Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 23:32

General

  • Target

    949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe

  • Size

    805KB

  • MD5

    54425fc7095f1214a487b1a057b39198

  • SHA1

    8749ead7231553bdd1a08959eea3b07cb9a839d6

  • SHA256

    949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1

  • SHA512

    50ec59575947afe0d43bc737721301d7edb2b623fdff98706552de07b12d57c043206a88d9e139d83a3754a8aa6745f377d95028ad7682c4287629deee72cf15

  • SSDEEP

    12288:rlGp0BYJKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:rXf1SwPHU8X31PfU17DhZy0lxHZ9/I

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 43 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 33 IoCs
  • Modifies data under HKEY_USERS 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe
    "C:\Users\Admin\AppData\Local\Temp\949916bbbc30569165fd655ebf8e5b188ee170e6e6a3c4b5512664dfe510a4d1.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2948
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3048
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2668
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2596
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2548
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1dc -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2292
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 250 -NGENProcess 258 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1276
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 258 -NGENProcess 1f0 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2624
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 254 -NGENProcess 260 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:544
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:868
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 260 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2516
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1dc -NGENProcess 26c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1dc -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1212
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 254 -NGENProcess 26c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:912
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 1ac -NGENProcess 1d8 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1ac -NGENProcess 1d8 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1004
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 290 -NGENProcess 27c -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2804
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 26c -NGENProcess 298 -Pipe 1ac -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2208
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2a0 -NGENProcess 27c -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2192
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 280 -NGENProcess 11c -Pipe 120 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 1d8 -NGENProcess 2a8 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1596
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1368
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:792
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:1604
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:572
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:896
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1060
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:912
  • C:\Windows\system32\IEEtwCollector.exe
    C:\Windows\system32\IEEtwCollector.exe /V
    1⤵
    • Executes dropped EXE
    PID:2880
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:828
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2156
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:1588
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:2704
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:2696
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2344
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:2500
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:1540
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:1544
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:1944
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:924
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1984
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:2844
  • C:\Program Files\Windows Media Player\wmpnetwk.exe
    "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2456
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1658372521-4246568289-2509113762-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1658372521-4246568289-2509113762-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1460
    • C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
      2⤵
        PID:2692
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2644

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      706KB

      MD5

      afc5c7d6f1124fd0fa1e5a81d693920c

      SHA1

      7ea3f367abe9b9b6e39d50ebe92cb9f533c7790c

      SHA256

      2d4f19ffe6b81f1c8b233f88663a343142ace361255bb513293c4e33686dee55

      SHA512

      fda75fee88b6f861d7adbf5c44f85f57b2db272d9d72d0f61db2d9d9892747d987f831ffd9b84753c65a90d89a16e2534c9d0157877311b9de4f9acc84101ec7

    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

      Filesize

      30.1MB

      MD5

      021e24a72cdfc29c321138452d42a048

      SHA1

      8321c60db714bb9d7eea6f3a4f2eb78fd6d7dab3

      SHA256

      539bc2750ff0b38988b731729a814a7adcf1c24f9cfc93b5d04545530c91bd78

      SHA512

      c14d6992e92c03809aaae6efe9b12a703eb4908ead7341b4f51377f5dd22c307a40951e2f01be391c7310433252f500c864cc3ccf29cf848228df9a8ace361ed

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      781KB

      MD5

      02e7a0770d91577a2be5d3d5ba96f8fd

      SHA1

      cb565eadbef3064107814f427199c8112b09fcd6

      SHA256

      9d97e57b1544f7aab2249a621d78de1df0a9da8c951d348f4b97a1431d27106e

      SHA512

      0429c1af00a9bff75042f55032e4c0413caae04294d41a2d87df3c4110e9819f71b46c2d426f041c1f17e70541f5dcca10e56b2cce359f232cb4940e2c85960e

