d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
Size

1.8MB
MD5

4fd4390c3c4452e6c6a00f61bee42f44
SHA1

c0536cf9790be7ccd3171bbf4b09cf4def4a3af3
SHA256

d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc
SHA512

2c61d8404eeaed368da73bba59ec627333ec0f4b34325173bf9eeb55d99eec1bdfae765146104697a42a8fd18a62d411a395acbaa3f9cea59c761092a4ef3bea
SSDEEP

49152:Fx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAMiLlBUKubZrX+ld:FvbjVkjjCAzJriBSTZL+ld

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 33 IoCs

pid	Process
476	Process not Found
2532	alg.exe
2544	aspnet_state.exe
2464	mscorsvw.exe
2228	mscorsvw.exe
2648	mscorsvw.exe
1912	mscorsvw.exe
1872	dllhost.exe
820	ehRecvr.exe
2176	ehsched.exe
2940	mscorsvw.exe
2180	elevation_service.exe
2076	IEEtwCollector.exe
1400	GROOVE.EXE
2728	msdtc.exe
2676	msiexec.exe
1204	OSE.EXE
1716	perfhost.exe
1984	mscorsvw.exe
1128	snmptrap.exe
2132	vds.exe
1964	vssvc.exe
2508	wbengine.exe
1464	WmiApSrv.exe
1408	wmpnetwk.exe
2940	SearchIndexer.exe
1452	mscorsvw.exe
912	mscorsvw.exe
880	mscorsvw.exe
2176	mscorsvw.exe
1192	mscorsvw.exe
2624	mscorsvw.exe
1940	mscorsvw.exe

Loads dropped DLL 14 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
2676	msiexec.exe
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
752	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\locator.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\System32\vds.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8e79e7e4501ed38.bin	alg.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\System32\alg.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{A460FDBD-01C6-4800-8EDB-C87720E1D9B6}\chrome_installer.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe

Drops file in Windows directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	alg.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{CBB4695C-479D-44B3-9739-3D3CFA045A03}.crmlog	dllhost.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{CBB4695C-479D-44B3-9739-3D3CFA045A03}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{DB2A1898-0568-42CB-BD1E-55F5A6E65296}	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{DB2A1898-0568-42CB-BD1E-55F5A6E65296}	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1900	ehRec.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: 33	1972	EhTray.exe
Token: SeIncBasePriorityPrivilege	1972	EhTray.exe
Token: SeDebugPrivilege	1900	ehRec.exe
Token: SeRestorePrivilege	2676	msiexec.exe
Token: SeTakeOwnershipPrivilege	2676	msiexec.exe
Token: SeSecurityPrivilege	2676	msiexec.exe
Token: 33	1972	EhTray.exe
Token: SeIncBasePriorityPrivilege	1972	EhTray.exe
Token: SeBackupPrivilege	1964	vssvc.exe
Token: SeRestorePrivilege	1964	vssvc.exe
Token: SeAuditPrivilege	1964	vssvc.exe
Token: SeBackupPrivilege	2508	wbengine.exe
Token: SeRestorePrivilege	2508	wbengine.exe
Token: SeSecurityPrivilege	2508	wbengine.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: 33	1408	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	1408	wmpnetwk.exe
Token: SeManageVolumePrivilege	2940	SearchIndexer.exe
Token: 33	2940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2940	SearchIndexer.exe
Token: SeDebugPrivilege	3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
Token: SeDebugPrivilege	3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
Token: SeDebugPrivilege	3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
Token: SeDebugPrivilege	3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
Token: SeDebugPrivilege	3004	d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeDebugPrivilege	2532	alg.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe
Token: SeShutdownPrivilege	1912	mscorsvw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1972	EhTray.exe
1972	EhTray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1972	EhTray.exe
1972	EhTray.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2960	SearchProtocolHost.exe
2960	SearchProtocolHost.exe
2960	SearchProtocolHost.exe
2960	SearchProtocolHost.exe
2960	SearchProtocolHost.exe
1948	SearchProtocolHost.exe
1948	SearchProtocolHost.exe
1948	SearchProtocolHost.exe
2960	SearchProtocolHost.exe
1948	SearchProtocolHost.exe
1948	SearchProtocolHost.exe
1948	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2940	1912	mscorsvw.exe	37
PID 1912 wrote to memory of 2940	1912	mscorsvw.exe	37
PID 1912 wrote to memory of 2940	1912	mscorsvw.exe	37
PID 1912 wrote to memory of 1984	1912	mscorsvw.exe	50
PID 1912 wrote to memory of 1984	1912	mscorsvw.exe	50
PID 1912 wrote to memory of 1984	1912	mscorsvw.exe	50
PID 2648 wrote to memory of 1452	2648	mscorsvw.exe	60
PID 2648 wrote to memory of 1452	2648	mscorsvw.exe	60
PID 2648 wrote to memory of 1452	2648	mscorsvw.exe	60
PID 2648 wrote to memory of 1452	2648	mscorsvw.exe	60
PID 2648 wrote to memory of 912	2648	mscorsvw.exe	61
PID 2648 wrote to memory of 912	2648	mscorsvw.exe	61
PID 2648 wrote to memory of 912	2648	mscorsvw.exe	61
PID 2648 wrote to memory of 912	2648	mscorsvw.exe	61
PID 2940 wrote to memory of 2960	2940	SearchIndexer.exe	62
PID 2940 wrote to memory of 2960	2940	SearchIndexer.exe	62
PID 2940 wrote to memory of 2960	2940	SearchIndexer.exe	62
PID 2648 wrote to memory of 880	2648	mscorsvw.exe	63
PID 2648 wrote to memory of 880	2648	mscorsvw.exe	63
PID 2648 wrote to memory of 880	2648	mscorsvw.exe	63
PID 2648 wrote to memory of 880	2648	mscorsvw.exe	63
PID 2940 wrote to memory of 2036	2940	SearchIndexer.exe	64
PID 2940 wrote to memory of 2036	2940	SearchIndexer.exe	64
PID 2940 wrote to memory of 2036	2940	SearchIndexer.exe	64
PID 2648 wrote to memory of 2176	2648	mscorsvw.exe	65
PID 2648 wrote to memory of 2176	2648	mscorsvw.exe	65
PID 2648 wrote to memory of 2176	2648	mscorsvw.exe	65
PID 2648 wrote to memory of 2176	2648	mscorsvw.exe	65
PID 2940 wrote to memory of 1948	2940	SearchIndexer.exe	66
PID 2940 wrote to memory of 1948	2940	SearchIndexer.exe	66
PID 2940 wrote to memory of 1948	2940	SearchIndexer.exe	66
PID 2648 wrote to memory of 1192	2648	mscorsvw.exe	67
PID 2648 wrote to memory of 1192	2648	mscorsvw.exe	67
PID 2648 wrote to memory of 1192	2648	mscorsvw.exe	67
PID 2648 wrote to memory of 1192	2648	mscorsvw.exe	67
PID 2648 wrote to memory of 2624	2648	mscorsvw.exe	68
PID 2648 wrote to memory of 2624	2648	mscorsvw.exe	68
PID 2648 wrote to memory of 2624	2648	mscorsvw.exe	68
PID 2648 wrote to memory of 2624	2648	mscorsvw.exe	68
PID 2648 wrote to memory of 1940	2648	mscorsvw.exe	69
PID 2648 wrote to memory of 1940	2648	mscorsvw.exe	69
PID 2648 wrote to memory of 1940	2648	mscorsvw.exe	69
PID 2648 wrote to memory of 1940	2648	mscorsvw.exe	69

