ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112

Analysis

max time kernel
151s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
Size

584KB
MD5

6a116c97067f0e3a3d6fad6a570791d0
SHA1

cbd703e02f076528e23782e9414779888ab70e60
SHA256

ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112
SHA512

60da70b6282b1a546ddd0cc1a2d4884441616746c9bd5e1360d81aa280ea7f20af83ef35532f62b3a2710461a8ca719c99120a07250518393ab4ab73e9c5d6ee
SSDEEP

12288:5zasWWBnUvtoThEkQOSxpqL13q8W9DGLoc8mHrfCbsEs31RepsLM4:EsB3mkDspqLg8WtGLdJrKYEuoX4

Score

8^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 39 IoCs

pid	Process
2044	mscorsvw.exe
468	Process not Found
1040	mscorsvw.exe
1516	mscorsvw.exe
528	mscorsvw.exe
1580	dllhost.exe
2020	elevation_service.exe
2008	mscorsvw.exe
1008	mscorsvw.exe
600	Process not Found
1132	DllHost.exe
1368	mscorsvw.exe
1572	mscorsvw.exe
1212	mscorsvw.exe
2004	mscorsvw.exe
1256	mscorsvw.exe
1720	mscorsvw.exe
1976	mscorsvw.exe
1572	mscorsvw.exe
1000	mscorsvw.exe
1764	mscorsvw.exe
904	mscorsvw.exe
1588	mscorsvw.exe
1916	mscorsvw.exe
1664	mscorsvw.exe
2028	mscorsvw.exe
1572	mscorsvw.exe
1512	mscorsvw.exe
588	mscorsvw.exe
1036	mscorsvw.exe
1752	mscorsvw.exe
1992	mscorsvw.exe
1408	mscorsvw.exe
1172	mscorsvw.exe
1960	mscorsvw.exe
1000	mscorsvw.exe
1908	mscorsvw.exe
2008	mscorsvw.exe
1676	mscorsvw.exe

