c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9

Analysis

max time kernel
107s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
Size

1.8MB
MD5

1a0964d7a1b47559705ccbba6d233617
SHA1

bdb66264beeeddbf7389134f866821cf4d27a61d
SHA256

c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9
SHA512

e502e148677ca31738518b2e1bfef17b009b3ca66b261ac9ee1b55b38dd4a0ee9f93dce5ae8015c8bdec2b2acec7f9eb6535a86c4a9d14b2c442701c9d949d21
SSDEEP

49152:nKJ0WR7AFPyyiSruXKpk3WFDL9zxnSnmgiTd8DsMcDKGfWbYCGE:nKlBAFPydSS6W6X9lnUBiTLMiKGu8CP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 35 IoCs

pid	Process
468	Process not Found
2704	alg.exe
2764	aspnet_state.exe
1516	mscorsvw.exe
1484	mscorsvw.exe
2828	mscorsvw.exe
1932	mscorsvw.exe
1828	dllhost.exe
2256	ehRecvr.exe
2128	ehsched.exe
800	mscorsvw.exe
2692	elevation_service.exe
2792	IEEtwCollector.exe
2388	GROOVE.EXE
524	mscorsvw.exe
268	maintenanceservice.exe
2732	msdtc.exe
2400	msiexec.exe
1808	mscorsvw.exe
3056	OSE.EXE
2232	OSPPSVC.EXE
1748	perfhost.exe
1332	locator.exe
2444	snmptrap.exe
804	vds.exe
1060	vssvc.exe
1488	wbengine.exe
2148	WmiApSrv.exe
2216	wmpnetwk.exe
1944	SearchIndexer.exe
2348	mscorsvw.exe
1600	mscorsvw.exe
2536	mscorsvw.exe
2788	mscorsvw.exe
1196	mscorsvw.exe