    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

      Filesize

      5.2MB

      MD5

      6c8f5b16a1d4f6b46a9a8b7e27950312

      SHA1

      647f4ba788bb28377673428516e77a57bed1d77a

      SHA256

      3355949c6d81cec5634a05514f97e3e22de01068495f2f42e62c606a54d60f02

      SHA512

      63b589bcc10c44fe6de3ba3781e3f43b8322dcc8ce9dc11ab14a365410960387adec9750dff0648caaf94da7a661068e7a937d57409d427a33bb8ebf7216c0df

    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

      Filesize

      2.1MB

      MD5

      78fd477cc86c3c108ba6d3ec56e80583

      SHA1

      7cd4fd0a11fd81c72f2fa2a81435a308d90f2fc0

      SHA256

      b05d739506acef0c914c9b392a2a72982bb85fcb7f59287e4cd597375c2e9921

      SHA512

      d59a375111dc0cc6a0fc9e13495d3460e8065f74d0550020e8d5b376c5dd42e91b9c0243325aebf6fcbf40e1ec8ab1ba5a23234fb806669127527aebaff2ef58

    • C:\Program Files\Windows Media Player\wmpnetwk.exe

      Filesize

      2.0MB

      MD5

      bd7679a92422b38c4515563aaa29069b

      SHA1

      b0c306394676167a60cb5ea5746b8928bee9078a

      SHA256

      a82d4798d8e1d15c6a24ccda4e222245b476d42b681b070356ae4551cc044758

      SHA512

      9a8129525f6bf305aac1eae0ad3cb4af4a50ab4cb404820b32d74c79fd913cfcb5b016fd12f07fad005a324685986544d0948bcee71ac2c64cb63829f30db399

    • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

      Filesize

      1024KB

      MD5

      0b3a7eb6c9f30115d74e509f2e72821e

      SHA1

      9a1e5718d56ccad808b035f7b54f4b67a3d1ee55

      SHA256

      5aee9b507e4d46dafcb19ef04466e04aead79b3811b78f90dd5358eb677f9499

      SHA512

      33846ae0ddd896d55080a13461766b7714685d25e6b9c9db4dd4ced080d61d62d7ea8fb349bb2054e957421413c137dff7edc7f96d50e3ee769c8366b554c171

    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

      Filesize

      872KB

      MD5

      4b347d5f62573b93408ea5df169cdad8

      SHA1

      99aca886df87f400d841b871d211d243cfa1c287

      SHA256

      bc7591fe28058b6509c02ae1822659e03ef3e38522bf89f614f25885de1f4142

      SHA512

      db82b8a116102bfbb91f71899325375dd1176dc642073419f9c40cfbddeb1b65a7805a8453e18dd95fb9c128473972197ef2644fb62f7ac4a0eee47e284536a4

    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

      Filesize

      678KB

      MD5

      8e864157d5d5a9cb0eae22fb908da061

      SHA1

      d05ad935b0b93f1ee847efa60c823034eaf52f67

      SHA256

      e4b8732902f6dc2e516dbf1a8f90b4c49a1bdd1459695d578d359fc0307b2b9c

      SHA512

      111cb4e863fe15a9919e24c20e2ee834a4251241b15b4fb5c38d2814b94e555877db0e09a8289085a77321a0096e8721f60249828544e1a6ec78e511d44e277d

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

      Filesize

      625KB

      MD5

      ef1b26578ba65008bf30051ac331097f

      SHA1

      424f2d76ee0b63eaac7cf8bd31bb4d7982ee0923

      SHA256

      b7db2992fbbb300e0bdc3e817ce3f54ecafedc321264732dfa4209153f469e3b

      SHA512

      6d810d4831a6a843a4ba6b570faf1ea87052e5ab77a8f556b6136a10560fe91fe8115ffd0d038241b2b38c39028082c54cd78400fc2fdc887513f8475b18e375

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

      Filesize

      1003KB

      MD5

      169bb97156420cba6b85f98e45c9659c

      SHA1

      0c3c13d59868226b51b12c233ff9a4483b29ab85

      SHA256

      5fac1cb7fa1b17532829ec974215993a0ad798608c27a6a35aef1ccbf8518755

      SHA512

      937962ef829d5f03f284d20693f2797942d20de1d71964e48e80f089b228de4fe85c003553e64a965df39d3b55c0be59438c5e4c4fd409024eb09d25d45e2999

