Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 01:22
Static task
static1
Behavioral task
behavioral1
Sample
1ee069455ec3b2de5eaefe54a536962c.dll
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
1ee069455ec3b2de5eaefe54a536962c.dll
Resource
win10v2004-20220718-en
General
-
Target
1ee069455ec3b2de5eaefe54a536962c.dll
-
Size
5.0MB
-
MD5
1ee069455ec3b2de5eaefe54a536962c
-
SHA1
6b3e9bd6122e40ee69d3bd441213fc1505c0d419
-
SHA256
bf9b8a89148553fa0da5d2270bf7db0b5482df6517867410fead18192d5135a1
-
SHA512
f021b5820e4a89608e87e1ce050fe2fa28b7930492bdb7823389e590f94988c967849abc6615a8c66c337a3f31df9a8bfddee6bf9e43ff497f93c57ec5cef6b9
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications mssecsvc.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1" mssecsvc.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3247) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Drivers directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS mssecsvc.exe -
Executes dropped EXE 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 4276 mssecsvc.exe 3820 mssecsvc.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2036 4276 WerFault.exe mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 4276 mssecsvc.exe 4276 mssecsvc.exe 3820 mssecsvc.exe 3820 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
mssecsvc.exepid process 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe 4276 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mssecsvc.exemssecsvc.exedescription pid process Token: SeDebugPrivilege 4276 mssecsvc.exe Token: SeDebugPrivilege 3820 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exemssecsvc.exedescription pid process target process PID 4100 wrote to memory of 2980 4100 rundll32.exe rundll32.exe PID 4100 wrote to memory of 2980 4100 rundll32.exe rundll32.exe PID 4100 wrote to memory of 2980 4100 rundll32.exe rundll32.exe PID 2980 wrote to memory of 4276 2980 rundll32.exe mssecsvc.exe PID 2980 wrote to memory of 4276 2980 rundll32.exe mssecsvc.exe PID 2980 wrote to memory of 4276 2980 rundll32.exe mssecsvc.exe PID 4276 wrote to memory of 612 4276 mssecsvc.exe winlogon.exe PID 4276 wrote to memory of 612 4276 mssecsvc.exe winlogon.exe PID 4276 wrote to memory of 612 4276 mssecsvc.exe winlogon.exe PID 4276 wrote to memory of 612 4276 mssecsvc.exe winlogon.exe PID 4276 wrote to memory of 612 4276 mssecsvc.exe winlogon.exe PID 4276 wrote to memory of 612 4276 mssecsvc.exe winlogon.exe PID 4276 wrote to memory of 672 4276 mssecsvc.exe lsass.exe PID 4276 wrote to memory of 672 4276 mssecsvc.exe lsass.exe PID 4276 wrote to memory of 672 4276 mssecsvc.exe lsass.exe PID 4276 wrote to memory of 672 4276 mssecsvc.exe lsass.exe PID 4276 wrote to memory of 672 4276 mssecsvc.exe lsass.exe PID 4276 wrote to memory of 672 4276 mssecsvc.exe lsass.exe PID 4276 wrote to memory of 780 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 780 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 780 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 780 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 780 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 780 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 788 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 788 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 788 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 788 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 788 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 788 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 796 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 796 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 796 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 796 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 796 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 796 4276 mssecsvc.exe fontdrvhost.exe PID 4276 wrote to memory of 900 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 900 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 900 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 900 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 900 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 900 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 948 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 948 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 948 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 948 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 948 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 948 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 312 4276 mssecsvc.exe dwm.exe PID 4276 wrote to memory of 312 4276 mssecsvc.exe dwm.exe PID 4276 wrote to memory of 312 4276 mssecsvc.exe dwm.exe PID 4276 wrote to memory of 312 4276 mssecsvc.exe dwm.exe PID 4276 wrote to memory of 312 4276 mssecsvc.exe dwm.exe PID 4276 wrote to memory of 312 4276 mssecsvc.exe dwm.exe PID 4276 wrote to memory of 404 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 404 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 404 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 404 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 404 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 404 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 868 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 868 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 868 4276 mssecsvc.exe svchost.exe PID 4276 wrote to memory of 868 4276 mssecsvc.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:780
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3232
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3412
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3340
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:3460
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:1272
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4232
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3112
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3788
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1124
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1620
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1776
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1944
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2472
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:1260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:1160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:4284
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:3152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:2112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2760
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3044
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1ee069455ec3b2de5eaefe54a536962c.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1ee069455ec3b2de5eaefe54a536962c.dll,#13⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 14405⤵
- Program crash
PID:2036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2344
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2088
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1732
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:1672
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1928
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1804
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1684
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1544
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1300
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1060
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4276 -ip 42761⤵PID:4640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\mssecsvc.exeFilesize
3.6MB
MD5da038e473c9e29b33ef48e73843a039b
SHA12168c668eb8df4173a3a60214297d1818f6a4363
SHA2562266e75d65b3f2117f2c72eabb9251ca53f01990ee6321499181282d31acd1b8
SHA512d6be08f350099e8686459f9a35b3669a5c47fb36078bf71a726d1dbe552d1cdf12a0f3743b027f40220a38503c5fdabbef163e1c413672c08b9930bb71c41f7f
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5da038e473c9e29b33ef48e73843a039b
SHA12168c668eb8df4173a3a60214297d1818f6a4363
SHA2562266e75d65b3f2117f2c72eabb9251ca53f01990ee6321499181282d31acd1b8
SHA512d6be08f350099e8686459f9a35b3669a5c47fb36078bf71a726d1dbe552d1cdf12a0f3743b027f40220a38503c5fdabbef163e1c413672c08b9930bb71c41f7f
-
C:\Windows\mssecsvc.exeFilesize
3.6MB
MD5da038e473c9e29b33ef48e73843a039b
SHA12168c668eb8df4173a3a60214297d1818f6a4363
SHA2562266e75d65b3f2117f2c72eabb9251ca53f01990ee6321499181282d31acd1b8
SHA512d6be08f350099e8686459f9a35b3669a5c47fb36078bf71a726d1dbe552d1cdf12a0f3743b027f40220a38503c5fdabbef163e1c413672c08b9930bb71c41f7f
-
memory/2980-130-0x0000000000000000-mapping.dmp
-
memory/3820-136-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/3820-140-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/4276-131-0x0000000000000000-mapping.dmp
-
memory/4276-134-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/4276-137-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/4276-139-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/4276-138-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB