Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 22:59

General

  • Target

    f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe

  • Size

    1.8MB

  • MD5

    1bcddb3f1645fc4fadfd03a26ce9bb74

  • SHA1

    3851a53552f2bc56976cdd19bf6c99a0f42846c2

  • SHA256

    f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13

  • SHA512

    8547f61c107b4c1775b96af4ee51e16b8c710537d0306065e8466cf94463b90f955b8883953436bbd684bd49bb86db44a1a55a70bbb9e0bb3356e4abbff5bb3d

  • SSDEEP

    49152:zKJ0WR7AFPyyiSruXKpk3WFDL9zxnSUisGcnlQHPxi:zKlBAFPydSS6W6X9lnpnlS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 33 IoCs
  • Modifies data under HKEY_USERS 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe
    "C:\Users\Admin\AppData\Local\Temp\f7674bbf5c79aff53386ae61383e11a97463026ad7d23473949adf436f618f13.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2776
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2552
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2408
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2540
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2864
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1916
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2012
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 260 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2448
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1dc -NGENProcess 1b0 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 274 -NGENProcess 260 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1100
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 274 -NGENProcess 1dc -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:908
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 280 -NGENProcess 260 -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2808
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 288 -NGENProcess 1b0 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:276
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 254 -NGENProcess 258 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2964
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 298 -NGENProcess 270 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2376
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a0 -NGENProcess 1dc -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1788
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2764
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2228
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2220
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:2072
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1592
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3012
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1372
  • C:\Windows\system32\IEEtwCollector.exe
    C:\Windows\system32\IEEtwCollector.exe /V
    1⤵
    • Executes dropped EXE
    PID:1064
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:3004
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:1740
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2912
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:2688
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1496
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2752
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:2036
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:1624
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:2996
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:1900
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2604
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:268
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:2836
  • C:\Program Files\Windows Media Player\wmpnetwk.exe
    "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2568
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1460
    • C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600
      2⤵
        PID:2628
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2052

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

      Filesize

      706KB

      MD5

      233731fc18a4b0d0f2111774eb6f79be

      SHA1

      1d2da5e011fec5f7ca6e4947c14b3f8f90eb852c

      SHA256

      e288ef0e3b5f87224bf2c36060561ae63d565a5b8737498959503d3018784afa

      SHA512

      af46f29732d71480fa0f4ba1a7b9afffea0f8d368a485259c2852d6957589188fdc5f7537400ce2f9fe3e2072896754c48e7f0d5c64f396c9d56fda29e9a2381

    • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      706KB

      MD5

      25690827f3353b92903f19cd8ad01b09

      SHA1

      7e30d9a2dd1b8d3909fb42cc4b1d17d2903330a5

      SHA256

      b2f46fca860ddf44c52a76f05df91903b84ae4f215e4f0c7ae787f437ede6224

      SHA512

      1b209f6ddad26aa99db7c787317a78f21496dd223dce52973752726d3bfaba7cbbf815534aaf246f3548a5aec157c03a3eb86af9e5b2acc13a72eec17329bcb0

    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

      Filesize

      30.1MB

      MD5

      81d57cefc9b49a534f8baf87dc0421fb

      SHA1

      b868870b4e0ab0218a0223b98b54e227c21559f9

      SHA256

      ef0a2faa42df7dcf51ade2d05e8eedaa765cd4ecd92d48fa1320e064766a060e

      SHA512

      452c54daa5123e40ac779e86519e2613e7bf4a3795d589fb26226a59333aef7f9b6728f49fb41da6c62b71b64b62ede9f1edcff2521f94669e96d83a5b877af6

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      781KB

      MD5

      c553cc3c615f33e1a1c07f59123425e8

      SHA1

      3aa7bd6d6e8824e434de8ef82507be76405ca600

      SHA256

      dda163e676c696a2ea3d352f9a11cbeb91779c60e8800a58027c4a0e9904064a

      SHA512

      f104e4bc354cd71823700c09f8f96744034e04002f5fab78eb5fee9e2bdfebe814b00a711993ef4f4c54db6480f055506fb730392ad9ff99f4b0cb8077583c81