Loads dropped DLL 27 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
1256	mscorsvw.exe
1256	mscorsvw.exe
1976	mscorsvw.exe
1976	mscorsvw.exe
1000	mscorsvw.exe
1000	mscorsvw.exe
1588	mscorsvw.exe
1588	mscorsvw.exe
1664	mscorsvw.exe
1664	mscorsvw.exe
1572	mscorsvw.exe
1572	mscorsvw.exe
588	mscorsvw.exe
588	mscorsvw.exe
1752	mscorsvw.exe
1752	mscorsvw.exe
1408	mscorsvw.exe
1408	mscorsvw.exe
1960	mscorsvw.exe
1960	mscorsvw.exe
1908	mscorsvw.exe
1908	mscorsvw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4063495947-34355257-727531523-1000\EnableNotifications = "0"	mscorsvw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4063495947-34355257-727531523-1000	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\Q:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\E:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\G:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\O:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\S:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\I:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\K:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\H:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\R:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\N:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\W:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\Y:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\Z:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\F:	mscorsvw.exe
File opened (read-only)	\??\F:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\L:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\M:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\P:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\V:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\J:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\T:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\U:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\X:	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\Q:	mscorsvw.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\SysWOW64\ahfnhhoj.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\ajaejlpi.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\SysWOW64\egcmjodl.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\qfjgabfj.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\locator.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\SysWOW64\khkmpbhg.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\SysWOW64\hcmnlfdo.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\wbem\ljbfoaik.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\jciekhgf.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\imbcgmfh.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\jlpeafjc.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\ooelckmc.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File created	\??\c:\windows\system32\dhdcojnc.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\alg.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\ofeaffjl.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\vds.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File created	\??\c:\windows\system32\okiqoipc.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\qgjgeoei.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\bpakjggl.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\system32\olefncgi.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\lgemaeed.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\nebgdpeg.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\7-Zip\nklemblo.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\7-Zip\nnknaeep.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\jiianoje.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\iibndipn.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\akaajeom.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ighnagcm.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\onakajab.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\ppkepfpk.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File created	\??\c:\program files\windows media player\fogjaiag.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\Internet Explorer\locaioni.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\gdaoemja.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\program files (x86)\microsoft office\office14\bcebimql.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\program files\google\chrome\Application\89.0.4389.114\oghakbln.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	mscorsvw.exe
File created	C:\Program Files\7-Zip\dklkkafp.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Program Files\7-Zip\klonohhl.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6079.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\fjinhpjq.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP565B.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP697D.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\dnacogfa.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	\??\c:\windows\ehome\bpmlikmn.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP4E8E.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	\??\c:\windows\servicing\omgjdjfa.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	\??\c:\windows\ehome\njmdllij.tmp	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPFA95.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
528	mscorsvw.exe
528	mscorsvw.exe
528	mscorsvw.exe
528	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1204	ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeManageVolumePrivilege	1132	DllHost.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe
Token: SeShutdownPrivilege	528	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 2008	528	mscorsvw.exe	33
PID 528 wrote to memory of 2008	528	mscorsvw.exe	33
PID 528 wrote to memory of 2008	528	mscorsvw.exe	33
PID 528 wrote to memory of 1008	528	mscorsvw.exe	34
PID 528 wrote to memory of 1008	528	mscorsvw.exe	34
PID 528 wrote to memory of 1008	528	mscorsvw.exe	34
PID 528 wrote to memory of 1368	528	mscorsvw.exe	37
PID 528 wrote to memory of 1368	528	mscorsvw.exe	37
PID 528 wrote to memory of 1368	528	mscorsvw.exe	37
PID 528 wrote to memory of 1572	528	mscorsvw.exe	38
PID 528 wrote to memory of 1572	528	mscorsvw.exe	38
PID 528 wrote to memory of 1572	528	mscorsvw.exe	38
PID 528 wrote to memory of 1212	528	mscorsvw.exe	39
PID 528 wrote to memory of 1212	528	mscorsvw.exe	39
PID 528 wrote to memory of 1212	528	mscorsvw.exe	39
PID 528 wrote to memory of 2004	528	mscorsvw.exe	40
PID 528 wrote to memory of 2004	528	mscorsvw.exe	40
PID 528 wrote to memory of 2004	528	mscorsvw.exe	40
PID 528 wrote to memory of 1256	528	mscorsvw.exe	41
PID 528 wrote to memory of 1256	528	mscorsvw.exe	41
PID 528 wrote to memory of 1256	528	mscorsvw.exe	41
PID 528 wrote to memory of 1720	528	mscorsvw.exe	42
PID 528 wrote to memory of 1720	528	mscorsvw.exe	42
PID 528 wrote to memory of 1720	528	mscorsvw.exe	42
PID 528 wrote to memory of 1976	528	mscorsvw.exe	43
PID 528 wrote to memory of 1976	528	mscorsvw.exe	43
PID 528 wrote to memory of 1976	528	mscorsvw.exe	43
PID 528 wrote to memory of 1572	528	mscorsvw.exe	44
PID 528 wrote to memory of 1572	528	mscorsvw.exe	44
PID 528 wrote to memory of 1572	528	mscorsvw.exe	44
PID 528 wrote to memory of 1000	528	mscorsvw.exe	45
PID 528 wrote to memory of 1000	528	mscorsvw.exe	45
PID 528 wrote to memory of 1000	528	mscorsvw.exe	45
PID 528 wrote to memory of 1764	528	mscorsvw.exe	46
PID 528 wrote to memory of 1764	528	mscorsvw.exe	46
PID 528 wrote to memory of 1764	528	mscorsvw.exe	46
PID 528 wrote to memory of 904	528	mscorsvw.exe	47
PID 528 wrote to memory of 904	528	mscorsvw.exe	47
PID 528 wrote to memory of 904	528	mscorsvw.exe	47
PID 528 wrote to memory of 1588	528	mscorsvw.exe	48
PID 528 wrote to memory of 1588	528	mscorsvw.exe	48
PID 528 wrote to memory of 1588	528	mscorsvw.exe	48
PID 528 wrote to memory of 1916	528	mscorsvw.exe	49
PID 528 wrote to memory of 1916	528	mscorsvw.exe	49
PID 528 wrote to memory of 1916	528	mscorsvw.exe	49
PID 528 wrote to memory of 1664	528	mscorsvw.exe	50
PID 528 wrote to memory of 1664	528	mscorsvw.exe	50
PID 528 wrote to memory of 1664	528	mscorsvw.exe	50
PID 528 wrote to memory of 2028	528	mscorsvw.exe	51
PID 528 wrote to memory of 2028	528	mscorsvw.exe	51
PID 528 wrote to memory of 2028	528	mscorsvw.exe	51
PID 528 wrote to memory of 1572	528	mscorsvw.exe	52
PID 528 wrote to memory of 1572	528	mscorsvw.exe	52
PID 528 wrote to memory of 1572	528	mscorsvw.exe	52
PID 528 wrote to memory of 1512	528	mscorsvw.exe	53
PID 528 wrote to memory of 1512	528	mscorsvw.exe	53
PID 528 wrote to memory of 1512	528	mscorsvw.exe	53
PID 528 wrote to memory of 588	528	mscorsvw.exe	54
PID 528 wrote to memory of 588	528	mscorsvw.exe	54
PID 528 wrote to memory of 588	528	mscorsvw.exe	54
PID 528 wrote to memory of 1036	528	mscorsvw.exe	55
PID 528 wrote to memory of 1036	528	mscorsvw.exe	55
PID 528 wrote to memory of 1036	528	mscorsvw.exe	55
PID 528 wrote to memory of 1752	528	mscorsvw.exe	56