Loads dropped DLL 15 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
2400	msiexec.exe
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
740	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ca200fe14501ed38.bin	aspnet_state.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	aspnet_state.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	aspnet_state.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	aspnet_state.exe
File opened for modification	C:\Windows\System32\vds.exe	aspnet_state.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	SearchProtocolHost.exe
File opened for modification	C:\Windows\System32\alg.exe	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	aspnet_state.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	aspnet_state.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	aspnet_state.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	aspnet_state.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	aspnet_state.exe
File opened for modification	C:\Windows\System32\msdtc.exe	aspnet_state.exe
File opened for modification	C:\Windows\system32\locator.exe	aspnet_state.exe
File opened for modification	C:\Windows\system32\vssvc.exe	aspnet_state.exe
File opened for modification	C:\Windows\system32\wbengine.exe	aspnet_state.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	aspnet_state.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\psuser.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_am.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_th.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	aspnet_state.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	aspnet_state.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{A460FDBD-01C6-4800-8EDB-C87720E1D9B6}\chrome_installer.exe	aspnet_state.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_et.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_vi.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	aspnet_state.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_ml.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_sl.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	aspnet_state.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	aspnet_state.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_en-GB.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_it.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	aspnet_state.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	aspnet_state.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_pt-PT.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_ta.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	aspnet_state.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	aspnet_state.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\psmachine.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	aspnet_state.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	aspnet_state.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\GoogleUpdate.exe	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\GoogleUpdateBroker.exe	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_no.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	aspnet_state.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\GoogleCrashHandler.exe	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Program Files (x86)\Google\Temp\GUM69F9.tmp\goopdateres_ca.dll	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	aspnet_state.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{7232CEC8-A085-4693-BB4D-FB2D60142642}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	aspnet_state.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	aspnet_state.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{7232CEC8-A085-4693-BB4D-FB2D60142642}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	aspnet_state.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	aspnet_state.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	aspnet_state.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	aspnet_state.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	aspnet_state.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{D9BAB42C-63D7-4950-8F63-AB3379C2F282}	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000906b5260ea76da01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-117 = "Maid with the Flaxen Hair"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform	OSPPSVC.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200017 = "GobiernoUSA.gov"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-116 = "Kalimba"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2756	ehRec.exe
2764	aspnet_state.exe
2764	aspnet_state.exe
2764	aspnet_state.exe
2764	aspnet_state.exe
2764	aspnet_state.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2516	c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
Token: SeTakeOwnershipPrivilege	2764	aspnet_state.exe
Token: SeShutdownPrivilege	2828	mscorsvw.exe
Token: SeShutdownPrivilege	1932	mscorsvw.exe
Token: SeShutdownPrivilege	2828	mscorsvw.exe
Token: SeShutdownPrivilege	2828	mscorsvw.exe
Token: SeShutdownPrivilege	2828	mscorsvw.exe
Token: SeShutdownPrivilege	1932	mscorsvw.exe
Token: SeShutdownPrivilege	1932	mscorsvw.exe
Token: SeShutdownPrivilege	1932	mscorsvw.exe
Token: 33	2456	EhTray.exe
Token: SeIncBasePriorityPrivilege	2456	EhTray.exe
Token: SeDebugPrivilege	2756	ehRec.exe
Token: SeRestorePrivilege	2400	msiexec.exe
Token: SeTakeOwnershipPrivilege	2400	msiexec.exe
Token: SeSecurityPrivilege	2400	msiexec.exe
Token: 33	2456	EhTray.exe
Token: SeIncBasePriorityPrivilege	2456	EhTray.exe
Token: SeBackupPrivilege	1060	vssvc.exe
Token: SeRestorePrivilege	1060	vssvc.exe
Token: SeAuditPrivilege	1060	vssvc.exe
Token: SeBackupPrivilege	1488	wbengine.exe
Token: SeRestorePrivilege	1488	wbengine.exe
Token: SeSecurityPrivilege	1488	wbengine.exe
Token: 33	2216	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	2216	wmpnetwk.exe
Token: SeManageVolumePrivilege	1944	SearchIndexer.exe
Token: 33	1944	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1944	SearchIndexer.exe
Token: SeDebugPrivilege	2764	aspnet_state.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2456	EhTray.exe
2456	EhTray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2456	EhTray.exe
2456	EhTray.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3060	SearchProtocolHost.exe
3060	SearchProtocolHost.exe
3060	SearchProtocolHost.exe
3060	SearchProtocolHost.exe
3060	SearchProtocolHost.exe
2484	SearchProtocolHost.exe
2484	SearchProtocolHost.exe
2484	SearchProtocolHost.exe
2484	SearchProtocolHost.exe
2484	SearchProtocolHost.exe
2484	SearchProtocolHost.exe
2484	SearchProtocolHost.exe
2484	SearchProtocolHost.exe
2484	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 800	2828	mscorsvw.exe	37
PID 2828 wrote to memory of 800	2828	mscorsvw.exe	37
PID 2828 wrote to memory of 800	2828	mscorsvw.exe	37
PID 2828 wrote to memory of 800	2828	mscorsvw.exe	37
PID 2828 wrote to memory of 524	2828	mscorsvw.exe	45
PID 2828 wrote to memory of 524	2828	mscorsvw.exe	45
PID 2828 wrote to memory of 524	2828	mscorsvw.exe	45
PID 2828 wrote to memory of 524	2828	mscorsvw.exe	45
PID 2828 wrote to memory of 1808	2828	mscorsvw.exe	49
PID 2828 wrote to memory of 1808	2828	mscorsvw.exe	49
PID 2828 wrote to memory of 1808	2828	mscorsvw.exe	49
PID 2828 wrote to memory of 1808	2828	mscorsvw.exe	49
PID 1944 wrote to memory of 3060	1944	SearchIndexer.exe	61
PID 1944 wrote to memory of 3060	1944	SearchIndexer.exe	61
PID 1944 wrote to memory of 3060	1944	SearchIndexer.exe	61
PID 1944 wrote to memory of 2380	1944	SearchIndexer.exe	62
PID 1944 wrote to memory of 2380	1944	SearchIndexer.exe	62
PID 1944 wrote to memory of 2380	1944	SearchIndexer.exe	62
PID 1944 wrote to memory of 2484	1944	SearchIndexer.exe	63
PID 1944 wrote to memory of 2484	1944	SearchIndexer.exe	63
PID 1944 wrote to memory of 2484	1944	SearchIndexer.exe	63
PID 2828 wrote to memory of 2348	2828	mscorsvw.exe	64
PID 2828 wrote to memory of 2348	2828	mscorsvw.exe	64
PID 2828 wrote to memory of 2348	2828	mscorsvw.exe	64
PID 2828 wrote to memory of 2348	2828	mscorsvw.exe	64
PID 2828 wrote to memory of 1600	2828	mscorsvw.exe	65
PID 2828 wrote to memory of 1600	2828	mscorsvw.exe	65
PID 2828 wrote to memory of 1600	2828	mscorsvw.exe	65
PID 2828 wrote to memory of 1600	2828	mscorsvw.exe	65
PID 2828 wrote to memory of 2536	2828	mscorsvw.exe	66
PID 2828 wrote to memory of 2536	2828	mscorsvw.exe	66
PID 2828 wrote to memory of 2536	2828	mscorsvw.exe	66
PID 2828 wrote to memory of 2536	2828	mscorsvw.exe	66
PID 2828 wrote to memory of 2788	2828	mscorsvw.exe	67
PID 2828 wrote to memory of 2788	2828	mscorsvw.exe	67
PID 2828 wrote to memory of 2788	2828	mscorsvw.exe	67
PID 2828 wrote to memory of 2788	2828	mscorsvw.exe	67
PID 2828 wrote to memory of 1196	2828	mscorsvw.exe	68
PID 2828 wrote to memory of 1196	2828	mscorsvw.exe	68
PID 2828 wrote to memory of 1196	2828	mscorsvw.exe	68
PID 2828 wrote to memory of 1196	2828	mscorsvw.exe	68

