Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 04:58

General

  • Target

    7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe

  • Size

    1.8MB

  • MD5

    b4a950b36a8a71d5e3769ae5454b6f76

  • SHA1

    d8a5c3c34d909e918d20f10d55a9f2c1c8956d5d

  • SHA256

    7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda

  • SHA512

    7056c999d8152c8ed5ace3b1560e6053dbb2a8c39dd503db50c1f4e6aad970b4b45a406b75502f4fdd4a736392551f6668fd957db45b265f75e5bdcbacf1e59e

  • SSDEEP

    49152:rx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WA4Dmg27RnWGj:rvbjVkjjCAzJ1D527BWG

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 51 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 56 IoCs
  • Modifies data under HKEY_USERS 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe
    "C:\Users\Admin\AppData\Local\Temp\7456bad45e6eb13416c4110685fb6a365adf88e99806e9e2d497e6f3acec4eda.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2724
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2540
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:276
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2716
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1948
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2692
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1976
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2312
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 254 -NGENProcess 25c -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2372
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1ec -NGENProcess 238 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2084
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 264 -NGENProcess 25c -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1d4 -NGENProcess 258 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2944
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1ec -NGENProcess 26c -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1800
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 24c -NGENProcess 258 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 274 -NGENProcess 1d4 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2444
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 238 -NGENProcess 25c -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2320
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 24c -NGENProcess 27c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 254 -NGENProcess 260 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 25c -NGENProcess 284 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:556
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 288 -NGENProcess 260 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2932
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 278 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2244
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 27c -NGENProcess 25c -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1800
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 294 -NGENProcess 254 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2952
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 260 -NGENProcess 28c -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2132
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 25c -NGENProcess 29c -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 298 -NGENProcess 28c -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2404
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 278 -NGENProcess 2a4 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2504
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 2a8 -NGENProcess 28c -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2284
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2356
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2544
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 204 -NGENProcess 1e4 -Pipe 208 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1312
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 254 -NGENProcess 238 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1200
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 25c -NGENProcess 22c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2436
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 204 -NGENProcess 264 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2952
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 230 -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2600
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 268 -NGENProcess 22c -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2432
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1b0 -NGENProcess 204 -Pipe 230 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2148
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1b0 -NGENProcess 204 -Pipe 230 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:488
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 204 -NGENProcess 1e4 -Pipe 1bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2948
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 1dc -Pipe 1b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1920
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 22c -NGENProcess 1dc -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1524
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:1228
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:568
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1644
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2880
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2604
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1708
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:1524
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2076
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2528
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1080

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

          Filesize

          1.3MB

          MD5

          2c9c15fc716d378364a13578fabf5646

          SHA1

          e20d4dd1588c49f160b4bff002b45f77847da6e8

          SHA256

          952ec439ceb3d3a1f2fe4734cb3af5583ec036bec65fa2ce1b60340d3959b911

          SHA512

          4d2b8d76561b5e3d96a15448cbe306886a8a83b583ac9ded43f02a80f9704ce0b1b110955538ca83488ebb6fac2d10e2ddff5ec78c5cf75db9a4934bd406b9d2

        • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

          Filesize

          1.3MB

          MD5

          525a7eeb10109d1f10f04a885a5c2725

          SHA1

          7595f222898d529d7c2b76665b495832e95bd970

          SHA256

          86a2749059e5e7ce7a266c2bea0e8e906affe6deda0d08d7d83610f42338174c

          SHA512

          604cb69c6e31ed749bf6fbd66d3f97c72e9bc04145dac861c92fe984060ffd2104d6b2484db6e3dc8a50802a10d13cf3ba91fe59d4d8aa293ffabd583a04a8ce

        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

          Filesize

          30.1MB

          MD5

          ad0b9f99f439f016e749842587e53129

          SHA1

          fdda5472fb42656b106ac2896c7ce764e8ee5986

          SHA256

          7327a9a8d5b07676a6f207fa02f3a4d937fdf9442bedbcce20b5ef99b8607d2b

          SHA512

          dc1f618a27da9683a200d4eefb79a65ace9aab5caaeb36e0be3221371005831c0513e43206424720268c5f40a1a7280ec1b8c58e2ff3cb9c0ac35f7e504a9331