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	mscorsvw.exe

C:\Users\Admin\AppData\Local\Temp\ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe
"C:\Users\Admin\AppData\Local\Temp\ca9066a31add0ac03dbfc8ff735bc433152c2d2f932cfdb604d3f357d3ccd112.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2044

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 198 -NGENProcess 1a0 -Pipe 1ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 228 -NGENProcess 208 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 21c -NGENProcess 208 -Pipe 1a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 260 -NGENProcess 230 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 250 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 204 -NGENProcess 208 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 24c -NGENProcess 220 -Pipe 230 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 268 -NGENProcess 204 -Pipe a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 220 -Pipe a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 24c -NGENProcess 278 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 264 -NGENProcess 220 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 220 -NGENProcess 274 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 27c -NGENProcess 220 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 21c -NGENProcess 24c -Pipe 208 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 280 -Pipe 21c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 264 -NGENProcess 28c -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 28c -NGENProcess 26c -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 294 -NGENProcess 220 -Pipe 150 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 220 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 29c -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 264 -NGENProcess 294 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 264 -NGENProcess 29c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 29c -NGENProcess 214 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a8 -NGENProcess 298 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 298 -NGENProcess 264 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2b0 -NGENProcess 214 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 214 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 2b8 -NGENProcess 264 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 264 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2bc -NGENProcess 220 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1676

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
PID:1580

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
694KB

MD5
6ce4c4c69367f51341c733dc35d09998

SHA1
2d844a8a9e9133a3a1cdc90aa2f63b36f50ce21e

SHA256
26f293c68206161941690ad06dc3e6760fffe5581bd4a07bb259e92994a78579

SHA512
0e3933b3ce3e4eb41de8de115b07ba555e4d04471cd794e2cd56686cbdeab6b8764b91773a0414b031442aa9308c02629698f16c526a5d345450b9b841b55d3d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.6MB

MD5
1f29853a275f6f7244b9d904bb27c794

SHA1
388318248e68fdc9ba122fd691f3e6216446f347

SHA256
f1a5ae284b4019be47db7ad88718a3e1232a7edf331d111375d7a48504e8e25a

SHA512
a3edbbdc8cfc47d820aeb65ad4add0beafd12cfe357b6026d742eca28acf570a3cdf080c2db60ffe357d365cfdd34d9a7bb091f31144f539ac2e5503f815fe9a

Download Submit
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
2.0MB

MD5
5f051f259a1162aa8d00c58a955fdac5

SHA1
d02fde2b55f7309dbc839edd5ad87686687ce0bb

SHA256
472a49867feca9ecc28dcc7026c9eaa1c7321d412423d3d2eaa70477a952ff15

SHA512
ca25fc32180b325e9bbbad4275782d90225b2415450a770cb81e9455e6c4dbec89654cb2ee5fe13afecd322918018e0b47d757ff16e1e0167f75d5a785a2529f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
640KB

MD5
00ce7fc35cf2ca71d6c0cb380298d10d

SHA1
ecfabbfefe5e90e108d9acc10f79c7154e88efef

SHA256
75a1a64e144220a036b8423e606dc18689c065a09d4b817bc34acfa7fba631d3

SHA512
7e0a303685071fa7389fa3c7746dbf0bb60698c53bf8e2c550f07c6bcc8338627728dba12dafd693b6cc2863c65c2deb26f3199b544ed0c64c64ed7d6c97ec01

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
640KB

MD5
00ce7fc35cf2ca71d6c0cb380298d10d

SHA1
ecfabbfefe5e90e108d9acc10f79c7154e88efef

SHA256
75a1a64e144220a036b8423e606dc18689c065a09d4b817bc34acfa7fba631d3

SHA512
7e0a303685071fa7389fa3c7746dbf0bb60698c53bf8e2c550f07c6bcc8338627728dba12dafd693b6cc2863c65c2deb26f3199b544ed0c64c64ed7d6c97ec01

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
613KB

MD5
b1249bae57720824288d1204bb236b13

SHA1
3e91d064e91b96e67e4dc456687909a428c0c6e6

SHA256
5dea58d93fb10dd3ecb4def9be82f7f0522c4fc6dc4bb8dab5870043aa126ad9

SHA512
cf07101d11936ec67b1e07037194bb00aa000e24f6d2831504ea7c9b93e9d908c0981313f0c3ba43e314c467ae40ce145620398edc9d732dd2b186baca258101

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
613KB

MD5
b1249bae57720824288d1204bb236b13

SHA1
3e91d064e91b96e67e4dc456687909a428c0c6e6

SHA256
5dea58d93fb10dd3ecb4def9be82f7f0522c4fc6dc4bb8dab5870043aa126ad9

SHA512
cf07101d11936ec67b1e07037194bb00aa000e24f6d2831504ea7c9b93e9d908c0981313f0c3ba43e314c467ae40ce145620398edc9d732dd2b186baca258101

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
644KB

MD5
f5e7a1a7490141dd1b65bf5475717e76

SHA1
f626b3e4f753fda6e38d76b1891805f66ddd189b

SHA256
691c096b546560fa96df2824e50ceedc84fd31deefd049080bb8c7ff8b0dcdc5

SHA512
c45ffd3023fc82658fe4569c50e4eb94443ea550cf024f37c4d0d684bc729077a0c438345d7c7383e21134c0b9f02bd3c168ef178ebe53c2ba0604cfa16c57e0

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
565KB

MD5
7dd80136943412dd4df43c358f003ade

SHA1
ab12b92b237fdfd8a395bdf5bd1ea3ad5b23e3f6

SHA256
a2de7046a47b7a9118c1184f2bda8d6b6e058408426d71a3cbbe71840142b6c5

SHA512
423ad2acdbda9d083a78f044d429364e28f003c2ba64ab8799b246c87153a42c68a4c91b1ccb206008d3d438a6e1914eee79ccc898726ee976b23e2b574f6d5b

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
565KB

MD5
7dd80136943412dd4df43c358f003ade

SHA1
ab12b92b237fdfd8a395bdf5bd1ea3ad5b23e3f6

SHA256
a2de7046a47b7a9118c1184f2bda8d6b6e058408426d71a3cbbe71840142b6c5

SHA512
423ad2acdbda9d083a78f044d429364e28f003c2ba64ab8799b246c87153a42c68a4c91b1ccb206008d3d438a6e1914eee79ccc898726ee976b23e2b574f6d5b

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
694KB

MD5
a01358ea394b5eb13c934012159cd02b

SHA1
e345890c00089782883ed7fe778325f48352c1c9

SHA256
2c4ac710e9d5ea445af2322ef496da0fadd352da954f5a95469c01da0ace18cf

SHA512
4c61602c42697545249ba86637c1b42a689da1be93fc5249d8d8b06226063a728b1e315ca068c0d675a820e813763e0cd2ffacd4b3626fe5c9ce78996e1ee834

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
419d99b4e28bed27343f4dcc3e96660e

SHA1
ec48669664c3a17ea997838a21239b199ce56a27

SHA256
ce1c8b0149ed4bd9f8ca25362bc35936f4edb2076716409c6a16219b61285e91

SHA512
449a9da6848703a73947221c355974f14fb59386e7c480384c040cd71f21a723ffa5eee96b60fd62d9413f558ebeab0845324a0dd41a3462982b28ae4439b1a1

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
788KB

MD5
baa590649f13e0e359b65eb6609c6790

SHA1
6956590967c1679fdc92b03127c0e40db69c3f21

SHA256
08edbd4e84d8a7003275e4d3a1c34c51d1fbb82b2e88d15eab673c467d3d45ea

SHA512
1c28463fcfd7a1a6a7162e139a404d89d0bf6100ebe95707ad4363089fb61659ce954020da62a0a6af5fd63c59e16010449da9fe547475b83ba9b926e84d8224

