Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 23:03

General

  • Target

    313f13e3302b66922638dd97d0f2574d221b209ba2532a2643b2974d23068685.exe

  • Size

    1.8MB

  • MD5

    65f9480d805c9528ab0c6edb024dcfec

  • SHA1

    34a21a437ddeab55a250b4e12e110edacef8c81c

  • SHA256

    313f13e3302b66922638dd97d0f2574d221b209ba2532a2643b2974d23068685

  • SHA512

    38ac2c0c4788799eabbdc3bad57e88a4a9594eaaec1feedf7de5513a62b968d1ff905fd6f5c1da9c77db542edd71c42daa734f53effe26a898ece2ca30255ee7

  • SSDEEP

    49152:Fx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WA73wCapGZ1eNvM:FvbjVkjjCAzJegCapC1eNvM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Modifies data under HKEY_USERS 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\313f13e3302b66922638dd97d0f2574d221b209ba2532a2643b2974d23068685.exe
    "C:\Users\Admin\AppData\Local\Temp\313f13e3302b66922638dd97d0f2574d221b209ba2532a2643b2974d23068685.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2036
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2520
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2688
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2740
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1256
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 1e8 -NGENProcess 1f4 -Pipe 1f8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2732
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 258 -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2916
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 264 -NGENProcess 278 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 204 -NGENProcess 2a4 -Pipe 2ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3012
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2d8 -NGENProcess 2a8 -Pipe 2cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2460
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2a8 -NGENProcess 250 -Pipe 2b4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1028
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2f8 -NGENProcess 2c8 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1704
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 2f8 -NGENProcess 2e8 -Pipe 2fc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1088
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 340 -NGENProcess 2c8 -Pipe 33c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1928
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 340 -NGENProcess 2f8 -Pipe 2c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2716
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 338 -NGENProcess 2c8 -Pipe 348 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:776
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 338 -NGENProcess 340 -Pipe 344 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2132
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 354 -Pipe 2c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 358 -NGENProcess 364 -Pipe 334 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:604
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 368 -NGENProcess 354 -Pipe 350 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1552
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 34c -NGENProcess 358 -Pipe 368 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:892
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 36c -NGENProcess 37c -Pipe 354 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2008
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 1bc -NGENProcess 2dc -Pipe 2f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 2a0 -NGENProcess 340 -Pipe 378 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2940
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 21c -NGENProcess 304 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2168
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2a4 -NGENProcess 2e4 -Pipe 21c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2316
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1564
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:860
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:2820
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1716
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1020
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:996
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1448
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:2532
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:2416
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2636
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:1600
  • C:\Windows\system32\IEEtwCollector.exe
    C:\Windows\system32\IEEtwCollector.exe /V
    1⤵
    • Executes dropped EXE
    PID:632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    1.3MB

    MD5

    a021f77e592d493cb83972bd95e1b31b

    SHA1

    0933086459e11664c0edf62cbb1dfbf3cb394e15

    SHA256

    9d277abe7f0e7fd0d30c087fffb7423553a8145920ca3e0efb54093bf85b0901

    SHA512

    fb78f43ca755217dde163454aee43261a77273271e4cbe8f20c912a10af8bbe03f0981fadb38aec0f7eeda13f83da9911a37f5d238c27f03163ab040ab73bfc7

  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

    Filesize

    30.1MB

    MD5

    d418e0795e8a7d99063156b0ca0a8dd9

    SHA1

    2a74a58dafc95d1092d28f4a80c89ac07bdcc5b8

    SHA256

    9093f6c74c38b8e41f9e2f5183efee8af3f907128499ba252408bda90207afb6

    SHA512

    12f4ae69ad2b36dc9424b3a49c3fa308b66efd2aabc9f183ff32e49ae2d3db24bb4cb53b2ccc4340cc34a7dc9a742126bf247bda5ebfbf580cb1c8d89756af40

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    1.4MB

    MD5

    617857d9a826395f074c7036d83de866

    SHA1

    38eda2881f4638999deaff178b15a1ccf70eebe3

    SHA256

    28ed918173e1f625843acafa97c1395f3b15a66789343b98cec7a8b1716d03cc

    SHA512

    748e0b9449670151c22384c033d21a992b0634022d3808205e097da4798fc5eb5f7788cfe0fd446e45f1d1cae6a69bbe93f2255974ad739d7a32ade403b1ad6c