    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

      Filesize

      5.2MB

      MD5

      e17be1a616254471e9ab89c58d62a783

      SHA1

      fc38c9b5f548df69ef79541659f2316d6e8771a2

      SHA256

      0c9528bf6bbc848f205120121fabbffcbb88881b2751eee92bf0275d6d25d84a

      SHA512

      fede34415aaa4e745c8b053f94da7d98cd40e145b07b4e2bdbb779e48eec35063ebea7f490a59ae14f00b2d69a0043d7cf6051f1bb7562e787986aa7ddbad484

    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

      Filesize

      2.1MB

      MD5

      db4f93828a819d56d0314d676a12fa62

      SHA1

      b749868895e12741322b55ed03febc66c4ed8fbd

      SHA256

      3ec7e0883b71075c3ab7553038dc4e976c6ac7a0a260250821d84b15c9c609ef

      SHA512

      efce1d86235ab6494198e8ff626eccbb281aa9ea903d91194e2d68a35180abe6156482483abdd6e8583216375ddf4c46ced933ac78b4c04c28a5617fd831dd47

    • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

      Filesize

      1024KB

      MD5

      40077e58c61fad92519e140e0dc34022

      SHA1

      2cce66177530344f88e37eb84f0043be701bf444

      SHA256

      6e3868949a3dc1443296f14a96c93c58e3b50bfc4b177f37ac0b233ed8baa1f0

      SHA512

      20e5128d8533a27568aacd900a58a947cbbce92dbd1bac8dce44871d1f7edb57b8d303c21c1b9945e386bb42265c48ed32347b3f4b275e0dd835c30eab2f662f

    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

      Filesize

      872KB

      MD5

      34bb7238217d0c3b7a392f33037db1b2

      SHA1

      0a3a4873f4f81ff0b06199e3047d5a22ed5db69a

      SHA256

      66c8c40d5b9671aa20bd89ee28704a1c5a5254f447267aae818cbf10fa463c41

      SHA512

      307797d55595e8269b4adbd6765e8ac77df5e3233bf4bdf03d65aae2e39d02a032070c89debe574168baca17e9cdf414f7d84a2cdc1e7b443fb97e87b97795b3

    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

      Filesize

      678KB

      MD5

      eb9361ba715c9931e921808548e25395

      SHA1

      41965eee94d13973dc04904d5ef59f81390a776f

      SHA256

      11900b6d9a0bd72fcb5a200894d5f48fa9aaaa1da4fd50cac81a2cfaa04d3359

      SHA512

      2f5f6151d966a11ed21ffc311b2aa5020f87d43dae4ddd63fa4ba9a71c7962ba8350b212dfe25e569617ce2b090f8443a343d5e715fb67906395a7f635b3640f

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

      Filesize

      625KB

      MD5

      7bfd38404f1dcaccbbc302971f952c66

      SHA1

      49fb174f96363f7e59a2889225da386c6c99bb8c

      SHA256

      ddac52fef2660587f7b5e7722a972e1e8f585d93e6ba598115166a8ad0d2bbdf

      SHA512

      5211bef0109ce3241155b78aa6d0b870b860738182d227a5c3b1355a76b253018d833ffe28193af51163099ddff404f924aabfd9ee86900a6337a57a5554b066

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

      Filesize

      1003KB

      MD5

      7d9bf98055ca9f84c5c259d1a6f6eeb0

      SHA1

      32403a4f65305beebbcb857fa6176dde0e6566a5

      SHA256

      2cbc7c3798711d88fe783f99c993eacf5de922081134850db1aa9edcd4616a9a

      SHA512

      5bd4d7a90c5661ba1404d0816f75b72ca62977743c8f6220060c4c7616a312b22e2b14bd698bc18c683e3e203b14ba5943bfde850e1c0ac23fae9a2c1555ba3d

    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

      Filesize

      656KB

      MD5

      dbd953cc03004f6386cd55df93c85587

      SHA1

      b6fa7b8d56165946b2b56cd65e907d0d41c093fe

      SHA256

      6b7733aed4fe997bdbf58e3f5a12b5bd95d1cfc39c1703a3a32d7433fc676dff

      SHA512

      0eca875344a830b27c5f546928d3eaa71275a54af47cc172730b8b2edfaaf8c5ad4ac470782c495e07b82fc28c31aa635e819227f6d4b4b26616dda375aebc31

