4aa8ad8fa8

SHA512
9c5b7c93e821c8bd731d05ebb9d25c66fcdf8d62592eee6de41d358e0ef1bdfa2514ac91de91c813b3154cb0b5239bb80dbffbe2843ab7b997c33de51603e64f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
783KB

MD5
597e929a44b6346f14a59963a2a80f49

SHA1
ae24f52265c9274392d1614a196e41e07085fac5

SHA256
b04ca8acb3e3e560981a5989d8f8b117978fdfe60eada08f9138add897be57c4

SHA512
f242383a96c2dc957568a5c32357d82e24c683df908737d8043dc6b26ef4a708ef557970e8477f02bcc265a99d17e08b5f3bce752a5f6e4b5ee03746af34a7ad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
842KB

MD5
1697f766293ac719991d4eba6ad54d88

SHA1
44c145befa776a93e9bfcb8a35676ce6ef5d81b2

SHA256
d3cf4cdce02367139ea51c2d7c01ca85b03e180964ca2cd3213687b4100ddf9e

SHA512
e81c5630e5aaef55479195b3b5dc1ed1581b3763194182877a519aea3c244419a4b2edf4ebac24307f6e445edbf4fc15816f16ee88ecca520bb5534d2583ded7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
789KB

MD5
debe789fa3aa48f400df088884b9a95f

SHA1
866a1020da6a1f6c45352c8aea714048a5d7c73f

SHA256
150b4adfd979439700ad97cfe21ef1ee2619b023ff2ad9876e2e05bea1cc60c2

SHA512
2e8ba23636d60ac387fad45c98124a0c5f96d92aa3a39853604071d17790aa455bc0a70c467a520918453715fc27bf17d0ec957610ebb447507466a967fa67bf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
747KB

MD5
6e27bc83500b556f646f3ba9a6368dec

SHA1
6d4e9d8259e1956441ffb8668271fb19cd374726

SHA256
bff0fd2ca5dbbd40d0639643f1f46297a77c48e23bb38778f72dad91f413160f

SHA512
ce00d322084ecb3a5c23159231a2727cd6f19ecbf2958293e5689abb3933c2ba79f939edc151a93ce480b6eb26459005dc39fe3be4d2a5e33297f13ecaada992

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
174KB

MD5
8a11f6c0581a9518aaadf2d833910710

SHA1
2c5b517575198903263da3f4293f8414e798c1a9

SHA256
b6cd09ed7100f1f765b4d063595bd456b62f63b6eae588ea00a1558c1d84b693

SHA512
5db49847e0f7324e049a570cfa79e52ec90dd6395dc78ec6cfa4d2eb68bd7a0ae9b33d4f017038565902fcb046dd78a5d547b1963806c15bbccd7f3fd70aa8d0

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
565KB

MD5
651b90555c47da15774caaf0ab5a7c16

SHA1
91f398308e493d6308c342ea9d55bc68fa0ff316

SHA256
695330a9ea7e5d91563b4d2f393a9c2c950e174290e243df1bc7974007b17366

SHA512
749b03ac4f8bbba85d1c08ec7f3a6f35a7dad8b68f913f5d608432bea68e292bd2be6a8a988175b732bf81eadcb86dbfc7c68a7770a72910b51b9a6c2100446c

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.2MB

MD5
66be326f5082daae77839ca9f71d606b

SHA1
bdbc0bf695840356bada4e4269a6991bd0ba9704

SHA256
8c56421ef376256314aff255e1263f39faeffc44e52c608b276811034a53b682

SHA512
b34cba3a5ee7d4c5a3d6208d3a016f04c518ed9cd187314dbf36c48b6131f0779ddc8e159ead9c0a2302aa55eb8fda65355701683e96bbafd3eaefaad25c7053

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
776KB

MD5
1dfb6085a92bfa42e029eef22df2f987

SHA1
7ae99ed7cd7bc51ca4560e3574305c378d15fc11

SHA256
8e1bd9ac4895474a477a70f816bfc70682b1fb7f2b809006761e3c4dac71da91

SHA512
26e162e9e52d0d197b547fdcc5fa6d63829f2fc88a7496c378bb9aa8dba0c7b92b15ec04fa154cc7af70c397c05e10d78337f8ea43afa104bf3b132aab20af3c