Download Submit
\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe

Filesize
5.2MB

MD5
01b63f6919d8603765b2ab7e06487331

SHA1
78c29ec3d69c6a38d3c32438901db36008ac76ca

SHA256
c079356a23bb386ba05431a7c73c2a81bfb31b57413783612e2e6b211b60dd3f

SHA512
9ced152f2214b62793a133a419309c5126d94c1b1805f10ddf1b184e05b695e594b5e043284d2f4ecc76a3cbceb7028998057b3a0181ea0c4addf5b9ad22603c

Download Submit
\??\c:\program files\windows media player\wmpnetwk.exe

Filesize
2.0MB

MD5
249f1ab0a91c9e24c41f46ec587f2211

SHA1
f60bf4361cfc3793f123286d3e4e5888423db33a

SHA256
d7d13e04b07695a7a8ecf1ac3869830a70f679de218f038bc5e9051696a0b10a

SHA512
5283c0f0554b80cb8b97e477fd35b95289746335a63e12244ba4e5d195bec0300f155678b262d04f4c53e96be9865cec545169b8f080776298b23e4798913a2c

Download Submit
\??\c:\windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
389fdd1f215120fdd298eb621210e064

SHA1
2b0eb90ef7d78046228df52a102554de1a73dea8

SHA256
2b10a53097d62e24e1d8a98266770f55f2d795c680b84c6e2e8ca5074f52853d

SHA512
4980bffba57cdbeab4dd52f1294f9a5706d1d9fc3236514bc2f4e3e8ac54210ef20a5c5a0bef0cbef60c177dd40b300559af69640fb40173ce501607334294cf

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
679KB

MD5
839f632936972f8b1daa23cf4db50f5f

SHA1
99e7e0915c6ce0e8683328bb84093a8e5d2f89b2

SHA256
85196e7afcce861805a1bed5fb956409b2483e6f85a431b81d97945de4e83dac

SHA512
af5b4e5dc2095ebeb817284b488de4b17c324a095f2aa2e6f951c538f058fbd32075093022c83956f26dae62e81430774f66104efc6af46f936c0111eae83863

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
591KB

MD5
ef9865c5da882807d79c5674aab2af64

SHA1
8a29ef58d4296350a6a993c51daf9bffc5077ace

SHA256
6bb407e894b189333f5d10ec310bc51d60a310a21139bfa2a08d72ec498ea349

SHA512
c60e3b6a55fda4f570a11830193519ae25a8284c1c2948ca7fc7e881ed0e6478b1dfcf1e14180354872f75f0d91c1572c9b59525a86fa17c335bb648d0b47a1c

Download Submit
\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe

Filesize
644KB

MD5
f5e7a1a7490141dd1b65bf5475717e76

SHA1
f626b3e4f753fda6e38d76b1891805f66ddd189b

SHA256
691c096b546560fa96df2824e50ceedc84fd31deefd049080bb8c7ff8b0dcdc5

SHA512
c45ffd3023fc82658fe4569c50e4eb94443ea550cf024f37c4d0d684bc729077a0c438345d7c7383e21134c0b9f02bd3c168ef178ebe53c2ba0604cfa16c57e0

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
632KB

MD5
bc2d1e918d2c248cbac508064c2d583a

SHA1
ead40100b93b31ed02bf43b464fe189e02c835dc

SHA256
388808afff13e5e381977705a4671c22c939791f194a8f7e8a567331f4a3546e

SHA512
5dd25e6f910cb8ed5413395452ceb3dca75683b0e58bdcd35d7b4ae896ebda52e04040dfb50455c32bed5aca8c5fbaaa3932c6837151184508cf1b06e8d87d72

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
48cefdae5f52f2b345fb190fd9896287

SHA1
0d398fe3350b73b72cfc94ad1ed7c23e13ca57e1

SHA256
f51d937bef1061b93764ef1a9cc652eb5925ac46b819184abf2793075bc301c1

SHA512
06dddda1a9c7f323795558a0f428af92657abd6b54ee0be4541b181871bf99940faf37a977b79d112e7581138a7e1e938bc3c35dfa91c1d31a9ed7465317d3ab

Download Submit
\??\c:\windows\system32\ieetwcollector.exe

Filesize
666KB

MD5
d08aed2204a6414ae06a13b4330402e8

SHA1
d64e29a4b3dc8a16addbfe292fc71676f63b48b7

SHA256
5d4801e369077f0af016bb902387949eb92e6e9271e3459f96b5a16bae6a44f9

SHA512
5ecbbcbd06136f55dd129978599f0a9d1dece8386b567aaeb031bc80220968f7bb8f66a9ca69550e820532f0d8d194c2394b7c485ad05d0e9f705f8ec8796c5a

