67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02

Analysis

max time kernel
177s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
Size

784KB
MD5

01b05b974291ba4c7818cc3fa9cf75a6
SHA1

e795caf67af6f953e785d66f91b912beaf4d2f64
SHA256

67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02
SHA512

dbc5d6deb829ab8fbe5515e151e1855da570010ea0976ce2e721becfe41babe3bbbde7c6d178cf09c347511c53988d94dd3cc6ec2dba88cf0450da168cf2134e
SSDEEP

24576:HsqSroAupL8uSrOYMnq0CqoJjEHMhYwdFHs:7GD+LzGf

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 9 IoCs

pid	Process
1584	mscorsvw.exe
464	Process not Found
1340	mscorsvw.exe
1764	mscorsvw.exe
636	mscorsvw.exe
1856	dllhost.exe
2008	mscorsvw.exe
640	elevation_service.exe
1064	mscorsvw.exe

Loads dropped DLL 5 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000\EnableNotifications = "0"	dllhost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 18 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	dllhost.exe
File opened (read-only)	\??\M:	dllhost.exe
File opened (read-only)	\??\P:	dllhost.exe
File opened (read-only)	\??\E:	dllhost.exe
File opened (read-only)	\??\F:	dllhost.exe
File opened (read-only)	\??\G:	dllhost.exe
File opened (read-only)	\??\H:	dllhost.exe
File opened (read-only)	\??\I:	dllhost.exe
File opened (read-only)	\??\V:	dllhost.exe
File opened (read-only)	\??\Q:	dllhost.exe
File opened (read-only)	\??\S:	dllhost.exe
File opened (read-only)	\??\N:	dllhost.exe
File opened (read-only)	\??\O:	dllhost.exe
File opened (read-only)	\??\R:	dllhost.exe
File opened (read-only)	\??\T:	dllhost.exe
File opened (read-only)	\??\K:	dllhost.exe
File opened (read-only)	\??\L:	dllhost.exe
File opened (read-only)	\??\U:	dllhost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\vds.exe	dllhost.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\system32\klhopmmd.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\locator.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\system32\ioigbjlf.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	dllhost.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\alg.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	dllhost.exe
File created	\??\c:\windows\SysWOW64\bqpmglce.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\alg.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	dllhost.exe
File created	\??\c:\windows\system32\mdeikhnk.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	dllhost.exe
File created	\??\c:\windows\system32\baqbapjh.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	dllhost.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\system32\hkbknfkn.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\system32\ifobmffm.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\SysWOW64\fjhmnjeo.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\SysWOW64\ddicngod.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\system32\fmaplqgf.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\system32\amkqgjnd.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	dllhost.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\SysWOW64\kffnojgh.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	dllhost.exe
File created	\??\c:\windows\system32\ekajmpfi.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\system32\omkmpddl.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\system32\iabjkehf.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\vds.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	dllhost.exe
File created	\??\c:\windows\system32\wbem\nqipimqm.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\system32\locator.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	dllhost.exe
File created	\??\c:\program files (x86)\microsoft office\office14\idicefni.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	C:\Program Files\Internet Explorer\offmchkk.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\program files\windows media player\ajfhblme.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\program files\google\chrome\Application\89.0.4389.114\cpmkegbf.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	dllhost.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	dllhost.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	dllhost.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	dllhost.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\blgoooib.tmp	dllhost.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	dllhost.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\hijmjgli.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	dllhost.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\ppjnnmff.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\efdbehgj.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\hdqeebap.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\hikbdgej.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\ehome\mgoiplee.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\kfiakani.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\microsoft.net\framework64\v2.0.50727\pgooogme.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\ehome\ickojbgi.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B4165460-FFF4-4C09-AB0B-5BBC6333B49B}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	\??\c:\windows\servicing\pkgdekkh.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\nheogchg.tmp	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	\??\c:\windows\servicing\keehnomc.tmp	dllhost.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	dllhost.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	dllhost.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	dllhost.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	dllhost.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B4165460-FFF4-4C09-AB0B-5BBC6333B49B}.crmlog	dllhost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1856	dllhost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1456	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
Token: SeShutdownPrivilege	636	mscorsvw.exe
Token: SeShutdownPrivilege	636	mscorsvw.exe
Token: SeShutdownPrivilege	636	mscorsvw.exe
Token: SeShutdownPrivilege	636	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	1856	dllhost.exe
Token: SeShutdownPrivilege	636	mscorsvw.exe
Token: SeShutdownPrivilege	636	mscorsvw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1456	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
1456	67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 2008	636	mscorsvw.exe	32
PID 636 wrote to memory of 2008	636	mscorsvw.exe	32
PID 636 wrote to memory of 2008	636	mscorsvw.exe	32
PID 636 wrote to memory of 1064	636	mscorsvw.exe	34
PID 636 wrote to memory of 1064	636	mscorsvw.exe	34
PID 636 wrote to memory of 1064	636	mscorsvw.exe	34

