Analysis

  • max time kernel
    154s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 19:58

General

  • Target

    edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe

  • Size

    1.8MB

  • MD5

    963d920f95753f80594ae3438bbdb5c3

  • SHA1

    a94b3fe25fa51339b750a568fa429dc8f5991374

  • SHA256

    edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352

  • SHA512

    6611f73b1f45345813573b60cb055d3589b2f93ac04b192bd13bbefb78909ff02a0aca2c32dd37a0ebc996820b85b7c1f53bcbd1bb615d72103ae53303d00488

  • SSDEEP

    49152:rx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WA/kQ/qoLEw:rvbjVkjjCAzJMqo4w

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 45 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 28 IoCs
  • Modifies data under HKEY_USERS 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe
    "C:\Users\Admin\AppData\Local\Temp\edaaf5f891682323c24c6a219e1084bab24901468f15640f5bf0605463401352.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3000
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:2572
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2124
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2552
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2800
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:752
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2172
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1ac -NGENProcess 250 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 254 -NGENProcess 240 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1200
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 240 -NGENProcess 184 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d4 -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 23c -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1664
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 184 -NGENProcess 268 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2940
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 184 -NGENProcess 258 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2476
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 184 -NGENProcess 1ac -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1920
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 26c -NGENProcess 254 -Pipe 184 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1700
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 27c -NGENProcess 260 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1000
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 274 -NGENProcess 284 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2808
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 288 -NGENProcess 260 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1688
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 288 -NGENProcess 274 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2772
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 27c -NGENProcess 260 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 290 -NGENProcess 1ac -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2452
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 298 -NGENProcess 260 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2720
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:592
  • C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1556
  • C:\Windows\ehome\ehRecvr.exe
    C:\Windows\ehome\ehRecvr.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2204
  • C:\Windows\ehome\ehsched.exe
    C:\Windows\ehome\ehsched.exe
    1⤵
    • Executes dropped EXE
    PID:1940
  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1804
  • C:\Windows\eHome\EhTray.exe
    "C:\Windows\eHome\EhTray.exe" /nav:-2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2104
  • C:\Windows\system32\IEEtwCollector.exe
    C:\Windows\system32\IEEtwCollector.exe /V
    1⤵
    • Executes dropped EXE
    PID:844
  • C:\Windows\ehome\ehRec.exe
    C:\Windows\ehome\ehRec.exe -Embedding
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:856
  • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    PID:1880
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2440
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:2780
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:2152
  • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:688
  • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:564
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    PID:2836
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:2116
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:2360
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:2760
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2348
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2748
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:2212
  • C:\Program Files\Windows Media Player\wmpnetwk.exe
    "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1340
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\system32\SearchProtocolHost.exe
      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3787592910-3720486031-2929222812-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2644
    • C:\Windows\system32\SearchFilterHost.exe
      "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
      2⤵
        PID:2036
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:548
    • C:\Windows\ehome\ehRec.exe
      C:\Windows\ehome\ehRec.exe -Embedding
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1380

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

      Filesize

      1.3MB

      MD5

      a3777855b8a44fa8f697040cd7f2cd98

      SHA1

      6eb53d6a6e97d31b4b187a3d8941c73aed544ef6

      SHA256

      f8f75fc1b6c227d7ab3772e4ffc60dda353808a181ba63a522d98309a506801b

      SHA512

      62f5485bb56c9af11b6640b274c44be7223deed1e0420327a10ab894b60298b04c96e017453c6f5f86cd03c69c3c86233271537a684e69771e261db2c642653b

    • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

      Filesize

      30.1MB

      MD5

      b81c49cd70f35cc1a9e17346221f795c

      SHA1

      dbcf7f05cec1b09e2b97f75999ab97e85738d454

      SHA256

      43db89bde37bc80368cd5257e61c58bb6b7f2471cb3f52ba37f7db7e5396f347

      SHA512

      f0829bc1184aa8f6bc92492d36ad6b38996fd052a15911a985969222f0ce388738d041cdf9f26b978a83a376e4cdd11d1cfc8e8f26668945df740b488ddc5e5d

    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

      Filesize

      1.4MB

      MD5

      d27704ffe919e1b297f7baab8b2ac709

      SHA1

      21a900394f683ad3498fb0840706492909047f75

      SHA256

      7a872db81052244bb64b73c7b3ca2b5f78ede210eea0881d9b86e3591c45a397

      SHA512

      8dc8cde64c0a75fbb5a85c88c5e088966b3e11f1ad534f7ff640d5bf3761eecd3f960341cf181724c9f05b0f689c18e0ae27cb225029875c44c60a95bcd5cd40

    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

      Filesize

      5.2MB

      MD5

      1b2c6a92813857318f988a0e26c9258d

      SHA1

      a8dbf22a9eeadf62dd180711de85b8b30c3aaf2f

      SHA256

      9f0bfba54a332fef6ab68eca4a5655543e1707d1c117813c4e4ff47658461d3c

      SHA512

      2afd5a05b9f17c96e308be2b985ff8d4591eaae2dc57c4f35799156bb32437bc01b1324f3a2dbc703639ae9bcc71217a2d14fae6775ef6c82104afe1b5f50920

    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

      Filesize

      2.1MB

      MD5

      8137734991728bce5dbd87ba7fd8a36e

      SHA1

      6a63c08750b0ff61ce74a9b780c32f47d2d4b6af

      SHA256

      f88a3f3cb4c697dc918e4df108d96137df184d8ea6fb42fef11f3c0ab44eac8f

      SHA512

      2a54a88301ed43b80f116c4dbb865771e1e06594bc66697e89db04fa599665e674b97921c72124f13d0bdf8b570bcf1852cc68d4c089f9b39a7291ccb8e011bd

    • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\8f96978fc46d9f00d8780351026924d7_bf9bdae1-6812-4169-92a0-a7c2b4bbb305

      Filesize

      59B

      MD5

      db733e033c397fec5917611957620271

      SHA1

      6f94d1daa0fc4ec1b2d4cbcb93730d8edb77a2b7

      SHA256

      1f3ffadd3b80c7f95be06e245410768e8302a24e573868da3c6fd91230025bdc

      SHA512

      9a9bb4cf6380bb0a73ea414ca2226a344c7da003e49610dc38bd10892dc17244e4c88bf8a466131027e3c064c693ad99014e6853fff51edb21cb690b926b962f

    • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

      Filesize

      1024KB

      MD5

      40077e58c61fad92519e140e0dc34022

      SHA1

      2cce66177530344f88e37eb84f0043be701bf444

      SHA256

      6e3868949a3dc1443296f14a96c93c58e3b50bfc4b177f37ac0b233ed8baa1f0

      SHA512

      20e5128d8533a27568aacd900a58a947cbbce92dbd1bac8dce44871d1f7edb57b8d303c21c1b9945e386bb42265c48ed32347b3f4b275e0dd835c30eab2f662f

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

      Filesize

      24B

      MD5

      b9bd716de6739e51c620f2086f9c31e4

      SHA1

      9733d94607a3cba277e567af584510edd9febf62

      SHA256

      7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

      SHA512

      cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

      Filesize

      1.2MB

      MD5

      fb3a320c885ce17bb7a92fe8d1e55196

      SHA1

      f687081dec4fda9f7605db1a4f79baee2ab1ab75

      SHA256

      98fd7f16eef60455d6f0a3e73559d7e2bc7e428aad1b800279759f2330effc72

      SHA512

      b70950943054833a05bb3f120c5fa0aaa1e2de189d8329539f1359114f82bad4182e06d12d9da4bcdeec21606edf40aee25a346c86a7e36209ee746e0bf98475

    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

      Filesize

      872KB

      MD5

      62707c97b2066724b92647ec37d37e04

      SHA1

      c2def4837d6e79ff0e2166f62d5a71c214ee54a7

      SHA256

      e766f9b707566c1d2aa4052272d96f83cef98e91bd53f5c81e405fd41be1618c

      SHA512

      3ab162d8308bf7da4d0d068748a78bc865909c71909e6b72cdbfa48596f6019e7696b312adfc39e85c3898721eaac375c40ba99e407ceb781a05c8277067cda0

    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

      Filesize

      1.3MB

      MD5

      8abc07986e08e7ee8d9ccd8a1cbce687

      SHA1

      63430dc3dacd5261164d173babf1de8c8f6de55a

      SHA256

      864c680f0e6a7aef9529c0d08be3b015fb7fa51a8c5ed708ce219df9eb592d58

      SHA512

      c46b83ed6ab6665751ef3dc87cef0bb263c3d8471c05e8290cbc1ef11e5ee69cef0928a880e8d531768791cb96226654e2efa45927c78d9cfb3ed8dcd595ef6c

