blustealer | 3ed0594f9fef04feeaec1abc8f1ad0b85c75df614ba09377e394321ccb16e586

Resubmissions

12-05-2023 14:28

230512-rtgxxadd83 10

12-05-2023 14:17

230512-rlq6lsfe9y 10

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-05-2023 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order.exe
Size

1.4MB
MD5

98ac95047944a90076ed642f2b56fc7f
SHA1

e34b95acbdbead3a7057f6e42673bed24aa573c9
SHA256

421845b1fbf3828e4f4fe3e7147f501a422bd6ae755e388a089c67d005770b58
SHA512

8d415d64193df913602752c3004a7a24d7bc0ab29129eda9a1e9653e7cbfbaccb5ada7a1aa4a8b4ea81ff7fc2696fea242caf722e655b43f41cdc952738c5f74
SSDEEP

24576:N8whh2b5/1L3Y5zhzKSYIb34DSNCZlk0pRIIV6Kkcd4UiivgEvyV1jBSH:w91Lo5zgSYUI24ZlkwRI+9WUiiv7vyX0

Score

10^/10

blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 52 IoCs

pid	Process
460	Process not Found
1472	alg.exe
1616	aspnet_state.exe
1200	mscorsvw.exe
1524	mscorsvw.exe
1676	mscorsvw.exe
268	mscorsvw.exe
1368	dllhost.exe
520	ehRecvr.exe
764	ehsched.exe
1336	elevation_service.exe
1852	IEEtwCollector.exe
468	GROOVE.EXE
832	maintenanceservice.exe
2116	msdtc.exe
2176	mscorsvw.exe
2320	msiexec.exe
2424	mscorsvw.exe
2608	OSE.EXE
2660	OSPPSVC.EXE
2756	mscorsvw.exe
2804	perfhost.exe
2872	locator.exe
2896	mscorsvw.exe
3020	mscorsvw.exe
2148	snmptrap.exe
2280	mscorsvw.exe
2444	mscorsvw.exe
2432	vds.exe
2680	vssvc.exe
2564	mscorsvw.exe
2824	wbengine.exe
3036	WmiApSrv.exe
3068	mscorsvw.exe
2900	mscorsvw.exe
2168	wmpnetwk.exe
2104	mscorsvw.exe
2396	mscorsvw.exe
2700	SearchIndexer.exe
2940	mscorsvw.exe
2088	mscorsvw.exe
2764	mscorsvw.exe
2896	mscorsvw.exe
1820	mscorsvw.exe
1536	mscorsvw.exe
2996	mscorsvw.exe
2964	mscorsvw.exe
1492	mscorsvw.exe
2540	mscorsvw.exe
1392	mscorsvw.exe
2384	mscorsvw.exe
2764	mscorsvw.exe

Loads dropped DLL 16 IoCs

pid	Process
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
2320	msiexec.exe
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
752	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f9594175decfa14c.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	Purchase Order.exe
File opened for modification	C:\Windows\System32\vds.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\vssvc.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\wbengine.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\msiexec.exe	Purchase Order.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	Purchase Order.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	Purchase Order.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	Purchase Order.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	Purchase Order.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 1792	1852	Purchase Order.exe	29
PID 1792 set thread context of 628	1792	Purchase Order.exe	33

