9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d

Analysis

max time kernel
151s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
Size

887KB
MD5

498d5b0dae4bb89ce636a3f000bc3360
SHA1

d813622863215be48af5f29eb0465480b7009779
SHA256

9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d
SHA512

5b1dff856127930f23d70315740eaf2e9f4877d9f673759c24d46542c119f6e41ade62def91163efce983bdbaa969ecf42a1083dc3d3689b3ad9d6e13a504716
SSDEEP

12288:cQyN/7YkrWBfWhvRhQUkcVS15NkiM6aOvYsRzBtHnwi/AXwnKRh4e2Y0Xp:cQyN/7DSBfWhkcVQ+6aOvYs1+0X

Score

8^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 38 IoCs

pid	Process
1196	mscorsvw.exe
464	Process not Found
676	mscorsvw.exe
1716	mscorsvw.exe
520	mscorsvw.exe
1432	dllhost.exe
1568	mscorsvw.exe
1960	mscorsvw.exe
592	Process not Found
1196	DllHost.exe
1644	mscorsvw.exe
1964	mscorsvw.exe
960	mscorsvw.exe
1000	mscorsvw.exe
664	mscorsvw.exe
1604	mscorsvw.exe
1376	mscorsvw.exe
580	mscorsvw.exe
528	mscorsvw.exe
1848	mscorsvw.exe
1264	mscorsvw.exe
1356	mscorsvw.exe
1744	mscorsvw.exe
980	mscorsvw.exe
1776	mscorsvw.exe
268	mscorsvw.exe
1412	mscorsvw.exe
1604	mscorsvw.exe
1932	mscorsvw.exe
2032	mscorsvw.exe
940	mscorsvw.exe
980	mscorsvw.exe
960	mscorsvw.exe
1848	mscorsvw.exe
548	mscorsvw.exe
560	mscorsvw.exe
1496	mscorsvw.exe
1956	mscorsvw.exe

Loads dropped DLL 26 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
664	mscorsvw.exe
664	mscorsvw.exe
1376	mscorsvw.exe
1376	mscorsvw.exe
528	mscorsvw.exe
528	mscorsvw.exe
1264	mscorsvw.exe
1264	mscorsvw.exe
1744	mscorsvw.exe
1744	mscorsvw.exe
1776	mscorsvw.exe
1776	mscorsvw.exe
1412	mscorsvw.exe
1412	mscorsvw.exe
1932	mscorsvw.exe
1932	mscorsvw.exe
940	mscorsvw.exe
940	mscorsvw.exe
960	mscorsvw.exe
960	mscorsvw.exe
548	mscorsvw.exe
548	mscorsvw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4063495947-34355257-727531523-1000	mscorsvw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4063495947-34355257-727531523-1000\EnableNotifications = "0"	mscorsvw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\L:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\M:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\O:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\M:	mscorsvw.exe
File opened (read-only)	\??\O:	mscorsvw.exe
File opened (read-only)	\??\S:	mscorsvw.exe
File opened (read-only)	\??\U:	mscorsvw.exe
File opened (read-only)	\??\R:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\T:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\G:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\U:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\W:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\X:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\H:	mscorsvw.exe
File opened (read-only)	\??\T:	mscorsvw.exe
File opened (read-only)	\??\V:	mscorsvw.exe
File opened (read-only)	\??\K:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\Q:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\S:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\F:	mscorsvw.exe
File opened (read-only)	\??\Q:	mscorsvw.exe
File opened (read-only)	\??\R:	mscorsvw.exe
File opened (read-only)	\??\P:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\J:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\Z:	mscorsvw.exe
File opened (read-only)	\??\Y:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\G:	mscorsvw.exe
File opened (read-only)	\??\J:	mscorsvw.exe
File opened (read-only)	\??\F:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\H:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\I:	mscorsvw.exe
File opened (read-only)	\??\K:	mscorsvw.exe
File opened (read-only)	\??\V:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\X:	mscorsvw.exe
File opened (read-only)	\??\Y:	mscorsvw.exe
File opened (read-only)	\??\N:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\Z:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\E:	mscorsvw.exe
File opened (read-only)	\??\P:	mscorsvw.exe
File opened (read-only)	\??\E:	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened (read-only)	\??\W:	mscorsvw.exe
File opened (read-only)	\??\L:	mscorsvw.exe
File opened (read-only)	\??\N:	mscorsvw.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\alg.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\system32\snmptrap.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\vds.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\system32\vds.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\alg.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\system32\ui0detect.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\vds.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\system32\msdtc.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\system32\alg.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\locator.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	mscorsvw.exe
File created	\??\c:\windows\system32\vssvc.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\system32\msiexec.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\locator.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	mscorsvw.exe
File created	\??\c:\windows\system32\fxssvc.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	mscorsvw.exe
File created	\??\c:\windows\system32\dllhost.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	mscorsvw.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe

Drops file in Program Files directory 39 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Program Files\7-Zip\7zG.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Program Files\7-Zip\Uninstall.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	mscorsvw.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	mscorsvw.exe
File created	C:\Program Files\Internet Explorer\iexplore.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	mscorsvw.exe
File created	C:\Program Files\7-Zip\7z.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	\??\c:\program files (x86)\microsoft office\office14\groove.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	mscorsvw.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	mscorsvw.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	mscorsvw.exe
File created	C:\Program Files\7-Zip\7zFM.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{5B888EF9-CCA9-4177-BA6F-9057CCB55948}.crmlog	dllhost.exe
File created	\??\c:\windows\servicing\trustedinstaller.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF613.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP4F1B.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.vir	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index142.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPC41.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat	mscorsvw.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	mscorsvw.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe
520	mscorsvw.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1760	9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
Token: SeShutdownPrivilege	1716	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	1716	mscorsvw.exe
Token: SeShutdownPrivilege	1716	mscorsvw.exe
Token: SeShutdownPrivilege	1716	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeManageVolumePrivilege	1196	DllHost.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	1956	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe
Token: SeShutdownPrivilege	520	mscorsvw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1568	520	mscorsvw.exe	33
PID 520 wrote to memory of 1568	520	mscorsvw.exe	33
PID 520 wrote to memory of 1568	520	mscorsvw.exe	33
PID 520 wrote to memory of 1960	520	mscorsvw.exe	34
PID 520 wrote to memory of 1960	520	mscorsvw.exe	34
PID 520 wrote to memory of 1960	520	mscorsvw.exe	34
PID 520 wrote to memory of 1644	520	mscorsvw.exe	37
PID 520 wrote to memory of 1644	520	mscorsvw.exe	37
PID 520 wrote to memory of 1644	520	mscorsvw.exe	37
PID 520 wrote to memory of 1964	520	mscorsvw.exe	38
PID 520 wrote to memory of 1964	520	mscorsvw.exe	38
PID 520 wrote to memory of 1964	520	mscorsvw.exe	38
PID 520 wrote to memory of 960	520	mscorsvw.exe	39
PID 520 wrote to memory of 960	520	mscorsvw.exe	39
PID 520 wrote to memory of 960	520	mscorsvw.exe	39
PID 520 wrote to memory of 1000	520	mscorsvw.exe	40
PID 520 wrote to memory of 1000	520	mscorsvw.exe	40
PID 520 wrote to memory of 1000	520	mscorsvw.exe	40
PID 520 wrote to memory of 664	520	mscorsvw.exe	41
PID 520 wrote to memory of 664	520	mscorsvw.exe	41
PID 520 wrote to memory of 664	520	mscorsvw.exe	41
PID 520 wrote to memory of 1604	520	mscorsvw.exe	42
PID 520 wrote to memory of 1604	520	mscorsvw.exe	42
PID 520 wrote to memory of 1604	520	mscorsvw.exe	42
PID 520 wrote to memory of 1376	520	mscorsvw.exe	43
PID 520 wrote to memory of 1376	520	mscorsvw.exe	43
PID 520 wrote to memory of 1376	520	mscorsvw.exe	43
PID 520 wrote to memory of 580	520	mscorsvw.exe	44
PID 520 wrote to memory of 580	520	mscorsvw.exe	44
PID 520 wrote to memory of 580	520	mscorsvw.exe	44
PID 520 wrote to memory of 528	520	mscorsvw.exe	45
PID 520 wrote to memory of 528	520	mscorsvw.exe	45
PID 520 wrote to memory of 528	520	mscorsvw.exe	45
PID 520 wrote to memory of 1848	520	mscorsvw.exe	46
PID 520 wrote to memory of 1848	520	mscorsvw.exe	46
PID 520 wrote to memory of 1848	520	mscorsvw.exe	46
PID 520 wrote to memory of 1264	520	mscorsvw.exe	47
PID 520 wrote to memory of 1264	520	mscorsvw.exe	47
PID 520 wrote to memory of 1264	520	mscorsvw.exe	47
PID 520 wrote to memory of 1356	520	mscorsvw.exe	48
PID 520 wrote to memory of 1356	520	mscorsvw.exe	48
PID 520 wrote to memory of 1356	520	mscorsvw.exe	48
PID 520 wrote to memory of 1744	520	mscorsvw.exe	49
PID 520 wrote to memory of 1744	520	mscorsvw.exe	49
PID 520 wrote to memory of 1744	520	mscorsvw.exe	49
PID 520 wrote to memory of 980	520	mscorsvw.exe	50
PID 520 wrote to memory of 980	520	mscorsvw.exe	50
PID 520 wrote to memory of 980	520	mscorsvw.exe	50
PID 520 wrote to memory of 1776	520	mscorsvw.exe	51
PID 520 wrote to memory of 1776	520	mscorsvw.exe	51
PID 520 wrote to memory of 1776	520	mscorsvw.exe	51
PID 520 wrote to memory of 268	520	mscorsvw.exe	52
PID 520 wrote to memory of 268	520	mscorsvw.exe	52
PID 520 wrote to memory of 268	520	mscorsvw.exe	52
PID 520 wrote to memory of 1412	520	mscorsvw.exe	53
PID 520 wrote to memory of 1412	520	mscorsvw.exe	53
PID 520 wrote to memory of 1412	520	mscorsvw.exe	53
PID 520 wrote to memory of 1604	520	mscorsvw.exe	54
PID 520 wrote to memory of 1604	520	mscorsvw.exe	54
PID 520 wrote to memory of 1604	520	mscorsvw.exe	54
PID 520 wrote to memory of 1932	520	mscorsvw.exe	55
PID 520 wrote to memory of 1932	520	mscorsvw.exe	55
PID 520 wrote to memory of 1932	520	mscorsvw.exe	55
PID 520 wrote to memory of 2032	520	mscorsvw.exe	56