    • C:\Windows\SysWOW64\perfhost.exe

      Filesize

      587KB

      MD5

      1ab87160c05ca41edcdddafb33f03508

      SHA1

      38d1bac95599b0f0321d0374bebd1d43f6f188b8

      SHA256

      eea16af54f8363aa8714b00517f0cba984d7f5a75eab36924abcf4b5f6382b52

      SHA512

      03eed4b23ae7aa1dc616fcf232d8a01692f2c02eec8b2816c4d926240cfe860181ceb8c240a7e219578d48a9884f5dfd08d847c7941eed522f23eccb4ef92cb3

    • C:\Windows\System32\SearchIndexer.exe

      Filesize

      1.1MB

      MD5

      fa0063c09856b36b878234328103fcb0

      SHA1

      1cbe6710514e899ec3935c2078cc9f724f78f5e6

      SHA256

      bcc27c4f97da27ed8175112485ef5958ac56385bf1a5cd34a07e56a9bef2a38d

      SHA512

      3d45fca2acdadebf65e6c899ff51b3113d9a2bf47a6612a2bef6b9e9dbe319e3b246dc5c55c74e4a318e419f4c7048c9e878c8d0b86dd30a67c09bfc8ef4af94

    • C:\Windows\System32\VSSVC.exe

      Filesize

      2.1MB

      MD5

      d36d364f84db78d28288500e1556a1e8

      SHA1

      625d572f3ac8fe1153c4795d6289b14d704c8a4d

      SHA256

      9200828c89d1a9f5ac682cbe2c2ac1b2f78740e209214f2d79422c72b4aa850b

      SHA512

      7fbc6c2a621caa0275cea32a96a5b91176ecbf31306833350b6cbd0b4c3e58f2636899e351fba9459461c7dc581cff87a21bafc688af85e07f9f6a9fb63f7338

    • C:\Windows\System32\alg.exe

      Filesize

      644KB

      MD5

      686a92597fff471e2ebfbba95265284c

      SHA1

      673b0f50501d998adf0fe666a32cd617dde7f167

      SHA256

      f56bc238894a32fcd77c224e274a780c810c2ddc87f4b5b129d985d1e1ab6756

      SHA512

      33d79608897f84e970dd4ec013bb56a726c0b1ac69e24e898f1a9653c6601dbe0b354f89e589661ccd2331b62c88a903e37c211abd280dec05390df4e91b1752

    • C:\Windows\System32\ieetwcollector.exe

      Filesize

      674KB

      MD5

      b829ac0fc1063e9e9d015efcc9ead7b4

      SHA1

      1a957a3a8e7fa41fbbf5a68d5d2b774affac4501

      SHA256

      8fb3cdfcf6ca2912411a9320fa9830c2bd91560a8c3aeacb1bedcd836b4b52e1

      SHA512

      9204f52949a3d6ac517394a6b09eb6c96746b3270b0b6fd9346479f43aa68b2859d94a23fe130f689bb5aff4e25337b6cdd69b9629dc8ec5d4ec346f02f3de90

    • C:\Windows\System32\msdtc.exe

      Filesize

      705KB

      MD5

      0b734dbad3696e6575910e8cfd4e4238

      SHA1

      b6560b9bd96281564a70ebaf8e007642aa1fd838

      SHA256

      d1283fbc816d3d906a6a9f7004f07d35033c863a69f9565806e470f1302e6e8c

      SHA512

      a5f32036ca4c151af7260f6472c3e9301feb6be8f81bd9e5ecbc29a966e382d45bc2dc69144c7f27dfa90eae131c5940a1d6108f84fadea1e7b3fb38dce6fc92

    • C:\Windows\System32\vds.exe

      Filesize

      1.1MB

      MD5

      626f4b19a9bd4a80f734cb63da1b358b

      SHA1

      5fc9405b6fc3d30824ce96668181d5f2eb09c5e6

      SHA256

      8ebcfb5943868cf74b0757947631b2703151f58b0aa7eabbfb6c58fad1397196

      SHA512

      605281109b8a56e5bd0d07bab8ef3602fa8a955524e7b9c19d56f73e64f668409a69a9bccdbf9f9208725f37d54ab5f2481e0f03fae1210654a2fd85abdca217

