b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
Size

1.1MB
MD5

62034d055873020490b1abf71d3231a0
SHA1

2b4ff7294dcbca3e3b97debf6106c6eaa57de907
SHA256

b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1
SHA512

8826e8464bbbc1b3481d8fcccc78f326361097d5d9f60ab7a25583a4d6ce5839bcee194b1bc238b837bb2befa571624cb1bafabbd02a6cd39be530cde5c419f9
SSDEEP

12288:2svd+JRdOeyuOI2alz+4RwXMknM6xZ9rUVXT55Lh2EvsULgkAW969bbB3w/:FvkjbOClz++wXMt6xZ9q5Lh2CtuPi

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 8 IoCs

pid	Process
1660	mscorsvw.exe
468	Process not Found
968	mscorsvw.exe
1808	mscorsvw.exe
1684	mscorsvw.exe
1736	dllhost.exe
2016	mscorsvw.exe
1864	mscorsvw.exe

Loads dropped DLL 4 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2292972927-2705560509-2768824231-1000\EnableNotifications = "0"	mscorsvw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\S-1-5-21-2292972927-2705560509-2768824231-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\S-1-5-21-2292972927-2705560509-2768824231-1000\EnableNotifications = "0"	mscorsvw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2292972927-2705560509-2768824231-1000	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\F:	mscorsvw.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\H:	mscorsvw.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\wbem\qiqpkfcn.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\ainpabed.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\SysWOW64\gmafhche.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\maideknn.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\SysWOW64\iinlkjjd.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\alg.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vds.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\lagldgkj.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\bokfbanf.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File created	\??\c:\windows\SysWOW64\fkfnokpk.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File created	\??\c:\windows\system32\nkaflmel.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File created	\??\c:\windows\system32\mbcaohfg.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File created	\??\c:\windows\system32\kcjcikhj.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\jihihnma.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\mpkllggb.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\SysWOW64\jhkoefal.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\gnhjadpm.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\ccgilncc.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\system32\fcbbeacd.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\mozilla maintenance service\ikomeakn.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\daginkaj.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\program files (x86)\microsoft office\office14\cnooqnjj.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\nacjfcok.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\program files\windows media player\efcmbomg.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\program files\google\chrome\Application\89.0.4389.114\bjcjnoeh.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	mscorsvw.exe
File created	C:\Program Files\Internet Explorer\idiocqog.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe

Drops file in Windows directory 46 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\jhelqmpg.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{2233829E-1F4C-4D8C-982E-7FCC223FA72C}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\anefbhif.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{2233829E-1F4C-4D8C-982E-7FCC223FA72C}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\microsoft.net\framework64\v2.0.50727\dgmqohqj.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\ehome\kkiiiolj.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	mscorsvw.exe
File created	\??\c:\windows\servicing\ppaenmmi.tmp	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\lekfkknf.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	\??\c:\windows\ehome\blpeajbd.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	mscorsvw.exe
File created	\??\c:\windows\servicing\idpgdglh.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\qcmoqlch.tmp	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	mscorsvw.exe
1684	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1404	b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
Token: SeShutdownPrivilege	1808	mscorsvw.exe
Token: SeShutdownPrivilege	1684	mscorsvw.exe
Token: SeShutdownPrivilege	1808	mscorsvw.exe
Token: SeShutdownPrivilege	1808	mscorsvw.exe
Token: SeShutdownPrivilege	1808	mscorsvw.exe
Token: SeShutdownPrivilege	1684	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	1808	mscorsvw.exe
Token: SeShutdownPrivilege	1684	mscorsvw.exe
Token: SeShutdownPrivilege	1684	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	1684	mscorsvw.exe
Token: SeShutdownPrivilege	1684	mscorsvw.exe
Token: SeShutdownPrivilege	1684	mscorsvw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2016	1684	mscorsvw.exe	33
PID 1684 wrote to memory of 2016	1684	mscorsvw.exe	33
PID 1684 wrote to memory of 2016	1684	mscorsvw.exe	33
PID 1684 wrote to memory of 1864	1684	mscorsvw.exe	34
PID 1684 wrote to memory of 1864	1684	mscorsvw.exe	34
PID 1684 wrote to memory of 1864	1684	mscorsvw.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	mscorsvw.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	mscorsvw.exe

C:\Users\Admin\AppData\Local\Temp\b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe
"C:\Users\Admin\AppData\Local\Temp\b92dba50ed58fa0c7637e0ee808086fc694aeac713bfe86caaacf779232574d1.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1660