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
693KB

MD5
822f64168da8b619aa1d60b422f691ce

SHA1
3148d9c76fab2539d5da1bd8bc50d574191c2a6e

SHA256
c0d89e1a1da2dc5a865ba7fdcf2dccf93d609b6e062dcee9758bfe6f222bd149

SHA512
83bdc7541baf80227c16121760d0b0cd61a3872d7a7efa9054bc152216b38cb9eacb1668dd9cddf6717350385a007de77397b31e9c682d602c0cb37f9b543357

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
683KB

MD5
5f4922689b7cdcf9c7cfdd8001f08b43

SHA1
05714993aacbbd991cb99c15a74b7e69cb0b05d2

SHA256
0526b8a91414a2bfe5f11e74969a4d6c02902cd2576a0e744ffea9d827e75e5f

SHA512
ce0235a049d9252ff719d72640327d64a3e135e73fc2554eb904136623469e43b93ca81d7e162f816d70331a2fa0c69f069235a59105b2bed070280e86813ec6

Download Submit
\??\c:\windows\system32\searchindexer.exe

Filesize
1.1MB

MD5
87c1ebc6923a96b43ab3285dad84870b

SHA1
00ede0100d9672962d25b11d796e2f5193b4c222

SHA256
77137c6b7f8cec0d271d93c85c3e819b741927fe21ad0e65218ce32d2e7611be

SHA512
a5224cb9883f46477cc112d954f2657993f4fde94bf574d320ff7c1b4210a445ec02ffc6085bdd29dee8f708a11f8be5b98b76189e26d3d117b8eb4286e2db5e

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
569KB

MD5
49472297960d0309c2e7d6c8b8d9ad3f

SHA1
f565e0a00fc9da365cd788a7b2bf4dbb54eb43fa

SHA256
4df164a1587b3b4c7f5bdd98369fe00b50cf06e5f9c537fe1bedf037daa4ad3a

SHA512
b71b07a3196455aaccdebb46e17f8758a65527dd3abb0d5251399f75d50e3bb65bf520d008ab8ff3fa36edd548c4ce2661292e8102f44cad5f1a8aa57d1878d8

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
595KB

MD5
ba8d761ad37badfb7f7f053e72a1a863

SHA1
880fa6420ccffbd197f4fe5c037309542ce22baa

SHA256
4835a072cb35610eef6b8c23f06d188f1bcd5fdc7c660df97d641f9a247750c0

SHA512
c8c37c25c5d1cc02847c6e9ef0eb777b8b00b04322cb3ee11591c14abd26d5980bb304a9a4a3bbe7c56f2bd0b76dd71d11e829efcfd718cc7998fe63125c8b24

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.1MB

MD5
d5f1e96ea913125336a4cff48229f748

SHA1
0195b9a1f6954e222e009c252ad62088f817fff8

SHA256
1831d89ddbb9cc4a0633f4f0571b682ba78b45b77c01a44448ec7540bab28dfc

SHA512
900f3ae6c04e82f29ed09173451b8e6cee8e87cd0834f1167d30b24453d2167206eafdd754c6c2dd534829315b06e5904babe3967dfcce9e31ce1a47f6638030

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.1MB

MD5
8b46f218241ff0211ef80605c60b81c1

SHA1
446cecfd906ff78d724ede646a8edd6999f97a63

SHA256
3e1cc1239ea2e2bb7b781c836a83f239a4521f3c22f10865b9c852684a9e3921

SHA512
9eed9d02874e6093216e68d3ad0fa618a7a9b3966b44cdc30bfc0660877e55874ed117b940632f51dc1e8541a660332225dd1c499aabd3dfc661de557b50b2a1

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
753KB

MD5
9d0a7ec2d15f90168b5f952b0052c837

SHA1
1f947c1a76f20ddb1cf328363c26883c26f28d36

SHA256
0078567077d4d6510aa3f0653dcfec85e964af4ba7f0a315c9c8135b6d2fbe60

SHA512
038507d3fd5581a7e421544ae77fbc47f5e574fb721f25f95cad7753d8e76364bd8223fa5898b5733871aa730e4b9757e5722075b51cfac77897d336c21ace1d

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
2.0MB

MD5
175f43e0a18a3f607ba85786934f722c

SHA1
f29b43093f7da67b98b0cd8bb08a90dc7934dc8a

SHA256
6acfdc1dcc4ec29035da77beedc897eacbe5a32861b37feb7abe9da5227b10fa

SHA512
2dc8d3aa145294bf657ebebc2335191d6ff97f259187988485d71163bccd9c2148157da9465e26f28db0ea43eaa3a4a704f940b91d303051908677718b430a35