    • C:\Windows\system32\fxssvc.exe

      Filesize

      1.2MB

      MD5

      cb0c4400d317eee4cd37d38499b229a9

      SHA1

      e13618597dc41f64a2f79cbdc29d485b7d0b72c0

      SHA256

      166224f821b15a4ad25dd2d28cff3923afa2555f3dc56cfb0e50a85984158fa5

      SHA512

      f2f8e337a3da9aa985aee22ba946b8f09d911c5995a4788265cdf4035c6ec93a1b67e44e15195d7a5d6c1b40ea7b870985750d7cd44b1bdfd68ad61e6869f52e

    • \Program Files\Windows Media Player\wmpnetwk.exe

      Filesize

      2.0MB

      MD5

      660b22edc672be226f28d3c0d9634be0

      SHA1

      0c7a4df01c5905f69c76bffeceda872661595bf5

      SHA256

      2959d0b0cb64b35f4efcf5be978ff4f5fe9bfe4acec96ce59e1b1367a1ada13d

      SHA512

      a5af8988e847671f01386320b4bc4a93b1353f40c3155269d9fec98165209754abde4949289a9aeda51e172fa11483bdae763814976fefeb088cf29bfdfc7598

    • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

      Filesize

      648KB

      MD5

      b4ee16a0a095f2b2f9e30e7af5639ee4

      SHA1

      7d76985c941db9dded919a29e2e0762df7b3fb34

      SHA256

      e3d0f71acc842f3a0939eae4dbb74ec85a77b1f2550651e446556d1dddba1891

      SHA512

      15484d51d3f331ce4e59b1d586a9034f52db0dd20ea065a95412b19397bc4c7eb1d1d5e6f4267ec35621f0b850dca56fd5adfc41c1ed533a68c4e9e7d263fa08

    • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

      Filesize

      603KB

      MD5

      de71631ebb829398e155036a2ccd952e

      SHA1

      d104295306db9731b0d4f5532a07992cb5bc904c

      SHA256

      57a1118dac31726e5b7bf4aace9ddbadbd0b4fedce405800e4f74fdf5f0372c0

      SHA512

      d1e94b057ead0bf3d7bf6f81fb3cbbd7a4bf57fbe037ce8c160805a86bbd8de63b84721c2f8a7d6c36132c4c420e3ed18afccb2bedd611ce720e55b533dc8c93

    • \Windows\System32\Locator.exe

      Filesize

      577KB

      MD5

      b30338f54c712996c0a566b096f0da1c

      SHA1

      92cdd0edc069411189ce6d9b902c776e83d3d36e

      SHA256

      d114cd88c730ed91e753d6eba8e28a1b80981d19a069b5c0a72d87379feb840a

      SHA512

      cb126b30adc22c29041a9e845b82ff06b4f76ddf7859b27d54b22eca88bec7e4d5357c987862bf1fcc335bf19dca195a2ecb6073af24e3a3fd542bd1c186ec68

    • \Windows\System32\dllhost.exe

      Filesize

      577KB

      MD5

      fcc12dc0cdeab0e3d5ae08e5e603b60a

      SHA1

      1c76a606c5a04125339909cb45c0587fdf3abaac

      SHA256

      02154fb52686f9bb0f4e0832dcecaac53aa122bff4b6dd3e0387ac48017cb90a

      SHA512

      d89deaafb5fb387c5c671180a395a615c09ce24d3e82cc8d7af250fae642089c1361cadc718e550b88ef4d2b4468e5d5c4d17f07a1faa6a73d0878eeb7732957

    • \Windows\System32\msiexec.exe

      Filesize

      691KB

      MD5

      9afec9dff49b2f6e1e5e2e4b9c62df91

      SHA1

      56ad450ea9654297a5e2eebc9f3e2b256c756f4c

      SHA256

      87297bffd28dec115c48348dc7351131a57c01a6b3bb05bacf78667bffaee36c

      SHA512

      d4a7e5fadda3f14029c989c15e7b25e8a56a1814ff3b632b244cd993e9add25d2d5a44e868304bef064035d17250c43cd21fa09c09fa71f2060d4e56a8431fe1