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe
"C:\Users\Admin\AppData\Local\Temp\d711743d0c61b47b8eddf727d615a3069ef97474a6501753374c85778d71bacc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2464

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1dc -NGENProcess 1e0 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 258 -NGENProcess 244 -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 240 -NGENProcess 24c -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 258 -NGENProcess 1ac -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 240 -NGENProcess 270 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1940

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 244 -NGENProcess 22c -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1984

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1872

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:820

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:2176

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1972

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2076

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
PID:3056

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2728

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1716

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1492

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1464

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2960
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2036
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.3MB

MD5
6eaf3926e96dab841bb779c88069e764

SHA1
c14de3d3acda6c62b850a42427c70d941fe3c155

SHA256
72d0b43665993ab90ebc068c4b1bac29df417aa21a75f78b8852b991902ad747

SHA512
da48f9a7482ef6429391c026cb29bf498f5fc87d0668404a70ae6af5f5c586585c56b9d97e0ecb8cb962e5546727a500a4b499c6c5966062f5dd0a268aefddf9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
2.4MB

MD5
9328b135d53a3f2fcd21ef107f7404ca

SHA1
2a1e1d231bcfb7cb036633503151ed9aa22834c9

SHA256
39a8ef0be7c8537f8d572cd038737075e60dc3297a53947877ee8d8947a5eb4c

SHA512
39f62026bad1a3a057e3988fd14ee5df2d69a554871e81c02a014b28741ed6f91860be0e2f47b2e100daad52020393a8b581260a9cb93428b967d84f0d49b63c

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
1.7MB

MD5
66743c1ad4d0f91a4095554da7bbed4e

SHA1
3b4f6a40c6cd425927782ccbd2b2fd1a2e1d6ba4

SHA256
d49fbdb747632be01f3a89faaad4cf3bb25a60d1e5ffa310906c463094c043f8

SHA512
5d5795b77aa7600b540e9f125f9cda217c59e85c1e9667c874a0179ca8066abd16cafdabc9eb42969f46db8414febb16fc54268e8177f8f5851290e01066bfd0