Download Submit
\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
2.0MB

MD5
5f051f259a1162aa8d00c58a955fdac5

SHA1
d02fde2b55f7309dbc839edd5ad87686687ce0bb

SHA256
472a49867feca9ecc28dcc7026c9eaa1c7321d412423d3d2eaa70477a952ff15

SHA512
ca25fc32180b325e9bbbad4275782d90225b2415450a770cb81e9455e6c4dbec89654cb2ee5fe13afecd322918018e0b47d757ff16e1e0167f75d5a785a2529f

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
640KB

MD5
00ce7fc35cf2ca71d6c0cb380298d10d

SHA1
ecfabbfefe5e90e108d9acc10f79c7154e88efef

SHA256
75a1a64e144220a036b8423e606dc18689c065a09d4b817bc34acfa7fba631d3

SHA512
7e0a303685071fa7389fa3c7746dbf0bb60698c53bf8e2c550f07c6bcc8338627728dba12dafd693b6cc2863c65c2deb26f3199b544ed0c64c64ed7d6c97ec01

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
640KB

MD5
00ce7fc35cf2ca71d6c0cb380298d10d

SHA1
ecfabbfefe5e90e108d9acc10f79c7154e88efef

SHA256
75a1a64e144220a036b8423e606dc18689c065a09d4b817bc34acfa7fba631d3

SHA512
7e0a303685071fa7389fa3c7746dbf0bb60698c53bf8e2c550f07c6bcc8338627728dba12dafd693b6cc2863c65c2deb26f3199b544ed0c64c64ed7d6c97ec01

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
666KB

MD5
05b41d48e3461eb280c96c01340d040f

SHA1
d4742d6b1a8422db5ac47cb61e6cede60458e22e

SHA256
12fcec7bd227b6a6de43a7cf4ca9abb1676537b823aeb39913c0664add0ff175

SHA512
8f07fdb303e99e1da82255b9155e11fa79d3e44a6610a39c08218bf279e9118106f3c36901cc8caa0e8af1519f31bd2771bbb8417c6a6472eebf5aed28387abd

Download Submit
\Windows\System32\dllhost.exe

Filesize
565KB

MD5
7dd80136943412dd4df43c358f003ade

SHA1
ab12b92b237fdfd8a395bdf5bd1ea3ad5b23e3f6

SHA256
a2de7046a47b7a9118c1184f2bda8d6b6e058408426d71a3cbbe71840142b6c5

SHA512
423ad2acdbda9d083a78f044d429364e28f003c2ba64ab8799b246c87153a42c68a4c91b1ccb206008d3d438a6e1914eee79ccc898726ee976b23e2b574f6d5b

Download Submit
\Windows\System32\dllhost.exe

Filesize
565KB

MD5
7dd80136943412dd4df43c358f003ade

SHA1
ab12b92b237fdfd8a395bdf5bd1ea3ad5b23e3f6

SHA256
a2de7046a47b7a9118c1184f2bda8d6b6e058408426d71a3cbbe71840142b6c5

SHA512
423ad2acdbda9d083a78f044d429364e28f003c2ba64ab8799b246c87153a42c68a4c91b1ccb206008d3d438a6e1914eee79ccc898726ee976b23e2b574f6d5b

Download Submit
\Windows\System32\dllhost.exe

Filesize
565KB

MD5
7dd80136943412dd4df43c358f003ade

SHA1
ab12b92b237fdfd8a395bdf5bd1ea3ad5b23e3f6

SHA256
a2de7046a47b7a9118c1184f2bda8d6b6e058408426d71a3cbbe71840142b6c5

SHA512
423ad2acdbda9d083a78f044d429364e28f003c2ba64ab8799b246c87153a42c68a4c91b1ccb206008d3d438a6e1914eee79ccc898726ee976b23e2b574f6d5b

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1F73.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1F73.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP37E3.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP37E3.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPD6A.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPD6A.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPFA95.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPFA95.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
memory/528-91-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/528-70-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/588-214-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/904-184-0x000007FEF25D0000-0x000007FEF2FF3000-memory.dmp

Filesize
10.1MB

Download
memory/904-185-0x000007FEEE540000-0x000007FEEF5D6000-memory.dmp

Filesize
16.6MB

Download
memory/904-186-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/904-189-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1000-173-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1000-232-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1000-174-0x000007FEF2DE0000-0x000007FEF3803000-memory.dmp