    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

      Filesize

      656KB

      MD5

      d18a736604e7acd4d03b5d3cd9ef84e0

      SHA1

      0a5ba61331c543e635dad743ff11ff4de0ed79d3

      SHA256

      614fb0aab7689ae327b4d0faa051b77af85b7435b071c0d1fd4525ca70f60773

      SHA512

      03dc5cac84a796a7c70db3ae789660ca6a641ec9fbd30c9d0c2b6774c25e68c57786ce348fc2b7da99ff0404a6ae729a07e51f81ea7b2ab2a746f88825a19880

    • C:\Windows\SysWOW64\perfhost.exe

      Filesize

      587KB

      MD5

      ac664682549c0e390ab11db695b7e3fa

      SHA1

      ea9f7e3cf3bdeec9b7e58cee0d5e4d3b955c3225

      SHA256

      b25b9b16ed15168780e73433820140f4227e801a540f84e199fc724c9bd5e943

      SHA512

      0fc819554473361623351c353b8e25c53e41e0d8ebcc097319d9033e004f36a5edccb4adffb0c95f7f25cce37573c360cf9e18d06360851bfe75dd4a8e3e1dda

    • C:\Windows\System32\SearchIndexer.exe

      Filesize

      1.1MB

      MD5

      feb251a5a1ec0b6f157faa7d502f13b3

      SHA1

      48fe4b7c4d5d9fe562a7a590fb6ace09d1b4683b

      SHA256

      1e77ed05f15c467b9357e1d1e7cd2f3c56158d2f242ad1e186a79dbe0ddf5097

      SHA512

      aa382cff61f65c1580e1893a7036f5138c69098680a0e5215b604255f64b25cc0c0e77e119bc8bdfe6da4de3ca4e89f95286b70c98f6355830a4d4dfcf8fa91c

    • C:\Windows\System32\VSSVC.exe

      Filesize

      2.1MB

      MD5

      ffcacc71b112374e38adb6cfb4f1a44e

      SHA1

      cb2ce8ef78449de96b5766c52b86374adf2fdeb0

      SHA256

      cb06cf1ae9813ecda71d2c4b0b770e2576b26f57ac76fac716785a8123063f7d

      SHA512

      699a6552fd03c927dd2b55a6704b3c17a2ec24974639827c0d48dd74c584a9da1993b5494df74c4388e302bf370979525a0e8fd6597673d90177587ababcdc23

    • C:\Windows\System32\snmptrap.exe

      Filesize

      581KB

      MD5

      2966656796b680cfa895e5ce7f8abc0a

      SHA1

      0a461074183ea451cdc1a8c37633e685b678ebbf

      SHA256

      ddae73b6dad7707a014b9f3b8808a34c21518791f51a20a4fb4116092c013b29

      SHA512

      bb6b9d55999e76c547eb453650e5de1c249556cb63ed5f953d7c8c095b6732bdff0719f78c3e657ff259a8e2656803177b8547cf18f6752b84f169f71de3c73c

    • C:\Windows\System32\vds.exe

      Filesize

      1.1MB

      MD5

      9440b6ef108911f08fb052de4e95787e

      SHA1

      ca6631457dfdfb662d680f062da579f2b0524678

      SHA256

      e64abfd82d7c23de968ed696d536e9aab036a11f3bce01b91e8c9bead9a92493

      SHA512

      4a3b59dc919cadbb2d2cd758b38fd98891f34bf6da4a5e9c0d87bc1614610ff7ad4ec486cc66d902fdb823a7971e96ca65deb451980a5e11e5bf2ec100b0e1fb

    • C:\Windows\System32\wbem\WmiApSrv.exe

      Filesize

      765KB

      MD5

      e015198669059498f2ca11f554f086fa

      SHA1

      94fd9dbbbf229f3c3b06c578c058c5490fcb8e5a

      SHA256

      c3f90a9a75cc91f19881adec2d964b0d6ea852a69af64e17a0d0642e714e9855

      SHA512

      69330cb7728708c33417f523077534fd459685d83189a1bf426b3f59fe5e7be65ab871bb25b74f7569f98409c3766278cba8564d3ae8e05df5d3e07dc6c827b2

