expiro | b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891eb

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-01-2025 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
Size

770KB
MD5

c55ab05632041ddfe5bd75a64581d560
SHA1

3df450510db96e99dea7abb7627d3e3e7bd5bcbc
SHA256

b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891eb
SHA512

daee95079c2e62652cde00b53a0c7ba26856cec4f5c5f35a22b23757f8066a434cd779940e737a5ca6cd146f4e876a830d8b15ec1156ed41ee1f8f2b569ea0ac
SSDEEP

24576:FsqSroAupL8uSrOoMxossbnJivQjZFnyHYP:FGD+LzG7hsEnJGQ1py4P

Score

10^/10

expiro backdoor credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 3 IoCs

backdoor

resource	yara_rule
behavioral1/memory/3032-2-0x0000000001000000-0x00000000011E4000-memory.dmp	family_expiro1
behavioral1/memory/2816-54-0x0000000010000000-0x00000000101BF000-memory.dmp	family_expiro1
behavioral1/memory/2660-96-0x0000000000400000-0x00000000005C8000-memory.dmp	family_expiro1

Executes dropped EXE 9 IoCs

pid	Process
2816	mscorsvw.exe
464	Process not Found
2864	mscorsvw.exe
2660	mscorsvw.exe
2648	mscorsvw.exe
2964	elevation_service.exe
2076	IEEtwCollector.exe
3060	mscorsvw.exe
1720	mscorsvw.exe

Loads dropped DLL 4 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3692679935-4019334568-335155002-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3692679935-4019334568-335155002-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\T:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\U:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\Q:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\M:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\X:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\K:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\L:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\R:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\E:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\G:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\H:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\O:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\Y:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\V:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\W:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\I:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\N:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\P:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\J:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\Z:	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vds.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File created	\??\c:\windows\system32\fxssvc.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\msdtc.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\msiexec.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\vds.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\vssvc.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\snmptrap.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\locator.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\wbengine.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\alg.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\system32\ui0detect.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File created	\??\c:\windows\system32\alg.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\DVD Maker\DVDMaker.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\7-Zip\7z.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\7-Zip\7zG.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\7-Zip\7zFM.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Internet Explorer\ieinstal.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	mscorsvw.exe
File created	\??\c:\windows\servicing\trustedinstaller.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\servicing\trustedinstaller.vir	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	\??\c:\windows\ehome\ehsched.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.vir	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	mscorsvw.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe
2648	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3032	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe
Token: SeShutdownPrivilege	2648	mscorsvw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
3032	b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3060	2648	mscorsvw.exe	38
PID 2648 wrote to memory of 3060	2648	mscorsvw.exe	38
PID 2648 wrote to memory of 3060	2648	mscorsvw.exe	38
PID 2648 wrote to memory of 1720	2648	mscorsvw.exe	39
PID 2648 wrote to memory of 1720	2648	mscorsvw.exe	39
PID 2648 wrote to memory of 1720	2648	mscorsvw.exe	39

C:\Users\Admin\AppData\Local\Temp\b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe
"C:\Users\Admin\AppData\Local\Temp\b1712d5dae24c33010dde7658357b424c8dcdf39f8d8fd15ff728531b3c891ebN.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2816

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2660

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 19c -NGENProcess 1a0 -Pipe 1a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 19c -NGENProcess 1a0 -Pipe 1ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1720

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.vir

Filesize
700KB

MD5
096842dab577c717a48fcbb493606fb0

SHA1
76b07764b579d8f8b734846cd58d738d720c5ad8

SHA256
f3456891c97b9f057ae38fb635eac658479691b50c509d016a766178663f8ad3

SHA512
84ae1a1d19682624f47ee68ae70f0df4db0caff2fc6d23647278fd2b77d097a2ec7cfd811a0cc4a65aadc00a59d992a86e2b31770eff147cce8383027ed209d8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.6MB

MD5
81fac41e5bdb1e5f68c29e546f660ada

SHA1
58a2c64b7fe9b45e4f5a776704c9bec4cbbd67fa

SHA256
f39c02ae1497e65a7956589588adafd274765750eb80782ab0ce7d880863c598

SHA512
2b56b0f0b027034a6503b5c13bc525a01319080ab49f55e4846ef07ca96b150b9c90fca50640c72b95937a6f4b62d758381af1d78b010a703f508400dd86c9ea

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.vir

Filesize
4.8MB

MD5
3c77b49324ccc845f799e9e73e4191b4

SHA1
552d8b079fb807931495652a7de82a801d67ddb1

SHA256
549bf24bf8bf92a2a40c1fe9fa9714dff3c3195971f4c23c05e1575c92ac8250

SHA512
8adbed76c6697a53d7c49c638ff45c3daf97015aa233ee6cb3c3db218943ca6f265b81157d7a2f31e87935004d18ec8203ea295096704a2c285a3f7a2dc42c88