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
2fe35aa24361ab900a2af8020b58025b

SHA1
2d4c75c9edb6da706cdca28705fbd5dc9ebc2f8a

SHA256
ffacdeacc2bb3cb50c9f8c442bf113806c2a551e98d86294f2c8344c4b12d16d

SHA512
fd0804943ea5bcd3b5309286aabb0a636fb0db61ec3849e32c4bfe1570c1ebc8bc04aed62d60928f0ecf55db09cf2ceb53a5e8482db9e28fd9e7a6bd92fafdf6

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
986KB

MD5
172502e30a600e51c01a7e50b21856c9

SHA1
ae6f4d6fe61cbbc0eeeed5168d8ac3b293260d1f

SHA256
22778b4d992e5653c012b3d332d7b6a0d7b7d2c338a11e5447a2cc9d74c56f3a

SHA512
4b2b0c833c778adc965a4231319296ccc2c5fdcc4325cf8f16711e2f656d059bbe410b2e39024f6df05d6b13efb6e01f14776f4b806b35d3e8a200b12b8351f7

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
385KB

MD5
4d2f24f4f5793d7a93a486850f6fbfd7

SHA1
cd50423cdf3a940d9245857431cb0618fec503a0

SHA256
298106cd5e2585471064a30885b0edc58e8d73ab7ede66931f1d1275d2e16a3e

SHA512
83e7f4c54bb2d3a30d4d8efda00e9034b96c092c4e5b23a00b7fcf7818242903e05d7c655c5e645e6fb1cec25276557524c5d778445862845872b1192408d7ba

Download Submit
C:\Windows\System32\Locator.exe

Filesize
431KB

MD5
6cfc94dd003a6029c2536a0c2531e135

SHA1
407c149d900129fdec2babe6cbf726558149f14d

SHA256
245196dfc244b210ed7a0054d6826bfdd76d342822687a2a2b6d1e9be0dc20b8

SHA512
c5d0e5c1f434d70704dddf1784c1103ee8070a5cc681755d801cc2a5c2d65cb255198c062564a20bb23c5cfe3dc552a5899879c1e9b6201bfd7e59772ff006c1

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
292KB

MD5
baad0dec9739ad3090c1d79b1c21bf35

SHA1
b3eb5475aeea1312c50c72be10224986f91eaf4d

SHA256
13bccf868486a6908bee0c0e4af26e3d171bc378e38a19334138b462faae9b4c

SHA512
aa1af21cf8a8a8eb1e4079fbff9afb6b23783006c13d759f966cfef2d621d7a1b14094a74411e08c08da3b2f535fa796b665109e39629bf93c424dfe5d2789dc

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
314KB

MD5
17e46a277a34324356720e386f898330

SHA1
098a3ba3bd270a7aec9f9e065a329707222290fc

SHA256
d3f5df87ad2ec3a366a8c947a9c81a23d8e72affdfa3c6ea5df81c8a8e3b90c6

SHA512
7d337f6d5d1d8ef17740b43e42572cc29c346894224855e594e7c917ee9ed266a7cc440cb922b1df80426956212ad1b25c178251e93ba63e5388cac6e6060b4b

Download Submit
C:\Windows\System32\alg.exe

Filesize
969KB

MD5
d5706fcfae7151ebe9414e7a00e987b4

SHA1
faacb0a4e1aa029ee6ca4d011240c486e6a9320f

SHA256
f83b4a4a33a94cb4c029091b37e43d3e9fc52aabefc452928e10ac87882143a0

SHA512
037c6d9181510f8079aec411e774fa1e79ff0fcaa250598fb5150e6e932345f1cd46288bdd182c0d6e6ad29fdf2a926cbccdd897364753dfb1da6ed417983774

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
164KB

MD5
486c727322c66207bbba1c88379be1d1

SHA1
2ecdbf076fc295b1f0ba37029adcff2824ae39c7

SHA256
c89fdd8d1656e2f718c678c1cbf67954bbbc82edb608459adeb00306b07c675b

SHA512
a1569a5ba34a987886b9f75f1596f5fc156f29671f644340842244d5aee6af96cfa589683e265fb677c4977b3e7f31d7e03894df6bf678edd87ad532c66adbc8