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	dllhost.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	dllhost.exe

C:\Users\Admin\AppData\Local\Temp\67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe
"C:\Users\Admin\AppData\Local\Temp\67d60a477aa6caaa0d411bb2dfdb1f15dfb4392c3dbf6ad2b3624b4f0fa46f02.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1456

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1584

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 168 -NGENProcess 19c -Pipe 1a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 218 -InterruptEvent 220 -NGENProcess 1ac -Pipe 1b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1064

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1856

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
2.0MB

MD5
92b3813308d64454364a33d280dec4c4

SHA1
03077aace52e34c44a1caa8b0e9d8d2314fb17ea

SHA256
d6a5c85d143e8a394b9a3e4df7963beff35aa58687f2a46805cc6fdcf0068c49

SHA512
b47716738bd35bfd267dcbcf9d4ec2e79218b107914d4d97f6e53baaa1c73b50f67dccc1f8b03ff4f52f0fe29f69ca1b443d9fd43ae199e3e02ec8ffdf241a7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
656KB

MD5
fdbdee918ab5a314ec8e1d590a6b6f13

SHA1
99d5eb84d9e80d94b1d9616e24f6eab514cd6710

SHA256
ea9f355939dd81c627a2500f2d7064cc05f727cdac017c12da76fb4feb18889a

SHA512
5cb9a69cf909b7345afa06bb05b799ad321ef224941d3b7bd8ad385663437590909814e304d950e9cf4fb019bbc5a9af0612175d67b65e001a93b80dec257801

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
656KB

MD5
fdbdee918ab5a314ec8e1d590a6b6f13

SHA1
99d5eb84d9e80d94b1d9616e24f6eab514cd6710

SHA256
ea9f355939dd81c627a2500f2d7064cc05f727cdac017c12da76fb4feb18889a

SHA512
5cb9a69cf909b7345afa06bb05b799ad321ef224941d3b7bd8ad385663437590909814e304d950e9cf4fb019bbc5a9af0612175d67b65e001a93b80dec257801

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
686KB

MD5
8bfeaa9f6b88f4403ccde113d2a47ab0

SHA1
1fe3835a66562656095d70e5d282ab809d5a6c01

SHA256
56b014ff2231cfa616e1548fd987f5cb741553aed67300c85fe6dc213420b29a

SHA512
245c0ca1943fa3ec45099f9f0b398d23c6ec996ba0cbe9b3a120af852713d178106ac8dc99ddfe38c3283b1bfa1e0d06a7b6813374c59e330d68735039d53252

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
686KB

MD5
8bfeaa9f6b88f4403ccde113d2a47ab0

SHA1
1fe3835a66562656095d70e5d282ab809d5a6c01

SHA256
56b014ff2231cfa616e1548fd987f5cb741553aed67300c85fe6dc213420b29a

SHA512
245c0ca1943fa3ec45099f9f0b398d23c6ec996ba0cbe9b3a120af852713d178106ac8dc99ddfe38c3283b1bfa1e0d06a7b6813374c59e330d68735039d53252

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
686KB

MD5
8bfeaa9f6b88f4403ccde113d2a47ab0

SHA1
1fe3835a66562656095d70e5d282ab809d5a6c01

SHA256
56b014ff2231cfa616e1548fd987f5cb741553aed67300c85fe6dc213420b29a

SHA512
245c0ca1943fa3ec45099f9f0b398d23c6ec996ba0cbe9b3a120af852713d178106ac8dc99ddfe38c3283b1bfa1e0d06a7b6813374c59e330d68735039d53252

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
686KB

MD5
8bfeaa9f6b88f4403ccde113d2a47ab0

SHA1
1fe3835a66562656095d70e5d282ab809d5a6c01

SHA256
56b014ff2231cfa616e1548fd987f5cb741553aed67300c85fe6dc213420b29a

SHA512
245c0ca1943fa3ec45099f9f0b398d23c6ec996ba0cbe9b3a120af852713d178106ac8dc99ddfe38c3283b1bfa1e0d06a7b6813374c59e330d68735039d53252