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	Purchase Order.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	Purchase Order.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	Purchase Order.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	Purchase Order.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	Purchase Order.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	Purchase Order.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	Purchase Order.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{938C99D7-7388-427F-A12F-CA98ED07AE94}.crmlog	dllhost.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Purchase Order.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	Purchase Order.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{938C99D7-7388-427F-A12F-CA98ED07AE94}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	Purchase Order.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	Purchase Order.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Purchase Order.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Purchase Order.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{3DC329BB-D338-4A1A-BDEB-9767FAD41E5F}	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform	OSPPSVC.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\VLRenewalSchedule = 816acb9f0100000000000000040000001890320100000000e2e045280100000000000000040000000100000000000000e0967d7f02000000000000004a000000350039006100350032003800380031002d0061003900380039002d0034003700390064002d0061006600340036002d00660032003700350063003600330037003000360036003300000000000000000077da4c9402000000000000004a000000360066003300320037003700360030002d0038006300350063002d0034003100370063002d0039006200360031002d003800330036006100390038003200380037006500300063000000000000000000ada4eeeb0400000000000000080000000000000000000000ada4eeeb040000000000000008000000000000000000000058192cc10100000000000000040000007800000000000000847bccf10100000000000000040000006027000000000000	OSPPSVC.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{3DC329BB-D338-4A1A-BDEB-9767FAD41E5F}	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1852	Purchase Order.exe
1852	Purchase Order.exe
1948	ehRec.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe
1792	Purchase Order.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	Purchase Order.exe
Token: SeTakeOwnershipPrivilege	1792	Purchase Order.exe
Token: SeShutdownPrivilege	268	mscorsvw.exe
Token: SeShutdownPrivilege	1676	mscorsvw.exe
Token: 33	1456	EhTray.exe
Token: SeIncBasePriorityPrivilege	1456	EhTray.exe
Token: SeDebugPrivilege	1948	ehRec.exe
Token: SeShutdownPrivilege	268	mscorsvw.exe
Token: SeShutdownPrivilege	1676	mscorsvw.exe
Token: SeShutdownPrivilege	268	mscorsvw.exe
Token: SeShutdownPrivilege	1676	mscorsvw.exe
Token: SeShutdownPrivilege	268	mscorsvw.exe
Token: SeShutdownPrivilege	1676	mscorsvw.exe
Token: 33	1456	EhTray.exe
Token: SeIncBasePriorityPrivilege	1456	EhTray.exe
Token: SeRestorePrivilege	2320	msiexec.exe
Token: SeTakeOwnershipPrivilege	2320	msiexec.exe
Token: SeSecurityPrivilege	2320	msiexec.exe
Token: SeShutdownPrivilege	268	mscorsvw.exe
Token: SeBackupPrivilege	2680	vssvc.exe
Token: SeRestorePrivilege	2680	vssvc.exe
Token: SeAuditPrivilege	2680	vssvc.exe
Token: SeBackupPrivilege	2824	wbengine.exe
Token: SeRestorePrivilege	2824	wbengine.exe
Token: SeSecurityPrivilege	2824	wbengine.exe
Token: 33	2168	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	2168	wmpnetwk.exe
Token: SeManageVolumePrivilege	2700	SearchIndexer.exe
Token: 33	2700	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2700	SearchIndexer.exe
Token: SeDebugPrivilege	1792	Purchase Order.exe
Token: SeDebugPrivilege	1792	Purchase Order.exe
Token: SeDebugPrivilege	1792	Purchase Order.exe
Token: SeDebugPrivilege	1792	Purchase Order.exe
Token: SeDebugPrivilege	1792	Purchase Order.exe
Token: SeShutdownPrivilege	1676	mscorsvw.exe
Token: SeShutdownPrivilege	268	mscorsvw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1456	EhTray.exe
1456	EhTray.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1456	EhTray.exe
1456	EhTray.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1792	Purchase Order.exe
2416	SearchProtocolHost.exe
2416	SearchProtocolHost.exe
2416	SearchProtocolHost.exe
2416	SearchProtocolHost.exe
2416	SearchProtocolHost.exe
2944	SearchProtocolHost.exe
2944	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1828	1852	Purchase Order.exe	27
PID 1852 wrote to memory of 1828	1852	Purchase Order.exe	27
PID 1852 wrote to memory of 1828	1852	Purchase Order.exe	27
PID 1852 wrote to memory of 1828	1852	Purchase Order.exe	27
PID 1852 wrote to memory of 696	1852	Purchase Order.exe	28
PID 1852 wrote to memory of 696	1852	Purchase Order.exe	28
PID 1852 wrote to memory of 696	1852	Purchase Order.exe	28
PID 1852 wrote to memory of 696	1852	Purchase Order.exe	28
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1852 wrote to memory of 1792	1852	Purchase Order.exe	29
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 1792 wrote to memory of 628	1792	Purchase Order.exe	33
PID 268 wrote to memory of 2176	268	mscorsvw.exe	47
PID 268 wrote to memory of 2176	268	mscorsvw.exe	47
PID 268 wrote to memory of 2176	268	mscorsvw.exe	47
PID 268 wrote to memory of 2424	268	mscorsvw.exe	49
PID 268 wrote to memory of 2424	268	mscorsvw.exe	49
PID 268 wrote to memory of 2424	268	mscorsvw.exe	49
PID 1676 wrote to memory of 2756	1676	mscorsvw.exe	52
PID 1676 wrote to memory of 2756	1676	mscorsvw.exe	52
PID 1676 wrote to memory of 2756	1676	mscorsvw.exe	52
PID 1676 wrote to memory of 2756	1676	mscorsvw.exe	52
PID 1676 wrote to memory of 2896	1676	mscorsvw.exe	55
PID 1676 wrote to memory of 2896	1676	mscorsvw.exe	55
PID 1676 wrote to memory of 2896	1676	mscorsvw.exe	55
PID 1676 wrote to memory of 2896	1676	mscorsvw.exe	55
PID 1676 wrote to memory of 3020	1676	mscorsvw.exe	56
PID 1676 wrote to memory of 3020	1676	mscorsvw.exe	56
PID 1676 wrote to memory of 3020	1676	mscorsvw.exe	56
PID 1676 wrote to memory of 3020	1676	mscorsvw.exe	56
PID 1676 wrote to memory of 2280	1676	mscorsvw.exe	58
PID 1676 wrote to memory of 2280	1676	mscorsvw.exe	58
PID 1676 wrote to memory of 2280	1676	mscorsvw.exe	58
PID 1676 wrote to memory of 2280	1676	mscorsvw.exe	58
PID 1676 wrote to memory of 2444	1676	mscorsvw.exe	59
PID 1676 wrote to memory of 2444	1676	mscorsvw.exe	59
PID 1676 wrote to memory of 2444	1676	mscorsvw.exe	59
PID 1676 wrote to memory of 2444	1676	mscorsvw.exe	59
PID 1676 wrote to memory of 2564	1676	mscorsvw.exe	62
PID 1676 wrote to memory of 2564	1676	mscorsvw.exe	62
PID 1676 wrote to memory of 2564	1676	mscorsvw.exe	62
PID 1676 wrote to memory of 2564	1676	mscorsvw.exe	62
PID 1676 wrote to memory of 3068	1676	mscorsvw.exe	65
PID 1676 wrote to memory of 3068	1676	mscorsvw.exe	65
PID 1676 wrote to memory of 3068	1676	mscorsvw.exe	65
PID 1676 wrote to memory of 3068	1676	mscorsvw.exe	65
PID 1676 wrote to memory of 2900	1676	mscorsvw.exe	66
PID 1676 wrote to memory of 2900	1676	mscorsvw.exe	66
PID 1676 wrote to memory of 2900	1676	mscorsvw.exe	66
PID 1676 wrote to memory of 2900	1676	mscorsvw.exe	66