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe

Filesize
1.6MB

MD5
f0f3ab1582e4cd8191917424aae3e1ef

SHA1
d8a23ec21942f7b9c03cb48f90a6d58794b75851

SHA256
3a89f3896421ec303ba1562f7fa273d95bc913e604bc0f5c55f30fe8cff26b3e

SHA512
78e6fccd479dc93e147a229073913f74c68bf0a45946e99ac64f0bef56ee079e01543a391d4c3b305c42055ffc1fb609d451151914f64bcd9ee22babf3d2841b

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
1.8MB

MD5
d85eb34312fa408d983bc15d90324d44

SHA1
d42e7ed5a34e116058f7721bd8264447e6170540

SHA256
b3bc189af38a9a3dcafc79be5121a09266178087ee5c952edaffff7a889bfced

SHA512
844a262602deba22531f29b35be1344a3ce17aab7924efea70c5903e5b7ffcdc29d6dfb3fb662f8617d0c7f42e506b1214f835dddd03893f8303e887451a1e89

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
ceab8c5b98d1f02aafe65679dc3c7682

SHA1
87c5ba6b6d218b66dd15387e6b43e493db379e55

SHA256
c41a1eea455691d9653ba9ce1179c927c03f2fb156ab18052b80f38f657896ff

SHA512
274f48175d94bcb4fe7768878fc3e6b9d4ecdf47b2fe8b1184a36ce067efb10a9127c6d4bbc0ddb6304382f003528d3683640d808131b4dd00ff8f4bfbb1feaa

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.5MB

MD5
aaf5ffd3d0d4e6402bb93272ab5417c3

SHA1
83cbbc1f9f34e15c9cbb8fed4d7aae91a56b5e17

SHA256
b033f5d19b0b2a2c45c52da9fcc2392be3740ae9c169e14a033b1e0c9cbf55da

SHA512
d46434129738880f275cd1c88e3709bee542ad7f4c82de38c0d6586819535ae5c32926e6a705571147063a569da7f075f39fa83ad890bd250325b77459318e7e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe

Filesize
1.2MB

MD5
acf1b1ce5f6bb7e298308aa9d5ba12cc

SHA1
1c6b39b5daa7457e327f333ee22ae3ee470a176f

SHA256
0db2f7dad51c94d9c58f2883dfaac37b0ee7fffdce2d06ce8c10c16230eb4666

SHA512
821ce5ded65e0d2972571cb07703087615e9bd5ac5981debc806a290836f3f4014a70c4642e225e2351444011bee57f7630bdabdf247e8ac27b98612fdc24fcd

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe

Filesize
1.2MB

MD5
55e3c4965e8a97537f136cd697fbc5dc

SHA1
122348f65a106bec55295d55dc764db65ef8baa4

SHA256
19cb5132ffb1639244a1c27e31ef3fc90d94f042f855bb18322cd2f2f28d1faa

SHA512
e8881f80db75df191c728a03b7223954c08839fa64fcefe284225fe1d920a4e96f6d4486b75ec7dece155bca4b50222a99e090aa47f84423e9d34031c8f8622e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe

Filesize
1.2MB

MD5
9ad3894900af2098a069944e02c6298c

SHA1
e066c68b1e2e8575b12a7087088802b59cfc3b47

SHA256
9e131555240151154266a8f1ccec94ba0e9ae2f739d907b5360937c005360ca2

SHA512
365b984b8d31760afcd8bd9977c9b8f8f5d9eaf71696bda538ad4b6c5b527d07c9d09168dc7ea880c3a84eb530c9986fd8b893c8917e4c5415d2171b8fd2e18a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe

Filesize
1.2MB

MD5
3d8cacfeccce632ed7b323a544abba11

SHA1
2e72139bb7c2be08129365c2c3555ff3ca70343d

SHA256
e7e303e9c899aad9019b456a6a569124bec94c19f34c258813aa3f3629724960

SHA512
8379a6373c81ad8046b9b3a525087d91b8580981cd0f34e34bb9a4ce29ad6b4f5f64c8143f8aadc0be5f2d1f91fcd5cb2495cef890f170761c58e47610667dae

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe

Filesize
1.2MB

MD5
ae9b1008ee06aabe2cb6e3131298d2fe

SHA1
5055c072b1f93eac3c059c4499f48a91990eff75

SHA256
cc36f8d2b8e4c6d44264113839b27b092e491386ed841a2c1c6d53756b9ffa5e

SHA512
55471e976609ebda1d973e46cfb0caf8d75654653765445028c690ed76dd915675fb129da1c3788f123b3485bbaae162ded1614b6b8864207ffda62ee96adace