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
633KB

MD5
96340b1faba95a02e90875f8cc8d6f7a

SHA1
d9f3615a1b416d3170cbd87cdfbd1ed3acfec188

SHA256
1eca1ec6b7ad97aa4b23b02a9d2d6cc40b5680afef50389cdfc3c11a367825a9

SHA512
34e728cb8a39b4e458272b25cba930ede5c1136201558659522a7a301d332fa22f2c7501db5b309a472630efbdc9a28cdfa050baa6bf9e2c4fd4c459ad7b0993

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
633KB

MD5
96340b1faba95a02e90875f8cc8d6f7a

SHA1
d9f3615a1b416d3170cbd87cdfbd1ed3acfec188

SHA256
1eca1ec6b7ad97aa4b23b02a9d2d6cc40b5680afef50389cdfc3c11a367825a9

SHA512
34e728cb8a39b4e458272b25cba930ede5c1136201558659522a7a301d332fa22f2c7501db5b309a472630efbdc9a28cdfa050baa6bf9e2c4fd4c459ad7b0993

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
664KB

MD5
9aaebdcec2cd1e55267d140e587567f6

SHA1
b051ae06d322984824a25eaf611e87ce957c6aaf

SHA256
d1141e6358c52807823fab8e0580862369854ebd45530b0096cba05e2deb033c

SHA512
79ca80fd645287e60877918378d2a83bcc0a4a7ef3598c4dcb117b0136e22bad806d7793c1e9372efdf6399d608a65c2c4482f985473a19097f8f2abc1e97eee

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
585KB

MD5
ad6b1c0d75d07a04939a7c2a850e1bc1

SHA1
278a8de92e0130425a6b7e01fff629a04ab0b5d8

SHA256
30df75ba40ea136ab41897de517a15d4cad81a0c733ddbe768c85be5efa5b231

SHA512
aaa566baa53854ec5ddc261580dee6bc884250cbd779b313bdccc58ecea2e8b0be4cfade385654b554052b40788a2066fd8b0305b86daf46cbf81270c82d982b

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.1MB

MD5
0210617f2313625cf0a7cecc67da500f

SHA1
8890e5de423d544a0c515224227fae2f6bdd668a

SHA256
d761b8e6cc3f17bce57e555056941011e18395f35c494842480d9384ee9787f2

SHA512
81091990c06084c8f0800ddfe67ee4f80c23fd0a61ce8cbbb69922942e56f059f084dd98ec6a058df037475d19730d0f7298e2c74c4848c4bdf464d27fe01337

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
804KB

MD5
d3f8390e95ac940ceac7e1091444a589

SHA1
039ece9e0b818c34764b5487d82c2f9ac8e497c1

SHA256
f082e5577c435e3162fe3755e4c8417c325a2c76eb467e700f9cd3397f639901

SHA512
c2dd37482790e4d5be2fa94190084b506ff08acda3b8a3598ed747fdd3371152339d5f8fde96e81e886533dac25c1b2139c1cfabb6d6003ae522fdd36f50ba90

Download Submit
\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe

Filesize
5.3MB

MD5
e1d1cb6433bfccaf7ccb79c8f65ec1b2

SHA1
e6f165c066eabcd4272ae8033b1f4c45472d35c0

SHA256
75d309c21db12118e168d4ba9bd3db2486220bbba4dfb2e2ab5c021c94d7529e

SHA512
54c12b7cef29c124b904d85a8e1f4c957d1f4f8140cb229191d0d906dd352bbe5fb7a7cc4709cf8c4a2b227087e39a06665e230e01897ddfb51ea2951b7a0ffc

Download Submit
\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
2.0MB

MD5
92b3813308d64454364a33d280dec4c4

SHA1
03077aace52e34c44a1caa8b0e9d8d2314fb17ea

SHA256
d6a5c85d143e8a394b9a3e4df7963beff35aa58687f2a46805cc6fdcf0068c49

SHA512
b47716738bd35bfd267dcbcf9d4ec2e79218b107914d4d97f6e53baaa1c73b50f67dccc1f8b03ff4f52f0fe29f69ca1b443d9fd43ae199e3e02ec8ffdf241a7e

Download Submit
\??\c:\windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
1edf88ffa457b31ca2a1fdb6d5e744d1

SHA1
ef16a507998d7db17199f9a70ac81dba27ced3fb

SHA256
7eaa90ebfad4f39efa138cbe363b7a5f9a33285536259a16871df71e74a50567

SHA512
aeceb1b30fc10ff683112ac28b9e495d4946e08f9233da6c3e82ca995dc4a162f1441220b31799d0e17c573b0cedf2dcd3a98066ae16e9676e98621722fec904