    • \Windows\System32\snmptrap.exe

      Filesize

      581KB

      MD5

      443d2d2e5ca1452e5b843ccedfa9b97f

      SHA1

      60e41afdc6b9c76a53edda61da7cc2a37a501fcd

      SHA256

      b77794f1d0019b7784bda193eb79849dc3bd3088fa1caea086d7fac2edf09fb4

      SHA512

      1eb3fef8bec3a5a26c01a33f96db27562e187cad54201ddec7230ab0a3cf65f8f122d70c013db9cab413a2b792ef699c0291eb3ad22b52e0e6bb9024054ef00c

    • \Windows\System32\wbem\WmiApSrv.exe

      Filesize

      765KB

      MD5

      1760a5ca331e0e987f482e189b7dd9f0

      SHA1

      26c1d2c0052d8ddfba8dc6728acf33d514b768b2

      SHA256

      da379944eb8f7f5c2d27cbd37c36fa9406002310f67a0979c9ab507d940e2901

      SHA512

      d543abcc6666703f6fc328f18c320c74701c5fbd8bf1a6f30bdc2308b720435f84f15e81eafabdac3a146609006fd00f0b97ae8c7687d86e57f395d694cf777f

    • \Windows\System32\wbengine.exe

      Filesize

      2.0MB

      MD5

      baf5cf1b53bbc8b2af90484228b9d2ae

      SHA1

      36cda3fc14160e9c54ee44a38209595b2d82a1a2

      SHA256

      c4fab25edec93af7dfe43773445fc28440d6c8dc55b5487c5255eef971ecde2a

      SHA512

      71da084ca92a0511f7eca917feedc6f6b648a9fdbfa7b35e83aa6d6b93c4fbedb244999b8d03ec418fd748efb038a5377b5348ac6786ba4d8fb108ea9703f3da

    • \Windows\ehome\ehrecvr.exe

      Filesize

      1.2MB

      MD5

      1d8b7e4c8d71d0d20a650c2a8bba2037

      SHA1

      7f633a1bf0874e878a6a6616e4566a6bfddf48a6

      SHA256

      dca0d5bffbbe5d51f393f892edf42ce3c3bec418992db4df0909b1382f1cc4c4

      SHA512

      1c8332dc8d00d52fc56bda9a7d7ed4c1bdb547fe2e8a988fee10c96673a6b526e4738f34abf60a596f413f89c9e5a25d9a4e61a0896b86184c5b7897da4c9df8

    • \Windows\ehome\ehsched.exe

      Filesize

      691KB

      MD5

      d0a52e9de51d1c266b4bb891184f1aed

      SHA1

      d32b7f1e792ff6887bfafe906b2cfa0d608a8cc7

      SHA256

      61b5cf89f76eeb4279fe291e4a58102051afc14849d4730d62a0e756010cccd7

      SHA512

      8bd2f6c7d30d7b68e1227e2fb69c56769b572ce82ed6489fb087af6bbde61959259e4d83913239569817a4e64dd18804920a776c595d1b4c8d9fed5ed9de8032

