ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b

Analysis

max time kernel
150s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
Size

736KB
MD5

84a20e79c3b5c5de1a34e153dad359fe
SHA1

56aedb1d58fabe505891fb93c351bd35de4c8644
SHA256

ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b
SHA512

de7de2cd9bcf19dfac6072be03b69ebb9627d2aa61e9e63412a9333d0addd5363fd4b525575111429cc9a5b39ad9a3399d94708c8f74d48562d0b19d6452a865
SSDEEP

6144:ijTwjof6xvJQrQMoahlJeHrs4aIEVkONMDjNbAN2MpOXR0y0XU2xTA7Da0O85wID:f4iWQMDHeHrnQNpS0ykKyIEAcIZJ

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
1136	mscorsvw.exe
464	Process not Found
1308	mscorsvw.exe
1740	mscorsvw.exe
1700	mscorsvw.exe
620	dllhost.exe
808	mscorsvw.exe
472	elevation_service.exe
1092	mscorsvw.exe
2008	mscorsvw.exe
2024	mscorsvw.exe
1500	mscorsvw.exe
344	mscorsvw.exe

Loads dropped DLL 5 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000\EnableNotifications = "0"	dllhost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	dllhost.exe
File opened (read-only)	\??\W:	dllhost.exe
File opened (read-only)	\??\Z:	dllhost.exe
File opened (read-only)	\??\F:	dllhost.exe
File opened (read-only)	\??\H:	dllhost.exe
File opened (read-only)	\??\Q:	dllhost.exe
File opened (read-only)	\??\R:	dllhost.exe
File opened (read-only)	\??\Y:	dllhost.exe
File opened (read-only)	\??\E:	dllhost.exe
File opened (read-only)	\??\M:	dllhost.exe
File opened (read-only)	\??\N:	dllhost.exe
File opened (read-only)	\??\P:	dllhost.exe
File opened (read-only)	\??\U:	dllhost.exe
File opened (read-only)	\??\V:	dllhost.exe
File opened (read-only)	\??\X:	dllhost.exe
File opened (read-only)	\??\I:	dllhost.exe
File opened (read-only)	\??\J:	dllhost.exe
File opened (read-only)	\??\O:	dllhost.exe
File opened (read-only)	\??\T:	dllhost.exe
File opened (read-only)	\??\G:	dllhost.exe
File opened (read-only)	\??\K:	dllhost.exe
File opened (read-only)	\??\L:	dllhost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system32\msdtc.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\msdtc.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\SysWOW64\dllhost.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\ieetwcollector.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\alg.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	dllhost.exe
File created	\??\c:\windows\system32\wbem\wmiApsrv.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\fxssvc.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\locator.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	dllhost.exe
File created	\??\c:\windows\SysWOW64\searchindexer.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\vds.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\alg.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\ieetwcollector.exe	dllhost.exe
File created	\??\c:\windows\system32\snmptrap.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\ui0detect.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\SysWOW64\svchost.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\dllhost.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	dllhost.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\msiexec.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\vssvc.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\alg.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\ui0detect.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\system32\wbengine.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	dllhost.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\vds.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	dllhost.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\locator.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	dllhost.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	dllhost.exe
File created	\??\c:\windows\system32\vds.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\program files (x86)\microsoft office\office14\groove.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	dllhost.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	dllhost.exe
File created	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe	dllhost.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	dllhost.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\program files (x86)\microsoft office\office14\groove.exe	dllhost.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Program Files\Internet Explorer\iexplore.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	dllhost.exe
File opened for modification	\??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	dllhost.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	dllhost.exe
File created	\??\c:\windows\servicing\trustedinstaller.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	dllhost.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	\??\c:\windows\ehome\ehsched.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A17C7EED-944E-4517-88EB-9122572D812B}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	dllhost.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	dllhost.exe
File created	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A17C7EED-944E-4517-88EB-9122572D812B}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.vir	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	dllhost.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat	mscorsvw.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
620	dllhost.exe
620	dllhost.exe
620	dllhost.exe
620	dllhost.exe
620	dllhost.exe
620	dllhost.exe
620	dllhost.exe
620	dllhost.exe
620	dllhost.exe
620	dllhost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1900	ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeTakeOwnershipPrivilege	620	dllhost.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe
Token: SeShutdownPrivilege	1700	mscorsvw.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 808	1700	mscorsvw.exe	32
PID 1700 wrote to memory of 808	1700	mscorsvw.exe	32
PID 1700 wrote to memory of 808	1700	mscorsvw.exe	32
PID 1700 wrote to memory of 1092	1700	mscorsvw.exe	34
PID 1700 wrote to memory of 1092	1700	mscorsvw.exe	34
PID 1700 wrote to memory of 1092	1700	mscorsvw.exe	34
PID 1700 wrote to memory of 2008	1700	mscorsvw.exe	35
PID 1700 wrote to memory of 2008	1700	mscorsvw.exe	35
PID 1700 wrote to memory of 2008	1700	mscorsvw.exe	35
PID 1700 wrote to memory of 2024	1700	mscorsvw.exe	36
PID 1700 wrote to memory of 2024	1700	mscorsvw.exe	36
PID 1700 wrote to memory of 2024	1700	mscorsvw.exe	36
PID 1700 wrote to memory of 1500	1700	mscorsvw.exe	37
PID 1700 wrote to memory of 1500	1700	mscorsvw.exe	37
PID 1700 wrote to memory of 1500	1700	mscorsvw.exe	37
PID 1700 wrote to memory of 344	1700	mscorsvw.exe	38
PID 1700 wrote to memory of 344	1700	mscorsvw.exe	38
PID 1700 wrote to memory of 344	1700	mscorsvw.exe	38