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
699KB

MD5
3972fb540b8d42f993daff21173f161e

SHA1
81a87f5fb6aed05b9c0937abe863e5a0662ef284

SHA256
286e46ee799aff21ddaf9e283e4b714b801d116a22b1eda07da52e2053d89582

SHA512
355ab3d3135b920cc141429688761bfedb172f29216316b0e983bf37a7e157ace70a56e0022b0cd14944ddbf3df9c57795f066b12734053835a342b46986518a

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
611KB

MD5
6a60087d41c8824d3a42700c2a5af38f

SHA1
abb0e12d899cba7ef67159d936cc7f58fef34d11

SHA256
5fce14c06916b6d6dfe894ff4ebe6596327b058833f7f08174eddfb3b99d82b5

SHA512
9bdc8834cc8ea4aa074df3bbf154fd24dbb7ab53e50a00bc4baec1df1adb7ff13622b00d94cfd70387ad9593c1d949f02b21bb97fe0d68f401519b244af6a7cf

Download Submit
\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe

Filesize
664KB

MD5
9aaebdcec2cd1e55267d140e587567f6

SHA1
b051ae06d322984824a25eaf611e87ce957c6aaf

SHA256
d1141e6358c52807823fab8e0580862369854ebd45530b0096cba05e2deb033c

SHA512
79ca80fd645287e60877918378d2a83bcc0a4a7ef3598c4dcb117b0136e22bad806d7793c1e9372efdf6399d608a65c2c4482f985473a19097f8f2abc1e97eee

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
652KB

MD5
2c651e2d7499366e9a7e41c0b9e496df

SHA1
6d6bdc65da55114e76f98c4a2ee97f7f167dacd9

SHA256
81be0a2fe85d2a478de47b197c14c14241ec881a3c071ff7794022c34a128b3d

SHA512
99d68b8876840fdcb8d51ffc5f174f15d5fac1a49e3b5bbebaa99f33e72c95ac4f51d6a7962cb591088ce6b8b8aac06f30ec160d93b3f1dba8eafad6f3d460b4

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
151b01567dbf2765aa70f493d2067396

SHA1
0d4b5408eac9c2192cfe0e3a9eab1c91cbae8f03

SHA256
db9a5f5adadbeda1c22a20311df79a9438d8a5f697d05e1cead5ad4a66bc6119

SHA512
70231ed5b922c0ede0110bc751f93c94ed4916f9dd012501fc0813c61083f42b3bd4b78a223bad70de68ba244d95730380b738f0cfded255336d7a01cd0a754d

Download Submit
\??\c:\windows\system32\ieetwcollector.exe

Filesize
682KB

MD5
e3b14a493d4d8396bdf8e82b31f4a287

SHA1
24589ea55e6b703dff469f4b1547aac5df72c54f

SHA256
65fe3d9aefa29cf51006fd7a0a8de90ce9b2aee20b8d0a75301bced3c9a9a44d

SHA512
afcfa93d3a89b31f430da9075bf6b8269dfc6d02a88b27cae3bbd26e58fceb33737d18de16d27c3f0a3c5abff1af00bec6438e5c8b366f4da17f8d5b50e070bc

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
713KB

MD5
1ac51bcf529795096823c121deef7a55

SHA1
d68958662422a89cc8a19238974c8d5544a4333f

SHA256
c7207a5b83a9dae033d410ef301f14a0290d68c7748270fee215c354b50644c5

SHA512
84d069e0bee3af1412c5cefed4776d67c00b9bc377ebdf097e1a9f94fc3e579c4814a0aa9ec37d48174e9999b27982307a57b2e02167936e5f1b28a5701e95a8

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
699KB

MD5
ab7f2f4af1ce57a507242116932b2259

SHA1
d28641cdc65b71ae4511928443a66d696e692d7b

SHA256
adbef8f7584796b643eed7a7b841409247dc1487d70dc4ca3871f53ad95c1f02

SHA512
0b03fa52b70b70c08834478645513a5f96fc599da52633e0273ffbaa63855b5f2149d2c48f51cdc9e5f01c5896ff76f469c0a52f5777a0e3a6de10c73d35d116

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
589KB

MD5
e8ca74545d62dd376ab93614c985f5c8

SHA1
5f7c099eeafb3429d1e3ebf3d9ede25727126231

SHA256
e248b20f09160697e8c68b8018841446e35cf9095232a96bac70385bc4ae98ba

SHA512
915c45a23a9c01264424f3923a9835631d38d54afe90f766f384073e4a9864bb5f3b45233e5db8d15ceb730af3bc7cd07569e27ca82477c38f65a32ec540ce4a