    • memory/1064-169-0x0000000140000000-0x00000001400AE000-memory.dmp

      Filesize

      696KB

    • memory/1064-178-0x0000000000290000-0x00000000002F0000-memory.dmp

      Filesize

      384KB

    • memory/1064-262-0x0000000140000000-0x00000001400AE000-memory.dmp

      Filesize

      696KB

    • memory/1372-269-0x0000000000CB0000-0x0000000000D30000-memory.dmp

      Filesize

      512KB

    • memory/1372-179-0x0000000000CB0000-0x0000000000D30000-memory.dmp

      Filesize

      512KB

    • memory/1372-190-0x000007FEF4020000-0x000007FEF49BD000-memory.dmp

      Filesize

      9.6MB

    • memory/1372-196-0x000007FEF4020000-0x000007FEF49BD000-memory.dmp

      Filesize

      9.6MB

    • memory/1372-264-0x000007FEF4020000-0x000007FEF49BD000-memory.dmp

      Filesize

      9.6MB

    • memory/1372-280-0x000007FEF4020000-0x000007FEF49BD000-memory.dmp

      Filesize

      9.6MB

    • memory/1496-259-0x00000000003E0000-0x0000000000446000-memory.dmp

      Filesize

      408KB

    • memory/1496-252-0x000000002E000000-0x000000002E0B5000-memory.dmp

      Filesize

      724KB

    • memory/1508-148-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/1508-73-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/1508-70-0x0000000000230000-0x0000000000296000-memory.dmp