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

    Filesize

    5.2MB

    MD5

    6ae22e7ea6f7e975dc072b0c221ae4a2

    SHA1

    abc4ce7418a7f6fb22cadfe0fc58815651716379

    SHA256

    ba0ebf7973400cf9f314124cc030318bba35a7db4651a95e953285f4f3b9f814

    SHA512

    0584bb5988be355bb0f6de14b7faeb750333f4a4992693c7f507d4fe9063293f179e2c50fbdc7aa3f88a51eb1a44de430de0abe13af7719532652eb4b21185d8

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

    Filesize

    2.1MB

    MD5

    0b3c9f1a1f5f6c0f4ed49defa01b934d

    SHA1

    fedea509394e3e3a0f3e3f79180676dddb3197ce

    SHA256

    a6a8fd76b950c11ee910f1812b9590a145c7e218c019da8362efdff7a8260139

    SHA512

    5e743bc68d604f54426037b5e84f88dda6d9e46b077a481055a40ce72f6200b9992347e3afb205a4799e7d69fe38d835f95b06b1172a913e8c4fb3a8e5ac86e9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

    Filesize

    24B

    MD5

    b9bd716de6739e51c620f2086f9c31e4

    SHA1

    9733d94607a3cba277e567af584510edd9febf62

    SHA256

    7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

    SHA512

    cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

    Filesize

    872KB

    MD5

    d6cac29b03f02fa65c365b31fb557124

    SHA1

    cc86eb5e4f93434a2b09ee5d3c9e9e5b730c6d68

    SHA256

    aa1eab8a0cbcafc7739496937bd41abc04a56298f89fef0f8f1cb97c8aaf93b2

    SHA512

    08995b2d0c208c7d2224ecf95396f38c91f8dd45d87e782cd62de6d228e55b65c537428d58b1f3a6aa85b3ecd29434496997cc07b1bc1280eba9e413257339f5

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

    Filesize

    1.3MB

    MD5

    3c4da69e28b52bbf5d634f1547b1c45f

    SHA1

    8f775435dddbe653a1284ca266844666bc4ac342

    SHA256

    297fc78ef5ec19dd456e5816c5e2ec75c8e1a04215117b6fe121b3ed620e5640

    SHA512

    199c62f2631b7b743d05bfc45947f81089c4ca51894ccfa2d54622c6684456bdae2edcc18f6bae9bce0b1e98d4ca37297e5eecae5cee485aaaea227481e467f0

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

    Filesize

    1.3MB

    MD5

    ce5e632bb8f456d8146483ed17d96a69

    SHA1

    717cf437418e37a71b63fff46543673e54a68968

    SHA256

    a76991661992e394b805cf57054faf7d63d351919fd00e2d55b1c83fd7944f35

    SHA512

    1657d5374ce9f4e81569183b8adbf74deddb25f422c05e15237e99939351263fbc51558c82cd36b72a32acb4b9975f4c09b69acb086dd8662cb8d08181230516

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

    Filesize

    1003KB

    MD5

    ba6fcaa0bf057ba7b5d45ab284e5f802

    SHA1

    1232b07f0cb9e68ed3d3b7115667b18bfa70adaf

    SHA256

    4c8711c0697270f8cf5f619ca7040410325ee2027ab81a5dc38073274bf58f0a

    SHA512

    6a962a80cd52b81c4e28de57567b837d724717edae40b39b9b2132ced5f8d1c1dea116f197c45fedd97f45d98fca88d588482fd76bcf531efcf6f1a8379aa257

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

    Filesize

    1.3MB

    MD5

    0438f5eba6fdc8621c5886813b616807

    SHA1

    263680f47f040c76b3c3494955f213ffffe08371

    SHA256

    cdb2feda648354aca00d540a696b5f7d2984e5062aed83288530d3686a9fe0d2

    SHA512

    7216627f24713947587b94a9743b0802c03c25b74f4eb3bdb65e8d732f5dfdd6025c9535ac544deea32c25f2c0153c2bb205409672ffc406df654ba647d1f1f0

  • C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\10e773bd2a37835d.bin

    Filesize

    12KB

    MD5

    47503efd1f5ad82e7036f2d1f4f09614

    SHA1

    a2b16bd04c4161d128b4fd5e76185970d80bc3ee

    SHA256

    76e0fd58cad62af4c40292cea7f469623399b32548f64d202fe0d592595ac261

    SHA512

    1c080990b118ee9702f4199712d3dd422fdba30e4c435c0284877537e28f3b6e1da4b23de43de68727e90b328514ae7e63b884f86d4438dbaebb274513da67b9