        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

          Filesize

          1.4MB

          MD5

          4384094d9accfa80e182239e0c48e524

          SHA1

          ef74476b48434906ecd29d8f6593c9b2c29c23a0

          SHA256

          f246a0f776e7899a17d85267f92318178826aa8e96e3e197d2b13a84e1a9b4f5

          SHA512

          fbb43316bf523d50ac0109a614c65a35c30bdb276c6c42626f5272f06ee1bdfe492731d23a6e855205d434b9569b7088c7f36381c8ea5f002b258b8bc105d7bc

        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

          Filesize

          5.2MB

          MD5

          b1df58a56062699f5b9ff929340adbc7

          SHA1

          9d4f3598d2484f3c5b6a58322d156858809c8d41

          SHA256

          c1f25f7489c0d04b13e8ade39060c1be5c442ab5ee6cf60a586b8b6dd6457a5b

          SHA512

          457614d017ef129ad040916bccc1cf39bddad438d8c519a9ec75047cf1eabbea002b29543d4906626e57f4c5e39126d2561735aced1fc2c38dfbb1bd24218964

        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

          Filesize

          2.1MB

          MD5

          40a781bf935f7bf4fc6bf4827404838c

          SHA1

          7c292e7f8b622bf1c37496a1a3fe193f88ea85fa

          SHA256

          e058b7f94ca12ca6abf5347eee728538ac0d9c15b3200d74632a9b3fd26f801b

          SHA512

          9e80085f22cd49cd80c49832710b87ad501819dd41c3966a47c69d35fb566ea845a6ad875839c671b3497d14dd98bb9f77391bbfc779a78a9124efb797d47a2f

        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

          Filesize

          872KB

          MD5

          af901fc78eafa2f8d24dbfebf108863a

          SHA1

          d049976aceddf160c22b2af0e5bd7cf58b41d288

          SHA256

          f141cbdd8f643cf869bc0d48fe6e5487544e3372c5a5d0cbf9dd9017f7e0ee53

          SHA512

          c5fc1d1821170eec48eb3388bf07e56ba567aa57d43766caea091197d4bce9ec4e3ab0608a56be46eec017b73f5e8f22c522540706e675d206543cdcdb765571

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          60852a44909c11dcfea9cd9951876faf

          SHA1

          ac224a6e39a19bafba39d9a4f556a64fba3404ae

          SHA256

          b1fda08fa153a8771e6deed08a529a99a43aa39de09bbe010cec2835eef9d38a

          SHA512

          9c62f54929edc0716e5e3e50954965d3618680326a2b4458667c9af3eb4fcff048b30af2462334af139cd673060d4a380db8e9d68f6612a4f41f11ad6237eb2e

        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

          Filesize

          8KB

          MD5

          8804835fb71ad482679c97d1a767cbf6

          SHA1

          9c5031e7245a57883de199c72f142f15aa156412

          SHA256

          8752635640ff0d51191c33a91a8b3a7c1ba5f57af860471d288c9549b301f827

          SHA512

          ba209979712a3059cc91ab79096318d21bf764773f0c4c517408f02ed621ca54bfcfbe760b8dde4a6651af289fe99b7dcc739883f281680ba7241a41a016ba97

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

          Filesize

          1.2MB

          MD5

          3bb514157d03efe49848151c4cc15b95

          SHA1

          52752b808b209496e86ba99133f0ffd2fabfc683

          SHA256

          6559339dd340db887063d4104aa01987e4384b686472d813f96ffa7c88006eec

          SHA512

          d19ef771211db4b16f6193fd77b59a60743329bf074792c0d6bc23b35bd8eb5d9a672e1db996ca739f0568da39c1024bb76cd754898a15236759dd72df5b1569

        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

          Filesize

          1003KB

          MD5

          44c2c379f4fac49e09d5d97d6fefbc19

          SHA1

          8f135d2f16edc2065bb748fa2b99a0753f4e8d1d

          SHA256

          b5d08f4e4697aaeef01befd6feb5ea59d3e25bcf16818b41b3b95dc4c8de2651

          SHA512

          2916ed2d57b4b3137332018ce97a0159db7aa4eef28a33a7ed260f4af909c4f8809a8aa4799b0b68bd9aeff1acf767fb1593decd6b7fcd9d935637bbbe670c9c