      Filesize

      408KB

    • memory/1508-77-0x0000000000230000-0x0000000000296000-memory.dmp

      Filesize

      408KB

    • memory/1624-322-0x0000000100000000-0x0000000100095000-memory.dmp

      Filesize

      596KB

    • memory/1624-323-0x0000000000420000-0x0000000000480000-memory.dmp

      Filesize

      384KB

    • memory/1740-226-0x0000000140000000-0x00000001400CA000-memory.dmp

      Filesize

      808KB

    • memory/1740-225-0x0000000001000000-0x0000000001060000-memory.dmp

      Filesize

      384KB

    • memory/1740-216-0x0000000001000000-0x0000000001060000-memory.dmp

      Filesize

      384KB

    • memory/1740-209-0x0000000140000000-0x00000001400CA000-memory.dmp

      Filesize

      808KB

    • memory/2036-321-0x0000000000240000-0x00000000002A6000-memory.dmp

      Filesize

      408KB

    • memory/2072-140-0x0000000140000000-0x00000001400B2000-memory.dmp

      Filesize

      712KB

    • memory/2072-150-0x0000000000170000-0x00000000001D0000-memory.dmp

      Filesize

      384KB

    • memory/2072-230-0x0000000140000000-0x00000001400B2000-memory.dmp

      Filesize

      712KB

    • memory/2220-236-0x0000000001430000-0x0000000001431000-memory.dmp

      Filesize

      4KB

    • memory/2220-133-0x0000000000880000-0x00000000008E0000-memory.dmp

      Filesize

      384KB

    • memory/2220-124-0x0000000140000000-0x000000014013C000-memory.dmp

      Filesize

      1.2MB

    • memory/2220-214-0x0000000140000000-0x000000014013C000-memory.dmp

      Filesize

      1.2MB

    • memory/2220-143-0x0000000001430000-0x0000000001431000-memory.dmp

      Filesize

      4KB

    • memory/2228-111-0x0000000100000000-0x0000000100095000-memory.dmp

      Filesize

      596KB

    • memory/2228-118-0x00000000008B0000-0x0000000000910000-memory.dmp

      Filesize

      384KB

    • memory/2228-176-0x0000000100000000-0x0000000100095000-memory.dmp

      Filesize

      596KB

    • memory/2228-110-0x00000000008B0000-0x0000000000910000-memory.dmp

      Filesize

      384KB

    • memory/2408-24-0x0000000140000000-0x000000014009D000-memory.dmp

      Filesize

      628KB

    • memory/2408-32-0x0000000000950000-0x00000000009B0000-memory.dmp

      Filesize

      384KB

    • memory/2408-25-0x0000000000950000-0x00000000009B0000-memory.dmp

      Filesize

      384KB

    • memory/2408-109-0x0000000140000000-0x000000014009D000-memory.dmp

      Filesize

      628KB

    • memory/2540-37-0x0000000010000000-0x000000001009F000-memory.dmp

      Filesize

      636KB

    • memory/2540-103-0x0000000010000000-0x000000001009F000-memory.dmp

      Filesize

      636KB

    • memory/2540-36-0x0000000000450000-0x00000000004B6000-memory.dmp

      Filesize

      408KB

    • memory/2540-42-0x0000000000450000-0x00000000004B6000-memory.dmp

      Filesize

      408KB

    • memory/2552-11-0x0000000000780000-0x00000000007E0000-memory.dmp

      Filesize

      384KB

    • memory/2552-90-0x0000000100000000-0x00000001000A4000-memory.dmp

      Filesize

      656KB

    • memory/2552-12-0x0000000100000000-0x00000001000A4000-memory.dmp

      Filesize

      656KB

    • memory/2552-18-0x0000000000780000-0x00000000007E0000-memory.dmp

      Filesize

      384KB

    • memory/2688-245-0x00000000005C0000-0x0000000000620000-memory.dmp

      Filesize

      384KB

    • memory/2688-238-0x00000000001E0000-0x0000000000292000-memory.dmp

      Filesize

      712KB

    • memory/2688-231-0x0000000100000000-0x00000001000B2000-memory.dmp

      Filesize

      712KB

    • memory/2752-271-0x0000000100000000-0x0000000100542000-memory.dmp

      Filesize

      5.3MB

    • memory/2752-286-0x0000000100000000-0x0000000100542000-memory.dmp

      Filesize

      5.3MB

    • memory/2752-285-0x0000000000870000-0x00000000008D0000-memory.dmp

      Filesize

      384KB

    • memory/2764-96-0x0000000000260000-0x00000000002C0000-memory.dmp

      Filesize

      384KB

    • memory/2764-97-0x0000000000260000-0x00000000002C0000-memory.dmp

      Filesize

      384KB

    • memory/2764-92-0x0000000140000000-0x00000001400AE000-memory.dmp

      Filesize

      696KB

    • memory/2764-88-0x0000000000260000-0x00000000002C0000-memory.dmp

      Filesize

      384KB

    • memory/2764-161-0x0000000140000000-0x00000001400AE000-memory.dmp

      Filesize

      696KB

    • memory/2776-71-0x0000000000400000-0x00000000005DB000-memory.dmp

      Filesize

      1.9MB

    • memory/2776-1-0x0000000000400000-0x00000000005DB000-memory.dmp

      Filesize

      1.9MB

    • memory/2776-0-0x00000000005E0000-0x0000000000646000-memory.dmp

      Filesize

      408KB

    • memory/2776-6-0x00000000005E0000-0x0000000000646000-memory.dmp

      Filesize

      408KB

    • memory/2864-51-0x0000000010000000-0x00000000100A7000-memory.dmp

      Filesize

      668KB

    • memory/2864-320-0x0000000072750000-0x0000000072E3E000-memory.dmp

      Filesize

      6.9MB

    • memory/2864-86-0x0000000010000000-0x00000000100A7000-memory.dmp

      Filesize

      668KB

    • memory/2864-282-0x00000000004B0000-0x0000000000516000-memory.dmp

      Filesize

      408KB

    • memory/2864-50-0x0000000000BE0000-0x0000000000C40000-memory.dmp

      Filesize

      384KB

    • memory/2864-58-0x0000000000BE0000-0x0000000000C40000-memory.dmp

      Filesize

      384KB

    • memory/2864-57-0x0000000000BE0000-0x0000000000C40000-memory.dmp

      Filesize

      384KB

    • memory/2912-284-0x0000000140000000-0x00000001400B6000-memory.dmp

      Filesize

      728KB

    • memory/2912-221-0x0000000000B80000-0x0000000000BE0000-memory.dmp

      Filesize

      384KB

    • memory/2912-212-0x0000000140000000-0x00000001400B6000-memory.dmp

      Filesize

      728KB

    • memory/2996-326-0x0000000100000000-0x0000000100096000-memory.dmp

      Filesize

      600KB

    • memory/3004-191-0x00000000002D0000-0x0000000000336000-memory.dmp

      Filesize

      408KB

    • memory/3004-205-0x000000002E000000-0x000000002FE1E000-memory.dmp

      Filesize

      30.1MB

    • memory/3012-162-0x00000000002F0000-0x0000000000350000-memory.dmp

      Filesize

      384KB

    • memory/3012-155-0x0000000140000000-0x0000000140237000-memory.dmp

      Filesize

      2.2MB

    • memory/3012-250-0x0000000140000000-0x0000000140237000-memory.dmp

      Filesize

      2.2MB

    • memory/3012-257-0x00000000002F0000-0x0000000000350000-memory.dmp

      Filesize

      384KB