    • C:\Windows\system32\fxssvc.exe

      Filesize

      1.2MB

      MD5

      e8161db3e5f7cf7045c471ed87d4752d

      SHA1

      fffcb96be72106996e53d14d5a9cf08141d85543

      SHA256

      326dfe7ac99093056e632c7da0155b248fccb180032b94ad2ae7287a648f5b45

      SHA512

      a9e527abd07f4cbede9525fbadacb71ebf2fddb3fe5a127c7f9df4d952f27b7f759f4d31fcb666b5fe09b6d691d15e36562d5258dab5f729f98114da9ea8eb96

    • C:\Windows\system32\msiexec.exe

      Filesize

      691KB

      MD5

      3d58330c8bef2bb963a386dc5fa04803

      SHA1

      ac70ca53bb07ea7dafcd758d714b2042ff0a994d

      SHA256

      810649211c98b0aa246f123bb098a278024e65d1ed4ef22f9edb3a231a49d221

      SHA512

      5ffe03788a85f048c2a33dc664064d6dbbad029be29995b2fa770fed9fbaddbe8d946e9f521759ad68334eed6b9f5a7ef0803c471af59425fd71670babeec745

    • \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

      Filesize

      648KB

      MD5

      0c7dc86868e2a795d653c074c222dfad

      SHA1

      c245d286c56643ff1d4add3f7ef48dcd7ab60e61

      SHA256

      0f450e4ea5412cc78c4b0482571487ed1fdf0218a160281bb65fdff2cf481932

      SHA512

      f9619ffa251d4218b96e736207dcaf4d945cd5f36b27990ffdff3b60cd7d6817619cc985cad6303e1c6df70a8afd523b1241530ef982e1c784139ff933258d3e

    • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

      Filesize

      603KB

      MD5

      4231f14fcde55e2440db03593e5d7999

      SHA1

      1ea5a2ee25734ae9567a304dd9d561debb377cba

      SHA256

      0e9c2a217e5e089336edfe49638f0af53c06a103749ed5ce37217989b509c144

      SHA512

      ed37dfaf6210019273cc2aca611dc48659ffc5160b5a2256e343bd1a12785f6ff055499466e689aa300d5befbbd1438072907a26a6b90458c0a61c11ae9a0402

    • \Windows\System32\Locator.exe

      Filesize

      577KB

      MD5

      c5259300537c0c824b7ea84e19f3efc3

      SHA1

      64b71d97c75276c11a7ccd743aad6f38d3697c79

      SHA256

      8c0e724b00d0f9a46ca40b8579726a389dc604827af5da3b665d4ca1d99b9a73

      SHA512

      b9e4e66435209ae9299d567e9b02faa88ed4837b8a549a5000a0231fa5fc2cb0d9605b9ffa9ced5b96ac74df94c67558d01c8491fcd412de8570267accdfd6ee

    • \Windows\System32\alg.exe

      Filesize

      644KB

      MD5

      51b16036b993a366886fc76f6362a807

      SHA1

      0e247d355ebdb4c44bcc1dea8445afb048dbaed3

      SHA256

      3f4ba3b19e096ccf1e4dd1e3d6e1129bb5eba89c47d8bdb7ef9117f34b1f6f3b

      SHA512

      94471f9a6806c17bfca44ca880772939939174497ca5a33a4180fd9f5c80e01c3e7745f24870bd3af8a76918ccba9e488bf1cdc626b8136d5745c0a0fc887a98

    • \Windows\System32\dllhost.exe

      Filesize

      577KB

      MD5

      efaaff8e804fbf16bc157d6be14f60c6

      SHA1

      558bd96db303457a445ce54db1c3d74888785be3

      SHA256

      9ac1cefc993e7efa958fe361ad89bdc997ea946b8ed5299599bffb63eb7221cc

      SHA512

      7e5d7d62729fc3c918ad25521f174402a200bd9eccdbb6330a67266c29ba279d12bb743b27eeff07b62f4427ecc4f973e76b1f0b9ea292452837379bf0e69ded