C:\Users\Admin\AppData\Local\Temp\ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe
"C:\Users\Admin\AppData\Local\Temp\ab70e546b889a419370ec1b128a278f89b610cff27360b2405dc900128e8ae0b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1136

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:1740

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent f4 -NGENProcess 19c -Pipe 1a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent f4 -NGENProcess 19c -Pipe 1ac -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1bc -NGENProcess 1f4 -Pipe 1b8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 214 -NGENProcess 190 -Pipe 208 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 230 -NGENProcess 19c -Pipe 1b4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 234 -NGENProcess 1f4 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:344

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
1.9MB

MD5
9539567199255df0b14d7a857d4edc3d

SHA1
93613ade8ac759a2a989fb6d17121abad782dbb2

SHA256
321931b07379c90a62d2b9a182814f89da7e4a72a6ec5781dbe405295b6f1e63

SHA512
97d69ba71eb053f65f82ec518901a8641a17e9a768244e9038f5e528b1c9ea87d3bfed1ac8cca7091c76cd3a09eecf90e6d451b81112477b66b9dab625b9c077

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
582KB

MD5
342d7243ba21604cbce8452761126c63

SHA1
5e0ab1e078ab5b99c0311f127af79b6f6bc7ad2b

SHA256
ebc00f0844d2454bb04db2977811c5d8a5d2e2cc225cbf4277161fef23c9c566

SHA512
0bcf42c02322da0ca75ae507325926f9be9b8071f7ddb8c51b894f8fabdca8ee92eb00316897a4f034ebe410c5bbb15b199b9ea2c91c5eec1d1dd389d2f8fe61

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
582KB

MD5
342d7243ba21604cbce8452761126c63

SHA1
5e0ab1e078ab5b99c0311f127af79b6f6bc7ad2b

SHA256
ebc00f0844d2454bb04db2977811c5d8a5d2e2cc225cbf4277161fef23c9c566

SHA512
0bcf42c02322da0ca75ae507325926f9be9b8071f7ddb8c51b894f8fabdca8ee92eb00316897a4f034ebe410c5bbb15b199b9ea2c91c5eec1d1dd389d2f8fe61

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
559KB

MD5
05099f14e95680856686f23db41278b4

SHA1
ec1e3431af7214472c0b76d3dd825a5a37c28ab5

SHA256
8d24ea3c9504f75931efd326f624bf99b1ba72778025da4f13f9bf70c017bf1f

SHA512
9031729d06b77f44d7de18d939af3cdc9e840f099aa367ca780dc5d0cc05241456097f463cc7ecc5e4a206b1ab91292b99af96bbd9f5c8c3f24e402c7e79502f

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
559KB

MD5
05099f14e95680856686f23db41278b4

SHA1
ec1e3431af7214472c0b76d3dd825a5a37c28ab5

SHA256
8d24ea3c9504f75931efd326f624bf99b1ba72778025da4f13f9bf70c017bf1f

SHA512
9031729d06b77f44d7de18d939af3cdc9e840f099aa367ca780dc5d0cc05241456097f463cc7ecc5e4a206b1ab91292b99af96bbd9f5c8c3f24e402c7e79502f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
590KB