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.3MB

MD5
c345aef2a07bf4598dd4a7c71958f4e7

SHA1
64a8db817bfbd81ef24d354c0e1c58a10ec363a7

SHA256
f140c049e608d1bbc28fbe0ad3b5bec3e6e3277a73c6fac3f710bc10f52e1c53

SHA512
fcff81002420dea029f5c65fdb9b17fa60d21e5cf2c6244a02484db66e5c153c7753c17ca5f3b79fcaa07b05ef6f120aa9c2fb15108b7ab81290a79daa755a34

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
be28158bb9f46ae1c27b975588862113

SHA1
38a3fdf79df77910a8bdd1a34e0469d5ddac41f6

SHA256
e8c2474f6a7fd5431326a43802d4e30ff896405e4204120d5df8e0fac4eed73c

SHA512
081428142823ca6d097d0cad0e56c9b115469acf156d781a14f18ff3e20bc10d358735fff23ffaeb7804f0a5f51c5b9d2b8aac4423902620c55a7acf3a339523

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
619KB

MD5
ec10f72cff37812f78d6e5562bd8cfb6

SHA1
e8e55065908c911c7e29b03cfa9c139271f032c3

SHA256
7ae77caeeeb6c39ea5b091555e2131d0946deb6f88b2ea9297c7d40c5ddc848d

SHA512
f04a2aeb43307f394d10c4ee52580d5257a7e815c2813318c17fe7fcc3d0f6ff892c0b13694d0f438ffc1d80e2b261c2aefff43064b6580ced79940414179fd6

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
0ab164db5d4e72ad3c2457fa3b9447d5

SHA1
447d4b9147169a746751b1b2156d2088f6639018

SHA256
811588ab3913940e247215189856a6f1aec6b459bf8f7e75481b4c8841fb6ec2

SHA512
607dee33de93cceecec99e717d3b86e2e979e93d4fb7029d81c21a5a1b9fe98a01958057d77b8ec68f8641e69691a671eabc5b692b98ec06540660956fe5eff5

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
650KB

MD5
f4d901478e232bc7f15d64a65342ad16

SHA1
bcd04bc324632fa3a6c9369bc9a7aa2bc67ee696

SHA256
ac14ed9718dbc07682fd546f3e8b588f236b839d02366040c147b16d68a2da1f

SHA512
736a5e82c5e8a6c0c6216c8e386c8e101ffe3e035516cea2c50b7bb260a78160edaf4d1492cf40ead94187f80390a3537359af18760964399a10ed3e82b2a9d2

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
669KB

MD5
05a987af12bbef05ce1e378ed0803003

SHA1
4ce12875717ac117485082a06cdd87d8c17b0b11

SHA256
65ad8f556749f8a7149d6949c324e9aff60c5b1a953365454e6e5dbbfa075cd4

SHA512
4b4b24c7ea4afd83f7226c9d1fd6945eb46d609fb76d30eeca9df48d4ee968ff119564913f647b29449ca16b0ead3923c222d8c4fe2d478761a931544637f9f1

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
700KB

MD5
95a0b51577d94b1d19fd65907845c292

SHA1
d3df6a3b66b543e7e3ba52de2fdb5c7733fbc1f6

SHA256
4d42f9019417b266496eda6747efb7f22a66741698152a0f6a3e8d9132aadbb3

SHA512
38b980c34b6bb9907ab63034716ff8e7a7b31ab3bf54bd502fa5eac805f3934e68099d23cd9523611a25f9eab123f4056b71d3af3d276aa29a38990682604a17

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
eb85dd0df03dbc028a738893dc176f54

SHA1
7b217afa9c4edbfa6be9c5f0fd1986e6d598a0c6

SHA256
d3382e06c0b08a646d9658b5ec1329ed0e149a09872a8c2382247176eac0b043

SHA512
005a84986992ffcc09c154f9d406bc23c0ed3d33be3e90d0b840eb83c28d83fd4f6d586d5023e103260a0e2ce6d6f5725fb2802bd24d360c9024c2fa601f7215

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
775KB

MD5
ecbc498f849b4d959b5d05be289a2032

SHA1
59380ecf2db95f58801e679b0650c7ce1e81d391

SHA256
4efaadb0fd563aedb2244fd3f7f484d246738915e2759ca81b46a5cd0e4514c8

SHA512
7387ee647d347e38c7df7a41ef695b45d60633a8489d934a3dd3dbd394f136b8b263e6d3982bc34a364791d0abd34e87a71718f16e4ce8ebc589c7426fbd2bc8