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1808

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 19c -NGENProcess 1a0 -Pipe 1ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 19c -NGENProcess 1a0 -Pipe 1b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1864

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
636KB

MD5
c46e00d87a58f9b44a53dfedeae5d7ec

SHA1
5c45c313cd5e01b695b5e41fd88d241058efc0e5

SHA256
ea2d6fc6a94511f6b33fd1978c7ddc6a2cbf67cca13a45978da7c01c079c4068

SHA512
5102040ffd9a6aacc0eac8d83680fed53e0d3beac9bbdfab9cb39151dcdfd5f7c14c73e768d324ae57a22f8e4ad3a250384a83fe1d04d56487addcb637be2ab7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
636KB

MD5
c46e00d87a58f9b44a53dfedeae5d7ec

SHA1
5c45c313cd5e01b695b5e41fd88d241058efc0e5

SHA256
ea2d6fc6a94511f6b33fd1978c7ddc6a2cbf67cca13a45978da7c01c079c4068

SHA512
5102040ffd9a6aacc0eac8d83680fed53e0d3beac9bbdfab9cb39151dcdfd5f7c14c73e768d324ae57a22f8e4ad3a250384a83fe1d04d56487addcb637be2ab7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
cc95387560cac488625243f6afda15c0

SHA1
f94cf6d7fc80d32e1e903850c9d49f8e55cc1509

SHA256
7510d3b7f70d81461b493b040a32a874d2c95f37a774283d03331c3ceca0db00

SHA512
9c0bb00301a9f2ac2305da85041c7646e72ca6027d001a8212bf35c768a3ed8300473ef1f5cd75fb4af39b366d78617b0db2f5d2c4b93b80c279526056dc91a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
cc95387560cac488625243f6afda15c0

SHA1
f94cf6d7fc80d32e1e903850c9d49f8e55cc1509

SHA256
7510d3b7f70d81461b493b040a32a874d2c95f37a774283d03331c3ceca0db00

SHA512
9c0bb00301a9f2ac2305da85041c7646e72ca6027d001a8212bf35c768a3ed8300473ef1f5cd75fb4af39b366d78617b0db2f5d2c4b93b80c279526056dc91a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
cc95387560cac488625243f6afda15c0

SHA1
f94cf6d7fc80d32e1e903850c9d49f8e55cc1509

SHA256
7510d3b7f70d81461b493b040a32a874d2c95f37a774283d03331c3ceca0db00

SHA512
9c0bb00301a9f2ac2305da85041c7646e72ca6027d001a8212bf35c768a3ed8300473ef1f5cd75fb4af39b366d78617b0db2f5d2c4b93b80c279526056dc91a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
cc95387560cac488625243f6afda15c0

SHA1
f94cf6d7fc80d32e1e903850c9d49f8e55cc1509

SHA256
7510d3b7f70d81461b493b040a32a874d2c95f37a774283d03331c3ceca0db00

SHA512
9c0bb00301a9f2ac2305da85041c7646e72ca6027d001a8212bf35c768a3ed8300473ef1f5cd75fb4af39b366d78617b0db2f5d2c4b93b80c279526056dc91a0

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
613KB

MD5
1f7de626d6e1208919f63f3f891076b6

SHA1
45da2f715b598347dafaad4768465ea1e808c780

SHA256
871bb2dc65c658f04fc7af07712c92772c2401c2c7be20a731df74a143204827

SHA512
1f598e7ac61332a7c96fa1623f06c66cfba58f9aa1067abf38667e2b2c0236db7f952864abde93ced16b8ed6ead8022bbe1294c76da3b811db4a773998f8cb23

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
613KB

MD5
1f7de626d6e1208919f63f3f891076b6

SHA1
45da2f715b598347dafaad4768465ea1e808c780

SHA256
871bb2dc65c658f04fc7af07712c92772c2401c2c7be20a731df74a143204827

SHA512
1f598e7ac61332a7c96fa1623f06c66cfba58f9aa1067abf38667e2b2c0236db7f952864abde93ced16b8ed6ead8022bbe1294c76da3b811db4a773998f8cb23

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
644KB

MD5
00ba3c7f7b5ebd748a4e46145dfa18bb

SHA1
02bba6d5d6f373bb931b99f97e642b22eeeaafb3

SHA256
c1a1c893ac850abffd790eafd4f3e4ee6145380fdea7bab8346ae5f7770acbda

SHA512
668501973c3a2fb2f980c2bf12ddc5d34f1f53acc69b9e1e5b38df245844c649395ef38f78f741c8bb6061fc8eb6a395f84ba00dbf9a5b2c77b7697a900018a4