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe
"C:\Users\Admin\AppData\Local\Temp\c50ffe1ae4ea96be866574517064d9e5cfd58c396ba5d0d7db3a2dbfd39ac7f9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2704

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1516

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 244 -NGENProcess 250 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 23c -NGENProcess 254 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1d8 -NGENProcess 1ac -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 25c -NGENProcess 250 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 250 -NGENProcess 25c -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  PID:1940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 278 -NGENProcess 1d4 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2bc -NGENProcess 2d0 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:2324

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1828

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2256

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2456

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2692

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2792

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:268

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2732

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3056

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1748

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1332

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2444

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3060
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 596 600 608 65536 604
  2⤵
  PID:2380
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
1.5MB

MD5
c40b51dadb498d5f2c5ce2c4cf256787

SHA1
c68aadd1d2cff9946e708c60fd880d6abe3c9803

SHA256
04306591522ff2961b129d970141bb2c37c486ac04fbe742d56a7adde5f32da4

SHA512
b8428e72ce3a7f4492c30ac8e86a7b2a8c86a7bb3e29dfc5fd117789272888368662fa555896fd0522d23c42083624ed48a2f92211477c08c38aa80d1fac2e84

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.6MB

MD5
f8a4121820efbd651ba67aee0370639f

SHA1
499eaf592642e33621ea6eceff790bde71fde34f

SHA256
fd539daa103efc0e9f70178b68069a02a44825919d7ce628e6ee3762a0bca253

SHA512
676177d841c8053f5b653ec3abc5e9bdaa6e21cc32cddb3389e5e83ffff138c2c4ad66b45d89aacd987d2407303bb09ecb0e6c718a49bec375fa6e4966747387

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
832KB

MD5
6b8f4dbe127178bfb0b10c5fa5b5ee2f

SHA1
da4665cfdc33cba0335e84126ea278ceed4c77f5

SHA256
4b5dae3835dbb2af7dda271d41fef08ac077bea2a3ce128e0e8a19cdb6d0a0eb

SHA512
1d6b95fd9fe4ef259f8e5e9c5d2cede153436780b5a67a89c982d1d5b97d63ce7f68bcdbb74076f5aa782bee6faa469f4ca69165d9e3ee14a4d7f4a508beeaec

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
1.9MB

MD5
ce1ced29240ad6b73231749f26793bdb

SHA1
c693bc5f68a040a01fb029c27f6f48c082bbff9b

SHA256
c2b456eaefd1fec7bbedd43c1aabe2e7c004779cb9c773ef2c20a4d75d3b8fb6

SHA512
ac4b6ccf14d49ed97e32fb48a246b39ec90432e6d63b5a4459479cc8fda9a42a60fd590d710aef23ac8c50e7a7294a7f7610deb4e77134d69d388e17d9cc15a8

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.2MB

MD5
3e1ee561b10b25738207b32d8f5b31cf

SHA1
a5a48b467342ed3dd495a7dcd4e7abe89438a505

SHA256
94341545e6a3d93f64e374e0ca9dd6528efb01bb1f3b8975aec843c09f6ce298

SHA512
96ffcc29d6c4b64cd2c3a6a4133d10b93aeeac06a98b6cf03b61f82891c4bcb3ab6efb1ec22ae892e2cc581ce71c1ecdccc67fa302003aafc18009fa02b810d2

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
fbac4a87c277324b4529f5a263d7234b

SHA1
799725c887efdd3b7460e426828806578836ae6c

SHA256
53b1541cc36856b5351c6ad25e3fcd1ac9840925ae69af3f9934f9107cb9cf9d

SHA512
f6cd6080b5733282eca0bf7e93bdd47237e91f20fd5d4f20d1756f21fe0b02f2227c946a4c62ad35339916bd214ba514c4345df62ad6332728ac37c30018a7ef

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
1.6MB

MD5
d12f2e07b65b9580cbf97caac3f46fe7

SHA1
7f41e648f2d6acf4ab66e19c5733b49d58e610ae

SHA256
c69098d50af2348aebe0d1da6ac80181e8d8cf13a54f5edd707de0e123c2061b

SHA512
75d935ae6d75c209d3b9ca08175a3b5e58c6f303480f8b3290d162fa3661ae1f5f370bf78f3f70d35b4cfc12351d7f0342e20e9df37f5531cae954e8273ed9f3

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
975bf04607d48b495e5ef82b4b30e8b6

SHA1
62aab47d81e55f984542c4460871f63f44c68dc3

SHA256
fee975ea843de4e62d31cde0b9eed9bc70e02115f6aee2daae3a90f1c39d09d7

SHA512
6906eb7c2dd6d84617e1fa083776a2e0ed4568f82f2bd79f3e961870af71267a7b6d68678eff1526cd60d64f07547f5e13ffc1bcfe4b85892ef17b634c472b91

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
40077e58c61fad92519e140e0dc34022

SHA1
2cce66177530344f88e37eb84f0043be701bf444

SHA256
6e3868949a3dc1443296f14a96c93c58e3b50bfc4b177f37ac0b233ed8baa1f0

SHA512
20e5128d8533a27568aacd900a58a947cbbce92dbd1bac8dce44871d1f7edb57b8d303c21c1b9945e386bb42265c48ed32347b3f4b275e0dd835c30eab2f662f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.2MB

MD5
4b968acd6d6b2f2ee89c7dbaa72672d4

SHA1
15b5315179183611b4ca728ce6e7c42a2fe9d975

SHA256
adf3d6f6c935faf7df38ecc03e6c082de964570f569c62b8217e38ea45a87df5

SHA512
2dbda8c6a7d8a8f5d5666a4e64e401da5ed863fcda1f35074998d2c08c81fdafccef762800dd33f4f72d57b16a79f3fe9e0f3438cdd310e0b152d172f876471c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
90441fdaf5c6fc30b1707b414e16baab

SHA1
9db04291ac76fbae8a8be8bb148e4a771d0d96cf

SHA256
82dbe0a40d68ce5586a31102b3ce706e24be1ce5825cbfd7e4ef6fab7d1b169f

SHA512
099572d80d3644a4344f3bc7dc9b2666af76af405afdb557b4358de3199900a1897c296bdc39795fab14af0b464045fedac963ef90c20fb1f67b0b65b3937a54

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.5MB

MD5
40dc92d7762f38f7a759e3c51fac2874

SHA1
95bd4ddab5631b6ed45568d2d37c95a8dc6f16f1

SHA256
c83eef279aa2a63a36db382d898c91e573ded4d4b5aeec1081c20bfc1bfdbcac

SHA512
681b928c33a20c4d3d2433850f22322e11115d3ee2301ad19dfd118ab6020f85520a61fad8768bc4d351004a08a36b157a31d465aa4a4106700e9c97cd2d91aa

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.4MB

MD5
cddbe9a7e6253e16aba76a51f35b1e82

SHA1
f4b3aad3d00bbf2f152776f51ad254734c249d30

SHA256
bf990173d9b161a17c850bf95e144f8f7af19270862b36712d5e4247110c372a

SHA512
a04b58194452cc2e582cae0741a33b7a035a4053be3126c6cebb77e2aa87cf62d2d885d618f628180520f4a55513a52c0151344d870439d1af81d237d32b15c0

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
401c9232050990232e78ba0a4da5ec2e

SHA1
38287fb19bed6ddcceef4f3c0cdef19fa3e141a2

SHA256
289c2caead8b8847b87d0d4c6174e32743d1ce5e04d7e61d73ac42bc38272f40

SHA512
63077d4e1ae93944f64a007a92a20228e973542d71f8df666549bf4ad3c02aa5b1d969be6d913710b3d62f06975ba1e58892f02ea557999467f3d90b5f31a53d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.5MB

MD5
a942f7be864c7ba690cd7bfc500aba1c

SHA1
ad19aabf0a08a967d45b4687bd342dcb8950674d

SHA256
580dc808a2961edaa60384904979b2d18d81c5a7b62941e087586cba685630e1

SHA512
913689b86d0fbb41a998920b051f711a1576f9e96c0f1ddbe53626e4ebe605d27cb75fa07b0b71566f9cc26ae597bd494e901d9a1f5b19a19ea3b1a33880088d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.2MB

MD5
f5b60cc7d7a8efcc18671df43fc50ed4

SHA1
dea5e2cc97618d74e091858ff59d19382a37b525

SHA256
35ec30da6463a761de95bc3c4afff3374d3feac148b75c1a5647b13f09116094

SHA512
e761c45f7fb979ba4cc40600929690ca524e9f0cb0876bb081614130449e41c32b0bac6f4900840e8b44759e2b04aca4b08a462940003339288dcffd53e415a9

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
64KB

MD5
c0cb7c204b0dfc9acdf7abf19197bf28

SHA1
7cd4cf26a276b8d2bc964dcb4e230ece1fd1b996

SHA256
575971d86f6034ff1a2efab90414bd3c7b157316a0fe4c8f2cf003750be50d10

SHA512
ba562a3c90e36b8e5b953673ccb0fe95e8ca6600691c4a4cdf4d4a2f8b715907e9362eb90f36a0609185173ceee7bb7ebbe39b1f613e66db6625d6449eff56bf

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.4MB

MD5
293b25e5309ba10fad2ab6b94727665e

SHA1
fe34b6d3165c056297a8170033002ae3e6db3844

SHA256
54b6396ce294de05abae97fd4cbe7895462b6e04624e958f4a51a92434fad054

SHA512
81b14f65a05dd550c2e39fb109e511c17dd820a9c844acfcd9d6c40d05c50412c4b86bbd709b22a54faf2b547a5c0242e48f47da7af168fc1e326780677ff502

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.4MB

MD5
591d4beece0dcd515f0f7c83a3085e81

SHA1
91bc2b58ffd28db04704991e3044506512242a3f

SHA256
6b9a7d67e60e6fd23629d34e19df3818a66b575697ce8151cdbcb7792cd0b320

SHA512
b1e16fe5185f40181161e3d875e5b5a7e67e69164d9e31a83c4454347d5bc489b01466de4a68781e5bf14123417ef834030b19c44ac14df772a73fca2b53b919

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
128KB

MD5
6ff24cea159a3ddd5a3295bf49fecdd5

SHA1
be777c4413b52807d780dc5a73712c9dd746d1e4

SHA256
45a5defd3bfaa27ebac9dafc4f77d41811fde0004072b0286d757e4e25b68a76

SHA512
4fdd3e187820f1c220316311986804374fcc88edd3464fcb6f27313335378115ad0c3b979cba36d3cfe66f81d91822eee0b41dfbda29907568ed2d3a0a74f255

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.1MB

MD5
974e887075a132bf92902f4026de83f7

SHA1
b5ca45e2a7bbf62761ee8163e4fbd09d312eb059

SHA256
a6d467911c677c8b54df009fe1240407ac356b0d8d5cbae08b88dc844b35dbb8

SHA512
61506d3e9c716f6a7360857372b52be3d515c0c0c7f6f5649dcb0beca8db37eff2c7ff7c95ab3c0c3e96e056d654f1d885013112c006fc8afd48a752da21dbcf

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
448KB

MD5
9c6d43632fdc7b846a47a96c86e24a26

SHA1
e8b703ffc7ed395a0005bfc96cf2d7cf26956928

SHA256
696bd489c44b7a69654cb47d1d9c6fdfd307e7a1f84492e211c3276adf4cd027

SHA512
18a4da9853896315383c8dfd323905cfde07a569fcba018f26734955944503bc6e5406c33f9da26d2e95c25a5a3721c1176304058a147e4fd5ebf5b7d89019b7

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
704KB

MD5
33f018db3d530c551e8f0fef7b8ce261

SHA1
d00dd978c85c2e59e3a6d2a6b4d2e39ca10e8b31

SHA256
159726aa406674f52b4cddc70240930b5a5f8d8899aed08be7d7063b49896c78

SHA512
09cbb360c2778a58c1a2c92b31c7f1c5c038f2dde8eb20490682f63b13fafb774067d875ef134bbccb08c5191aef79596232bd0959be03a3ceb75679e801f445

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.9MB

MD5
66bf20e9b00abc67f77c011a13901fde

SHA1
c11068ea48fff2729124d536bd083b207f80923a

SHA256
7f9c09960d5cbaf82871f42d7470e3d7d3fb9ffb0bd28f717b0f6b542a7a7508

SHA512
5f2e1211898772bd26a6e18db20292f6460518d7eab1e38a6a8585ef7234a62d4376a54497c8faa598b5cdcc0637131cb70fddf642db22df14ba2187474701cc

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.6MB

MD5
9b9a56499b02c341c1eb053c53d4e636

SHA1
31576ac9ff0ce9e2b6958473dfb520ab5a0be1df

SHA256
13c9c16e8c8eb845b7d1baa5fb961062767fa7fa16e2b3b886aa5833b25cf90f

SHA512
3c7c568af32ae3c549f146e69ed4c74af2676287b8024ceca9e266b3d48a68b10319cf268ec0142b890e739e7c685026f8d0d64e98965f18320c23bdeae7eecf

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
1.5MB

MD5
f6fb4444e7b2f3a7d032438364e7d70a

SHA1
27b648e45a18d0fea770284ec7ce973ee82c2497

SHA256
35748d9464364525fa2c6ef81e2decdffc9fbeaa1dea45ff9f616300e1009641

SHA512
700e6b80d96985cbc5a0f240e3ca9563dfc6b15411ef791b94558810a44b74c3c55240dc1f93a91997f7606b61245b80387b6a4a6b6f192f4170f370b9ff310d

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
1.2MB

MD5
639a6a19a4c86eac802b0c207328b3fe

SHA1
98a7508c16aa48f4e0759f3a4a4d2e5dcb051646

SHA256
9fda025429b520ba4f5b061e4827c21db1c2c6f3ae04009ba652ae6fd3d4f098

SHA512
37a07ccebc45ebcd50a303f894718dc56a86ce1eaa6a5e5d969cd9db1c903df2878b9337bf809c681206182cba01b190c70e08fd0567432ae96e2a668a9de5c0

Download Submit
C:\Windows\system32\IEEtwCollector.exe

Filesize
1.4MB

MD5
e46207bba56d67e24f869d9bf1c073ce

SHA1
1ea765562b73e725b4b3c7c164e7b20c8c54b964

SHA256
c37ec28f1586e691b926f1369ee47adcf575a697a034af472fa9caca1727379b

SHA512
77d8d1f9bd27badb801659ccc9610e0b314eac26e65b5fb57db924104e9b838320fa37a9e7c6550f0e7a6934129ecf65aa2e2f208b1cbc6bf3fd79a0044ce1f7

Download Submit
C:\Windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
27f35a912f5bab2f3e9c15ffd7d96f72

SHA1
394c4bc335739f849383362544813dac73ede6b1

SHA256
f29afcaabca734aabe59727199343cd29ed974b4311e0dd9a1092fa273e739b2

SHA512
ae4036fac6abeff0ce885a61151ab6ed4184308742b755e6702568dd3434112939487b915fa90031d97d3b113e633c09f444fd10894bd82394a21d53f407f3b6

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
12b5fcfcf355513766992ec658a3b164

SHA1
309cd37715381f7f1cd158ec6cf0272118553702

SHA256
922bd75d75d6b158d06c2366ef8c39038b3ec2f4eeb00556376f76cf0ac0bf0f

SHA512
171bf3b86686f54f25b7e231cf2ea0eec105095e29adec0f8deafc4b1832b25e186543b4579b90a8e463778385b9587798de3c7ec89da7748eb8be7c94bbab42

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.4MB

MD5
f98c621508306f7b34dcde7c2f5663a4

SHA1
e90535f28906ba62f7a062d6a9717323642a9676

SHA256
ecb73eb03386feddf71c41bc3dc02f4bc6b539f3f711f21d0313addd67c141a3

SHA512
0ed2bf5147374e756be9cc41063f2f4b6dabd94dfc860fdd032eb15b5eaf3101beab33edf48029e245fef2990af34f6e3492c02be904f0423b60285a3f4bf799

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.4MB

MD5
0cb8a98b63835a8150f58fd06e18cc2b

SHA1
9f9fcbca2cf064ad5a0af0e7e98177c9da4a8e34

SHA256
46168959ed25a5a1399256fe83acccad17c65e56369c4c0db5692db9b9a0acd4

SHA512
c923a5fc5059fbaa3cc3eb77b1b5116f32c63192b5b3f2b7972b919e4fb850f93acbd0f056b703c4df75afb6c1ff8f5465547ab83d40f40ceec33740b13e1910

Download Submit
\Windows\System32\alg.exe

Filesize
1.4MB

MD5
a7e75b5d4c086a28a38ac0c4e0e3079e

SHA1
b1e7f10bb528e6e9891d36e75cfb189862dab042

SHA256
23c5e0b4b262623ab3bc71966d6edaed3aef7f884c39de4d0abf2de3982ff2d1

SHA512
90abc877806a47e34453d3c46cfcf3b1ab361d39fe8c84ebbf1c2a69ad2ff4f8d63c63ab86306332e4d31b3c0b65bad028a943fd643c2895a1728f2d043fc67f

Download Submit
\Windows\System32\dllhost.exe

Filesize
1.4MB

MD5
ab760e7504462eec80d79e790deae532

SHA1
285b62bdeaa9355c71c72bd63873eecb794a25b1

SHA256
85494befdced455c8ce7ec44a55761248de905f63f976ae1fb766f3c8840cec2

SHA512
ccd1e88fc1b4b58fd1b062e9576336e0104926b09b6a68389c9d8c21a0a94f8cfe0ae17b859f59fe437edcae5435a042c489f384a07db8c50a635f1df3fcc705

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
1.5MB

MD5
f49c27c36a36892eca9729b6bbe6987e

SHA1
19fd07a0029fcad6bd315bfcfd283f8595e8a4ed

SHA256
66445a3ffc44e7b523c85939da350db1d591e89310a36c1405bf1d248feaa703

SHA512
2c5e339d3b44978365aae14e1d3209f67dd8599417e40dbf15ca57319e0b8c9b4d9b3e80fa4cad8fc65e6fdc2604c62a661923aed19aa62903387aa97dafac59

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.5MB

MD5
481ec53291b8e04fe3d343dc179a15b6

SHA1
4600e3eff058826d47507678ea26089bc3fbbe51

SHA256
1941551e3eafa5607364a636e563b5159a340f62edb672928c21d0d286f1a6b7

SHA512
5857a3fb78e1e5cb68228100d438b32944eee40bfc9c59378690af2b2ab7600524c5d44eef274922a5a75628c96fa77b65274eb2d4648c63ea3a4d2e62f27685

Download Submit
\Windows\System32\msiexec.exe

Filesize
768KB

MD5
55cd4193a6c47328f8585ad48df6889a

SHA1
0c5a12f3a1a7213757f243d3533f442d85a9a3a1

SHA256
84a1b9a8dea9140ad2cc09205b82f9b1a585af29125fd57c8ed5afa3680feaf4

SHA512
4b0276b255752f13a1b3a41834f9f53337b004320379846937a3d0fa93cd188ad4dc4f0280151d1d63b250bf8120d8feb458dd5357db75f95895244dd538d25d

Download Submit
\Windows\System32\msiexec.exe

Filesize
19KB

MD5
a2a3ab96cf74c5f93293c3a587f94ef5

SHA1
c1344c71a37781cadfdeeca8202bdef021c79282

SHA256
9153f312423568c28bbca0cb690457bbef196d582834251683371cb472a66e3e

SHA512
24efa69594f3c687d388113005c3d77d51945ec19189e9f4b324e645651ae79c6f0e86eaef2b97f850ab4b332f6031acfdb67e0a02fbd049c360c97c95d3c10b

Download Submit
\Windows\System32\snmptrap.exe

Filesize
1.4MB

MD5
da8b90404ed01577193a06a678789a19

SHA1
fd8f6cc372cc887c20028aa8c115c8824ce0e56d

SHA256
c353339dee68541c9a7d479afff2b654506d24d47825503fbdf3a3c3928cb0ca

SHA512
97bc28e45ac2ccb998dc0382af0f9bf83b006bbe68edd5b2e093e46b615ded0b4707b32f20554aaec6c9fd81b27942e061ff6a9a17d3e85dab9870c6e168c4ce

Download Submit
\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
7b8394b2e9a760594179b02e414d03c6

SHA1
1019a9e219156b25f1436211f1eb5107e6d38b79

SHA256
d2ff85b78eb8a663b0769a85b068458ad43de4e226a1169fb36fabd31d0c4526

SHA512
5dd47c32a5c45a77707470e2a270453964593ac2c0431e7a5536e33ff830541a42af367ec5324ff59c5471fce95c7c82b41d0c1763d34b13d9556a306d97e481

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
9dbc29719d8939798d34f417441ddf76

SHA1
af72d4c2add062e4341ea27f355940125b7c72bd

SHA256
79ee8581084f5b89df06152dbb5e674742729923f7dc2404c24837e9f0aaa368

SHA512
c8bd9e17d61d4ff5cddcbb25fd0ebfc4b443dbaf383ea4e21e593b3236fa721d254063d16816c0378f2a344cb6b567c45fb4c56bc7be9f6ff85e6068f550ee94

Download Submit
memory/268-371-0x0000000001000000-0x0000000001060000-memory.dmp

Filesize
384KB

Download
memory/268-350-0x0000000140000000-0x0000000140269000-memory.dmp

Filesize
2.4MB

Download
memory/268-360-0x0000000001000000-0x0000000001060000-memory.dmp

Filesize
384KB

Download
memory/268-366-0x0000000140000000-0x0000000140269000-memory.dmp

Filesize
2.4MB

Download
memory/524-358-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/524-405-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/524-373-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/524-348-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/524-406-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/800-288-0x0000000000330000-0x0000000000397000-memory.dmp

Filesize
412KB

Download
memory/800-352-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/800-290-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/800-314-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/800-375-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/1484-196-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/1484-225-0x0000000010000000-0x0000000010246000-memory.dmp

Filesize
2.3MB

Download
memory/1484-187-0x0000000010000000-0x0000000010246000-memory.dmp

Filesize
2.3MB

Download
memory/1484-188-0x0000000000430000-0x0000000000490000-memory.dmp

Filesize
384KB

Download
memory/1516-172-0x0000000000430000-0x0000000000497000-memory.dmp

Filesize
412KB

Download
memory/1516-178-0x0000000000430000-0x0000000000497000-memory.dmp

Filesize
412KB

Download
memory/1516-207-0x0000000010000000-0x000000001023E000-memory.dmp

Filesize
2.2MB

Download
memory/1516-171-0x0000000010000000-0x000000001023E000-memory.dmp

Filesize
2.2MB

Download
memory/1808-399-0x0000000000870000-0x00000000008D7000-memory.dmp

Filesize
412KB

Download
memory/1808-380-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/1828-353-0x0000000100000000-0x0000000100234000-memory.dmp

Filesize
2.2MB

Download
memory/1828-247-0x00000000005B0000-0x0000000000610000-memory.dmp

Filesize
384KB

Download
memory/1828-250-0x0000000100000000-0x0000000100234000-memory.dmp

Filesize
2.2MB

Download
memory/1828-254-0x00000000005B0000-0x0000000000610000-memory.dmp

Filesize
384KB

Download
memory/1932-228-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Filesize
384KB

Download
memory/1932-236-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Filesize
384KB

Download
memory/1932-237-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Filesize
384KB

Download
memory/1932-304-0x0000000140000000-0x000000014024D000-memory.dmp

Filesize
2.3MB

Download
memory/1932-232-0x0000000140000000-0x000000014024D000-memory.dmp

Filesize
2.3MB

Download
memory/2128-278-0x0000000140000000-0x0000000140251000-memory.dmp

Filesize
2.3MB

Download
memory/2128-296-0x0000000000170000-0x00000000001D0000-memory.dmp

Filesize
384KB

Download
memory/2128-374-0x0000000140000000-0x0000000140251000-memory.dmp

Filesize
2.3MB

Download
memory/2232-411-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2256-393-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/2256-260-0x0000000000460000-0x00000000004C0000-memory.dmp

Filesize
384KB

Download
memory/2256-370-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2256-259-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/2256-298-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/2256-267-0x0000000000460000-0x00000000004C0000-memory.dmp

Filesize
384KB

Download
memory/2388-344-0x0000000000230000-0x0000000000297000-memory.dmp

Filesize
412KB

Download
memory/2388-356-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2400-377-0x00000000005B0000-0x0000000000801000-memory.dmp

Filesize
2.3MB

Download
memory/2400-372-0x0000000100000000-0x0000000100251000-memory.dmp

Filesize
2.3MB

Download
memory/2516-1-0x00000000006C0000-0x0000000000727000-memory.dmp

Filesize
412KB

Download
memory/2516-6-0x00000000006C0000-0x0000000000727000-memory.dmp

Filesize
412KB

Download
memory/2516-0-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2516-169-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2516-7-0x00000000006C0000-0x0000000000727000-memory.dmp

Filesize
412KB

Download
memory/2692-305-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2692-355-0x00000000008B0000-0x0000000000910000-memory.dmp

Filesize
384KB

Download
memory/2692-396-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/2704-53-0x0000000100000000-0x0000000100243000-memory.dmp

Filesize
2.3MB

Download
memory/2704-229-0x0000000100000000-0x0000000100243000-memory.dmp

Filesize
2.3MB

Download
memory/2732-362-0x0000000140000000-0x0000000140255000-memory.dmp

Filesize
2.3MB

Download
memory/2756-336-0x0000000000C70000-0x0000000000CF0000-memory.dmp

Filesize
512KB

Download
memory/2756-413-0x000007FEF43A0000-0x000007FEF4D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-419-0x0000000000C70000-0x0000000000CF0000-memory.dmp

Filesize
512KB

Download
memory/2756-401-0x0000000000C70000-0x0000000000CF0000-memory.dmp

Filesize
512KB

Download
memory/2756-342-0x000007FEF43A0000-0x000007FEF4D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-331-0x000007FEF43A0000-0x000007FEF4D3D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-246-0x0000000140000000-0x000000014023C000-memory.dmp

Filesize
2.2MB

Download
memory/2764-93-0x00000000002D0000-0x0000000000330000-memory.dmp

Filesize
384KB

Download
memory/2764-86-0x00000000002D0000-0x0000000000330000-memory.dmp

Filesize
384KB

Download
memory/2764-85-0x0000000140000000-0x000000014023C000-memory.dmp

Filesize
2.2MB

Download
memory/2792-316-0x0000000140000000-0x000000014024D000-memory.dmp

Filesize
2.3MB

Download
memory/2828-210-0x0000000000650000-0x00000000006B7000-memory.dmp

Filesize
412KB

Download
memory/2828-209-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/2828-216-0x0000000000650000-0x00000000006B7000-memory.dmp

Filesize
412KB

Download
memory/2828-295-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/3056-388-0x000000002E000000-0x000000002E254000-memory.dmp

Filesize
2.3MB

Download
memory/3056-400-0x0000000000540000-0x00000000005A7000-memory.dmp

Filesize
412KB

Download