MD5
e6d33d3b7292aae8b51192a0464f48f2

SHA1
4fb4083093b199dddb984b3c8d1197e2d2f0bd6b

SHA256
a8391dd69ccbdb7f65bdd2c08fb0b381688fb98a63aae869eb36173ff6b0ec11

SHA512
7327ad2b846185e42daf66f84c269d0b06a6100ebfe91b767d19f3681c3d57bfc1e74d0b4b0e4abd3ce14da4cb3c32fb8665bf37e287b7a800d23cdb6a74a431

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
509KB

MD5
833cf361d1bcbbdf41f7d23c718a4a15

SHA1
46327764f2f15812d3c41d397ef9645b2d6a5f85

SHA256
016091cc0219f0f4e2b35a443d0e01950ef43cc14b9abf3364f438a041a1d5e1

SHA512
1768f91ae088acb56ec766672b653c5758be7743db027bd7039a4524f999d437332e148e0d75ad157f08eaeb662f4e9d3c0e2ffea38dc8398647e6c8ad33f2c2

Download Submit
\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe

Filesize
640KB

MD5
ae5ffa95061f4b37c5c468d1aad5d8e1

SHA1
d56b67576b3e26705d065b26bb68e8bb16f23758

SHA256
85297a75f1409bacfa36d85ceb6fc87800fa3c97abebb013edf3b2e3a3eed0de

SHA512
bfc313e44fec5c4bb5ffcd50035f08debaf1fe34b6b65bbfe17a13fcf46ea3e927541fc9b86d4ef45fd3cf99e6f4fd4e792f836517292dd9e5bffeab6c2c377a

Download Submit
\??\c:\program files (x86)\microsoft office\office14\groove.exe

Filesize
30.0MB

MD5
8069a7e2e204dd396588897fccb2c685

SHA1
cdaf34a57a72a918878d9a967f4969a3570f7a10

SHA256
a6117ac51e9fd2ae893f43a4191cbd9f9d9ec162be109f0020d3832864ad113e

SHA512
a955ad425cc604dc6a81929e6aa841335a71f25e332ce93a4b3e7ebc89a1c749963075f51c6411d819d6324ad9b6e6b14623b99354443b91e713a4ad6a15381b

Download Submit
\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe

Filesize
730KB

MD5
d89656bf0645d1d1201c59af678b5be5

SHA1
b4427d4f902d6c4f44bfe532c0ebccf99c2dde9b

SHA256
a18b6a0b9923585f9ff6fdebb0d71480595d6bcde914d0d77e37099f66dd5b97

SHA512
be9998a258484356b4506dbe11e46c708f745cfddeb92c317438634df48ef96c50d4779045ef83728c52b883592c5710d09fcbb6cb1eac6b75762a65cbeae0af

Download Submit
\??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
1.9MB

MD5
9539567199255df0b14d7a857d4edc3d

SHA1
93613ade8ac759a2a989fb6d17121abad782dbb2

SHA256
321931b07379c90a62d2b9a182814f89da7e4a72a6ec5781dbe405295b6f1e63

SHA512
97d69ba71eb053f65f82ec518901a8641a17e9a768244e9038f5e528b1c9ea87d3bfed1ac8cca7091c76cd3a09eecf90e6d451b81112477b66b9dab625b9c077

Download Submit
\??\c:\windows\ehome\ehsched.exe

Filesize
624KB

MD5
b260c7d8324e0391e614e6832cd72022

SHA1
0558704afd0b1968a0262e427e12c74928682c76

SHA256
dcbe7bde286cc95de11f6b546c4113da97d074f4eb6b9444bf02ef3a9881ade8

SHA512
efb6d466cde03fd5c411b476a752d4bf0fceb2a0eed3f148328141f6c4d2cfdf173cfc12c1d65007927c3eae1064a01fbead146adb068dd75d5376c1785076ac

Download Submit
\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe

Filesize
536KB

MD5
05e4ce36a35b92d4d82b4bbb3c8b0fef

SHA1
2ada4a620838922ec8e0fa2fbf62c4947ee51050

SHA256
9fbbe2c28f5a78c53ad42fe6ae0cee5f14b12717af9211b719b4c68230ab552f

SHA512
c823994aaaca155087c53f7bce296be32b8a54eeee8183991f88f983e0ebf5c88cbc3b85ea4da8a7110519870f2e9abc4b8359e38e8fde215601cf57f7751e67