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
644KB

MD5
00ba3c7f7b5ebd748a4e46145dfa18bb

SHA1
02bba6d5d6f373bb931b99f97e642b22eeeaafb3

SHA256
c1a1c893ac850abffd790eafd4f3e4ee6145380fdea7bab8346ae5f7770acbda

SHA512
668501973c3a2fb2f980c2bf12ddc5d34f1f53acc69b9e1e5b38df245844c649395ef38f78f741c8bb6061fc8eb6a395f84ba00dbf9a5b2c77b7697a900018a4

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
565KB

MD5
eba8fd840babc603943ab16963a54683

SHA1
68a6bcde1d1d1b01094d87eba3c45cfbe0775644

SHA256
0d0e36638025d2de485adbbe195b8ba9cf74ec2f193c58d34c2c4628b05109d9

SHA512
e86621d6b65968332b34895d082b7570ebc57ae8371db6cc72f85817c445dfc107a6c1d4790dee678b6cf2a38207ac187e67ec2b86c2f6148a1bdb1ba98c6032

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
694KB

MD5
32feb3ff5eb6664d79fcbe998146aeca

SHA1
0ffe595b3bcdef2a0e739915322453fea8db62f5

SHA256
ef45fc3223167f59c793273ea56cc85112eb8e1a16df369a10d219382a44a65d

SHA512
c1559de14342f182d212337e6fde4c352b80f6849b42b797be816fdfbdf52e097ce8a0aaabb49abd8c8a2ccbe3be775b15304d94931a5de884b7e7b7d416777d

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
d66a21b5ee19fbb0a37b9269179181c6

SHA1
5915d3e1d451662cf7d7fb9ca73af394e28e82bb

SHA256
a245b5330071d0ab814dcd055bad9ac3806e9f6b85c5ec9ea77c8ec8e8881103

SHA512
88b12a094b7ad8fe5673d580c03f956b4aa300a53fb99b1a78f4ff0bf8acc5826800e0aca67fa192a10b41f498714e8b7726c4cb1a1722f8deca5d8d7d72ec0c

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
784KB

MD5
ff60c6dbd74c0e8217ad50844e03ccae

SHA1
225dc1906c7cbd71e39a14d01c88f081946346ef

SHA256
2cf53caec184949d92e7a9efddee4e4009abf62527b42ac282fbacf79127724c

SHA512
caea51d115042f23d99852550c73c1831903e77cab69ddbe2307a9d5d55cb35c0dc7708bda7b25fc658b8b5b96fe29f5c67d75fb18bd35e3d2e05494c86f2c0f

Download Submit
\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe

Filesize
5.2MB

MD5
0e631639e7a0f34e580c6a41453ba44d

SHA1
9fd5eddead22c047f1bf96e043bdb183df6e6a3e

SHA256
6838bbd2a09b5f7203d2d0338a09c306c1a487981fff28efb75f75558f600b29

SHA512
df233fc55f67f680377fd4f17244287307036ad6a4d39fa6642b74d7ea37e1be3ee77109f5a80f01ff1d864ce5eaac2971be44d22cba2b474a397992c5e631df

Download Submit
\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
2.0MB

MD5
41fa12419aaf98cbdefd27caef437388

SHA1
df6258c1a48d1a06d1ec4d0c9508d2a03d663913

SHA256
1502b612688ebc11dc54a38c61036dd5e66cb801d83674286b236c4cb6316ab1

SHA512
005f557ef05231fa3edb16f0df531cc9d95ecfa6ada46d1962df974f8b536cd0f8693c01759d6d69fd21d9367e6f50a57e0c2be2c972b1dbb892987157676c70

Download Submit
\??\c:\windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
94898610cdee8b57be474ced80c44cd5

SHA1
3e9a159fb0688bae939f103a7ff88c1d5c5651a0

SHA256
a458b757ca507ae1b22ba811ed83e3037e99b71881b9fd88986a6e2e0bccb94c

SHA512
b26f5a2560de162111276b5ce73a98d132f81cbf6d4febe274095156142222061a1680b10ce451be89e3b1ba781c3240da540917d0feb1c897ff8465b96fce41

