Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 23:05

General

  • Target

    89586006208bfff1f54910f8e2f1f042124e5884691526b4dd7a60b8f3986e68.exe

  • Size

    625KB

  • MD5

    b8e7e9caa68c561e556e50c3c72d60f2

  • SHA1

    b6216225d04b0ac0d0eebad3db234c56f311434a

  • SHA256

    89586006208bfff1f54910f8e2f1f042124e5884691526b4dd7a60b8f3986e68

  • SHA512

    581f1e2609ab2b72b928eb2c0f51d7ffd86110201f8643f3c4c6f328fa2a8dea48b79b6affe08c19a53951f9f9c9a021e2cf6a6b357ec87f00c9f2408a74a2f9

  • SSDEEP

    12288:42zgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Fz7ozX0j52pMkuLoiSJVlIL29mhNq6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 50 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 26 IoCs
  • Modifies data under HKEY_USERS 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\89586006208bfff1f54910f8e2f1f042124e5884691526b4dd7a60b8f3986e68.exe
    "C:\Users\Admin\AppData\Local\Temp\89586006208bfff1f54910f8e2f1f042124e5884691526b4dd7a60b8f3986e68.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2468
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2920
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2620
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2732
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2400
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1672
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1316
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 1ec -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 25c -NGENProcess 244 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 238 -NGENProcess 1dc -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1876
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 23c -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1980
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 264 -NGENProcess 1dc -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1152
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 250 -NGENProcess 26c -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1304
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1ec -NGENProcess 1dc -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 274 -NGENProcess 264 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2492
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 244 -NGENProcess 250 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2140
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 27c -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 278 -NGENProcess 274 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2184
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 284 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1496
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 260 -NGENProcess 274 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2212
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 274 -NGENProcess 27c -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2800
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1dc -NGENProcess 264 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2104
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 294 -NGENProcess 284 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1dc -NGENProcess 298 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 2ac -NGENProcess 27c -Pipe 2a8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2116
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2b4 -NGENProcess 2a0 -Pipe 2b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 1a8 -NGENProcess 1dc -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2016
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2ac -NGENProcess 298 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2680
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    PID:764
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1804
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1040
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:1736
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1304
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:1656
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2032
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:592
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:1684
  • C:\Windows\system32\IEEtwCollector.exe
    C:\Windows\system32\IEEtwCollector.exe /V
    1⤵
    • Executes dropped EXE
    PID:1320
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2844
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2132
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:576
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:2572
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:2300
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:2684
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:2108
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2752
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3048
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2972
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:2496
  • C:\Program Files\Windows Media Player\wmpnetwk.exe
    "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2312
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2124
    • C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

    Filesize

    706KB

    MD5

    4d6cd4b84d512f443f2c02ca83b26605

    SHA1

    5143acce495bb660f275b4508196b287057ea3fc

    SHA256

    5efa10bcc0351c81b3619a8cb55682dcfc705487b55c469a4f51e1c46dd27f4a

    SHA512

    44947f636a8dbd66038c3d3f918f7e35d26a69b280bb92a7876b2eb0c189502d8f10bdfc39ead9a5e68ed31a55b8241593d0fa9c2ff5557e2a70ae4505bbd9cb

  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

    Filesize

    30.1MB

    MD5

    8efc3f1ae06177416f5a1bdce1a30f93

    SHA1

    c918bd8bb920d7a8d30cee8de2d2a97e644bb59c

    SHA256

    667d9a3d94110b3c38d318d46e866537e6abbe9f67a04d662b10baad48d71a6d

    SHA512

    9f01b7673df80d6702ce55e1b42aa029b3b3dbfecde765af7c5d892900e69e17034415bcf1beb8ee410aa127b47d1abae2a6f79e0bce94c73df209b3e5ef0428

  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

    Filesize

    781KB

    MD5

    03874771be273b1fa01ae51ba5c852ae

    SHA1

    1206021ac73a5c3ed958213e6832f7daf1d5e7ea

    SHA256

    e4952b840cf6f2b1308a64b1353243c5ce9d4812e470529c9d05e06630959664

    SHA512

    279ec72c140a59d648d95183814f6a22d5813c6f4fe8f2b766f8e4cf7df80eb1bea173bcadc7c4e5669343a4907a0fefdb16bbcd15a54d6840446727508152c8