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

Filesize
1.4MB

MD5
a06ab0a5347e652f843185336bc6d6b9

SHA1
3107646ca1fd2b6d58a1f0ec1a11127974e6171d

SHA256
6a46da216b389fbbd76b394c3b29b209b82d183cfa461afbaeaa7418ac345ad6

SHA512
04dc3cb0040aee5b5d02a94070421cb7b894dffcb619c2a83d5361c46ce7a700ada1dfc9244540206a360f8370e4442190d4aa01b78a7fea6dd9e1209fbff5e4

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.6MB

MD5
1c8c987c8075e39df3bab4118f6f5f04

SHA1
e0267ccd7f00e1b07fb8680b6ed46e9d87768898

SHA256
5e6663b621840bd784f724431ad5a54f30822fc17a274c07ec077303123d585d

SHA512
4676114c99ff35939f2394f1936b4d24b2154dd2af45511a0e98220442b2bde04ce11744a40e0564b1e84061f12334352882335cae3ef99fa8762a9fc62e12f3

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
960KB

MD5
59dbcc92c06fc90a3ef98195ee5a85cf

SHA1
8d9dc7e64f35b7b487e2c9195a7960234fd9946a

SHA256
235ae16485f363c9b904f02bc0120116bbc2a067130191a2e796fb0b965cbcfa

SHA512
a04c318fff29dd44d5da3a151323c9adea8612cb92724f390ddba4458a476e13956e27fbbb3b9e5c07812a2bfe96db1bcd4b642de096af3a7072da9d92ee8338

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
2e575a5bca015e6cf49be382e7e5eb4c

SHA1
59973e34e901fc18ce5f221586231e48baa80c43

SHA256
7d6362c542677fd2df578fecc93807d655f81077e70c973ddfe2fa6d75220084

SHA512
6ef729f865b4f68075fa7c1c429a2e3fe760369bba28dbfc1611dc7327645c1ad58b860f65192c8b31f64b3743199a4d356942b2595b7167311f210bb869170b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
a4caaa5c8eac25c4e31e050e3e8e88c0

SHA1
d539518c9df72f333555eec43944db323b5f9d67

SHA256
51a5174ae5724eb7e942abadacd838041950999c925386be4d96ca0cc9ba5495

SHA512
94c9b7d62f107df491899bd86df6849fb4a1ddb7b0a07663c84b76caeb00686732b4d752612034e219972b2e7fe744c9c60af6d944a9475f5052695fe8653b69

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.2MB

MD5
843772376762fc7fddea6cefee2cd0e9

SHA1
9da46c33fd0b26d50a78a51459758751f05b780d

SHA256
6b4410de268f7d3e4f786ea89bbb3b7bc2a59947c1195e28a8a964d65b1f535e

SHA512
a881c479da8d963077b05225b062df3e6eccfdbe327dff0df8a01500966845cbcb953a3f91ae15c3ed96ca1267ca0a7b0082f99d4a4314ccf4f4f4af5ba957fb

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
ba77bc5f218b25a5dc1deb39abac65dc

SHA1
6b08cddfe7057bf424f80243e2f78254b86dee04

SHA256
f2851ddfeb7eb47996a1059152b87476fbb279beb3e4d76a171de7983f0360b7

SHA512
37ebcb9e3310f9d1a1a46dcf0109e8111ad204fce2bd218c9352fb8529005decaa49606763952879a66d0cb6da9934dacec9c3133914d005c530c37d3b24fd8a

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
384KB

MD5
d68aff7a925babf68237d05f625131ed

SHA1
e32405932687f2be5559dba96eeae1d0e540c309

SHA256
a9ce7091185dff97ee7c382d67b98b7f2808d65db0d8a06dedf92898f78c84bf

SHA512
e0939ac152a1fc94bc3cb81f93d1570ad643e03122bc9a214e8fe4ced3890e1abda4229f5d5a3a798fde731509e8651b79ff811c7b1a9bfb792af00dd74a64fc

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
19564c29d8da979b38f22b716ecde7ac

SHA1
11f8561b15033d2078665e82feb86ed7ecb97080

SHA256
65b118f185d4243ccf031813e0853004a149d1148b909f1748c8444776d89584

SHA512
d54df439428887db0854c1498808c1c0305f4609366e748335d322ff2bfcac75a145e093ea0ee92ca1a3e340e92078a9f68d21b49e07266120a7ccaff1eeeb62

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
64KB

MD5
06b8c38f75e9f2fe73080253464add18

SHA1
58159e9ba076d8624d07609e48770dc0c46d639c

SHA256
7a8f3d74b936cae7cf2808495f94e2c18fcf280b4e8b771d77c6002d7713737d

SHA512
adeeeaa2a69768e7ff8dc364e9c960cd1f735e84c5272fcea4c4f1576def2a765a4772996ce9d61737a54eae7d764f6e86f3b442757c064bb7c43673e4aaf175

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
aaa4ab3a0797d80054ec2508fd0e3f1a