    • \Windows\System32\ieetwcollector.exe

      Filesize

      674KB

      MD5

      9040897dffd09c4462a2ec0e62846572

      SHA1

      2c9ee7c74b2ef4ca1b1e10533a84d6db7a0c34be

      SHA256

      050b640d3902bdcd38f86a8b6b0f78198b5d29154c0e14c902824f94a13ede7d

      SHA512

      0e9c37ffb88e6aa45b0fd8366e73d4e0c9610a1328d574a583336ac0a3d246614c29f8d58b236ef0a45d44855f746a68b325a72a02c7ce89326507ccce13adcb

    • \Windows\System32\msdtc.exe

      Filesize

      705KB

      MD5

      f8e42925fea6b9039fa299da39ccff0d

      SHA1

      d11c0535f746fe693aaa9e2a6834653c1fd41573

      SHA256

      bbc68ff53343434eddebb96d2c10a10c8bc11b766ca6063c34812841b2130b4c

      SHA512

      7a50e1a272d07048b0d05ccfad1494f40c35a3aebaf4ae3413277cdd5c8d3e220b4c126614439caa766d2b067cd5a0db65b6d1408318e2f3c8d5dcc178732b36

    • \Windows\System32\wbengine.exe

      Filesize

      2.0MB

      MD5

      a8e9c9bd5e445fdfea5e88d5a5bba01f

      SHA1

      2a09707f6c55662231cad02191aeca2286ba537c

      SHA256

      5140dad35ab4df3a27a791379803c2391668a77ffb2ac5ff3306ce9b93f4a737

      SHA512

      4798bef6734040dfd7c450e508ec254367502f7e8c0dfb982fc40d973ae90521e38734251fcab6de3c5e514decea0146fde4889466b26477469784ac6d0ac96c

    • \Windows\ehome\ehrecvr.exe

      Filesize

      1.2MB

      MD5

      de88c91b820a13e7553cacd8c9a65426

      SHA1

      f021c89828ac96c853843a8167cd1195734e42ed

      SHA256

      bb89fd7b7ae0d31f2d11cceda3fd2e50937a3ba3173d3c851983d56e8ab693e6

      SHA512

      24826bc334bfc1bd80c9b80f040bac9fab28b39a7a0362cca8b0c6f9d528b7ccd2fcae7926c8303f10a2c48840e021a0aae76e7b6afb2e25ffbda38162354efb

    • \Windows\ehome\ehsched.exe

      Filesize

      691KB

      MD5

      1d399b748fc4be0f78ff36d60b0297fe

      SHA1

      20ff475a448f80a177169b40d1bb7bdb929a7a1b

      SHA256

      0c502a6eed3ee77f41da9bb8f6e19cc59283cfea2ffb4977ccb6e522d665896f

      SHA512

      e3873a7dd9e2efbee983c448d41462f60d7c8b2a0e68122c226576e3b8c141ccf1697e8300c56f08020d2407c314aff0a02069c5722d58872de22052cc59e235