  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

    Filesize

    5.2MB

    MD5

    08b8af5d1a9fcee973f5f48b119434b5

    SHA1

    6c926382776d5156a2ea4d514407077a636989aa

    SHA256

    e86d518e10897a4ff7ba9e4505672b37d739642e4d4ea595c6b15b12a7fa563c

    SHA512

    d5d7f722e86b1d26f184132e06a2775cd6b24fdf6e6ae8fd0c881be3bf95e282b313d35b11180bce134cbe238d9d0998608348851f33eca093c4766e9b5d1980

  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

    Filesize

    2.1MB

    MD5

    75b7588636d8bd0a1c0c9b9068cdd183

    SHA1

    b48603652638865ab2ad9e9a4668dfba77e42c08

    SHA256

    9cd4dd36eeedd9f336ccdb9f7bea1d4c88e12b6b964a1af94cd36cdbe743e427

    SHA512

    f31b4d6337fc12550a8cf4dddcb0e94e56ba995c89cb18b5e999a2bd77b2b0efee46cea49b07b2b83773a206db716b689d5016a8102be37530600fea33697687

  • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

    Filesize

    1024KB

    MD5

    10b29ab6a20f00bfb34f115d114c9f3a

    SHA1

    12fe0187e6ad0382241bf272f4c876d5cfb84cda

    SHA256

    618d9073b5daaa227bc665901cb63eb5399f5e7c6a530fd298dfe8f90f4acd65

    SHA512

    8dcc96c7a2959f07cb9ef87ae512a84f00cbeaa50a9a92b121fe5557664b3ec6b36c49e443ad654fb1dbd06f6f9147913805b821d8b9e025e89ca9ff28c61f35

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

    Filesize

    24B

    MD5

    b9bd716de6739e51c620f2086f9c31e4

    SHA1

    9733d94607a3cba277e567af584510edd9febf62

    SHA256

    7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

    SHA512

    cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

    Filesize

    648KB

    MD5

    21b3b24dcffe4678fade9493c44cbc30

    SHA1

    38ebc68f1f27946a7a61e8a4f0af6b1acaafc23d

    SHA256

    71598db4ad49e06c6252a2363f8da31e1f760dbf643aea823a870146e0dfe72f

    SHA512

    c520423430a7f8835f14eda8c6c3284482d0a3d1ab6f7fbdb7d955fb2ddb679fb72fa70f0dfc81b47fc8d7a5f8a47a988891d5b20067bb2a1b2156f332ec7d21

  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

    Filesize

    872KB

    MD5

    8f8b4b519226f8a0dbb05ce41fea3549

    SHA1

    8043e1dfe4c2764eeeece737fe70d8ea33aa3d73

    SHA256

    00a2e7ffb6aff687b74282b13939037b527665f944ed3746ce6735d0f9e047a9

    SHA512

    6aab85b8d537c4c2a5f6eb894d203578589fa45aa28468a83b70111fbdb16208dcc383ec6bb2b0f151da9df976e2ed30ad7cc8309361df5001af0adaa250c617

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

    Filesize

    603KB

    MD5

    44d8d46b47d1433f585cbc3ff9f64e8d

    SHA1

    b30cb3c7ed8587b806a89bb00819dd1efff99708

    SHA256

    f11c5977b9943ba4efdfb479e4e5bf7bdcc698c8438f697d5d3d44f0024d7a8a

    SHA512

    d639b67af7450a0c8c96dd12fb332e396ee067b1cfd22c2d66646632962d5f8b383e59128bafbb2d1139b6bd3cb5a2d11b4a501626acb3345110189b0e3b5099

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

    Filesize

    678KB

    MD5

    f9b0525e5378fd2abb51caae60485eb5

    SHA1

    e5d7af5cd5f2396e90d3739395e107be4d513369

    SHA256

    4f83ca04f3a326f41fea1b80dd87416944f2f73f33d57b1a56eda7644ee1c6d7

    SHA512

    41b35f25705883db71c60c1246e9a1f2647176872fc9cd526a1a3bf858210cec6fd3ea8ad9af0ba7d06b3cc65dfe1bdc6e4d29965864a769738d29a2653543e4

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

    Filesize

    625KB

    MD5

    735952014105119e5c464f7f67090121

    SHA1

    e610ec4d70c89afac78b5d6003fb837b9007f2e8

    SHA256

    3899afaa68b48198421d7943a3057fa3c0c3b30fe1dc4de7cd126d6b0c36d8b2

    SHA512

    e8a598997e16cece38faba36d3a07e65aaa1bb2050bf4de98c0d72c1c5f57c67ae41352032b6795ae197dbcab52d8f40b9221476ffa53040f0f2c1869355d447