        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          dd64d7d0ef550daff1564299cb986598

          SHA1

          353c52da98ae664d19d7ba8374603a71d82eb393

          SHA256

          03063760f660c87af11661c2ddd00547f8d9f1c6a0922444980713c959e49745

          SHA512

          de6169ac2710934ddfdaf696623bf2a97c37125859af2fa0425bc7fbc7a5ee4e4f933ada6940feca8bf3d94bdb6c171fe58d558f41f43bb9903a7e2a2374caaa

        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

          Filesize

          58KB

          MD5

          3d6987fc36386537669f2450761cdd9d

          SHA1

          7a35de593dce75d1cb6a50c68c96f200a93eb0c9

          SHA256

          34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

          SHA512

          1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

        • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

          Filesize

          298KB

          MD5

          5fd34a21f44ccbeda1bf502aa162a96a

          SHA1

          1f3b1286c01dea47be5e65cb72956a2355e1ae5e

          SHA256

          5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

          SHA512

          58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

        • C:\Windows\ehome\ehsched.exe

          Filesize

          1.3MB

          MD5

          0354d2c411aef97b1d2889d8eee6b777

          SHA1

          918ab3d3d43369ce927e6cc5d804d7c03bc74726

          SHA256

          30e49cdd76f8b343d5a15068a8b7c74b1b9fc8b33e8ba61d945681e63e2759cf

          SHA512

          3e02b754bfcdeb0ebbd1bcdd6cd9cc2cb781f30bf920f7755d68464cdbcd403d98a3ed6dd3cb0556654f57be46f2605c1483aad2bdb4736defa4edba43791ef0

        • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

          Filesize

          1.3MB

          MD5

          245cd3d10f21cd331f164f0c8b1ba655

          SHA1

          f6d0a11d76a2a4ef561236100225b22bdda59fa1

          SHA256

          a0bdf6d60a699f04b7f8e7a3a415e78cfadda4d954d37fca18d2fdebf952911c

          SHA512

          7b8c7806cc980ff625c58fb481640f161b9859eb39eeee68254a5eb7da2b84c5b023bf1a3085cb231ea0fa9787bc41cb527929bdccc249a21792db6fa7ec71b9

        • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

          Filesize

          1.2MB

          MD5

          181c7a44276d7732c1527e6ae4c8bc3f

          SHA1

          b585335903e6667227f8a603e3b688b138ec177d

          SHA256

          223a02978c1312c683a849090b9dc5f31bac7891778eeabf573d110de7dececd

          SHA512

          1ff033d915eaf1a6e98c4edbb39295befb9d186b9a2ba9a72923990c0a7f54683f0d630437da3faf6dbedb0790118d0216065c12a34630d353168838ba84f0da

        • \Windows\System32\alg.exe

          Filesize

          1.3MB

          MD5

          e4d53eb18d1a6a3703fd44f75c1ee595

          SHA1

          11c606b2e03666ffe33c1e08c16821f1f9df24bc

          SHA256

          70c24dbc3ded0acf08fdf4f5277bc4f5ac390d772ee4ec31a20ae7854a86633b

          SHA512

          ee9309317c4da07367ae3d46929f556e8303fb5b5e2340cdd71a26a780ac3d83f715e78e1cfe9b06c39aafd57db29eb1f3bd9297c74b1fcf34724195828c31df

        • \Windows\System32\dllhost.exe

          Filesize

          1.2MB

          MD5

          59a15037577598563198fda62104028e

          SHA1

          3e703825ebecd5b668d1658017c382d7ba1ea60c

          SHA256

          2cfa6a0bed59a8457077d89d3b4282ca0887599b1f97a57b79cbd2d7b89f2386

          SHA512

          408471194acb3288f29d5f4244df3cbf5bcae836c2db3bd04a5b3c558ec16e932a76b84eba1673809091a19aae45b28bc2172b46b92137158ec422e8e595f29c

        • \Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPCEE3.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