C:\Users\Admin\AppData\Local\Temp\9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe
"C:\Users\Admin\AppData\Local\Temp\9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 194 -NGENProcess 198 -Pipe 1a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a0 -InterruptEvent 214 -NGENProcess 21c -Pipe 220 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 224 -NGENProcess 198 -Pipe 1fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 25c -NGENProcess 230 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 224 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 198 -NGENProcess 26c -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 24c -NGENProcess 1a8 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 230 -NGENProcess 250 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1376
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 198 -NGENProcess 268 -Pipe 230 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 198 -InterruptEvent 278 -NGENProcess 224 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 270 -NGENProcess 280 -Pipe 198 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 228 -NGENProcess 224 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 224 -NGENProcess 27c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 288 -NGENProcess 280 -Pipe 1c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 228 -NGENProcess 290 -Pipe 1cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 1a8 -NGENProcess 280 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 284 -NGENProcess 280 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 268 -NGENProcess 298 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 284 -NGENProcess 1a8 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 27c -NGENProcess 29c -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 268 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a8 -NGENProcess 1a8 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 1a8 -NGENProcess 27c -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a8 -InterruptEvent 2b0 -NGENProcess 268 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 268 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 2b8 -NGENProcess 27c -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 27c -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2a0 -NGENProcess 2c4 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1496

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1432

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
648KB

MD5
c3f88b2cff49477808632e7b80e2a6e0

SHA1
49d4e2f62589746a436580f5643691fac640c2f0

SHA256
91de37059bef2e35edd0a25866d980cba9e1fc8fdf6cdd1b3ad44371eeea16ed

SHA512
ae88dd94c22cff47d371b4318bd3bbe7f3ffd9217f78841a818100d1816acb96db86ece58c163fbde1899f7f809ced5a0154129d490fc1b07d900236a36c7717

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

Filesize
1.5MB

MD5
03d097155a75060f1053f0eb1f99b9db

SHA1
cf95e5ad405566cc6b496146b598b96cec559508

SHA256
809b78533497c28eefbf47a790b3bd2269963c3d3a8ef2212dca3379542cc044

SHA512
1bdd87fbe4e536d8a4c5f277e64989789200146e5dd10f6551076ba5f6c8853255f4ebab3c053c13829fcfdf41b148615c6b74f289ffa08027f31fe48cc0714d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
590KB