  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

    Filesize

    1003KB

    MD5

    16100d92e122e82d19741be350a136c5

    SHA1

    c84c694a040f6dd6f7117697e7a563112811570b

    SHA256

    d9a786751d558669fe9c9e79f73f0b01cb443503466ddee1a5bb15878f69628c

    SHA512

    0c806f0a412762e96121d5e92322a26380a3119df81ee450f5e5ff7074874ebf9f054152fa30019c69222dabf480a7f2001e682a56feb79791fa61901f51ae6c

  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

    Filesize

    656KB

    MD5

    92b62f68d4e19804e176ed05a8640f64

    SHA1

    4fba34f64b06dc733e7335b5c1a016739a3605c3

    SHA256

    28ab597442d16dcc520e62badd4d1792c3fd0e511f59dbdc50c76921f8451468

    SHA512

    5e9254ae1dfac065d33dfe3c51647a22ba5805db5ef8c30f188d3bfc499e8a623c6f1f3212b74654407de6fd02a383956255f74fd47357b73d5ae1deaf98c676

  • C:\Windows\SysWOW64\perfhost.exe

    Filesize

    587KB

    MD5

    e876971cda58c7cc763a2078c7dc017b

    SHA1

    66be18bd1aa7946da8328b705e14b2856af8eb77

    SHA256

    f4d72c4f474b185d35c7c0d0d3eca6725a7ffadd20d28912d012957007b30ee3

    SHA512

    4b3b59af33f52adb290aa97e277215e1aa29e6ad3f4589811d90dc904b6590669b9e947b06f9fb7d7dabad9ac463f54cc4a54ce1a51ccf433f765c2abfd4af3f

  • C:\Windows\System32\VSSVC.exe

    Filesize

    2.1MB

    MD5

    e7f371fb2f9fcadb9dd15ae8b773cf97

    SHA1

    3647f99e748c894505771d764861dd93b2ba2732

    SHA256

    150179e180e3863be103db49f410dcc55cc8a9d66b5bdd3b8e3d04b4dd0af7bb

    SHA512

    c7048a90fea30b40b17eda9e2be67a08c121a39affac50b7addef7c20a5e2f7a154c4ef9c95511ee29617eee6f1c08e2b97f641f8620300a7ed39ddd7bb2c6c6

  • C:\Windows\System32\ieetwcollector.exe

    Filesize

    674KB

    MD5

    96f4cb51493edd1bebee51b4724c0e12

    SHA1

    25f1560a123d093337848df9c4c3fd6fd89654df

    SHA256

    0a1f0ba82f57f9d5da7cc0c768d09908fe06ae18a8e9a86428086be7499af0a7

    SHA512

    24ce1ca2778468fad82c68755166330d3b3d0a5802529a7cb8d05834c66ad5237c377938bd10ff4468c35930298ab13d0b5bd5762b94d77be2cf113239f3329f

  • C:\Windows\System32\vds.exe

    Filesize

    1.1MB

    MD5

    392a105c7f0458db07052c280a6044d2

    SHA1

    730a8d4d7dc949b1b7409d099533e555de7559ec

    SHA256

    887b95c496450e70dd1c8d36d82b4f529410cc844a35c5d5cd51d9e1a7576ef1

    SHA512

    e8dd7ad9f9f217e047a137169eee62f93f370c630870f4ddb38bfd85a7a1aae2998eff3d261a1ad31a7a3fcfc75b326751a1c87d2cef2136cfa617efbca1bd3a

  • \Windows\System32\Locator.exe

    Filesize

    577KB

    MD5

    148e378cb726ab4e5872fb0be13c9ebd

    SHA1

    cc0eeb228b64c445af9e17d14252a1cbfb80b192

    SHA256

    2d4efaedd4bdfb3eb4bf0f3558541aad96f2c931963ab465c0ef6d70d11c5f5d

    SHA512

    7c3da95a9e8f06dcaa1006cfe2ac52457342e249876f7b18890703994f96b47f7528f40561ada946639157d8078837499660817654e2f6c4d5d4ac0471042a41

  • \Windows\System32\alg.exe

    Filesize

    644KB

    MD5

    0531ebc90eb9f34d95e82f61c97c3c0b

    SHA1

    57d0fab0b7fff2d9a766986cb87be109cd595e32

    SHA256

    8001bd987f616b4bd71bc79ddd2a576514fdb1bea95c6b109db949f159a50ec2

    SHA512

    31a115a477c312a68ac1366565258a1bb89aac431a8a3795f8978a264d25e84df87bba477a8ab1dd822afe2610e62c477636acd2fc07e6c709c0ab8d11f93534