          Filesize

          85KB

          MD5

          5180107f98e16bdca63e67e7e3169d22

          SHA1

          dd2e82756dcda2f5a82125c4d743b4349955068d

          SHA256

          d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

          SHA512

          27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

        • \Windows\ehome\ehrecvr.exe

          Filesize

          1.2MB

          MD5

          1bdce016f4c4f494807a43509b0d2f09

          SHA1

          85d29385f33eea0c92d5e9fdc04f16a864fddf8c

          SHA256

          8fd57800bcaded554c49120d8655d0ab9e354512e9805baee1b24cd4b0546f9d

          SHA512

          300fc6361f772df72eb5b606d18250f971729bff6a09f71c47f6fbcefbfa2498785a2dee365584db9b416437931a4b951d52b4ea2161251f378f671342ff3281

        • memory/276-172-0x0000000140000000-0x00000001401DC000-memory.dmp

          Filesize

          1.9MB

        • memory/276-94-0x0000000140000000-0x00000001401DC000-memory.dmp

          Filesize

          1.9MB

        • memory/568-270-0x0000000000B80000-0x0000000000BE0000-memory.dmp

          Filesize

          384KB

        • memory/568-173-0x0000000000B80000-0x0000000000BE0000-memory.dmp

          Filesize

          384KB

        • memory/568-321-0x0000000140000000-0x00000001401F1000-memory.dmp

          Filesize

          1.9MB

        • memory/568-176-0x0000000140000000-0x00000001401F1000-memory.dmp

          Filesize

          1.9MB

        • memory/1228-325-0x0000000001A30000-0x0000000001A31000-memory.dmp

          Filesize

          4KB

        • memory/1228-267-0x0000000001A30000-0x0000000001A31000-memory.dmp

          Filesize

          4KB

        • memory/1228-158-0x00000000002B0000-0x0000000000310000-memory.dmp

          Filesize

          384KB

        • memory/1228-161-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/1228-166-0x00000000002B0000-0x0000000000310000-memory.dmp

          Filesize

          384KB

        • memory/1228-175-0x0000000001990000-0x00000000019A0000-memory.dmp

          Filesize

          64KB

        • memory/1228-313-0x0000000140000000-0x000000014013C000-memory.dmp

          Filesize

          1.2MB

        • memory/1228-171-0x0000000001980000-0x0000000001990000-memory.dmp

          Filesize

          64KB

        • memory/1644-296-0x0000000140000000-0x0000000140237000-memory.dmp

          Filesize

          2.2MB

        • memory/1948-113-0x0000000010000000-0x00000000101E6000-memory.dmp

          Filesize

          1.9MB

        • memory/1976-353-0x0000000073C90000-0x000000007437E000-memory.dmp

          Filesize

          6.9MB

        • memory/1976-354-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/1976-327-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/1976-333-0x0000000000230000-0x0000000000297000-memory.dmp

          Filesize

          412KB

        • memory/1976-338-0x0000000073C90000-0x000000007437E000-memory.dmp

          Filesize

          6.9MB

        • memory/2020-147-0x00000000003F0000-0x0000000000450000-memory.dmp

          Filesize

          384KB

        • memory/2020-143-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2020-298-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2020-138-0x00000000003F0000-0x0000000000450000-memory.dmp

          Filesize

          384KB

        • memory/2084-380-0x00000000007D0000-0x0000000000837000-memory.dmp

          Filesize

          412KB

        • memory/2084-376-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/2140-121-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/2140-126-0x00000000002F0000-0x0000000000357000-memory.dmp

          Filesize

          412KB

        • memory/2140-120-0x00000000002F0000-0x0000000000357000-memory.dmp

          Filesize

          412KB

        • memory/2140-271-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/2312-369-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/2312-355-0x0000000073C90000-0x000000007437E000-memory.dmp

          Filesize

          6.9MB

        • memory/2312-368-0x0000000073C90000-0x000000007437E000-memory.dmp

          Filesize

          6.9MB

        • memory/2312-350-0x0000000000BC0000-0x0000000000C27000-memory.dmp

          Filesize

          412KB

        • memory/2312-348-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/2356-288-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

          Filesize

          9.9MB

        • memory/2356-286-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2356-180-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