  • C:\Windows\ehome\ehsched.exe

    Filesize

    1.3MB

    MD5

    10c2689ec8f1c795b954c39c21847639

    SHA1

    bb6a906fb38b5a97ab28c28b6d29749c4cf01c23

    SHA256

    bcabb718ece3a67bfe002ee38dfbea888920a73ca409902869c575b5ba19d8a3

    SHA512

    33beb46a0b5db00d310966309e7759d8e53b6799de279dee59d6b6a7559292e122c62f6f14bdcdbeb3c82ed6e9604e26738c994bc14b5cf2f12365fe450a8326

  • C:\Windows\system32\fxssvc.exe

    Filesize

    1.2MB

    MD5

    14b2251fc203ded0631055d079e585e1

    SHA1

    dce363b9eb9ca070e3874923c04330b035813e75

    SHA256

    a91a07d29cf7645a038e283a4b1ff74fe7ca5b99defaa61fdf11e506c6966fc1

    SHA512

    1dc1023ad8412138cec4d624217da8dbbb1758ad1edc1dd6d60ca29ad3a9430584ea8ed842c03a4f8298de89dc9e5d872769e0ab0cd976dc796f7421709f383e

  • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

    Filesize

    1.3MB

    MD5

    0ff47e7ece9046918bbdbf30ebd2704f

    SHA1

    b5874dcf394a050e160c36dfabe2d1e832f07b9e

    SHA256

    c45789e20ef7d1f6e6e7c9a12a2c3e3fa9697d288d7902f8641967eacc037238

    SHA512

    da8f3b4c0a917088e3ef713f018cf3d700b34be4f7b13bf972cdebf523bf3e70f50a0b2f48bec9c80c903d2d9d0b1b8d04d0cfb9d5280bc815b21516144dabdb

  • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

    Filesize

    1.2MB

    MD5

    59b69cd07aba96c7d6992fe6eac74805

    SHA1

    f89c1803ecaa7d79120b3f1ee2c6ab8193e9654c

    SHA256

    aa8b1066edb6add4efcc315a7f80fe041f29d97fa0f02f470379ac3cf2471584

    SHA512

    d7d99b131f358318c7d3d3b063da16239290e9ea053d8fb6a05b04582158e8a4512d9bad0fbdba202381c69efe5769682ddbb82606577e379a2915b845078301

  • \Windows\System32\alg.exe

    Filesize

    1.3MB

    MD5

    1422c614139f6c6bc20a31896b7f353c

    SHA1

    2f8ef3b2b1a7c00a914397c083fcbfcdbdb43728

    SHA256

    7fd3cadeb6d2465f00ad96ed405c6d4c0957853d4a2687d12a59a88b3e501d1c

    SHA512

    15ed750254f8b8f200f6e90a8700f372f2eaf3a77cca4fb6810325b40a5bb5f85b6bd2da45a4aab8b72138592f1d9d0e1757d2f5f78c6d0a23f92f789af78bc8

  • \Windows\System32\dllhost.exe

    Filesize

    1.2MB

    MD5

    656d23f70490865aa28cb487956341b1

    SHA1

    7c3854f8f41a6a07b42f1f93359d0e6a795a03a6

    SHA256

    947eb89d2a112ded4dc6ac4a76a27ad4d9820fcb182faf1a48d99eef2cefab96

    SHA512

    7b8bbf9de34df61332b14402e893a7d8eb1b01c45f5948190b6903457e53edc279c919a5169b10e336f85195e1c089a2cdad84cb461711a71f814b74e309b1e5

  • \Windows\System32\ieetwcollector.exe

    Filesize

    1.3MB

    MD5

    80ea404d033df4d830884817f65ef5f1

    SHA1

    167f6d30b852785777cf56bd33f31016a26d5322

    SHA256

    e6484a0bbba4466f810e19d8086697c6943b23f430b11f10da5fbdfee41640cf

    SHA512

    cf9a8308e8a827bd684fd185e1fcb78348066db4382ede702d4d01b7fe997c6c828cf0090d5b47e75002777d0b815150feccad5e7c6893df895899b2b48bf3ab

  • \Windows\ehome\ehrecvr.exe

    Filesize

    1.2MB

    MD5

    ed9bf0f3cbdf09e82ee6bb2d7aec5628

    SHA1

    f465202b5aca6e2328200c40ec5fb1f247b94caa

    SHA256

    fabbf9ccf93156a7fdc72e4b755cbfda0f2f3b225428ed606421d95e485f3117

    SHA512

    654640b9436f32465f02cd0ba721921bd0d80e7a846c976c20d37f08c55d4dce87cc7984f37ac87f89db3b0653a2b09d874d087404016655e6e25a25f74599f2