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
833KB

MD5
31b62a132332be3f0edc2be50f538cc1

SHA1
575c93079d6880ca1313159bf6b6263383f61f15

SHA256
34ef663411bb3ebdba1a69e1291b68d55c648f00deebbf0ed1034217c1420f4a

SHA512
e683c515aa665a374a5191388ac7133656f2e528813cb8821d6014a2447c76c5fd2f7266a9ea3920824772845119853bc23d408e04050d190d7f0ae571367d2f

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
513KB

MD5
6e701430d5b230ee4eae158c487f6c76

SHA1
fe0676ca221fbcbb1c8a4fe7f480b2e3646c6b85

SHA256
d8f6237d7989f1a587552323027f884842c387cce4421d7bfc78238d9e0d6afe

SHA512
fac54353d02f8843f6012f44129163b50f0557257cff6336174bf4dbefda3b770c7a7774675947bcd5839ed5519e94f8381ac87f723e6fdd882435ce13a2a2ee

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
597KB

MD5
65f8309223308fd6a863c7e41101d7ba

SHA1
37f991afed89cdfedbe6408138a33857b3100bb2

SHA256
dfa16d194cb3234ed613d835cb160a2b2aae6f7b0ebd1d853d800cd276383a02

SHA512
8d8d0baa71a0b0baa8ea4223e13869d2b330232529cc5af36444f8fb16b4d2eb3e0f2d28a4e6e183456e7437bb31949e9767577debfb15e8471266a95553cdc5

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
206KB

MD5
0959ec771fe6544ca2f9fc0bbb6d102e

SHA1
36db148b1cea5562057e6ecd6e8e716f6bff2d4a

SHA256
56a6ef8c56fe1d411bee4d9a89f59062b79fb8092d8135cafaecd167b002c272

SHA512
7e0ced29fd5b6a95af2eb9e1076458ad870f9b787edd2b9fd59181ffcf69bdeac8478174640caf999c3e42662ce5670745389e0ff23cb34306d2d16bd5304fca

Download Submit
C:\Windows\System32\vds.exe

Filesize
236KB

MD5
7a258779ee0f1956279b44edfd8e577c

SHA1
9a5ec133624962d19d8a1e8c967d0f0290294509

SHA256
3c95a594442b0573a2a3419dde4f9847fa68b92a391140eb3b692e200dfac8ab

SHA512
565344c4e224c6336d9fb0741057eb40e3e6073e23c215a5215ba572986ee8ac282706bfd7254722b883d1b63ea72004bcd0b56c3f88dd80254a8734ff5532e2

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
192KB

MD5
c72c66c29768763e1d978772969be7e4

SHA1
b0b23b6579ba31bb69dc3ef5d104e8c22494e0f0

SHA256
889c22f7f69eaa97f4b683060170082784cac52cd14932084c487f5d6823a5ba

SHA512
002e87cfb49570876be063b6d502f1155334e480133e6aed50bbc9e73e4540fb8d5517fa0dbebdcec7965a9f1b5a7f593f63f856ed2dde4069c7e3d53bccff66

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
186KB

MD5
57bc29877b36127b16a26a170dea0e10

SHA1
bdd4266e2fbfe6f85382c8bd3077f24c8c593c7b

SHA256
a530e1fd248a53155a0b178af496f7b9046565ca461ddc84f5a38bd45fd36b8e

SHA512
354ab35759264f837b0bf34f23312034284e64a4a77ee118f0d08b6146912f3c55332b532192f3d8eecd8d133ac5add8ab2dff8b879c5504121430c100b63c2b

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
703KB

MD5
74a9fdcfb69c2438e631b3d4b6c2b931

SHA1
ba785db0579ca1dd118022d150c4417302805c44

SHA256
e5ce3e9d475ff3ba0c17ca6d07ea6ff5405f15d73210eefacf6db2c71d602606

SHA512
668f9140286bba91889b1fb6fdfd179424d934b623e3b8209f251b82bb5592285066386097d5caa831d70136b4b49d9e740f98f058d07130a7d64757c7f34adc

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
783KB

MD5
544567d0e660f7fab88216dca8903abc

SHA1
b9adaacf1d8fe9615a00185efc9ef2ce59cbefc8

SHA256
a9f135873038cfd07458c47923f0366630e864d1bd3fa7f9b3efffc399b67d3a

SHA512
3e0c176344aefc04450fa40c19b6254a750b30a048c6c1ea168a70dcd47813bd61bd26532a17ce0b180c0c2087291c99118d920b89f7be07daddf9734f58d514