    • memory/572-137-0x0000000140000000-0x00000001400B2000-memory.dmp

      Filesize

      712KB

    • memory/572-149-0x0000000000830000-0x0000000000890000-memory.dmp

      Filesize

      384KB

    • memory/572-265-0x0000000140000000-0x00000001400B2000-memory.dmp

      Filesize

      712KB

    • memory/792-164-0x0000000100000000-0x0000000100095000-memory.dmp

      Filesize

      596KB

    • memory/792-109-0x00000000001D0000-0x0000000000230000-memory.dmp

      Filesize

      384KB

    • memory/792-112-0x0000000100000000-0x0000000100095000-memory.dmp

      Filesize

      596KB

    • memory/792-117-0x00000000001D0000-0x0000000000230000-memory.dmp

      Filesize

      384KB

    • memory/828-235-0x000000002E000000-0x000000002FE1E000-memory.dmp

      Filesize

      30.1MB

    • memory/828-237-0x0000000000A00000-0x0000000000A67000-memory.dmp

      Filesize

      412KB

    • memory/912-256-0x000007FEF3F80000-0x000007FEF491D000-memory.dmp

      Filesize

      9.6MB

    • memory/912-173-0x0000000000DA0000-0x0000000000E20000-memory.dmp

      Filesize

      512KB

    • memory/912-233-0x000007FEF3F80000-0x000007FEF491D000-memory.dmp

      Filesize

      9.6MB

    • memory/912-354-0x000007FEF3F80000-0x000007FEF491D000-memory.dmp

      Filesize

      9.6MB

    • memory/924-346-0x0000000100000000-0x0000000100219000-memory.dmp

      Filesize

      2.1MB

    • memory/924-348-0x00000000008C0000-0x0000000000920000-memory.dmp

      Filesize

      384KB

    • memory/1060-157-0x0000000140000000-0x0000000140237000-memory.dmp

      Filesize

      2.2MB

    • memory/1060-166-0x00000000004A0000-0x0000000000500000-memory.dmp

      Filesize

      384KB

    • memory/1060-293-0x0000000140000000-0x0000000140237000-memory.dmp

      Filesize

      2.2MB

    • memory/1368-150-0x0000000140000000-0x00000001400AE000-memory.dmp

      Filesize

      696KB

    • memory/1368-89-0x00000000001E0000-0x0000000000240000-memory.dmp

      Filesize

      384KB

    • memory/1368-91-0x0000000140000000-0x00000001400AE000-memory.dmp

      Filesize

      696KB

    • memory/1368-97-0x00000000001E0000-0x0000000000240000-memory.dmp

      Filesize

      384KB

    • memory/1540-337-0x0000000100000000-0x0000000100095000-memory.dmp

      Filesize

      596KB

    • memory/1544-338-0x0000000100000000-0x0000000100096000-memory.dmp

      Filesize

      600KB

    • memory/1544-340-0x0000000000150000-0x00000000001B0000-memory.dmp

      Filesize

      384KB

    • memory/1588-243-0x00000000009F0000-0x0000000000A50000-memory.dmp

      Filesize

      384KB

    • memory/1588-241-0x0000000140000000-0x00000001400B6000-memory.dmp

      Filesize

      728KB

    • memory/1604-253-0x0000000140000000-0x000000014013C000-memory.dmp

      Filesize

      1.2MB

    • memory/1604-132-0x0000000000870000-0x00000000008D0000-memory.dmp

      Filesize

      384KB

    • memory/1604-152-0x0000000001430000-0x0000000001431000-memory.dmp

      Filesize

      4KB

    • memory/1604-124-0x0000000140000000-0x000000014013C000-memory.dmp

      Filesize

      1.2MB

    • memory/1604-286-0x0000000001430000-0x0000000001431000-memory.dmp

      Filesize

      4KB

    • memory/1944-342-0x0000000100000000-0x0000000100114000-memory.dmp

      Filesize

      1.1MB

    • memory/1944-344-0x0000000000910000-0x0000000000970000-memory.dmp

      Filesize

      384KB

    • memory/1984-350-0x0000000100000000-0x0000000100202000-memory.dmp

      Filesize

      2.0MB

    • memory/2156-214-0x0000000140000000-0x00000001400CA000-memory.dmp

      Filesize

      808KB

    • memory/2156-217-0x00000000008E0000-0x0000000000940000-memory.dmp

      Filesize

      384KB

    • memory/2292-335-0x0000000073900000-0x0000000073FEE000-memory.dmp

      Filesize

      6.9MB

    • memory/2292-251-0x00000000005D0000-0x0000000000637000-memory.dmp

      Filesize

      412KB

    • memory/2292-240-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/2344-274-0x0000000000160000-0x00000000001C0000-memory.dmp