Download Submit
\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe

Filesize
590KB

MD5
e6d33d3b7292aae8b51192a0464f48f2

SHA1
4fb4083093b199dddb984b3c8d1197e2d2f0bd6b

SHA256
a8391dd69ccbdb7f65bdd2c08fb0b381688fb98a63aae869eb36173ff6b0ec11

SHA512
7327ad2b846185e42daf66f84c269d0b06a6100ebfe91b767d19f3681c3d57bfc1e74d0b4b0e4abd3ce14da4cb3c32fb8665bf37e287b7a800d23cdb6a74a431

Download Submit
\??\c:\windows\system32\alg.exe

Filesize
577KB

MD5
25a1bf054a51448495911bb1ca7b1eeb

SHA1
4fe3ccb158de91a66b71bd0498af79f7783d6fe1

SHA256
ade3353846b991251ef337c9cf2269637a0748d0826e0c22d452626373312b23

SHA512
a6780f9997e9d4c2e858d179951940d43284c67fd21fafe4895b8c5f7105bd5b62766fdab41d69511cd3dd3138cd04080e0d52a239d01cd29cf412dc5aa4fca1

Download Submit
\??\c:\windows\system32\fxssvc.exe

Filesize
1.1MB

MD5
8a5aaf04fb3c97b939789cf02b18d3a5

SHA1
e7eec9473d2834c43c7c06e8f15ea4170e334df3

SHA256
7658c708133bfc96a431c1573c11c0d557e0125b9d25fa0533573c22e803ffb7

SHA512
778fc4e474e462155e38176756786c50c5c8a23397037c8ead50f70ba6efb9a4c8bbdc23bb311c07c27c69bfd3dc3cf1982675d9895089eac15fbebb398f0521

Download Submit
\??\c:\windows\system32\ieetwcollector.exe

Filesize
609KB

MD5
91098820d8cda79c773370839a795c52

SHA1
6a771f12dd297ece4c512b80c6148e0b404eb09a

SHA256
c7b1232f47f607bd5efe38a4429b0000dbd6a0ca5989f8df7f8f1e2f2b6f1d56

SHA512
eb13f7fb5c784a3c9f1c8121b035ecc310874bf3e22d755168e8c323a4f493dbbe8ae3dbd39648ab0961be219fd32018ea658d05c19ad80be1b80cd8ad004889

Download Submit
\??\c:\windows\system32\msdtc.exe

Filesize
638KB

MD5
c8ad2f78a1f9c62d2b1855ed3e81467d

SHA1
c18309200e0b1e164e5c7251f7a1cf6738a248ca

SHA256
71f5cf8431cbd5705b4e5cc91bfb1ff8aab2f276302ed024e4873b62fb898141

SHA512
1556d128fa51cd67627b29cb9879e0ff99f0ee58e7e41f312be645c1e4d98b30f65811fb9ee2dc00eb1a9cc8bf8f9d5d493ac526e5573d5860ea624dd30cab61

Download Submit
\??\c:\windows\system32\msiexec.exe

Filesize
625KB

MD5
c9b6eed0c1d6555814a8a57e0dab40c3

SHA1
51f77c3d9c1e0a6cbe860d3d3b61452af5ac7c2e

SHA256
633874e118583e18663b958750cbdf908b9722adb368ab87bbf82297a9551ca5

SHA512
76fc4d8aee13a5d75acb8a425aa8ceae43667e46d59338f0e4bc750dd5b9eb5ea4c6c72e2f4a7d12637bf8a8e27ed10c9b2128e1c36f2f47aa357b39ce74c000

Download Submit
\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe

Filesize
1.9MB

MD5
9539567199255df0b14d7a857d4edc3d

SHA1
93613ade8ac759a2a989fb6d17121abad782dbb2

SHA256
321931b07379c90a62d2b9a182814f89da7e4a72a6ec5781dbe405295b6f1e63

SHA512
97d69ba71eb053f65f82ec518901a8641a17e9a768244e9038f5e528b1c9ea87d3bfed1ac8cca7091c76cd3a09eecf90e6d451b81112477b66b9dab625b9c077