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
91KB

MD5
3bf090b3f1652273891723d790997027

SHA1
33f9194e8dbba8abf2866d5ef47e8328d9999e69

SHA256
06a1e50619214bd76f747bb7a8a79033757f19d60bbff4821ed8e453d635134d

SHA512
b6369f1359fa0aae042e8ec4b4a0000bc591b42a2500a70bb8496bd7d75785942708e7071a779d99710c57c83201477f8f30a51eda7f2ba6bf19a31d7b0d7d85

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
761KB

MD5
04c3c930de71a5a281071d1d0f4d81b9

SHA1
80c6dd94baa6a9c533f8517dc430402088e1f0f2

SHA256
602d210afc6ec65d6e5b018dd12e971cafdbefa218d1ba0c761f7be385a1de9a

SHA512
27adbffc6924f0b406e485941be71b6cb920a56ffab8bc9f2c15f9e71492eac86755968889149a6ba11d5ca6e5c438cec55e0787f188dad25e9ccc9f4cd68902

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
112KB

MD5
be1a96e3653745f2abe9190ee2df6aaa

SHA1
163fb6889b1751a12fb42860f74aec3f007d84dd

SHA256
f26217fa1cc1d346ad7bf6af484134dc4c87226d43f2817872655ccfa1de59bc

SHA512
1cf4e5bc12db68e74351aaf48ccdf03de55b47cab031bed7c435ae42bb6763703110dc2e4a933c6032ac4fa119236688bd8648cef6e9667ebc3a4bc32200b01b

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
276KB

MD5
12e6001b85eece72af2cc69b903f985d

SHA1
40f8924f14cc25ab2f79b31fbe5e38bf1737aec0

SHA256
586a04f8c370a1f35ce70f3d6f11169f6e5ae9e0e27f9bbb5f3be9d9ec80108d

SHA512
f2f984b37b990af6d84b753eed9bf4e3f42fc27ffd82971dede83deb6b649f273c770ad25c358d04d18e9a421c2bd8a168e67df528468a1df87d6b2d35623c98

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
772KB

MD5
8e0f765c6aad24e5bb9843e698e28ce5

SHA1
20c049022c84dba152c688f795054b487e4fc4a0

SHA256
84d02d8c93d177ea2f53ec90a33b49a4be8886b6cb83409898edf29e8c283fca

SHA512
4c5b7540c00e88e2a4e39299d66b54f9f460b645ef7999717c2c6c05bda611ca762d7e805723fc39413bb3dfe11b1fca354b65c1cbfc01e6013f964b87310de3

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.2MB

MD5
1f2c4e7e9316380abf987205a6c7c144

SHA1
e2876e7d0b6f9bcf7df1fb5a2a1aeeb11a5c9688

SHA256
7bcf95ce931eab3a36fac645489cc0f6d9391718395c07d2e2d2ec8a783a580a

SHA512
fe8ddbc37e20e2ac3bb91844151a4d56e54482f6bf82034721d647d0b022d6d8ec28fd75028cd7c181d4098c3fff0baae3bb154c1a4ccb65eea853e7e7795c38

Download Submit
\Windows\System32\Locator.exe

Filesize
413KB

MD5
2198b9093c8d4c3f924f435d1964f4a4

SHA1
b0b81a16ff20bba09e2e069eed24a55dd4ccff6f

SHA256
108f5da46f6a854260e0bf85003f0f1d7e5d25d91cb73a0b430f9a909d8bf6dc

SHA512
ed09c3222412b7a6c9134a71ad982e9587ab1c045a6ca42a5114d8b13140cc1552938af6d6f62a01fa677dde1db30b61467ece8d7bd4c3384fb994943082b9ee

Download Submit
\Windows\System32\alg.exe

Filesize
865KB

MD5
9bd6bb7dd460c10fdc55732af4aa8ac9

SHA1
1d000e22453183ea1c21b443c3c6bcea1fc547b5

SHA256
3b45eec23188b19b453e555c955c28be838edcece97cd08aa130d4b3e9ee54da

SHA512
d93f3bfb9a7d611145ffdc0719978a90afbd90a3a97245d9b919c2754a8f003055fe712bf5ffddcb2eebb07574330d5ecd4c1567160f5d8584f5d99fdd1cd937