        • memory/2356-186-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

        • memory/2356-263-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2356-278-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

          Filesize

          9.9MB

        • memory/2356-287-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

        • memory/2372-373-0x0000000073C90000-0x000000007437E000-memory.dmp

          Filesize

          6.9MB

        • memory/2372-365-0x0000000000230000-0x0000000000297000-memory.dmp

          Filesize

          412KB

        • memory/2372-358-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/2372-384-0x0000000073C90000-0x000000007437E000-memory.dmp

          Filesize

          6.9MB

        • memory/2540-15-0x0000000000840000-0x00000000008A0000-memory.dmp

          Filesize

          384KB

        • memory/2540-34-0x0000000000840000-0x00000000008A0000-memory.dmp

          Filesize

          384KB

        • memory/2540-159-0x0000000100000000-0x00000001001E3000-memory.dmp

          Filesize

          1.9MB

        • memory/2540-16-0x0000000100000000-0x00000001001E3000-memory.dmp

          Filesize

          1.9MB

        • memory/2540-31-0x0000000000840000-0x00000000008A0000-memory.dmp

          Filesize

          384KB

        • memory/2544-294-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2544-304-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

          Filesize

          9.9MB

        • memory/2544-297-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

        • memory/2544-295-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

          Filesize

          9.9MB

        • memory/2544-317-0x0000000140000000-0x00000001401ED000-memory.dmp

          Filesize

          1.9MB

        • memory/2544-316-0x00000000001E0000-0x0000000000240000-memory.dmp

          Filesize

          384KB

        • memory/2604-374-0x0000000000FA0000-0x0000000001020000-memory.dmp

          Filesize

          512KB

        • memory/2604-318-0x0000000000FA0000-0x0000000001020000-memory.dmp

          Filesize

          512KB

        • memory/2604-293-0x000007FEF2B20000-0x000007FEF34BD000-memory.dmp

          Filesize

          9.6MB

        • memory/2604-345-0x0000000000FA0000-0x0000000001020000-memory.dmp

          Filesize

          512KB

        • memory/2604-343-0x000007FEF2B20000-0x000007FEF34BD000-memory.dmp

          Filesize

          9.6MB

        • memory/2604-291-0x000007FEF2B20000-0x000007FEF34BD000-memory.dmp

          Filesize

          9.6MB

        • memory/2604-292-0x0000000000FA0000-0x0000000001020000-memory.dmp

          Filesize

          512KB

        • memory/2604-299-0x0000000000FA0000-0x0000000001020000-memory.dmp

          Filesize

          512KB

        • memory/2692-322-0x0000000073C90000-0x000000007437E000-memory.dmp

          Filesize

          6.9MB

        • memory/2692-337-0x0000000073C90000-0x000000007437E000-memory.dmp

          Filesize

          6.9MB

        • memory/2692-307-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/2692-315-0x00000000005F0000-0x0000000000657000-memory.dmp

          Filesize

          412KB

        • memory/2692-336-0x0000000000400000-0x00000000005E7000-memory.dmp

          Filesize

          1.9MB

        • memory/2716-103-0x0000000000230000-0x0000000000297000-memory.dmp

          Filesize

          412KB

        • memory/2716-131-0x0000000010000000-0x00000000101DE000-memory.dmp

          Filesize

          1.9MB

        • memory/2716-98-0x0000000000230000-0x0000000000297000-memory.dmp

          Filesize

          412KB

        • memory/2716-97-0x0000000010000000-0x00000000101DE000-memory.dmp

          Filesize

          1.9MB

        • memory/2724-139-0x0000000000400000-0x00000000005D4000-memory.dmp

          Filesize

          1.8MB

        • memory/2724-0-0x0000000000400000-0x00000000005D4000-memory.dmp

          Filesize

          1.8MB

        • memory/2724-1-0x00000000006C0000-0x0000000000727000-memory.dmp

          Filesize

          412KB

        • memory/2724-260-0x0000000000400000-0x00000000005D4000-memory.dmp

          Filesize

          1.8MB

        • memory/2724-6-0x00000000006C0000-0x0000000000727000-memory.dmp

          Filesize

          412KB