Filesize
10.1MB

Download
memory/1000-229-0x000007FEF2DE0000-0x000007FEF3803000-memory.dmp

Filesize
10.1MB

Download
memory/1000-179-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1008-89-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1036-216-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1040-63-0x0000000010000000-0x000000001028B000-memory.dmp

Filesize
2.5MB

Download
memory/1132-112-0x0000000100000000-0x0000000100278000-memory.dmp

Filesize
2.5MB

Download
memory/1132-111-0x00000000031E0000-0x00000000031F0000-memory.dmp

Filesize
64KB

Download
memory/1132-124-0x0000000004350000-0x0000000004358000-memory.dmp

Filesize
32KB

Download
memory/1132-127-0x0000000100000000-0x0000000100278000-memory.dmp

Filesize
2.5MB

Download
memory/1132-118-0x0000000003240000-0x0000000003250000-memory.dmp

Filesize
64KB

Download
memory/1172-225-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1204-69-0x0000000001000000-0x0000000001251000-memory.dmp

Filesize
2.3MB

Download
memory/1204-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1204-54-0x0000000001000000-0x0000000001251000-memory.dmp

Filesize
2.3MB

Download
memory/1212-140-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1212-137-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1212-136-0x000007FEF32B0000-0x000007FEF3CD3000-memory.dmp

Filesize
10.1MB

Download
memory/1256-145-0x000007FEF3AC0000-0x000007FEF44E3000-memory.dmp

Filesize
10.1MB

Download
memory/1256-149-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1256-144-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1368-132-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1408-223-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1512-212-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1512-210-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1516-65-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/1572-207-0x000007FEF25D0000-0x000007FEF2FF3000-memory.dmp

Filesize
10.1MB

Download
memory/1572-209-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1572-169-0x000007FEF25D0000-0x000007FEF2FF3000-memory.dmp

Filesize
10.1MB

Download
memory/1572-135-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1572-172-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1572-167-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1580-74-0x0000000100000000-0x0000000100278000-memory.dmp

Filesize
2.5MB

Download
memory/1580-92-0x0000000100000000-0x0000000100278000-memory.dmp

Filesize
2.5MB

Download
memory/1588-190-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1588-191-0x000007FEF34B0000-0x000007FEF3ED3000-memory.dmp

Filesize
10.1MB

Download
memory/1588-195-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1664-199-0x000007FEF3CC0000-0x000007FEF46E3000-memory.dmp

Filesize
10.1MB

Download
memory/1664-200-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1664-202-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1720-152-0x000007FEF2DE0000-0x000007FEF3803000-memory.dmp

Filesize
10.1MB

Download
memory/1720-158-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1720-155-0x000000001CB50000-0x000000001CE4F000-memory.dmp

Filesize
3.0MB

Download
memory/1720-154-0x000007FEEE540000-0x000007FEEF5D6000-memory.dmp

Filesize
16.6MB

Download
memory/1720-153-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1752-218-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1764-181-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1764-180-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1908-233-0x000007FEF23B0000-0x000007FEF2DD3000-memory.dmp

Filesize
10.1MB

Download
memory/1908-231-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1908-235-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1916-196-0x000007FEF2DE0000-0x000007FEF3803000-memory.dmp

Filesize
10.1MB

Download
memory/1916-198-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1960-226-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1960-228-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1976-165-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1976-159-0x000007FEF2090000-0x000007FEF2AB3000-memory.dmp

Filesize
10.1MB

Download
memory/1976-160-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1976-161-0x000000001CAC0000-0x000000001CDBF000-memory.dmp

Filesize
3.0MB

Download
memory/1992-219-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/1992-221-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2004-143-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2008-87-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2008-237-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2008-81-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2008-236-0x000007FEF3CC0000-0x000007FEF46E3000-memory.dmp

Filesize
10.1MB

Download
memory/2020-77-0x0000000140000000-0x00000001403F2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-97-0x0000000140000000-0x00000001403F2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-206-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2028-203-0x000007FEF2DE0000-0x000007FEF3803000-memory.dmp

Filesize
10.1MB

Download
memory/2028-204-0x0000000140000000-0x0000000140291000-memory.dmp

Filesize
2.6MB

Download
memory/2044-58-0x0000000010000000-0x0000000010258000-memory.dmp

Filesize
2.3MB

Download