SHA1
d93ff1fc2b7b169e14d534d6ea77b001888cf1f7

SHA256
bcac406a26ae0ffa531285b80b4b8d5f17651db42c295c805452e206ab480347

SHA512
d4837745d92741d81d07d49eb7aefef4012ef0769ad8cc7acff648efae3c1a030896a2e3c71a314939c949d140e9cf258898526da164d0bce1ddd94acd67772e

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.1MB

MD5
baecfcd1259bc468c820eefca5e5f997

SHA1
bbffc1e867a81c1b6274dd0da84772f5184b982c

SHA256
cfbe8179eb4100824808bec73008096fcd9d505f6a1ab55429b4be1c8f916a90

SHA512
7d422d37f0e0257fae822d0899ac76e47aa3057a6536385f2315d5e450ba58bfaae3a35ac4e96a11e247db95eae6b927b31058e3ab713e3aa57c887e4eb0c990

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.1MB

MD5
a6ddc9d02d7f9ff88a942c80032bfb42

SHA1
9ef42c91b78c758686ad975622bb6a551a39d414

SHA256
0147a9de52951f5644937c81c63dfa6a668ebde8b482217d95b2e06f1da6a780

SHA512
a4abfb6bd3ee333280f5ac7dc5e13b9298c51dc9e9bfc9d5ff5f062cd89a3565cd154d6d0a16fa3b3ffb006f15f1573c2a71ba37510c237f542fea9d6ff4cfc3

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
e82bad756a5f8785132b2ef3558d982a

SHA1
11e5a614b8080614035e161236a526eafa7d1597

SHA256
3eb0e863339cd2b0bc06dbacd8a84c330484563ffcb184c5ecdc789459efbb47

SHA512
d03e32959d4efb2370864cdd523503e3e3fe60a0227fcbd9cb8145c108f7ba5654a7d76658cd89c137ee32bc4c0b66eb82cde9f60044aa5255a95e69d458f6a5

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.2MB

MD5
a707c42c8e6cb7ce50e2f520743888cb

SHA1
bd62c5fb1267926fd606c56a081e19ffcdb4483b

SHA256
18e40b270873020d2f2e2414842b1934dace7f9b840bf4a0a02e766b3d8d3b5f

SHA512
4e7024ffc84b0c0a7310d130bcdf4600def5333f75b7a1d6c7240257797d425925daf9803818c2c6abf5ba289dd71e0e8c1d8c1b829e3b4e10df0735100b221b

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
3a1e4b31d387208d08a49aea837039ac

SHA1
1b9e9ae450a0eccc7b4fe71ae5ac3a75d31d8344

SHA256
1278ebbf54720d87a8963761219db0c66c15dba5967d85d98ca36c893dd73fb0

SHA512
fafa1ec590897703e668028c8bf74e82a904d0034cdd2c08d57d3e3a93d28cb8b4571e81d58a683bb5cf8e3bf3f76846c83f00bdec32d62fec92000e7b6ec762

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.7MB

MD5
a75ee47346b38210e818a38200b071c8

SHA1
e6728fbf8f423e1b9799f717834643b30f01aabb

SHA256
9e89131f0f8baf6f3f9acad290568dfe4ac7fb142e93cff81a443f791cb82e4f

SHA512
31dd1ae2358fad5fb5feb9a00b114910c5ff4607805ace95911ca10a7e49198a7b24b8b023edf2f20eb72abdcb4fdf2d498c11b5b431f93b1795dbd82fdd2bee

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
256KB

MD5
cb4d3383013480f40270e6e284e063cf

SHA1
72921a05fc89d48c49ccab44331c364e7b51bd09

SHA256
f2e48ca917fd555c834f99291d99779ad33d8cf4293a65fddfe4aa2e64e95fa1

SHA512
2a85dcc681af7002ae0ddc61b53d922a382a00619f85988226f7840d25b168683db82cdcfba76431b66f9816e111efa1ca2f166450ec96b59569067ed0d9bcfb

Download Submit
C:\Windows\ehome\ehRecvr.exe

Filesize
1.2MB

MD5
96a3a93efede0f205ae123f1f96b33a5

SHA1
a3c7b53a51b4292e1c07675776ef4fe73c2586b1

SHA256
c355406e2899e6770d783c5f589f51488297a5c769a9898d6538b3a32ebdc2fb

SHA512
673435150d939b69dedde8f5f26c9adf28fb712d4975b4ec46cce5641464c186b0b56d4105f873933f9e882a52d31bb0e049659fcd0483239ee56dbe43376839

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
768KB

MD5
8408ec0507ced150cbf2943b06215084

SHA1
f3f790418d2e89629046c14f30b31b84f31d5abf

SHA256
2b47095d78c3bfd4cb64849dd751a378b96df524c8f9d3b0b558ede569379b18

SHA512
4af8a05ed89df086c834fac0f142e99282b09d157aeb5c61d98582a7310d03c96bfa82c3641ff9969ba84fd413bd414fcda51429fb826f8a79ab73b6debfe359