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
679KB

MD5
c415b2552cee8107d82d083c59f67938

SHA1
f9ef99e4caaf6dc43675d59e3cedf91045e4655b

SHA256
71449c61e23ee0236b192954fdaf0c8cfb7903126e7acbea4ad53a94a0028ce1

SHA512
a9b51d430de9ee2793327f78656cc50b4dde4f999f54e9c21887c1dd1f2aee3e0e9f5546656dacfb7d4e2ed3dfa97b88c48de12d7f705776eaf3c9bee10f1db3

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
591KB

MD5
82169958f05c17bd09566fbdb7dadd9d

SHA1
0b4909d1950042109a2a7b8bada1ccff5526e61c

SHA256
fcba86efe7197cdc1c01eb089ffb8553c872939e8c2b65e6baecdcfae3438463

SHA512
375676252b6452de8dc647aa35d265b528b2818ba1150d10a19e8a10fe27ad67692585555312cce4a2563dcf0755c805a0e39a58c53ea845bd28621a87f74a24

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
632KB

MD5
b5cd694b49f005ca4c9652a9b69722df

SHA1
7e8de4f9d307f3658aca9876721679a4a7f3ae5b

SHA256
ba1028b8bba2ec39426218a555419c73942d38df2f3c83cdd8a72135a3b3e18f

SHA512
ea753a56aef6e3d2c18507a772b9201a89dec0de67b9f09c9ebe4b32f4742394829991cfce9e238c09a1984e649d70ab4eb25553667cc70bbc9a7576c729284a

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
652aebc6dcb404ba63db5853a61739e1

SHA1
82e646b9c78e1d551191a1a8dd182295d7845c9b

SHA256
c616795a1fa5a88f4d473608394fb2d9974ada2f37b51fff2fb66e24dccd10e4

SHA512
4449f398d4b582151477e0ee5aef41c897b9a00ebe695a68d556698771dc19ee3940e89127e55738491f49df580f3b4a5639dc0328910470eb8489d49346e5cc

Download Submit
\??\c:\windows\system32\ieetwcollector.exe

Filesize
666KB

MD5
80f3de6f381d050d1e724374f0219576

SHA1
2b57210e96d65058a90f1d8e49656ce8a750eebb

SHA256
dca29ed6ad7b9712c505408a766f83bde1bb07a5aa36851ec36dd7e5ff48331e

SHA512
2a3e13f290b3232f4749e78fb3904f1cddd5c73359627df9712eb92f8a794947890f0b09c3632d0e78e06836e16732c17f6bee65768b2e61e171936ee11509ec

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
693KB

MD5
414a96679bca500b53dc968307ab94f9

SHA1
9a64955b85f3c9679d1a89599707b6bc156dc231

SHA256
dd33e7ecc8616193cf050cd814f2f8cd7b00ef6eb7ad4af013eade64108eac62

SHA512
2f92bcbb78e520f65fcc4055b1b195d29743b48fada61d459b195d27dba6238cf81550ed78c913317570e4ba9d320a50a63e4596eade78127681a3fe7a1c4939

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
679KB

MD5
a6bffe3b34bee69ca667b34becf23913

SHA1
db08c7d74b4199811dd9f1a4231d784fd139d05a

SHA256
01fecdf340085beeb32a9a1ad07afdfe57ffc5f75ec549154680a9d164c9a8a1

SHA512
e84f8dc1d400ecceb08058cee165249fceb0d3b4b7a19151bfe221f5344c9b233b343e4e72bd13fc180f4cdc97a41595395ba59e7161bd89452ba77cad1db3be

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
569KB

MD5
a8a15f3f3d67904f350bbb9530f27a39

SHA1
665156f44113943af28449b1ed8211c24a3dfce4

SHA256
e8024373835e448e6fac11af4f81ffe388ea964bfa00f18aa074922a408519db

SHA512
2e1e71d3700763c48bbd0d3e3a49938596fd4b9f1e0df91b1ae62d3665d951cf00a2b717531b15c4c87957eccdc2cd97fa9d29d093e32de853165937b3f54ee5

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
595KB

MD5
bfacb6d8be455a650ebbf2a1e7fb56bc

SHA1
637de41a1e937447ab60c0a0f12693430e674dfa

SHA256
fcc43bce49c3fad01fb8120a8d5bf394e2ac49aafe53fff53d6dacc3d0f812b3

SHA512
b845dbd85cdc9e5a4187f03777bc693a35de2dd761779ef46cfd8ffe4cfe25cb04902074b2d4bc1ea0fb56f8fa215f286babfcae93c5f438ea455d592d78d07a