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

      Filesize

      1.2MB

      MD5

      f4e8e7fe0963a25c6e691e194c1ed0c8

      SHA1

      0af3c06b8c7cd255a2d07844f339e00ae0faf6e0

      SHA256

      46144eaef219bb3c65f16295f019de483b73db8a18ee7a0fa5994a4392d899c6

      SHA512

      9114797bcb9fa1abbe733872d099fa136ed5c5427c15ad980905bb6a77142986d548a13335e308eae76de3e847d34f05fe03281fe5f6064e438d31dba5f5fb46

    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

      Filesize

      1003KB

      MD5

      ffde9a76b8186999cedf7f1654d29627

      SHA1

      33e0d30bcc336e804342b039640d2b7682de41cf

      SHA256

      e6abdc6fd68d82ecd9fde9cd4a6b69462327fbb082c3ec2d0ca7a06199b48633

      SHA512

      7bf157230abbb0c6cf1376aae5e7888057c4d037ed293a5e1f6854b54a0b6df612800a81842d772266bc3221e9dd3d1cb0db4fe82a1bbc400ae862ea4572d5c0

    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

      Filesize

      1.2MB

      MD5

      94c59e5780b619309d40d87600306bf8

      SHA1

      922e2b17cea5fdc4c5e02a3a827115478a282aed

      SHA256

      7090f8c5ab30505069ff8dc63d59213593f9cf29cb680d89d73642514828fc9e

      SHA512

      c906c903b23f03f6dd785cfe6cf0f802f11f5659d5be0fe5c2997426bcd8292f05123480e1206e88340cdf3885c5f9fc0b310b8aec0af272f97fa3b26439cfbc

    • C:\Windows\SysWOW64\perfhost.exe

      Filesize

      1.2MB

      MD5

      56d2623b535f34c7f984621a441f769e

      SHA1

      e11a1c3eb8cd9112f9a04b40f4943cd50f6fc274

      SHA256

      7fbbda31ba4f1dbd3e9d6569413aabf8c77ee4a4319bd2e57a15458b0ec8af90

      SHA512

      db1b3a26ea909d9098f3e636f508a008e8f9bc7dab40d186889118b8035cf36266fab3a21de8c6fd59ee82763d4921817d12ad1fcdb004cf3559357132a62af7

    • C:\Windows\System32\SearchIndexer.exe

      Filesize

      1.1MB

      MD5

      9ff0226415f51b4ab5fd29be8adb574a

      SHA1

      c9f186734377c05c653a33870f5c4e352213b1a4

      SHA256

      b39a186c6d6b23ce3131d24f9c78147bbe7088935cce002b00163a0530900514

      SHA512

      5308e97494ab12813ecf73466f28ea4a5bb2e3d229c14dca966aa5cf7e8dcd9e615c01ae10e56752cc87acf7628bc38bed5b15d4b4a7365fc9fd90b56e05d92f

    • C:\Windows\System32\VSSVC.exe

      Filesize

      2.1MB

      MD5

      ab72ad15e45a687c245b74dacf23883e

      SHA1

      16630d5bb455633fcb208552db0239dbfcc17ad9

      SHA256

      5c9a1f41a4e0fad5bf7a74d76cd489294ed23bbdbd866f0c2fdff2624870ac23

      SHA512

      bc3899a29b5b63d2bdda28991736f282913b5f3d3c66be916e808c8503adddf75a116caff0a7881d887e12b2284bf471431f5917fa1d5b50239c250b082e5b31

    • C:\Windows\System32\vds.exe

      Filesize

      1.7MB

      MD5

      5c62d9d946265a8690f761f33e6eb94b

      SHA1

      e823bb7a095f3ae7137d51ae0f1c76edfe536634

      SHA256

      dd36c71dcce4b759884ad513b8fa381a1e6b80bd7dbb232cdb31f586cf3c0716

      SHA512

      ba088a82be2386fb0e824c5efbd024c69113a24d5c23c411d0183227faf7cd4405ec665028b1d746a6ca51093ab62e7e3bc66c464aa74ebf5eb6cc183d95dbb0