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
128KB

MD5
5f33ce577af246aa9fc7e1dd8a3e42ed

SHA1
d0249f1a425dd56d6e8559ab42781148805800df

SHA256
7d78fdaf3fc5b4611f4089e540a64d74a77fb1ba3e2338619357fd286372934d

SHA512
e8280df5a2db8e11f8d64b715f4b02368f7330495e2a392a65117ff27ccb969290e385d00e654f719ab184bdd90e08c63c9f127ccdfff5b162a6336a80321bd6

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
f33bb8610fe6c24dbe91db086aba4e91

SHA1
e631e179f742517712d74dc8b6b5632651ac4e1b

SHA256
57f207b2ae03b96b1c7c8feb7927f61a9a073170a70197e6a1c4fad193a001a8

SHA512
a731da00423f1d7f12d384f17596e065cc77f36c180e5d200b785b2ba80b30cfc967612a2746a9ffd8d01334a291292fa03deee067a37fc01ec2db4111f4fea9

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
573090c4a0e36cae000269e9dfa8dfac

SHA1
23cf3cf090c59b35ac357d7488152ddde3d85067

SHA256
91adf072f2f87f7726b37aac7afcdfcb97c988a2345eec7bf5c03cc3d318afb7

SHA512
3bf56264907c326755b0e1a0df0ccffbe2ce39abd07d4a41ae344d5e46d3ca9661135b5ee0830004e53c7dca3094ad1d1fccfa8328cdd39e2c1f488abed1df45

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
1.7MB

MD5
5aeeb51b04e390e0953ea088dcdf5249

SHA1
cd9b9340e6024ce1bc93b391899f58da8534d75f

SHA256
b41a5f668961bb95f76d25b64605537e3c0cc16a7578e3c2087ac0ddcee7e7e1

SHA512
01c93670320266450dcbbad5289767aba0171eee0cbe1df2607b88d4728803f33351e315b212660ed76958ad7986e79d36264af5da00bacf7158c3f9728c5833

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
0f3e262e0a6a71b6a6d8c0f66b93fe15

SHA1
1dc8696d909425578deff81f9985365afad0aa39

SHA256
a8c83876b208f40d8616a668a4fe8e9e3d65f41eba8ba46c0e14117d187c2b8e

SHA512
4c20d27709f5c77161ad8d33fbc3726f1beebb0dce79696b390a4c5964caa4735059232b5def7af764b3528042ee2dc0148f36c8fe9d4f3ddf133cd816673cb2

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
01655a190e9fd4701812eeb36ecb239f

SHA1
f6b77b942f17412407f71bc2b1c3134cf53ffb04

SHA256
70c4b20247d64e65abf76b88118472d16f79c2ad52888e9a534e4d75a3397d77

SHA512
2d0ecbc18812a4bca41501395fc59885bac3d6798203d4201531bb485ddf4b2f9d1cc8458e8db49ff82ae82ac425ea7687f93d748ca15a26766c04705db5eac8

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.2MB

MD5
f3bd4b244643d7b1b09fa0d46b5a6200

SHA1
43341f3b44307cd22f9f4e1cda28d92b4eb4b11d

SHA256
f1d6cf6ce5a22e6a7376064e90322e6f1f9788fb6d2497cb4e50fd3f9d503321

SHA512
98133aa785d98046ca07b7e4fcf4a899125e9ad73c84397bee8c357caf7c100fc6907d534b510ac7778734bfec08c0423d354263997bcb6ee7fac7c86ef6b7e7

Download Submit
\Windows\System32\alg.exe

Filesize
128KB

MD5
a8f7ad90f2954f835402264f0e994767

SHA1
4d6d046fd78e7b1ec07705593e39da1d789253b4

SHA256
8e003d92e8ac629557ed12dd4608e811c0f20df91bdcb0eacdff9e0200b00886

SHA512
a53e43a65d722257ac8f04c325c5b159b35484f10acdac3a8d7ed6e3de98520b265f8295ab12ffbe826fee762a4d2f5a0696eacece8802a84887fce621d4a9b2

Download Submit
\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
f2aa06af879769a59b09081e78c4fe67

SHA1
830be25f6a24d694af1d86eaa09a89905f06118f

SHA256
eb81b3bdfd6ca133c5d315a5ed636775ee053489167bb7b6f6636b292a492e5e

SHA512
726a08413c70b7e1c272b88321416d999a037cc2ec4f5d22cc65b769bbcbdf635fc8a606f333ae7526a85544c1838d62c8ac7adf53cc76cc720b1b3995015ae2

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
1.1MB

MD5
eedc3ce77c506b6fb0b7a756bd8c5732

SHA1
760b9219b5b1471ab265cc2348666a9feacc19da

SHA256
7be58daf5a600df2877f7491bc461e6f0fbf712570aedfca6d290d9375d7d418

SHA512
a606ed81c7bc4670164a4dcd938f5ed04d79767eadabcaa2e96c27a3ea26aad2e6e246d93e9f42af3a7b4a9a926fa7f51b79d57e44570fa0bccfe2246a39f0b5