      Filesize

      384KB

    • memory/2344-268-0x0000000100000000-0x0000000100542000-memory.dmp

      Filesize

      5.3MB

    • memory/2344-276-0x0000000100000000-0x0000000100542000-memory.dmp

      Filesize

      5.3MB

    • memory/2500-288-0x0000000000240000-0x00000000002A7000-memory.dmp

      Filesize

      412KB

    • memory/2500-279-0x0000000001000000-0x0000000001096000-memory.dmp

      Filesize

      600KB

    • memory/2548-103-0x0000000010000000-0x00000000100A7000-memory.dmp

      Filesize

      668KB

    • memory/2548-54-0x0000000010000000-0x00000000100A7000-memory.dmp

      Filesize

      668KB

    • memory/2548-55-0x0000000000310000-0x0000000000370000-memory.dmp

      Filesize

      384KB

    • memory/2548-61-0x0000000000310000-0x0000000000370000-memory.dmp

      Filesize

      384KB

    • memory/2596-38-0x0000000010000000-0x000000001009F000-memory.dmp

      Filesize

      636KB

    • memory/2596-39-0x00000000002F0000-0x0000000000357000-memory.dmp

      Filesize

      412KB

    • memory/2596-44-0x00000000002F0000-0x0000000000357000-memory.dmp

      Filesize

      412KB

    • memory/2596-82-0x0000000010000000-0x000000001009F000-memory.dmp

      Filesize

      636KB

    • memory/2668-34-0x0000000000A90000-0x0000000000AF0000-memory.dmp

      Filesize

      384KB

    • memory/2668-26-0x0000000140000000-0x000000014009D000-memory.dmp

      Filesize

      628KB

    • memory/2668-110-0x0000000140000000-0x000000014009D000-memory.dmp

      Filesize

      628KB

    • memory/2668-27-0x0000000000A90000-0x0000000000AF0000-memory.dmp

      Filesize

      384KB

    • memory/2696-262-0x0000000000550000-0x00000000005B7000-memory.dmp

      Filesize

      412KB

    • memory/2696-261-0x000000002E000000-0x000000002E0B5000-memory.dmp

      Filesize

      724KB

    • memory/2704-239-0x0000000100000000-0x00000001000B2000-memory.dmp

      Filesize

      712KB

    • memory/2704-260-0x0000000000590000-0x00000000005F0000-memory.dmp

      Filesize

      384KB

    • memory/2704-249-0x0000000000590000-0x0000000000642000-memory.dmp

      Filesize

      712KB

    • memory/2768-144-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/2768-78-0x0000000000240000-0x00000000002A7000-memory.dmp

      Filesize

      412KB

    • memory/2768-73-0x0000000000240000-0x00000000002A7000-memory.dmp

      Filesize

      412KB

    • memory/2768-72-0x0000000000400000-0x00000000004A8000-memory.dmp

      Filesize

      672KB

    • memory/2880-171-0x0000000140000000-0x00000001400AE000-memory.dmp

      Filesize

      696KB

    • memory/2880-258-0x0000000000160000-0x00000000001C0000-memory.dmp

      Filesize

      384KB

    • memory/2880-352-0x0000000140000000-0x00000001400AE000-memory.dmp

      Filesize

      696KB

    • memory/2948-0-0x0000000000400000-0x00000000004CE000-memory.dmp

      Filesize

      824KB

    • memory/2948-71-0x0000000000400000-0x00000000004CE000-memory.dmp

      Filesize

      824KB

    • memory/2948-7-0x00000000004D0000-0x0000000000537000-memory.dmp

      Filesize

      412KB

    • memory/2948-6-0x00000000004D0000-0x0000000000537000-memory.dmp

      Filesize

      412KB

    • memory/2948-1-0x00000000004D0000-0x0000000000537000-memory.dmp

      Filesize

      412KB

    • memory/3048-90-0x0000000100000000-0x00000001000A4000-memory.dmp

      Filesize

      656KB

    • memory/3048-20-0x00000000008F0000-0x0000000000950000-memory.dmp

      Filesize

      384KB

    • memory/3048-19-0x00000000008F0000-0x0000000000950000-memory.dmp

      Filesize

      384KB

    • memory/3048-12-0x00000000008F0000-0x0000000000950000-memory.dmp

      Filesize

      384KB

    • memory/3048-13-0x0000000100000000-0x00000001000A4000-memory.dmp

      Filesize

      656KB