MD5
38dd30eaeeaada55cfa9339794292061

SHA1
72ca2d379fea5493dd73e88c7e26f6888794804a

SHA256
6e82781b99ef690b6a06ecde01b1f1f9c26da9c102b18641f55731c1296a1c78

SHA512
4517d624802863eecd67fb9114bdf9dbda210430b8e4b6f85b95730d93bbce5a7de31fe2aa1315ad87e18b6c08aa7ec9df48928719ed6fd86f85069540e1550d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
590KB

MD5
38dd30eaeeaada55cfa9339794292061

SHA1
72ca2d379fea5493dd73e88c7e26f6888794804a

SHA256
6e82781b99ef690b6a06ecde01b1f1f9c26da9c102b18641f55731c1296a1c78

SHA512
4517d624802863eecd67fb9114bdf9dbda210430b8e4b6f85b95730d93bbce5a7de31fe2aa1315ad87e18b6c08aa7ec9df48928719ed6fd86f85069540e1550d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
567KB

MD5
d2f82da5ab432ff7097ad6c14033615f

SHA1
0666d39faf94b1904da744e9f10359c7eb8dccd0

SHA256
6058179f2070f5b5ab26eb3fd04f1fd583a71be93e6d532f5a8aa11cf439b3b6

SHA512
7dccc07ecb11d614a113d70cb372446cf4bec4d26036dc25b12448653f3100e8945c5bce5f0cc1f6a28505819e1cb40f5b8a1edd754e790878a371e08b0954ea

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
567KB

MD5
d2f82da5ab432ff7097ad6c14033615f

SHA1
0666d39faf94b1904da744e9f10359c7eb8dccd0

SHA256
6058179f2070f5b5ab26eb3fd04f1fd583a71be93e6d532f5a8aa11cf439b3b6

SHA512
7dccc07ecb11d614a113d70cb372446cf4bec4d26036dc25b12448653f3100e8945c5bce5f0cc1f6a28505819e1cb40f5b8a1edd754e790878a371e08b0954ea

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
598KB

MD5
c438c4cadd2fb662b5d01b4ef68bc7d8

SHA1
c69fe763b7772ee527fd50e75cb2d05da11f0db7

SHA256
c1d2dee3c0cdd2ed231c1188661df0cc8d8735817e3da2d648cb00edcfaef307

SHA512
5a408f83840544ac468f03e196057976fcfe7beac38de8cf6b7d4de320de8c3a7f8ed91faa4ffc63e6cb53742273eede7fb37294fb978b9f8aae4a6068c3fb10

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
598KB

MD5
c438c4cadd2fb662b5d01b4ef68bc7d8

SHA1
c69fe763b7772ee527fd50e75cb2d05da11f0db7

SHA256
c1d2dee3c0cdd2ed231c1188661df0cc8d8735817e3da2d648cb00edcfaef307

SHA512
5a408f83840544ac468f03e196057976fcfe7beac38de8cf6b7d4de320de8c3a7f8ed91faa4ffc63e6cb53742273eede7fb37294fb978b9f8aae4a6068c3fb10

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
517KB

MD5
232133b22642aa11961daf5c0f304aa1

SHA1
8ee6a8e5ec411d0680ea06d958e0061ddf5c62a4

SHA256
d963bcc7bad9b03984b50077d641e215038a1c15433823781eab7b6f1e6720b2

SHA512
76a3cf538a284177bce77d9db43cd39514fad73537ca68e1db4720471879e46f22ba515d7a4207bb27eb26489d692422c3bfc09863a88726fe4d7f7f329bb3d3

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
517KB

MD5
232133b22642aa11961daf5c0f304aa1

SHA1
8ee6a8e5ec411d0680ea06d958e0061ddf5c62a4

SHA256
d963bcc7bad9b03984b50077d641e215038a1c15433823781eab7b6f1e6720b2

SHA512
76a3cf538a284177bce77d9db43cd39514fad73537ca68e1db4720471879e46f22ba515d7a4207bb27eb26489d692422c3bfc09863a88726fe4d7f7f329bb3d3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
648KB

MD5
e74d30ecbdfecf9a0c7fe040a5f50423

SHA1
4cbd312739893a910e73e946d90075c1e7e69bec

SHA256
0bf12b6a24b12165bef2575a21005489ad340bd6b0f5c81556e430dc913b138c

SHA512
3d79e1fc2ea5c71d938c14274d2bc54b7e8071fbe9cd1cae47359cbab42824a82d128ac31c5852c3d50b40e1f2bbe3f455aae3b2e5906625540aa9e982a74f72