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
684KB

MD5
561356e3136c5b3af9dd3a019f8c46f2

SHA1
49138c403b7c9215167154ffb51e794d13457144

SHA256
8c4be827a3ed4a78c7a3276ab86e6c4005083a59a0ea13812208e3006a4749bd

SHA512
38e35d5cc6c89aacd66eac373461e743bc055bccbfac1e3aa181204062c83382e9e708c2054676819a23f7173e703372034a4f21f6da28fdc3007fb87dff8c60

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
596KB

MD5
1df543a39ede09b1f61284eb68ce6a81

SHA1
33f2b626adc211df1cd0b3ff232cf0461b6a4821

SHA256
769527e767a2b512a97d9e213f6a4a0536a3bcb6be588548e350e82dab880f5b

SHA512
3d30c50294b60ee916f8f73553e21cd3360fb6e560bf5879ce100dba5e8fdef1de7fd163ee61593a43634d696694247fadbc4109eb161f3682552680dda49fbc

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
637KB

MD5
ba5f2803b341d71b496e03d3a0581867

SHA1
4bd6234a097757f663f64a3d119a9dba77b7c029

SHA256
872ebea56c222af50e675e3e151904e42cf2726d367812178ae62dbe46586588

SHA512
491534de2ae15717931fd03d5ade202ee136b97ecc5a53bb72df4217428af712d467651e151aafe270a7ac84876cfc2afa5520393d42efed702dcea5834a476d

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
4ab7e3438fa44d3003775feeffa2be48

SHA1
10686c265b66e3615ff7b9a079aea7dc5ed45542

SHA256
ff964a7fa97c5eb9a93fd71c645e3cec098c2d12fae58fd1c4f7e9c1a0e5b9c7

SHA512
af6e84d4aad007ce9a1880bd2a639c4307693c9cea1c26a48a7bddd8352a18ae8d1b300df562665e19e96fe9d260337639a0517886e6821a8413d8875abe0a70

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
698KB

MD5
5adf22196502e9968768152f1a7d0dc2

SHA1
4fec1946f680a3a5bbcf19ba824fa98ebc70789d

SHA256
088b137312b959ba62850cfb96949790db8495ec1f452182b1cebdf0abb39deb

SHA512
a097a9e561f3076ef7c7296318017d92c5487f05f4b88cc798e3151ef5ff0e2d9b294365d0935d299963ef114f7360b30f2247ccb2485d41f7f13e9509d1164a

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
685KB

MD5
4360f9be87b5b57192acbc604d5ce5df

SHA1
fdf10ce9bb8cb428215a2e6dc3b4dad51d7fd53c

SHA256
68c184567ae14d5a7cdfe03e7f5507ee17410d9fe59c29999a10fa754695ce1b

SHA512
d42111d8a20cc9c8692ef900a0086a11f01a10d60e503347564e114e53cd2bd277af8c29134eb6ed530721acaaf9f8beb9f859effd40ed3a73c2699a640a53b9

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
574KB

MD5
4189e7a45dbb8b29177e64ab08305ac2

SHA1
0c5f38b0d491e6fe89e3dda85acea1ed5c7d37b8

SHA256
6551e29665a1c0d28614906d9156eddbf520938eae6a8c45c6762cc623e5fefa

SHA512
4a4bb9a8e99896de89fcdf4b0cbef438f977bea3cd587673784555def7dd6c6e64504d5775b396737739f606ccc1782c82e20f2a700d2abbdf0de88f3317eee2

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
600KB

MD5
d6b5a4dcc869e095aae0d93b860b22f4

SHA1
5fe37a4ce96592b56c26f02ea295e70909b12a07

SHA256
2018032f16ab928ac22ae4d0ba86926c1d11f96564d442a2589ce405d4fabf89

SHA512
e85b633a701cdd13a361c0d15990b14603949f6855309b1e1bffd4c9e8c2419b87197b95ab79fb4d300535c6fe3a36ef8b395bc25dabbfc636de5587324e71a9

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.1MB

MD5
650d9d4de77ecfa402e35f6299590fe9

SHA1
534d6b427859950ddd571beba8d1abe5a6e10958

SHA256
1fe2f1fdf36afa2e8189e3114c8979e2bf3c3bfc86807db5d3b66931b4a3d4d7

SHA512
74e1dc159a65203f137a7364687cbca1bcf703c28c1e9f8c7ba88f3407f33855934d59426b717a404fc58facb2167d9ec522f72f060c630e6ff50349206d0cf7