  • \Windows\System32\dllhost.exe

    Filesize

    577KB

    MD5

    89747caddab8ee4696397de7f84bd213

    SHA1

    0c1352fa572c5ce2bcb5cb2521ef3d0cff9266dd

    SHA256

    181afa5b1af6c30876db7865d99048e020883a1568136d3b94f72f71e0bf4a44

    SHA512

    d8f8dbdce19e0d0f8e49d0b288bd74af3841f3cafde21900d1e054fdf0c07e9861c7a8c4414932d87e714a86f4c0bad23402d0f446b2218a0f4353ed608d922a

  • \Windows\System32\msdtc.exe

    Filesize

    705KB

    MD5

    76f44e9a028cd7360b1937334b95ab9e

    SHA1

    48150d777569ccec52040aab2e415d2fdfeb48e0

    SHA256

    bed38ce41419aa4f311f05c78d49d1f70b69dc33cce2f16f690d85b713e03cab

    SHA512

    0df2028e3b779fdf1320c56a257d9a58af1c7486e72c7b4fd260e39aa7a02ec2d432825ea2f7a4509d5cbdc0e65c5e1cb205fbea078dd437a8ddda9c2014f3c5

  • \Windows\System32\msiexec.exe

    Filesize

    691KB

    MD5

    54a8b8daa030de6f8f7ec2f421d5137f

    SHA1

    6e79c9ed0c52d5c390d60caf86207c5674750901

    SHA256

    69b938b03ac0930e1f2f8c65bf52166086478a8808dc9d78e964b8196474cefd

    SHA512

    cff7f0f0eb73613718967cb5f62e54e49e84e647b68effc6823e67f7319bcd5f097f5f00a60ac33e82eb4d380beaf892b06c62544d4a54bb4d94e6f16d164c5f

  • \Windows\System32\snmptrap.exe

    Filesize

    581KB

    MD5

    8d911427361638dcd79a08360ac96d4c

    SHA1

    b060ab6049c5318bed1952da6000876271ab76f7

    SHA256

    4622142a7c855309dd6c9233d35285616dc49ba87901dc718a638c5f26c2e298

    SHA512

    1aade2986acd7fbd308bf2b0529e6d0a1bfdcdafbdbd7a9dfdc708f1bd3907e47db4fa7abf7121144ac7e5fdc080e4ac15992e78aafbf4aa8c377050f44fdd99

  • \Windows\System32\wbengine.exe

    Filesize

    2.0MB

    MD5

    acb776fea7261c81b69ba581d3d41d9e

    SHA1

    7448d616a77f5bcfde406f88f75765ce0292e58c

    SHA256

    f9393aad7720f4096617ec3cbc44cdf6e4e27429fc50207bec994d9ec5502dfb

    SHA512

    4b1ecd37bbf0c86a81837e26225b1a099969c15103754551c95e909998606a85ab2c1891351c33b42bb33e6a5918eb63703cf47071337bf721df8723fa8a5af6

  • \Windows\ehome\ehrecvr.exe

    Filesize

    1.2MB

    MD5

    a2002a930996f3285e19d3b04e76fb79

    SHA1

    dcbc35c9f6c6d642d4f5b51efa4221730e29df8d

    SHA256

    740c3cee499a4485d25343fefec8dea78372cb42ceb23da371622f69990d7a0d

    SHA512

    e1024363fc5318e438d7af4d4f29f0378da15d9d716713e7ae7e7d248646e8097aa0f89b9a33e3725cc46a5acf3bcb72f3b92964d0389e85aa80ba7029630f5a

  • \Windows\ehome\ehsched.exe

    Filesize

    691KB

    MD5

    eccadb956aec7cc637473d06ca063781

    SHA1

    5165abb1b3142bac2c8d46697c79fe9548bbf468

    SHA256

    91bd11deda7d4ea7552b2c01a4c310a7ca49a44894000934d35c9c22df991800

    SHA512

    6cbc448d777187ce0c696982ff379b27492c39495e5bd7a229063bc0388c83ac8421878f52d7b6d9555b7b6edfd07efb4d310778e9c6fc1c61283573d2a33d27

  • memory/720-155-0x0000000000AD0000-0x0000000000B37000-memory.dmp

    Filesize

    412KB

  • memory/720-174-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/720-159-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/720-149-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/720-173-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/764-87-0x0000000000610000-0x0000000000670000-memory.dmp

    Filesize

    384KB

  • memory/764-95-0x0000000140000000-0x00000001400AE000-memory.dmp

    Filesize

    696KB

  • memory/764-94-0x0000000000610000-0x0000000000670000-memory.dmp

    Filesize

    384KB

  • memory/1152-220-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1152-195-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1152-221-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1152-207-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1152-202-0x0000000000230000-0x0000000000297000-memory.dmp