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.0MB

MD5
9b0fed87d1b43e502d5e01a29538a88d

SHA1
77aeb014b22e56c618470d2d0cc7d256fe63cf07

SHA256
e7c344db0c0396be303d6a8bf4e153f15dede9693286cad7a6a8131f3a5b6eac

SHA512
76bea4e055dd54312ba8bd4c243843b2261f5c6b9490c9d17edf77804ad7b530c6ded7ca8d8f55fc835d5a71ac4a545e764f313aac9906db145a619e39a86107

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
738KB

MD5
3848def7cb58c2bdf9982fd72838e0a0

SHA1
0dce261489b78e8b71b90343fac88cf21c037ce5

SHA256
c99130b043b949bacbe6c3c0f824c20b04936cdf92f8f90e4aaf13d61fa7af48

SHA512
b7ad02c9e9d74bccd966847d6b5ab6a49461fc0a0a9f5b7a698661ff66948dd2d1d305aa93d5ff2370f457f687ed89cdfef54b9adb7bcc4750a8f60ab29541e7

Download Submit
\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe

Filesize
5.2MB

MD5
bfcf2ceeb0c73e1a5f827677e9909f21

SHA1
062fb5c86d78889fa522c6fff7533f3db24a325d

SHA256
898e647317e47b347deabd96177b68a414faf0970a0226e374f64fde8ef0c177

SHA512
69963cfa5351cdfaeb85f86bb5f838b81ffbebcb5983c1b4a72e8c0c1c18efd2120a5db26f3dd48ed91d4211686ed89693cfa6a76cc0ef89d0605c82715b5fba

Download Submit
\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
1.9MB

MD5
58b93b7562ebf61ffebc34e5bfa56303

SHA1
4ff5c51cb32a998bc6746bfffdd230d2e4e8bcc1

SHA256
04b2cecded9a2d4c6a6f30bee3752f3e5ce3effe78d2753ed2f1794226e1514f

SHA512
b268e438227c3effb68be46611d85329d80aad7b1ed2e4d385af618463c021913e46b6f6af2493a55c54d220f61e89d40a1d9ee3717e139202835a0f7378d5af

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
632KB

MD5
c53180809f0780320bf1664696b540f5

SHA1
1ab1b194b5b26748c4dd7f765dad3b7785ce1e5f

SHA256
1f2efaf8e7a56b1a467ed253d5cd7366dcda45141ed7d5d46206c40d10efdbff

SHA512
a0a645178a10ba04d024bbfebd0780d63a14b8a343dd1ab1f5dc01d81ed8a7ccc0110782a425766a5db7069c5051362242ad99927d218b8877aeef940478550b

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
544KB

MD5
7b44d032eda1bac3ac3367f04f1eae6c

SHA1
bb6e5f4bb96c948de718cec2bb6b6a074ff7dc37

SHA256
c6ba0a76530386c6e2e80746547d0797e3e00a91fefe4f5716da4a576eae358a

SHA512
fe09de6677f270d1f039c8acd17a34dea0ce4511a5bb2234c0246f6dcb0687a692cdb3d311c32d4020f33e1356cf06c23b8bf7e9a3770d3ec816198e1d985555

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
585KB

MD5
13962bf5a65655a7617802dac5df20c7

SHA1
c65a5bce4a72ddab7e24274fb692c047c1217ba9

SHA256
c83af320577672d7b0791d0294e3352a1892287ea8815d44717b3a58b62a4b1c

SHA512
8d122d50c7f23b442c52885026dd0c582283a5d6242bd175f5f2d250f7635c3f62cd965ce57d3d04a64cb31a07c04c8e33b45fb378b9fe7b5178a08ebebaeeba

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.2MB

MD5
152332fc89e7ce026b2ff820b7f2cc64

SHA1
cd5502e8d66834c41e85a7859defc13d1a660175

SHA256
3404174b52b28c6fb5a9ac58a5b0df31dc686b18571c0a0a00d4e530a8dd13cf

SHA512
ffdeb786b258f29311ed0d038a4fae840eecc7d76df591b14dd8256024c2357ab7b46b65f6f9312173c190eebb3c9e89331c22f6bca9ed80f886ad9c715d8294