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.2MB

MD5
f27c9d97fd2695bcedfb718837c34de0

SHA1
fd86d48a6bb288915a05bc4375450fbb1219a514

SHA256
ee59493bf494d74de5ceffcc4d602b96b1fd1f97a6fc5fb97e6d41237989d188

SHA512
7ac42e633b5d9e1e1942e2fe5d9a0b30853fdd49543f224a2ab81126e6d115b82a1a5a8a4e2cc6eb5ecd33ebe429ea4b076b1647e6bd2a24f5b8cf4d63551207

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
5b73de66a113fcd02466628d6bbf0f09

SHA1
481bc5caa17d5e03b58fb2a9107e08b1830298fa

SHA256
a10bf850e3fc28ad1ae344a905e6aaf41250d550dd80f1c4830cb8322ea9719b

SHA512
62e68197f8c8c6ccc5ae7fd165b6b33f7ec02bd8d61cd77c3d67f53265a2d97cd01eed0a1078382e00e5ce2a850070c2b56bc4e572b6a8958ff78f5cca0cf863

Download Submit
\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
41ca21fda742643b2724556ecb3e3148

SHA1
2a63b2fd6df349784715bfa0fc2013694a4e33d8

SHA256
9373979091189ec2a4c9f5f8d471e8c771c0be6740f746521b5d237e5c9e0ce7

SHA512
825432d8ff899e8485e822c6820bde78e9d85fdeb807556cdd6666ba24d329e80a7d2a6458cbab984f9de8b806921e464d45dbda3da8fb5aa5d2295f7b34fd6d

Download Submit
\Windows\System32\wbengine.exe

Filesize
320KB

MD5
dca4febfc1899f6f88e791c652bc05e1

SHA1
2595b17f3202b8c78f24c6d1709a753497c26185

SHA256
7260bfa5cc1c00bc214c6baeb4fc2b912c5d49bec1c826e2c4e78929f6cf21db

SHA512
65469a21f16217c99d21ace63479a294f0d2c719d37c2981dbe0fa70871e266c27b618058c35dd0067971df056ef1ded3f34d06dd36d4da41ea3d863d3e6c368

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
832KB

MD5
66d5657deefc9aab9706ab13ad4924f3

SHA1
96b0ea9bbb87e33fdca47f6146bf8bd9e9e95c7c

SHA256
b53eab6e5df8ab1448cb44a530c71bc8ba31489921b641c2db93b62c5e541ba8

SHA512
e78e4c75838b39497b57c8fbcb82d6f3ea0f77fd46c538287ff8d8ca91c9cb5e2ab2bd6c4dd3fd86ee047ec7d2fae1ba2e9da12e5a941c2e9f77aaf61e892fae

Download Submit
memory/820-318-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/820-148-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/820-291-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/820-124-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/820-133-0x0000000000850000-0x00000000008B0000-memory.dmp

Filesize
384KB

Download
memory/1128-304-0x0000000100000000-0x00000001001D5000-memory.dmp

Filesize
1.8MB

Download
memory/1128-311-0x0000000000150000-0x00000000001B0000-memory.dmp

Filesize
384KB

Download
memory/1204-282-0x000000002E000000-0x000000002E1F4000-memory.dmp

Filesize
2.0MB

Download
memory/1204-283-0x0000000000310000-0x0000000000377000-memory.dmp

Filesize
412KB

Download
memory/1400-199-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/1492-287-0x0000000100000000-0x00000001001D4000-memory.dmp

Filesize
1.8MB

Download
memory/1492-288-0x0000000000450000-0x00000000004B0000-memory.dmp

Filesize
384KB

Download
memory/1716-286-0x0000000000170000-0x00000000001D7000-memory.dmp

Filesize
412KB

Download
memory/1716-285-0x0000000001000000-0x00000000011D5000-memory.dmp

Filesize
1.8MB

Download
memory/1872-178-0x0000000100000000-0x00000001001D4000-memory.dmp

Filesize
1.8MB

Download
memory/1872-118-0x00000000001D0000-0x0000000000230000-memory.dmp

Filesize
384KB

Download
memory/1872-114-0x0000000100000000-0x00000001001D4000-memory.dmp

Filesize
1.8MB

Download
memory/1872-110-0x00000000001D0000-0x0000000000230000-memory.dmp

Filesize
384KB

Download
memory/1900-201-0x000007FEF4DF0000-0x000007FEF578D000-memory.dmp

Filesize
9.6MB

Download
memory/1900-194-0x0000000000EB0000-0x0000000000F30000-memory.dmp

Filesize
512KB

Download
memory/1900-319-0x0000000000EB0000-0x0000000000F30000-memory.dmp

Filesize
512KB

Download
memory/1900-193-0x000007FEF4DF0000-0x000007FEF578D000-memory.dmp

Filesize
9.6MB

Download
memory/1900-284-0x0000000000EB0000-0x0000000000F30000-memory.dmp

Filesize
512KB

Download
memory/1912-93-0x00000000004F0000-0x0000000000550000-memory.dmp

Filesize
384KB

Download
memory/1912-95-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/1912-167-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/1912-102-0x00000000004F0000-0x0000000000550000-memory.dmp