Download Submit
\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
2.0MB

MD5
92b3813308d64454364a33d280dec4c4

SHA1
03077aace52e34c44a1caa8b0e9d8d2314fb17ea

SHA256
d6a5c85d143e8a394b9a3e4df7963beff35aa58687f2a46805cc6fdcf0068c49

SHA512
b47716738bd35bfd267dcbcf9d4ec2e79218b107914d4d97f6e53baaa1c73b50f67dccc1f8b03ff4f52f0fe29f69ca1b443d9fd43ae199e3e02ec8ffdf241a7e

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
656KB

MD5
fdbdee918ab5a314ec8e1d590a6b6f13

SHA1
99d5eb84d9e80d94b1d9616e24f6eab514cd6710

SHA256
ea9f355939dd81c627a2500f2d7064cc05f727cdac017c12da76fb4feb18889a

SHA512
5cb9a69cf909b7345afa06bb05b799ad321ef224941d3b7bd8ad385663437590909814e304d950e9cf4fb019bbc5a9af0612175d67b65e001a93b80dec257801

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
656KB

MD5
fdbdee918ab5a314ec8e1d590a6b6f13

SHA1
99d5eb84d9e80d94b1d9616e24f6eab514cd6710

SHA256
ea9f355939dd81c627a2500f2d7064cc05f727cdac017c12da76fb4feb18889a

SHA512
5cb9a69cf909b7345afa06bb05b799ad321ef224941d3b7bd8ad385663437590909814e304d950e9cf4fb019bbc5a9af0612175d67b65e001a93b80dec257801

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
686KB

MD5
8bfeaa9f6b88f4403ccde113d2a47ab0

SHA1
1fe3835a66562656095d70e5d282ab809d5a6c01

SHA256
56b014ff2231cfa616e1548fd987f5cb741553aed67300c85fe6dc213420b29a

SHA512
245c0ca1943fa3ec45099f9f0b398d23c6ec996ba0cbe9b3a120af852713d178106ac8dc99ddfe38c3283b1bfa1e0d06a7b6813374c59e330d68735039d53252

Download Submit
\Windows\System32\dllhost.exe

Filesize
585KB

MD5
ad6b1c0d75d07a04939a7c2a850e1bc1

SHA1
278a8de92e0130425a6b7e01fff629a04ab0b5d8

SHA256
30df75ba40ea136ab41897de517a15d4cad81a0c733ddbe768c85be5efa5b231

SHA512
aaa566baa53854ec5ddc261580dee6bc884250cbd779b313bdccc58ecea2e8b0be4cfade385654b554052b40788a2066fd8b0305b86daf46cbf81270c82d982b

Download Submit
\Windows\System32\dllhost.exe

Filesize
585KB

MD5
ad6b1c0d75d07a04939a7c2a850e1bc1

SHA1
278a8de92e0130425a6b7e01fff629a04ab0b5d8

SHA256
30df75ba40ea136ab41897de517a15d4cad81a0c733ddbe768c85be5efa5b231

SHA512
aaa566baa53854ec5ddc261580dee6bc884250cbd779b313bdccc58ecea2e8b0be4cfade385654b554052b40788a2066fd8b0305b86daf46cbf81270c82d982b

Download Submit
memory/636-79-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/636-75-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/640-102-0x0000000140000000-0x000000014036F000-memory.dmp

Filesize
3.4MB

Download
memory/640-91-0x0000000140000000-0x000000014036F000-memory.dmp

Filesize
3.4MB

Download
memory/1064-100-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/1064-94-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/1340-66-0x0000000010000000-0x0000000010208000-memory.dmp

Filesize
2.0MB

Download
memory/1340-64-0x0000000010000000-0x0000000010208000-memory.dmp

Filesize
2.0MB

Download
memory/1456-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1456-56-0x0000000001000000-0x00000000011F9000-memory.dmp

Filesize
2.0MB

Download
memory/1456-54-0x0000000001000000-0x00000000011F9000-memory.dmp

Filesize
2.0MB

Download
memory/1584-60-0x0000000010000000-0x00000000101D4000-memory.dmp

Filesize
1.8MB

Download
memory/1584-58-0x0000000010000000-0x00000000101D4000-memory.dmp

Filesize
1.8MB

Download
memory/1764-68-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/1856-76-0x0000000100000000-0x00000001001F6000-memory.dmp

Filesize
2.0MB

Download
memory/1856-80-0x0000000100000000-0x00000001001F6000-memory.dmp

Filesize
2.0MB

Download
memory/2008-98-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/2008-84-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download
memory/2008-89-0x0000000140000000-0x000000014020F000-memory.dmp

Filesize
2.1MB

Download