Download Submit
\Windows\System32\dllhost.exe

Filesize
149KB

MD5
87a6fd7259f78b204a192e48301b11e7

SHA1
f780f7d1c52e30c91d2ddacd94ccf66d4c07e75b

SHA256
66f4b26d34643fcc87a65d0fa5ac78729979c3bf03ea723f254fe165a209c5da

SHA512
8fdd62b611a962e014720f45a2fec377f8a5159b2fb6ad90b03a539e9c9d7243be90d6e2813d490a621130e32f0d643e999a395ae05c4775182cfccbbae0a306

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
867KB

MD5
ba64837c47be697c5f26179a994d706f

SHA1
f18d82e3c95ac5455024553e1bf4d8149638c588

SHA256
a31e79e03486a4f8dfcc4883ca578da3df3b3923d755a4994bc723fb4152c150

SHA512
5196bd704f0fbb558e65864b36c48f60aa908f3e4fb13c54aaad9b477c49d6092f313e6db77bbc477987654c27a4312995dc2daaa08f73eb0fd1dde197c8f2ac

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.0MB

MD5
6769ce1ede4784da9082093928ee0f1f

SHA1
767ff2dec037d3a65e2562479f7cfc50389efdb0

SHA256
5350bd63112f2d7e3a359660b384dcdf8fb7b0dc1cdcb36bf677e7109c53a9a6

SHA512
3a8e93fb723cd975293a27c05118107d87e79c64762841e136b5a87742c4b0704c259e782b7ddeee016c184b0552afca9ac9c5f4bc844a1cd8284e71189da1f2

Download Submit
\Windows\System32\msiexec.exe

Filesize
335KB

MD5
4ba728972b1c31ffa269f6f1c11c7572

SHA1
d8774ae481a14ccbe290d8d087760fa5655c610b

SHA256
1b349f09948e8666d867effdd7ee78ea8f1eb71eda92741e4ce6b4a3ffc2b1ce

SHA512
7f4fb9ad1eead84dcbd7233e1b9fb7bdd74348e5fb1591f728ad12258b0d2bea1ba41d1654f03f319fc70df44ae41b7bacad9eb047db1971e19961b131c75467

Download Submit
\Windows\System32\msiexec.exe

Filesize
732KB

MD5
694f31947bf70b3d7fe39bb3e0a9ba58

SHA1
de5fa0b0958b1ca5b66ae8ce5b93de0f2ede5e5f

SHA256
f25ea8d39d727677d9b47b90b5f2f4d8ceb023e6a43ce0225862caf571308bb5

SHA512
f4780da47ae438121ed569e285da3f42bf8179fc8b662dc919d27271bd807b2069311521208c48f6f9d8f6c1da6c0efd6e7f8e735c9e7149c8930f5f7d6d44b8

Download Submit
\Windows\System32\snmptrap.exe

Filesize
179KB

MD5
62ea416bd61d56167b7b4218ea9eddb9

SHA1
b0d85d563732ee156cc405ea94f41f7d35ef1e98

SHA256
605c42f9c55e3277924388782d7c2040b23271582fbe3e5e4b0f59d884fe9615

SHA512
e0427c121e6798e9bf04b82aec2a2d2ef901bb006ce2abc3537c8513916ccd538f09ff13458aa44c4e5c81baddef96c3dc838aff1a15140a0e3c5dc743da7fb6

Download Submit
\Windows\System32\wbem\WmiApSrv.exe

Filesize
215KB

MD5
3e28021b22adf5d874b9bd56715dda9e

SHA1
fe81812bcbafbe828cee1dcbb11929dcc2392671

SHA256
299c81e40258e21bcdc5367ab2d069070cb450180494ccb035aacb58ed6f6a6c

SHA512
e782310280784caeefc8d9832345457a1f3aa08186dee0cd686899604d086872f5825c3eef3f34924a7a27e0d4b6f8ea9b6433be9c725a4066d6b1995bd2dbfc