    • C:\Windows\ehome\ehsched.exe

      Filesize

      1.3MB

      MD5

      20308669e51dd64331987cdda42e7a41

      SHA1

      5b9946fbba3d18d2dbdcd98c9c59385a4f49e0e3

      SHA256

      565e97d1f73dde0aad55b18056155ddd5927c1352c0c51ace364c3b75df6d7df

      SHA512

      b4724de764844e52e903807e074f2f141fb566c1a3a54ed24dc559c3c9316337552098327bf0384369f51a8ff41f184957ba2739dee5415f31767156f4d296ac

    • \??\c:\programdata\microsoft\ehome\mcepg2-0.db

      Filesize

      532KB

      MD5

      efd89bfe276f5e4ebc563659abacf6b8

      SHA1

      6f9158810b851eb817d2b32eb04fc72c4a95817a

      SHA256

      425c5a2f53d1bb29faf532dd6c68101b6e04e87562e26deae6c32f1f3eea3b1b

      SHA512

      871e8c96ca3daaf8bd0a123d0c396af31a8374572dd75dd75fc729d4e3ec6eb35a8674b4d23eb62c17e34363372316899a74f49bc1f2b90f9e76d9e4b7b49ee8

    • \Program Files\Windows Media Player\wmpnetwk.exe

      Filesize

      2.0MB

      MD5

      b0f65f5cd1fec91322d0dd63e01decdc

      SHA1

      00a2d5151febf60857b205edde6fdce28e8f0340

      SHA256

      455078854fdd1e02f9dc6a1e9b082af9271c73dbe3b76b8349f9120830d7f7b4

      SHA512

      ea78ce3a61ff1da4e186fa874a2132faf4876f92f381f18c729bb9cb401d3ad97d5a31dcf9a45996f3d90e2e77dc76ab7356f82f207203a03b8b21fdb7c7398a

    • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

      Filesize

      1.2MB

      MD5

      82735edde3d656ca4a9546b7003ced1f

      SHA1

      a58fae44fb1f9b5217b54c9a9ae84a4183687726

      SHA256

      36d08116b07c26713602a1d8a3ff925559eab0ee1804957b9072fb3f74532b27

      SHA512

      7635ef94f0bb6606423ec02e260d0626f33d4e6ecd5fdd2f6801c01ed5d3e0c8733aad5d7855358615357ee646b8259fa2b94320311d3fbdeb47a28801306ca2

    • \Windows\System32\Locator.exe

      Filesize

      1.2MB

      MD5

      cc11be9893f7d0609d0b15d8aad328d8

      SHA1

      c0079b2e38d45dc48a58a02b8091c7ac4b6f25ce

      SHA256

      3d737caeebaf34d62def21b07d5e859d8f968827b0a105d27b664ba29e2d4dc3

      SHA512

      9d5ee85dc3a378e4db4f74807b59194e103640d64a2f73414dd30ce368d24db10d916ecdbaa477b9e826a4b80df1d698e89e642282ec69ed8eda8ae079ed6072

    • \Windows\System32\alg.exe

      Filesize

      1.2MB

      MD5

      480cbdfd8033d7d4bdcd2802fa927eaa

      SHA1

      819f9867f5743319f1bc296030972cc8af4661f0

      SHA256

      04076f5495232b92409086867547bd2d7d4d6976487cb354d5c8cacfd31d912c

      SHA512

      efa3b8bae9a7796a0abffc2bc38e0ade50cdca7c72dc174b0639aa98113b7b1649c7ad95e5d43f9e584b18875ee0f3f52fa1ed56f62923114e07871fb58158de

    • \Windows\System32\dllhost.exe

      Filesize

      1.2MB

      MD5

      2146ce2c072b3367744b4a9c5f65bc90

      SHA1

      f59b0e3b053b0e43415c622f5e192c3b3eaee853

      SHA256

      ed008ed194f1eca8848d27927bb3778328a806ae011df76e6c138d0bd3c70f30

      SHA512

      c82de4eaf25d81d88058d94348a91ea6700aa1630f7d856949a3bf88ae225e314758ff1babee7d5e146148795da095006b8a4cee65c2ed268c5b6fd2edcaf473