    Filesize

    412KB

  • memory/1304-235-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1304-218-0x00000000009F0000-0x0000000000A57000-memory.dmp

    Filesize

    412KB

  • memory/1304-236-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1304-211-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1304-222-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1316-124-0x0000000000280000-0x00000000002E7000-memory.dmp

    Filesize

    412KB

  • memory/1316-130-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1316-119-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1316-116-0x0000000000280000-0x00000000002E7000-memory.dmp

    Filesize

    412KB

  • memory/1316-144-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1316-145-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1420-131-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1420-71-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1420-72-0x0000000000380000-0x00000000003E7000-memory.dmp

    Filesize

    412KB

  • memory/1420-77-0x0000000000380000-0x00000000003E7000-memory.dmp

    Filesize

    412KB

  • memory/1608-250-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1608-225-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1608-232-0x00000000004B0000-0x0000000000517000-memory.dmp

    Filesize

    412KB

  • memory/1608-237-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1608-251-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1672-128-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1672-106-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1672-111-0x0000000000230000-0x0000000000297000-memory.dmp

    Filesize

    412KB

  • memory/1672-114-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1672-129-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1876-191-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1876-176-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1876-192-0x0000000000390000-0x00000000003F7000-memory.dmp

    Filesize

    412KB

  • memory/1876-165-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1876-171-0x0000000000390000-0x00000000003F7000-memory.dmp

    Filesize

    412KB

  • memory/1876-190-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1980-206-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/1980-179-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1980-185-0x0000000000AB0000-0x0000000000B17000-memory.dmp

    Filesize

    412KB

  • memory/1980-205-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1980-189-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/2092-134-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/2092-161-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/2092-146-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/2092-140-0x0000000000B20000-0x0000000000B87000-memory.dmp

    Filesize

    412KB

  • memory/2092-160-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/2400-52-0x0000000010000000-0x00000000100A7000-memory.dmp

    Filesize

    668KB

  • memory/2400-117-0x0000000010000000-0x00000000100A7000-memory.dmp

    Filesize

    668KB

  • memory/2400-53-0x00000000004B0000-0x0000000000510000-memory.dmp

    Filesize

    384KB

  • memory/2400-59-0x00000000004B0000-0x0000000000510000-memory.dmp

    Filesize

    384KB

  • memory/2468-101-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/2468-1-0x0000000000330000-0x0000000000397000-memory.dmp

    Filesize

    412KB

  • memory/2468-70-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/2468-0-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/2468-6-0x0000000000330000-0x0000000000397000-memory.dmp

    Filesize

    412KB

  • memory/2468-7-0x0000000000330000-0x0000000000397000-memory.dmp

    Filesize

    412KB

  • memory/2492-252-0x0000000074140000-0x000000007482E000-memory.dmp

    Filesize

    6.9MB

  • memory/2492-246-0x00000000002F0000-0x0000000000357000-memory.dmp

    Filesize

    412KB

  • memory/2492-240-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/2620-28-0x0000000000A80000-0x0000000000AE0000-memory.dmp

    Filesize

    384KB

  • memory/2620-97-0x0000000140000000-0x000000014009D000-memory.dmp

    Filesize

    628KB

  • memory/2620-27-0x0000000140000000-0x000000014009D000-memory.dmp

    Filesize

    628KB

  • memory/2620-34-0x0000000000A80000-0x0000000000AE0000-memory.dmp

    Filesize

    384KB

  • memory/2732-38-0x0000000000230000-0x0000000000297000-memory.dmp

    Filesize

    412KB

  • memory/2732-112-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/2732-44-0x0000000000230000-0x0000000000297000-memory.dmp

    Filesize

    412KB

  • memory/2732-42-0x0000000010000000-0x000000001009F000-memory.dmp

    Filesize

    636KB

  • memory/2920-20-0x0000000000840000-0x00000000008A0000-memory.dmp

    Filesize

    384KB

  • memory/2920-21-0x0000000000840000-0x00000000008A0000-memory.dmp

    Filesize

    384KB

  • memory/2920-14-0x0000000000840000-0x00000000008A0000-memory.dmp

    Filesize

    384KB

  • memory/2920-13-0x0000000100000000-0x00000001000A4000-memory.dmp

    Filesize

    656KB

  • memory/2920-93-0x0000000100000000-0x00000001000A4000-memory.dmp

    Filesize

    656KB