Download Submit
\Windows\System32\wbengine.exe

Filesize
119KB

MD5
71f44dac018061cb439dd07ecf63d4ae

SHA1
1b01a5b2d98a0b3dff4c1a7c2342228bcb2e74cc

SHA256
8dab1363ed1a9b2afd775fe5cb25430abc61c0f56bbba2639a8733cfaf80008e

SHA512
7eead03070bc7fccd0a78c375755d2b9a43416da984ba80a359dc5b9a2903d7504a55c6de37590804962d837cdf54657b575f722a487345fcf5488566f36ec0c

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
e0ee80035bbdd4658286d3da0fe57d91

SHA1
47ef76fb6858df8ec408dfa1c58b9f76e69cfdf2

SHA256
42333a4ae48d1b21d4344d81e38e4890b5fa7a5d1f59a1a99ba4d7f7b934e1ae

SHA512
f4a27bc540ee8fbfa88444df72bf311288d2959e2b4e4a160fab65e0cd5615c9771d5a4086abcab417704f336bdc67ece987de439c90dff19ec58852e8e36111

Download Submit
\Windows\ehome\ehsched.exe

Filesize
1.2MB

MD5
047de05ea6af642524bad62a5b9776d1

SHA1
fa921087969329dfb472b2a8d30d18b23f4c6642

SHA256
bf6225bac5c51de324c8012892dfe8e057a895a03cfe610eaceb83a5cbc16514

SHA512
89014db6a751035316cc4249a3f02a76d4429858a707a1e34efbe034625c2e087d87b756f7b716eaefb5442a36703d74fce706afb99cbaba0bada3c58819a9f7

Download Submit
memory/448-186-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/448-246-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/448-180-0x00000000001E0000-0x0000000000240000-memory.dmp

Filesize
384KB

Download
memory/448-188-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/536-167-0x0000000140000000-0x0000000140153000-memory.dmp

Filesize
1.3MB

Download
memory/536-173-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/536-230-0x0000000140000000-0x0000000140153000-memory.dmp

Filesize
1.3MB

Download
memory/536-166-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/900-232-0x0000000000FB0000-0x0000000001010000-memory.dmp

Filesize
384KB

Download
memory/900-252-0x0000000140000000-0x000000014016B000-memory.dmp

Filesize
1.4MB

Download
memory/900-223-0x0000000140000000-0x000000014016B000-memory.dmp

Filesize
1.4MB

Download
memory/900-253-0x0000000000FB0000-0x0000000001010000-memory.dmp

Filesize
384KB

Download
memory/1164-41-0x0000000000910000-0x0000000000970000-memory.dmp

Filesize
384KB

Download
memory/1164-13-0x0000000000910000-0x0000000000970000-memory.dmp

Filesize
384KB

Download
memory/1164-14-0x0000000100000000-0x0000000100145000-memory.dmp

Filesize
1.3MB

Download
memory/1164-160-0x0000000100000000-0x0000000100145000-memory.dmp

Filesize
1.3MB

Download
memory/1164-42-0x0000000000910000-0x0000000000970000-memory.dmp

Filesize
384KB

Download
memory/1344-114-0x0000000010000000-0x0000000010148000-memory.dmp

Filesize
1.3MB

Download
memory/1344-139-0x0000000010000000-0x0000000010148000-memory.dmp

Filesize
1.3MB

Download
memory/1364-328-0x0000000100000000-0x0000000100137000-memory.dmp

Filesize
1.2MB

Download
memory/1364-335-0x0000000000350000-0x00000000003B0000-memory.dmp

Filesize
384KB

Download
memory/1456-274-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1456-214-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1456-216-0x00000000002E0000-0x0000000000347000-memory.dmp

Filesize
412KB

Download
memory/1592-143-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/1616-313-0x0000000100000000-0x0000000100136000-memory.dmp

Filesize
1.2MB

Download
memory/1616-321-0x0000000000250000-0x00000000002B0000-memory.dmp

Filesize
384KB

Download
memory/1660-294-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1660-347-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1660-291-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/1660-292-0x0000000000360000-0x00000000003C0000-memory.dmp