  • memory/860-169-0x0000000001A30000-0x0000000001A31000-memory.dmp

    Filesize

    4KB

  • memory/860-287-0x0000000140000000-0x000000014013C000-memory.dmp

    Filesize

    1.2MB

  • memory/860-160-0x0000000001990000-0x00000000019A0000-memory.dmp

    Filesize

    64KB

  • memory/860-158-0x0000000001980000-0x0000000001990000-memory.dmp

    Filesize

    64KB

  • memory/860-141-0x0000000000180000-0x00000000001E0000-memory.dmp

    Filesize

    384KB

  • memory/860-143-0x0000000140000000-0x000000014013C000-memory.dmp

    Filesize

    1.2MB

  • memory/860-149-0x0000000000180000-0x00000000001E0000-memory.dmp

    Filesize

    384KB

  • memory/996-270-0x000007FEF4A60000-0x000007FEF53FD000-memory.dmp

    Filesize

    9.6MB

  • memory/996-323-0x000007FEF4A60000-0x000007FEF53FD000-memory.dmp

    Filesize

    9.6MB

  • memory/996-314-0x0000000000C20000-0x0000000000CA0000-memory.dmp

    Filesize

    512KB

  • memory/996-333-0x0000000000C20000-0x0000000000CA0000-memory.dmp

    Filesize

    512KB

  • memory/996-423-0x0000000000C20000-0x0000000000CA0000-memory.dmp

    Filesize

    512KB

  • memory/996-427-0x0000000000C20000-0x0000000000CA0000-memory.dmp

    Filesize

    512KB

  • memory/996-336-0x000007FEF4A60000-0x000007FEF53FD000-memory.dmp

    Filesize

    9.6MB

  • memory/996-269-0x0000000000C20000-0x0000000000CA0000-memory.dmp

    Filesize

    512KB

  • memory/996-268-0x000007FEF4A60000-0x000007FEF53FD000-memory.dmp

    Filesize

    9.6MB

  • memory/1020-174-0x0000000140000000-0x0000000140237000-memory.dmp

    Filesize

    2.2MB

  • memory/1020-319-0x0000000140000000-0x0000000140237000-memory.dmp

    Filesize

    2.2MB

  • memory/1020-173-0x00000000008A0000-0x0000000000900000-memory.dmp

    Filesize

    384KB

  • memory/1020-254-0x00000000008A0000-0x0000000000900000-memory.dmp

    Filesize

    384KB

  • memory/1256-105-0x0000000010000000-0x000000001014E000-memory.dmp

    Filesize

    1.3MB

  • memory/1256-151-0x0000000010000000-0x000000001014E000-memory.dmp

    Filesize

    1.3MB

  • memory/1448-331-0x0000000100000000-0x000000010013C000-memory.dmp

    Filesize

    1.2MB

  • memory/1448-258-0x0000000100000000-0x000000010013C000-memory.dmp

    Filesize

    1.2MB

  • memory/1448-259-0x00000000008B0000-0x0000000000910000-memory.dmp

    Filesize

    384KB

  • memory/1448-265-0x00000000008B0000-0x0000000000910000-memory.dmp

    Filesize

    384KB

  • memory/1564-131-0x0000000140000000-0x0000000140155000-memory.dmp

    Filesize

    1.3MB

  • memory/1600-357-0x0000000100000000-0x0000000100542000-memory.dmp

    Filesize

    5.3MB

  • memory/1600-370-0x0000000072698000-0x00000000726AD000-memory.dmp

    Filesize

    84KB

  • memory/1600-461-0x0000000100000000-0x0000000100542000-memory.dmp

    Filesize

    5.3MB

  • memory/1600-325-0x0000000100000000-0x0000000100542000-memory.dmp

    Filesize

    5.3MB

  • memory/1600-338-0x0000000000820000-0x0000000000880000-memory.dmp

    Filesize

    384KB

  • memory/1884-118-0x0000000000B50000-0x0000000000BB7000-memory.dmp

    Filesize

    412KB

  • memory/1884-112-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/1884-113-0x0000000000B50000-0x0000000000BB7000-memory.dmp

    Filesize

    412KB

  • memory/1884-272-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/2036-6-0x0000000000240000-0x00000000002A7000-memory.dmp