Download Submit
\??\c:\windows\system32\ieetwcollector.exe

Filesize
617KB

MD5
ca555bb04334dd0465598d1baa3ed134

SHA1
85da0c8bc9836f3c692b178a42f5433f5cfa22ec

SHA256
fb21f830f172cca2d9cc0fef9cdbf6229165b7411ea8f96000cfe2614198c83f

SHA512
852658fe2f1024986a24108f6b5259d7c2510a06b5f686b2026abd6bd3f935bc3a037569d620e95124125be7902e52558681d047f1e32656acdf0b2f1589bd7c

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
646KB

MD5
7009ac86c2d870c654db7c918fc83ab0

SHA1
afe9599fb8ff96029225f5a07cf040710ca5d5df

SHA256
8dd9ecfffa28727d052d12c9cad924a619537ff4d7a81784c53872f84c92e669

SHA512
6eb3046e9bc2e79f7e72388406f4ff6a112883b71725a3c65c21853103af4f45dd561203fe53a1f952aa3f2bf2b70e152dfc3ede30424f48ab13bf887ec301eb

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
633KB

MD5
7902f34d9f7e27e174407ea73834f133

SHA1
6cecc5b1dfa7a4bd4909227ab1d55a12f714024d

SHA256
1fa268b577bf94698e9112bf1235df6593e183ad6d2151314b38e749bfa5ec63

SHA512
56e3d158bc61df819d2c2592a38163138cf77d7ae637cdd28d3b891304f5e7730a4edf83828959b3a7b44d8f88a5d3760b604d6d52aa55aaf6b5621a7354b374

Download Submit
\??\c:\windows\system32\snmptrap.exe

Filesize
522KB

MD5
b3be26ccd98253392fbbf0c884f22467

SHA1
f9460ed52ae9f53e91ef1f069437bf8b8d2b38d0

SHA256
95ed0b547d442e55dcf75283bc1206ec1f454fc3038d63982f0430c84749859d

SHA512
9b44bde1a7421f7c82700b661affd729795156f6da1de24a57bd3213ebdfe0bce413c35e13fe1484f0499721c97d7d8d1a53c42665be90ff4faf1cd29abcc2ff

Download Submit
\??\c:\windows\system32\ui0detect.exe

Filesize
548KB

MD5
407d40dc3e9434f70e1b886f57a8e51e

SHA1
be6e94d12f8e4f3863c2146356890f4759d85ebf

SHA256
4d70a2ffcddea429c47bb8c39ffe07d4a87877179ad1de312d7fdb61ca5f9f58

SHA512
a326103640a9b6a694264c7b57bc48aaa61cc3fb6e3cf883a6c07e80bfe08350f79f7d001ab4fa63d6eef61fa0c0e806ca5d4663e6719e109b0cc12e646d1ee6

Download Submit
\??\c:\windows\system32\vds.exe

Filesize
1.0MB

MD5
d3ce8329104de2a7e21b49cbba9ad2d8

SHA1
eb282e9165c04f76bdf4890da1acd8c1f3cbb661

SHA256
dc2860b190c16f7b9a57e59c71ed5cad28c0c409ec93a5cd82b0e715438be124

SHA512
aeb787ba490a20b5639094ca4e72635b8be37aee3c6a855d6c43fd71fbd54218587111dfe4e68da9adf70b851994e59a0818047997708201b43e73545bc255b8

Download Submit
\??\c:\windows\system32\vssvc.exe

Filesize
2.0MB

MD5
a33f2f27e28faa39762e123dffd5da60

SHA1
66c6195f68fcc50cbcd0e1124e99078b9b9ccdf5

SHA256
36bee84bcecc87c86160466b687f92114ccb7f246253feeef2955fa31c975039

SHA512
04a157f94d4b5176894b48f731147bd897eb2d7e52373c4ea2f312e540c781b653c7c551a3cf7a18c67f5492d0c07ea9f78eff00c45295e0ea01469421946d0b

Download Submit
\??\c:\windows\system32\wbem\wmiApsrv.exe

Filesize
706KB

MD5
7160c9d081df19f91b7fdc00fc0b988c

SHA1
75679d09b40509c288afa251a7571361b5a2044b

SHA256
5bd3d075fdfa730baaca3cdcd22c60f89e74bc141ba430807b8d0291e637954d

SHA512
c0311d957323a3c2dd4cc19ef42bdd5cefadfb8c3f7a34c6f1609ccce3e1863a1a373e18a9d0a87624ef14d496c5448042e073c328cdd3d1004fd4b020b885cc