Filesize
384KB

Download
memory/1660-296-0x0000000073F08000-0x0000000073F1D000-memory.dmp

Filesize
84KB

Download
memory/1660-352-0x0000000073F08000-0x0000000073F1D000-memory.dmp

Filesize
84KB

Download
memory/1716-239-0x0000000140000000-0x0000000140157000-memory.dmp

Filesize
1.3MB

Download
memory/1716-248-0x0000000000840000-0x00000000008A0000-memory.dmp

Filesize
384KB

Download
memory/1716-307-0x0000000140000000-0x0000000140157000-memory.dmp

Filesize
1.3MB

Download
memory/1916-293-0x0000000000CD0000-0x0000000000D50000-memory.dmp

Filesize
512KB

Download
memory/1916-203-0x000007FEF46A0000-0x000007FEF503D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-263-0x000007FEF46A0000-0x000007FEF503D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-271-0x0000000000CD0000-0x0000000000D50000-memory.dmp

Filesize
512KB

Download
memory/1916-204-0x0000000000CD0000-0x0000000000D50000-memory.dmp

Filesize
512KB

Download
memory/1916-206-0x000007FEF46A0000-0x000007FEF503D000-memory.dmp

Filesize
9.6MB

Download
memory/1916-220-0x0000000000CD0000-0x0000000000D50000-memory.dmp

Filesize
512KB

Download
memory/2032-200-0x0000000000870000-0x00000000008D0000-memory.dmp

Filesize
384KB

Download
memory/2032-192-0x0000000000870000-0x00000000008D0000-memory.dmp

Filesize
384KB

Download
memory/2032-199-0x0000000000870000-0x00000000008D0000-memory.dmp

Filesize
384KB

Download
memory/2032-259-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/2032-193-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/2092-219-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2092-152-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2092-158-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Filesize
384KB

Download
memory/2092-175-0x0000000001A30000-0x0000000001A31000-memory.dmp

Filesize
4KB

Download
memory/2092-237-0x0000000001A30000-0x0000000001A31000-memory.dmp

Filesize
4KB

Download
memory/2092-163-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/2092-162-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

Filesize
64KB

Download
memory/2092-151-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Filesize
384KB

Download
memory/2124-6-0x0000000000740000-0x00000000007A7000-memory.dmp

Filesize
412KB

Download
memory/2124-142-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2124-7-0x0000000000740000-0x00000000007A7000-memory.dmp

Filesize
412KB

Download
memory/2124-1-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2124-0-0x0000000000740000-0x00000000007A7000-memory.dmp

Filesize
412KB

Download
memory/2136-95-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2136-174-0x0000000140000000-0x000000014013E000-memory.dmp

Filesize
1.2MB

Download
memory/2640-99-0x0000000000450000-0x00000000004B7000-memory.dmp

Filesize
412KB

Download
memory/2640-124-0x0000000010000000-0x0000000010140000-memory.dmp

Filesize
1.2MB

Download
memory/2640-98-0x0000000010000000-0x0000000010140000-memory.dmp

Filesize
1.2MB

Download
memory/2640-104-0x0000000000450000-0x00000000004B7000-memory.dmp

Filesize
412KB

Download
memory/2644-354-0x0000000100000000-0x0000000100219000-memory.dmp

Filesize
2.1MB

Download
memory/2712-132-0x0000000000770000-0x00000000007D7000-memory.dmp

Filesize
412KB

Download
memory/2712-127-0x0000000000770000-0x00000000007D7000-memory.dmp

Filesize
412KB

Download
memory/2712-202-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2712-126-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/2756-308-0x0000000000170000-0x00000000001D7000-memory.dmp

Filesize
412KB

Download
memory/2756-299-0x0000000001000000-0x0000000001137000-memory.dmp

Filesize
1.2MB

Download
memory/2920-280-0x000000002E000000-0x000000002E156000-memory.dmp

Filesize
1.3MB

Download
memory/2996-348-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Filesize
384KB

Download
memory/2996-339-0x0000000100000000-0x00000001001B5000-memory.dmp

Filesize
1.7MB

Download
memory/3008-311-0x0000000100000000-0x0000000100153000-memory.dmp

Filesize
1.3MB

Download
memory/3008-325-0x0000000000510000-0x0000000000663000-memory.dmp

Filesize
1.3MB

Download
memory/3008-275-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/3008-265-0x0000000000510000-0x0000000000663000-memory.dmp

Filesize
1.3MB

Download
memory/3008-261-0x0000000100000000-0x0000000100153000-memory.dmp

Filesize
1.3MB

Download