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
582KB

MD5
342d7243ba21604cbce8452761126c63

SHA1
5e0ab1e078ab5b99c0311f127af79b6f6bc7ad2b

SHA256
ebc00f0844d2454bb04db2977811c5d8a5d2e2cc225cbf4277161fef23c9c566

SHA512
0bcf42c02322da0ca75ae507325926f9be9b8071f7ddb8c51b894f8fabdca8ee92eb00316897a4f034ebe410c5bbb15b199b9ea2c91c5eec1d1dd389d2f8fe61

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
582KB

MD5
342d7243ba21604cbce8452761126c63

SHA1
5e0ab1e078ab5b99c0311f127af79b6f6bc7ad2b

SHA256
ebc00f0844d2454bb04db2977811c5d8a5d2e2cc225cbf4277161fef23c9c566

SHA512
0bcf42c02322da0ca75ae507325926f9be9b8071f7ddb8c51b894f8fabdca8ee92eb00316897a4f034ebe410c5bbb15b199b9ea2c91c5eec1d1dd389d2f8fe61

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
610KB

MD5
7df9867b78a892b50506f274a8c93bcb

SHA1
1ce4caf0a4aca5fe9b720b28e786a9f9d26312e3

SHA256
0c6c50387aaa18fd35f210f184968b78b485a00cce96ba314c3be7b62e804f23

SHA512
0ed72dbcdb2ab5cc2f533a82a332883fdc539254c592e2b1565919e503c817fc66c7eaf0b1ff23462735243ff23d66c3e6f4ec73a5135ad505ad6195a07176c4

Download Submit
\Windows\System32\dllhost.exe

Filesize
509KB

MD5
833cf361d1bcbbdf41f7d23c718a4a15

SHA1
46327764f2f15812d3c41d397ef9645b2d6a5f85

SHA256
016091cc0219f0f4e2b35a443d0e01950ef43cc14b9abf3364f438a041a1d5e1

SHA512
1768f91ae088acb56ec766672b653c5758be7743db027bd7039a4524f999d437332e148e0d75ad157f08eaeb662f4e9d3c0e2ffea38dc8398647e6c8ad33f2c2

Download Submit
\Windows\System32\dllhost.exe

Filesize
509KB

MD5
833cf361d1bcbbdf41f7d23c718a4a15

SHA1
46327764f2f15812d3c41d397ef9645b2d6a5f85

SHA256
016091cc0219f0f4e2b35a443d0e01950ef43cc14b9abf3364f438a041a1d5e1

SHA512
1768f91ae088acb56ec766672b653c5758be7743db027bd7039a4524f999d437332e148e0d75ad157f08eaeb662f4e9d3c0e2ffea38dc8398647e6c8ad33f2c2

Download Submit
memory/344-115-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/344-112-0x0000000000000000-mapping.dmp

Download
memory/472-99-0x0000000140000000-0x0000000140348000-memory.dmp

Filesize
3.3MB

Download
memory/472-85-0x0000000140000000-0x0000000140348000-memory.dmp

Filesize
3.3MB

Download
memory/620-77-0x0000000100000000-0x00000001001CF000-memory.dmp

Filesize
1.8MB

Download
memory/620-75-0x0000000100000000-0x00000001001CF000-memory.dmp

Filesize
1.8MB

Download
memory/808-93-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/808-80-0x0000000000000000-mapping.dmp

Download
memory/808-84-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1092-94-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1092-90-0x0000000000000000-mapping.dmp

Download
memory/1136-59-0x0000000010000000-0x00000000101B7000-memory.dmp

Filesize
1.7MB

Download
memory/1136-57-0x0000000010000000-0x00000000101B7000-memory.dmp

Filesize
1.7MB

Download
memory/1308-64-0x0000000010000000-0x00000000101E1000-memory.dmp

Filesize
1.9MB

Download
memory/1500-110-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1500-107-0x0000000000000000-mapping.dmp

Download
memory/1500-113-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1500-111-0x000007FEF3490000-0x000007FEF3EB3000-memory.dmp

Filesize
10.1MB

Download
memory/1700-76-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1700-74-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/1740-66-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/1900-101-0x0000000001000000-0x00000000011E4000-memory.dmp

Filesize
1.9MB

Download
memory/1900-73-0x0000000001000000-0x00000000011E4000-memory.dmp

Filesize
1.9MB

Download
memory/1900-55-0x0000000001000000-0x00000000011E4000-memory.dmp

Filesize
1.9MB

Download
memory/1900-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/2008-102-0x0000000000000000-mapping.dmp

Download
memory/2008-106-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2024-109-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/2024-104-0x0000000000000000-mapping.dmp

Download