    Filesize

    412KB

  • memory/2036-0-0x0000000000400000-0x00000000005D4000-memory.dmp

    Filesize

    1.8MB

  • memory/2036-1-0x0000000000240000-0x00000000002A7000-memory.dmp

    Filesize

    412KB

  • memory/2036-250-0x0000000000400000-0x00000000005D4000-memory.dmp

    Filesize

    1.8MB

  • memory/2036-140-0x0000000000400000-0x00000000005D4000-memory.dmp

    Filesize

    1.8MB

  • memory/2416-297-0x00000000009F0000-0x0000000000A50000-memory.dmp

    Filesize

    384KB

  • memory/2416-304-0x00000000009F0000-0x0000000000A50000-memory.dmp

    Filesize

    384KB

  • memory/2416-301-0x0000000140000000-0x0000000140171000-memory.dmp

    Filesize

    1.4MB

  • memory/2416-289-0x0000000140000000-0x0000000140171000-memory.dmp

    Filesize

    1.4MB

  • memory/2460-482-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/2520-156-0x0000000100000000-0x000000010014B000-memory.dmp

    Filesize

    1.3MB

  • memory/2520-12-0x0000000100000000-0x000000010014B000-memory.dmp

    Filesize

    1.3MB

  • memory/2532-283-0x000000002E000000-0x000000002FE1E000-memory.dmp

    Filesize

    30.1MB

  • memory/2532-284-0x0000000000980000-0x00000000009E7000-memory.dmp

    Filesize

    412KB

  • memory/2532-274-0x0000000000980000-0x00000000009E7000-memory.dmp

    Filesize

    412KB

  • memory/2532-358-0x000000002E000000-0x000000002FE1E000-memory.dmp

    Filesize

    30.1MB

  • memory/2636-311-0x000000002E000000-0x000000002E15C000-memory.dmp

    Filesize

    1.4MB

  • memory/2636-408-0x000000002E000000-0x000000002E15C000-memory.dmp

    Filesize

    1.4MB

  • memory/2688-49-0x0000000140000000-0x0000000140144000-memory.dmp

    Filesize

    1.3MB

  • memory/2688-168-0x0000000140000000-0x0000000140144000-memory.dmp

    Filesize

    1.3MB

  • memory/2732-320-0x00000000002F0000-0x0000000000357000-memory.dmp

    Filesize

    412KB

  • memory/2732-312-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/2732-365-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/2732-356-0x0000000074160000-0x000000007484E000-memory.dmp

    Filesize

    6.9MB

  • memory/2740-87-0x0000000010000000-0x0000000010146000-memory.dmp

    Filesize

    1.3MB

  • memory/2740-88-0x0000000000430000-0x0000000000497000-memory.dmp

    Filesize

    412KB

  • memory/2740-130-0x0000000010000000-0x0000000010146000-memory.dmp

    Filesize

    1.3MB

  • memory/2740-94-0x0000000000430000-0x0000000000497000-memory.dmp

    Filesize

    412KB

  • memory/2820-310-0x0000000140000000-0x0000000140159000-memory.dmp

    Filesize

    1.3MB

  • memory/2820-166-0x0000000000BB0000-0x0000000000C10000-memory.dmp

    Filesize

    384KB

  • memory/2820-157-0x0000000000BB0000-0x0000000000C10000-memory.dmp

    Filesize

    384KB

  • memory/2820-161-0x0000000140000000-0x0000000140159000-memory.dmp

    Filesize

    1.3MB

  • memory/2916-360-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/2916-363-0x0000000074160000-0x000000007484E000-memory.dmp

    Filesize

    6.9MB

  • memory/2916-403-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/2916-359-0x0000000000380000-0x00000000003E7000-memory.dmp

    Filesize

    412KB

  • memory/2916-404-0x0000000074160000-0x000000007484E000-memory.dmp

    Filesize

    6.9MB

  • memory/3008-396-0x0000000000550000-0x00000000005B7000-memory.dmp

    Filesize

    412KB

  • memory/3008-383-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/3008-406-0x0000000074160000-0x000000007484E000-memory.dmp

    Filesize

    6.9MB

  • memory/3012-429-0x0000000000400000-0x000000000054F000-memory.dmp

    Filesize

    1.3MB

  • memory/3012-442-0x00000000002E0000-0x0000000000347000-memory.dmp

    Filesize

    412KB

  • memory/3012-463-0x0000000074160000-0x000000007484E000-memory.dmp

    Filesize

    6.9MB