Download Submit
\??\c:\windows\system32\wbengine.exe

Filesize
1.9MB

MD5
7799bc14d35fbf10ee5a814e2d4c4373

SHA1
a60eb7396dbe73b189c8c7262d3fa277182ae839

SHA256
488cf9321c5e11b643eadb4cb8b7fdff8db116544af37ce0e43039697bcf8740

SHA512
d6e2d78432fc89763a261e771b337aeb73f62595589f771fc0e7b083c6d98418a72ae7ec975b70b4a904b104ec42a7a8f029bdea63c498bf96b88bf730f0d113

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
590KB

MD5
38dd30eaeeaada55cfa9339794292061

SHA1
72ca2d379fea5493dd73e88c7e26f6888794804a

SHA256
6e82781b99ef690b6a06ecde01b1f1f9c26da9c102b18641f55731c1296a1c78

SHA512
4517d624802863eecd67fb9114bdf9dbda210430b8e4b6f85b95730d93bbce5a7de31fe2aa1315ad87e18b6c08aa7ec9df48928719ed6fd86f85069540e1550d

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
590KB

MD5
38dd30eaeeaada55cfa9339794292061

SHA1
72ca2d379fea5493dd73e88c7e26f6888794804a

SHA256
6e82781b99ef690b6a06ecde01b1f1f9c26da9c102b18641f55731c1296a1c78

SHA512
4517d624802863eecd67fb9114bdf9dbda210430b8e4b6f85b95730d93bbce5a7de31fe2aa1315ad87e18b6c08aa7ec9df48928719ed6fd86f85069540e1550d

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
618KB

MD5
ee54d6f34759499aa66fe9643cadcb4a

SHA1
db43e9cc4b0c07fe9265cc4d941f60936d0ab9e1

SHA256
904069b8a45419c1447a38e4687e68ad6bfe8ccb634c870bec3e1e17842f7f0b

SHA512
9c501d036dd34ab3fff6326edfda7f0cf2ecad867f29075d397177039f563610cc8cd302a5d93c16a70ea86f5fab6c29412713c6bad83c240c20bbc0b83f9237

Download Submit
\Windows\System32\dllhost.exe

Filesize
517KB

MD5
232133b22642aa11961daf5c0f304aa1

SHA1
8ee6a8e5ec411d0680ea06d958e0061ddf5c62a4

SHA256
d963bcc7bad9b03984b50077d641e215038a1c15433823781eab7b6f1e6720b2

SHA512
76a3cf538a284177bce77d9db43cd39514fad73537ca68e1db4720471879e46f22ba515d7a4207bb27eb26489d692422c3bfc09863a88726fe4d7f7f329bb3d3

Download Submit
\Windows\System32\dllhost.exe

Filesize
517KB

MD5
232133b22642aa11961daf5c0f304aa1

SHA1
8ee6a8e5ec411d0680ea06d958e0061ddf5c62a4

SHA256
d963bcc7bad9b03984b50077d641e215038a1c15433823781eab7b6f1e6720b2

SHA512
76a3cf538a284177bce77d9db43cd39514fad73537ca68e1db4720471879e46f22ba515d7a4207bb27eb26489d692422c3bfc09863a88726fe4d7f7f329bb3d3

Download Submit
\Windows\System32\dllhost.exe

Filesize
517KB

MD5
232133b22642aa11961daf5c0f304aa1

SHA1
8ee6a8e5ec411d0680ea06d958e0061ddf5c62a4

SHA256
d963bcc7bad9b03984b50077d641e215038a1c15433823781eab7b6f1e6720b2

SHA512
76a3cf538a284177bce77d9db43cd39514fad73537ca68e1db4720471879e46f22ba515d7a4207bb27eb26489d692422c3bfc09863a88726fe4d7f7f329bb3d3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1FA2.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP1FA2.tmp\Microsoft.Office.Tools.v9.0.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP38B.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP38B.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPC41.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPC41.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE12C.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE12C.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF613.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF613.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
memory/268-214-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/268-212-0x000007FEF3050000-0x000007FEF3A73000-memory.dmp

Filesize
10.1MB

Download
memory/520-92-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/520-72-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/528-177-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/528-171-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/528-173-0x000007FEF3720000-0x000007FEF4143000-memory.dmp