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  PID:696
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:628

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1472

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:1616

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1200

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 250 -NGENProcess 258 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 25c -NGENProcess 1e8 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 244 -NGENProcess 23c -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 250 -NGENProcess 264 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d4 -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 254 -NGENProcess 264 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 270 -NGENProcess 250 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 244 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 1f0 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 284 -NGENProcess 250 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 27c -NGENProcess 23c -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 28c -NGENProcess 254 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 294 -NGENProcess 280 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 264 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 28c -NGENProcess 2a0 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 254 -NGENProcess 2a4 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 254 -NGENProcess 23c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 254 -NGENProcess 1d4 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 254 -NGENProcess 268 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2ac -NGENProcess 2b4 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 298 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 298 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2764

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 174 -InterruptEvent 160 -NGENProcess 164 -Pipe 170 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 160 -NGENProcess 164 -Pipe 174 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2424

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1368

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:520

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:764

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1456

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:468

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:832

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2116

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2608

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2660

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2804

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2700
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2647223082-2067913677-935928954-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2647223082-2067913677-935928954-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2416
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
  2⤵
  PID:2520
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.4MB

MD5
6cb00c50edd2193c16481150fcfa03bd

SHA1
bd24cb98681070db38177dc51a83d1d20126a5bd

SHA256
591838d242a3dbf082f7f4ef096e23580dc808bdc1f11374297dfbcaaf4a58ea

SHA512
91cb8135dcae3bc6d27f8eb1c491f7b217506c7f371532443adddd48084a0a46af9651663401a9eaf705bdf72813c4c79f78c147c9f00672f6d2eb66c4bb246c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
30.1MB