    • \Windows\System32\ieetwcollector.exe

      Filesize

      1.2MB

      MD5

      64b732e1a4c29286293a69cb73944e41

      SHA1

      313718b3700540d6bbc2f3532e517e9e7d8373bb

      SHA256

      c6725841735548a6b3bb2515acb9afde388f538248c6914431ee36c9ee6a5848

      SHA512

      5760f6514689825b7b1c905c1e44892241a48deb6f15236864e23a89f36aee3e503b1af69d2273421f262b0a607fb8951791fb36bd09f79f44f1d91f352a8452

    • \Windows\System32\msdtc.exe

      Filesize

      1.3MB

      MD5

      1a339c437104c2bdbb1f90881902e998

      SHA1

      48f7c723a07229cc45d0e3d49486b5580db1407e

      SHA256

      88eb5102aa03bc3ff02782c55d839efecc76da04a3fe4c310f727e1e0fd91bff

      SHA512

      09999e33a6d587ea4e3903dde35cb209c0e8968f15544e0038915b22ff8f32270e3145ac180f5e4e5578a27a55c15d789710284407fe2375e18f37d027aea299

    • \Windows\System32\msiexec.exe

      Filesize

      1.3MB

      MD5

      e8200e1b8e455b93b419f702fea1a202

      SHA1

      5e5a918a29ef6ced0b1f35d97d69eb9861812f21

      SHA256

      041f19a94a2b43b6a249444035b86d0663d7e409b770b35fe96cfd6048cb7961

      SHA512

      f1869a7a78f28b0a7ebf64d736e096b620c2c15819470ac3b499c2f7a401c7864cec7bfa00ebe3b81f949256dc2849c6fd01c754ec70f90db90f05c891e123a9

    • \Windows\System32\snmptrap.exe

      Filesize

      1.2MB

      MD5

      f9a870b7445d70e885303e5712d88b98

      SHA1

      78772b5e8dcb9a5f2edc5ae7a689a65b9ef68bd4

      SHA256

      dfd90d739904ab03f5c96ceac20615c580882466904bf9de5cb1de8d5a179f3a

      SHA512

      0edf9137eff42f12bd6e840e78140c61778ccb4053b52e458722b3cf59b556cb46d751da2936dd86074a195b7f012ec1918086aafef98ef86859c7f6698bd919

    • \Windows\System32\wbem\WmiApSrv.exe

      Filesize

      1.3MB

      MD5

      fe3fd38ec79310fae4f00a845f22ea97

      SHA1

      1256c43a715eeaf0d3468729ee9bb7f6955aff7f

      SHA256

      3ee8251d881b162142a795267720efec1ba2bac1f02580f4dfb3eb524ccd1047

      SHA512

      10d1d51f6ab13f9d59a3808dc3fbd9636ed6c1aa88f190c898ece9f4fdc0d0fa8f31203c3db1c2bae0a9827c0956c7ff6cd3d107cd0b50f8506a90b661ad5d80

    • \Windows\System32\wbengine.exe

      Filesize

      2.0MB

      MD5

      4274cb2dcbfd300d78c85d711f148b66

      SHA1

      a21c47263a299930e763201b381545a47eb36c60

      SHA256

      5e8795a7cbe8458a97d54fdd7a1a2bd3aca64dcb32c14942b9a4d642a9a5295e

      SHA512

      8177835cb5b28d6653b152f96dbb15d1916599f44067134846dcb0b5377d30b46efab132c530945855ea0a0cd6a7b3871f3c8c5e6abf86c5f0ef3281b2837213

    • \Windows\ehome\ehrecvr.exe

      Filesize

      1.2MB

      MD5

      987a14ee124cf2966584fece30e1f368

      SHA1

      92299c684e321157628952a405a748c546f393e0

      SHA256

      4e96432d71eea7e1ce8a098168f468c6e8dbb5e47122cbfd43a1c9de7435d2f5

      SHA512

      e01964ac00689644c690b0a059866a8926645cbb11a5d4e6eb1557f9241bb6a285398ea5824d6c6d7baea6416280ebd40bf5417a783a38b1d0fd42601c404f5c