Filesize
10.1MB

Download
memory/548-237-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/560-238-0x000007FEEE830000-0x000007FEEF253000-memory.dmp

Filesize
10.1MB

Download
memory/560-239-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/560-241-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/580-167-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/580-168-0x000007FEEE830000-0x000007FEEF253000-memory.dmp

Filesize
10.1MB

Download
memory/580-172-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/664-145-0x000007FEF3050000-0x000007FEF3A73000-memory.dmp

Filesize
10.1MB

Download
memory/664-146-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/664-150-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/676-65-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/676-63-0x0000000010000000-0x00000000101DB000-memory.dmp

Filesize
1.9MB

Download
memory/940-226-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/940-228-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/960-139-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/960-134-0x000007FEF2840000-0x000007FEF3263000-memory.dmp

Filesize
10.1MB

Download
memory/960-232-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/960-135-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/980-208-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/980-203-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/980-230-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/980-204-0x000007FEF2840000-0x000007FEF3263000-memory.dmp

Filesize
10.1MB

Download
memory/1000-144-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1000-141-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1000-140-0x000007FEEE830000-0x000007FEEF253000-memory.dmp

Filesize
10.1MB

Download
memory/1196-59-0x0000000010000000-0x00000000101A9000-memory.dmp

Filesize
1.7MB

Download
memory/1196-125-0x0000000100000000-0x00000001001C9000-memory.dmp

Filesize
1.8MB

Download
memory/1196-109-0x0000000100000000-0x00000001001C9000-memory.dmp

Filesize
1.8MB

Download
memory/1196-122-0x0000000004350000-0x0000000004358000-memory.dmp

Filesize
32KB

Download
memory/1196-57-0x0000000010000000-0x00000000101A9000-memory.dmp

Filesize
1.7MB

Download
memory/1196-110-0x0000000002D30000-0x0000000002D40000-memory.dmp

Filesize
64KB

Download
memory/1196-116-0x0000000003230000-0x0000000003240000-memory.dmp

Filesize
64KB

Download
memory/1264-184-0x000007FEF2840000-0x000007FEF3263000-memory.dmp

Filesize
10.1MB

Download
memory/1264-188-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1356-192-0x000007FEEE1C0000-0x000007FEEF256000-memory.dmp

Filesize
16.6MB

Download
memory/1356-190-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1356-191-0x000007FEF3050000-0x000007FEF3A73000-memory.dmp

Filesize
10.1MB

Download
memory/1356-197-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1376-165-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1376-161-0x000000001CAC0000-0x000000001CDBF000-memory.dmp

Filesize
3.0MB

Download
memory/1412-218-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1412-216-0x000007FEF2840000-0x000007FEF3263000-memory.dmp

Filesize
10.1MB

Download
memory/1412-215-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1432-77-0x0000000100000000-0x00000001001C9000-memory.dmp

Filesize
1.8MB

Download
memory/1432-93-0x0000000100000000-0x00000001001C9000-memory.dmp

Filesize
1.8MB

Download
memory/1496-243-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1568-82-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1568-87-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1604-155-0x000007FEEE1C0000-0x000007FEEF256000-memory.dmp

Filesize
16.6MB

Download
memory/1604-221-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1604-219-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1604-153-0x000007FEF2840000-0x000007FEF3263000-memory.dmp

Filesize
10.1MB

Download
memory/1604-154-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1604-159-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1604-156-0x000000001CAE0000-0x000000001CDDF000-memory.dmp

Filesize
3.0MB

Download
memory/1644-129-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1716-68-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/1716-78-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/1744-195-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1744-196-0x000007FEF2620000-0x000007FEF3043000-memory.dmp

Filesize
10.1MB

Download
memory/1744-200-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1760-54-0x000000004AD00000-0x000000004AEF9000-memory.dmp

Filesize
2.0MB

Download
memory/1760-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1760-71-0x000000004AD00000-0x000000004AEF9000-memory.dmp

Filesize
2.0MB

Download
memory/1776-207-0x000007FEEE830000-0x000007FEEF253000-memory.dmp

Filesize
10.1MB

Download
memory/1776-209-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1776-211-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1848-183-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1848-235-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1848-233-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1848-179-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1932-223-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1956-242-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/1960-86-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1960-88-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1964-136-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/1964-131-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download
memory/2032-225-0x0000000140000000-0x00000001401E2000-memory.dmp

Filesize
1.9MB

Download