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.1MB

MD5
007cfa039858f7c41eb3fc421a46bec1

SHA1
341e2e33f33fef622fa09c949afaf0790858471e

SHA256
1b78bb65cfd0327e67064370f32b31abb34de1cbf91a9fccafc1777a0e831e42

SHA512
47a29cc2214b0cb7946f36ce1a67df333e25587e370d7c3882348b3f865852e3933b4446bbc7aeda354bae698534bba98ee50d3718764a23ead1aea6b10f4586

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
758KB

MD5
af7d429bc8327926eeffbbd446bf78e5

SHA1
98f15d34ad18959043724dc657d87d5a401845e1

SHA256
fad875a78029d38fec86f021a9d4134495d205943edae16041924b11b22801ea

SHA512
daa0aec4423a4d2511da2039d6adce76e14d4713ba10517a34cd64fa7f5ffa5dd25ee1026145557deaf4ea3cbd9aa2a6eb5dc917d4b6ac7ccf1e4ccddf55508b

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
2.0MB

MD5
332d9994470eb0f3e3688a7bfdbfbb58

SHA1
ddcdc94ae33812e497058f23f5042fae96060d50

SHA256
05f27b5bee68cd8dbfe42c03bef03645232a8906ee9eb233a648501d519a7991

SHA512
0946609e9f2dc87a0997dd377eecdf8e43f915982f0636e3cf0f7177b137392d008873487833c340375996ef266138b8b7fee15e5774ee824ee245575e2e1721

Download Submit
\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
b32d55f4d1a263a7d5cc9b2e26fd8afb

SHA1
a415458c3c7bafae83bdd12d3662571861cc789c

SHA256
ee793cc57821b54b27bb2d8e405577720e88bc02efeb12a092b20c4b35ddfa75

SHA512
7143c9f9c545c4e84c6bfd0468ca334fdc0e66932c62fb872098fbd5c077d4f8bdcbcf37cf1858aa2179eb3e6e5d9626b3b41bdfdc004c0b7a8bca70bf3058ee

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
642KB

MD5
c917f040a6da72c54baceaa029ed1ed4

SHA1
28cfcf93264692860b41b60ada140a506ca48c33

SHA256
69ec4c0d3efe2d74bddf6b1129ceaca5168a57b6d57dee63706cf8623a3d341b

SHA512
3abfd0d300d136ef0f6741ec8cc8688985373b4ea93047aa669b3eb2c0dd59e17f4c8740561177d4ed6091c0e21829601df747cc5a88a0d8b1ad417f44b14cc3

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
670KB

MD5
981140f38d9b79095d6a49e677cb6275

SHA1
8a4d79a48559a00273127467b133b35fbb4bc382

SHA256
cce561ef4e038b9c269effab736b3fbd2bb4d033a45f7d47ffd80622e07ee9ee

SHA512
b3129b39ab427c1e74b3fd7f72a477ff4da99f886b6177f1288ec22ee2327c8c4f0213fb76d5f3f17fc4dcdd264eb5edd7dcc97c5b2df219aa191a09e621d34f

Download Submit
memory/1720-177-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/1720-182-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2076-95-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2076-175-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2076-217-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2648-154-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2648-61-0x0000000140001000-0x0000000140002000-memory.dmp

Filesize
4KB

Download
memory/2648-60-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/2660-96-0x0000000000400000-0x00000000005C8000-memory.dmp

Filesize
1.8MB

Download
memory/2660-46-0x0000000000400000-0x00000000005C8000-memory.dmp

Filesize
1.8MB

Download
memory/2660-47-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/2816-54-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/2816-21-0x0000000010000000-0x00000000101BF000-memory.dmp

Filesize
1.7MB

Download
memory/2816-22-0x000000001000C000-0x000000001000D000-memory.dmp

Filesize
4KB

Download
memory/2864-36-0x0000000010000000-0x00000000101F2000-memory.dmp

Filesize
1.9MB

Download
memory/2864-35-0x0000000010000000-0x00000000101F2000-memory.dmp

Filesize
1.9MB

Download
memory/2864-92-0x0000000010000000-0x00000000101F2000-memory.dmp

Filesize
1.9MB

Download
memory/2964-85-0x0000000140000000-0x0000000140382000-memory.dmp

Filesize
3.5MB

Download
memory/2964-86-0x0000000140000000-0x0000000140382000-memory.dmp

Filesize
3.5MB

Download
memory/3032-0-0x0000000001000000-0x00000000011E4000-memory.dmp

Filesize
1.9MB

Download
memory/3032-2-0x0000000001000000-0x00000000011E4000-memory.dmp

Filesize
1.9MB

Download
memory/3032-1-0x000000000101A000-0x000000000101B000-memory.dmp

Filesize
4KB

Download
memory/3060-178-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download
memory/3060-160-0x0000000140000000-0x00000001401F9000-memory.dmp

Filesize
2.0MB

Download