    • memory/564-278-0x0000000100000000-0x0000000100542000-memory.dmp

      Filesize

      5.3MB

    • memory/564-276-0x0000000100000000-0x0000000100542000-memory.dmp

      Filesize

      5.3MB

    • memory/564-279-0x0000000000860000-0x00000000008C0000-memory.dmp

      Filesize

      384KB

    • memory/592-89-0x00000000005F0000-0x0000000000650000-memory.dmp

      Filesize

      384KB

    • memory/592-97-0x00000000005F0000-0x0000000000650000-memory.dmp

      Filesize

      384KB

    • memory/592-164-0x0000000140000000-0x0000000140145000-memory.dmp

      Filesize

      1.3MB

    • memory/592-92-0x0000000140000000-0x0000000140145000-memory.dmp

      Filesize

      1.3MB

    • memory/688-261-0x000000002E000000-0x000000002E14C000-memory.dmp

      Filesize

      1.3MB

    • memory/688-262-0x0000000000230000-0x0000000000296000-memory.dmp

      Filesize

      408KB

    • memory/752-153-0x0000000000400000-0x000000000053F000-memory.dmp

      Filesize

      1.2MB

    • memory/752-75-0x0000000000400000-0x000000000053F000-memory.dmp

      Filesize

      1.2MB

    • memory/752-73-0x0000000000540000-0x00000000005A6000-memory.dmp

      Filesize

      408KB

    • memory/752-79-0x0000000000540000-0x00000000005A6000-memory.dmp

      Filesize

      408KB

    • memory/844-295-0x0000000140000000-0x0000000140145000-memory.dmp

      Filesize

      1.3MB

    • memory/844-180-0x0000000000880000-0x00000000008E0000-memory.dmp

      Filesize

      384KB

    • memory/844-171-0x0000000140000000-0x0000000140145000-memory.dmp

      Filesize

      1.3MB

    • memory/856-313-0x000007FEF3C20000-0x000007FEF45BD000-memory.dmp

      Filesize

      9.6MB

    • memory/856-301-0x000007FEF3C20000-0x000007FEF45BD000-memory.dmp

      Filesize

      9.6MB

    • memory/856-210-0x000007FEF3C20000-0x000007FEF45BD000-memory.dmp

      Filesize

      9.6MB

    • memory/856-312-0x0000000000DD0000-0x0000000000E50000-memory.dmp

      Filesize

      512KB

    • memory/856-212-0x000007FEF3C20000-0x000007FEF45BD000-memory.dmp

      Filesize

      9.6MB

    • memory/856-211-0x0000000000DD0000-0x0000000000E50000-memory.dmp

      Filesize

      512KB

    • memory/1556-110-0x0000000000880000-0x00000000008E0000-memory.dmp

      Filesize

      384KB

    • memory/1556-112-0x0000000100000000-0x000000010012C000-memory.dmp

      Filesize

      1.2MB

    • memory/1556-118-0x0000000000880000-0x00000000008E0000-memory.dmp

      Filesize

      384KB

    • memory/1556-179-0x0000000100000000-0x000000010012C000-memory.dmp

      Filesize

      1.2MB

    • memory/1804-294-0x0000000140000000-0x0000000140237000-memory.dmp

      Filesize

      2.2MB

    • memory/1804-166-0x00000000008D0000-0x0000000000930000-memory.dmp

      Filesize

      384KB

    • memory/1804-157-0x0000000140000000-0x0000000140237000-memory.dmp

      Filesize

      2.2MB

    • memory/1880-187-0x000000002E000000-0x000000002FE1E000-memory.dmp

      Filesize

      30.1MB

    • memory/1880-311-0x000000002E000000-0x000000002FE1E000-memory.dmp

      Filesize

      30.1MB

    • memory/1880-266-0x0000000000520000-0x0000000000586000-memory.dmp

      Filesize

      408KB

    • memory/1940-149-0x0000000140000000-0x0000000140149000-memory.dmp

      Filesize

      1.3MB

    • memory/1940-150-0x0000000000390000-0x00000000003F0000-memory.dmp

      Filesize

      384KB

    • memory/1940-280-0x0000000140000000-0x0000000140149000-memory.dmp

      Filesize

      1.3MB

    • memory/2116-308-0x0000000100000000-0x000000010012C000-memory.dmp

      Filesize

      1.2MB

    • memory/2124-33-0x0000000000420000-0x0000000000480000-memory.dmp

      Filesize

      384KB

    • memory/2124-25-0x0000000000420000-0x0000000000480000-memory.dmp

      Filesize

      384KB

    • memory/2124-32-0x0000000000420000-0x0000000000480000-memory.dmp

      Filesize

      384KB

    • memory/2124-26-0x0000000140000000-0x0000000140134000-memory.dmp

      Filesize

      1.2MB

    • memory/2124-68-0x0000000140000000-0x0000000140134000-memory.dmp

      Filesize

      1.2MB

    • memory/2152-260-0x00000000003E0000-0x0000000000440000-memory.dmp

      Filesize

      384KB

    • memory/2152-268-0x0000000100000000-0x0000000100149000-memory.dmp

      Filesize

      1.3MB

    • memory/2152-271-0x00000000005A0000-0x00000000006E9000-memory.dmp

      Filesize

      1.3MB

    • memory/2172-215-0x0000000000290000-0x00000000002F6000-memory.dmp

      Filesize

      408KB

    • memory/2172-257-0x0000000073AD0000-0x00000000741BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2172-213-0x0000000000400000-0x000000000053F000-memory.dmp

      Filesize

      1.2MB

    • memory/2172-303-0x0000000073AD0000-0x00000000741BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2204-132-0x0000000000870000-0x00000000008D0000-memory.dmp

      Filesize

      384KB

    • memory/2204-263-0x0000000140000000-0x000000014013C000-memory.dmp

      Filesize

      1.2MB

    • memory/2204-126-0x0000000140000000-0x000000014013C000-memory.dmp

      Filesize

      1.2MB

    • memory/2204-154-0x0000000001430000-0x0000000001431000-memory.dmp

      Filesize

      4KB

    • memory/2204-290-0x0000000001430000-0x0000000001431000-memory.dmp

      Filesize

      4KB

    • memory/2440-232-0x0000000000FC0000-0x0000000001020000-memory.dmp

      Filesize

      384KB

    • memory/2440-216-0x0000000140000000-0x0000000140161000-memory.dmp

      Filesize

      1.4MB

    • memory/2440-217-0x0000000000FC0000-0x0000000001020000-memory.dmp

      Filesize

      384KB

    • memory/2440-231-0x0000000140000000-0x0000000140161000-memory.dmp

      Filesize

      1.4MB

    • memory/2552-38-0x00000000002D0000-0x0000000000336000-memory.dmp

      Filesize

      408KB

    • memory/2552-44-0x00000000002D0000-0x0000000000336000-memory.dmp

      Filesize

      408KB

    • memory/2552-96-0x0000000010000000-0x0000000010136000-memory.dmp

      Filesize

      1.2MB

    • memory/2552-37-0x0000000010000000-0x0000000010136000-memory.dmp

      Filesize

      1.2MB

    • memory/2572-61-0x0000000100000000-0x000000010013B000-memory.dmp

      Filesize

      1.2MB

    • memory/2572-12-0x0000000000170000-0x00000000001D0000-memory.dmp

      Filesize

      384KB

    • memory/2572-14-0x0000000100000000-0x000000010013B000-memory.dmp

      Filesize

      1.2MB

    • memory/2572-19-0x0000000000170000-0x00000000001D0000-memory.dmp

      Filesize

      384KB

    • memory/2780-259-0x0000000000780000-0x00000000007E0000-memory.dmp

      Filesize

      384KB

    • memory/2780-273-0x0000000140000000-0x000000014014D000-memory.dmp

      Filesize

      1.3MB

    • memory/2800-104-0x0000000010000000-0x000000001013E000-memory.dmp

      Filesize

      1.2MB

    • memory/2800-60-0x0000000000BB0000-0x0000000000C10000-memory.dmp

      Filesize

      384KB

    • memory/2800-53-0x0000000000BB0000-0x0000000000C10000-memory.dmp

      Filesize

      384KB

    • memory/2800-54-0x0000000010000000-0x000000001013E000-memory.dmp

      Filesize

      1.2MB

    • memory/2836-286-0x0000000001000000-0x000000000112D000-memory.dmp

      Filesize

      1.2MB

    • memory/2836-292-0x0000000000430000-0x0000000000496000-memory.dmp

      Filesize

      408KB

    • memory/3000-0-0x0000000000250000-0x00000000002B6000-memory.dmp

      Filesize

      408KB

    • memory/3000-50-0x0000000000400000-0x00000000005D4000-memory.dmp

      Filesize

      1.8MB

    • memory/3000-7-0x0000000000250000-0x00000000002B6000-memory.dmp

      Filesize

      408KB

    • memory/3000-1-0x0000000000400000-0x00000000005D4000-memory.dmp

      Filesize

      1.8MB