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.1MB

MD5
be2e5b3920a0607964de5850bc62c0c0

SHA1
12c6c7e976aede89765f6b1a2a85c62daf55bb06

SHA256
d7f4745439a52897fda3d224aaab9b7c88a617d44879841e0bb28766dc4fa871

SHA512
7e894c3fa1fe02af548968f1de3c4059af99a2a234bc0f7c7bc80e4b7da9c6fead94c67df9b329b36e3affd63b8b8f076c985e5ff76feb842f0f457230e2a60d

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
636KB

MD5
c46e00d87a58f9b44a53dfedeae5d7ec

SHA1
5c45c313cd5e01b695b5e41fd88d241058efc0e5

SHA256
ea2d6fc6a94511f6b33fd1978c7ddc6a2cbf67cca13a45978da7c01c079c4068

SHA512
5102040ffd9a6aacc0eac8d83680fed53e0d3beac9bbdfab9cb39151dcdfd5f7c14c73e768d324ae57a22f8e4ad3a250384a83fe1d04d56487addcb637be2ab7

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
636KB

MD5
c46e00d87a58f9b44a53dfedeae5d7ec

SHA1
5c45c313cd5e01b695b5e41fd88d241058efc0e5

SHA256
ea2d6fc6a94511f6b33fd1978c7ddc6a2cbf67cca13a45978da7c01c079c4068

SHA512
5102040ffd9a6aacc0eac8d83680fed53e0d3beac9bbdfab9cb39151dcdfd5f7c14c73e768d324ae57a22f8e4ad3a250384a83fe1d04d56487addcb637be2ab7

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
cc95387560cac488625243f6afda15c0

SHA1
f94cf6d7fc80d32e1e903850c9d49f8e55cc1509

SHA256
7510d3b7f70d81461b493b040a32a874d2c95f37a774283d03331c3ceca0db00

SHA512
9c0bb00301a9f2ac2305da85041c7646e72ca6027d001a8212bf35c768a3ed8300473ef1f5cd75fb4af39b366d78617b0db2f5d2c4b93b80c279526056dc91a0

Download Submit
\Windows\System32\dllhost.exe

Filesize
565KB

MD5
eba8fd840babc603943ab16963a54683

SHA1
68a6bcde1d1d1b01094d87eba3c45cfbe0775644

SHA256
0d0e36638025d2de485adbbe195b8ba9cf74ec2f193c58d34c2c4628b05109d9

SHA512
e86621d6b65968332b34895d082b7570ebc57ae8371db6cc72f85817c445dfc107a6c1d4790dee678b6cf2a38207ac187e67ec2b86c2f6148a1bdb1ba98c6032

Download Submit
\Windows\System32\dllhost.exe

Filesize
565KB

MD5
eba8fd840babc603943ab16963a54683

SHA1
68a6bcde1d1d1b01094d87eba3c45cfbe0775644

SHA256
0d0e36638025d2de485adbbe195b8ba9cf74ec2f193c58d34c2c4628b05109d9

SHA512
e86621d6b65968332b34895d082b7570ebc57ae8371db6cc72f85817c445dfc107a6c1d4790dee678b6cf2a38207ac187e67ec2b86c2f6148a1bdb1ba98c6032

Download Submit
memory/968-65-0x0000000010000000-0x0000000010200000-memory.dmp

Filesize
2.0MB

Download
memory/1404-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1404-55-0x0000000001000000-0x0000000001244000-memory.dmp

Filesize
2.3MB

Download
memory/1404-56-0x0000000001000000-0x0000000001244000-memory.dmp

Filesize
2.3MB

Download
memory/1660-60-0x0000000010000000-0x00000000101CD000-memory.dmp

Filesize
1.8MB

Download
memory/1660-58-0x0000000010000000-0x00000000101CD000-memory.dmp

Filesize
1.8MB

Download
memory/1684-71-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/1684-75-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/1736-79-0x0000000100000000-0x00000001001EE000-memory.dmp

Filesize
1.9MB

Download
memory/1736-85-0x0000000100000000-0x00000001001EE000-memory.dmp

Filesize
1.9MB

Download
memory/1808-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/1808-74-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/1808-70-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/1864-91-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/1864-89-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2016-90-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download
memory/2016-84-0x0000000140000000-0x0000000140207000-memory.dmp

Filesize
2.0MB

Download