Filesize
384KB

Download
memory/1984-290-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Filesize
9.9MB

Download
memory/1984-289-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/1984-298-0x0000000000AC0000-0x0000000000B20000-memory.dmp

Filesize
384KB

Download
memory/2076-196-0x0000000000160000-0x00000000001C0000-memory.dmp

Filesize
384KB

Download
memory/2076-195-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/2132-329-0x0000000100000000-0x0000000100253000-memory.dmp

Filesize
2.3MB

Download
memory/2132-337-0x00000000007E0000-0x0000000000840000-memory.dmp

Filesize
384KB

Download
memory/2176-147-0x0000000000370000-0x00000000003D0000-memory.dmp

Filesize
384KB

Download
memory/2176-309-0x0000000140000000-0x00000001401F1000-memory.dmp

Filesize
1.9MB

Download
memory/2176-140-0x0000000140000000-0x00000001401F1000-memory.dmp

Filesize
1.9MB

Download
memory/2180-175-0x0000000000910000-0x0000000000970000-memory.dmp

Filesize
384KB

Download
memory/2180-169-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2180-340-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2228-52-0x0000000010000000-0x00000000101E6000-memory.dmp

Filesize
1.9MB

Download
memory/2228-53-0x0000000000320000-0x0000000000380000-memory.dmp

Filesize
384KB

Download
memory/2228-59-0x0000000000320000-0x0000000000380000-memory.dmp

Filesize
384KB

Download
memory/2228-91-0x0000000010000000-0x00000000101E6000-memory.dmp

Filesize
1.9MB

Download
memory/2464-44-0x00000000003F0000-0x0000000000457000-memory.dmp

Filesize
412KB

Download
memory/2464-38-0x00000000003F0000-0x0000000000457000-memory.dmp

Filesize
412KB

Download
memory/2464-39-0x0000000010000000-0x00000000101DE000-memory.dmp

Filesize
1.9MB

Download
memory/2464-90-0x0000000010000000-0x00000000101DE000-memory.dmp

Filesize
1.9MB

Download
memory/2532-12-0x0000000000780000-0x00000000007E0000-memory.dmp

Filesize
384KB

Download
memory/2532-14-0x0000000100000000-0x00000001001E3000-memory.dmp

Filesize
1.9MB

Download
memory/2532-20-0x0000000000780000-0x00000000007E0000-memory.dmp

Filesize
384KB

Download
memory/2532-19-0x0000000000780000-0x00000000007E0000-memory.dmp

Filesize
384KB

Download
memory/2532-94-0x0000000100000000-0x00000001001E3000-memory.dmp

Filesize
1.9MB

Download
memory/2544-111-0x0000000140000000-0x00000001401DC000-memory.dmp

Filesize
1.9MB

Download
memory/2544-26-0x0000000140000000-0x00000001401DC000-memory.dmp

Filesize
1.9MB

Download
memory/2544-27-0x0000000000810000-0x0000000000870000-memory.dmp

Filesize
384KB

Download
memory/2544-34-0x0000000000810000-0x0000000000870000-memory.dmp

Filesize
384KB

Download
memory/2648-155-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2648-77-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/2648-72-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/2648-71-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2676-281-0x0000000000B10000-0x0000000000B70000-memory.dmp

Filesize
384KB

Download
memory/2676-297-0x0000000100000000-0x00000001001F1000-memory.dmp

Filesize
1.9MB

Download
memory/2676-275-0x0000000000630000-0x0000000000821000-memory.dmp

Filesize
1.9MB

Download
memory/2728-280-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/2728-279-0x0000000140000000-0x00000001401F5000-memory.dmp

Filesize
2.0MB

Download
memory/2940-164-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Filesize
384KB

Download
memory/2940-267-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Filesize
9.9MB

Download
memory/2940-294-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/2940-296-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Filesize
9.9MB

Download
memory/2940-295-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Filesize
384KB

Download
memory/3004-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/3004-70-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/3004-7-0x00000000005E0000-0x0000000000647000-memory.dmp

Filesize
412KB

Download
memory/3004-1-0x00000000005E0000-0x0000000000647000-memory.dmp

Filesize
412KB

Download
memory/3056-222-0x0000000000FC0000-0x0000000001020000-memory.dmp

Filesize
384KB

Download
memory/3056-223-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download