MD5
bb7c5bbd8c3e3874046f2fc41c4789e8

SHA1
502bdb23ed961ffb907591a1e98c0b5e008bb811

SHA256
a6f94d5fb7a9a5a3b332c0bc8b70bf115030615b00651e7b388a5d8c561e7ee3

SHA512
77fa2d9d3fa01bee8377b1c71cc0773812b6a9931abfe29c64f637dfe2b3fd2f5424a831b07c4014982a684f70f21b0d0652d979ebfb9bd27252eab620d8d68b

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
4b1879062b7b953c651d1657689db84e

SHA1
e1bac5d736d3dad186f329544def42addd9079b6

SHA256
d1d5fae598c706b1df7ae0e9cae862e3ffdebcbdefdb6a080fe0e44aa231b56d

SHA512
23c9298e06cf20ade04a99114e30554d95f8a9883fc6416c3f5c6ccb1b5f87b753aa15a70647c43de46c36968fcba94105f7ef61b23e2683577a80eb63f7c605

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
5.2MB

MD5
11bd9170ac3110cad6214fa4bdba11f1

SHA1
ef56667c7c29fe6293c558f36d32e13f9cef22df

SHA256
8be8c01d13bf5f6b17364729b236602ff9108cfc49dca144fd331da510883426

SHA512
fb0e247d87df0f235cebe6f31baaa864aa696d29ad4bbe47c08621a3c47f42c1d0e69ea7267649dcdb571e30d2f2301636ac9f61ae1abfbda1952e12df4c8cb7

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
a488f77a9cc146121255ce46764fca1a

SHA1
1136de09fd93ffe239c80063450ec2dd22008dd7

SHA256
441b5eab258c5034005d12b6a31385dec3c459e077bc6607aae941d2ad69c870

SHA512
759177331ea4bf70c5abd7caf97328542581eedb0ead5387117560413eff31283afc30350f3bef011b267a7a147cb9ea769e1ec82188536f9c32721d3d123a0c

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
c220f57e9f38c2ff47b25124685182af

SHA1
c1f4fbbcd273907490361858bd42867f9ebf4a36

SHA256
6bedcb79978ad2a5b06fadcfb95233f2df24ffbbc115faf1dad4a43569627e92

SHA512
1d4db53541ddeb62d3a379c63ce863491026cc74f56c35bf832b0beb6fa49fc982e083cc4ec3182b4ad15bdadeb22ce117de53cf99425d832124e1caec81f4b6

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
c194b25c6f7750aefec4cafb5bd17959

SHA1
b10f795fd39e871a7bdf2234c8906a7143483cb9

SHA256
8849e045cc953e359023f082406b1eb5e840111cd067910387e8d33fabecd723

SHA512
42c90c533641c6df67d7a8dbe60bd0612463f583708fdd0bed10fd482f5f91ee2b1417bd1f11d96f88128b547cd47c1ef3042ca957f36342c0662d7b427d8d0b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
09afc069c1de7c1453f0537671fd8811

SHA1
a0bad1b9c6504a817eabb0f99a51de3cee71a3d2

SHA256
c39f1e0f3ee98f9bfdbbbd9d613877a514a886cf25fc691771091563bea2bf59

SHA512
e407a14c521938c7053a6746ff87036c13a3dd06808ba194b9754bf38fe9b6cfea3f48ee1512a1e48920a539e18e2d9981f4182c9a3ef8014503bd68f4a632d1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
09afc069c1de7c1453f0537671fd8811

SHA1
a0bad1b9c6504a817eabb0f99a51de3cee71a3d2

SHA256
c39f1e0f3ee98f9bfdbbbd9d613877a514a886cf25fc691771091563bea2bf59

SHA512
e407a14c521938c7053a6746ff87036c13a3dd06808ba194b9754bf38fe9b6cfea3f48ee1512a1e48920a539e18e2d9981f4182c9a3ef8014503bd68f4a632d1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
b81fc40e038d542910470d754a3cda88

SHA1
03733cf5b8b37a112f0ac22f1078f273bc179723

SHA256
6b6d17b1a62299887e38589bd6e6cb94c38328616c4bde37b2d38fe65d133dee

SHA512
7232c90d42c582c8e6e60055ee5cdd0aeddc9f9f1fd9bc55830a47ec722069ff29ac463eb752d15e3b0aefba26343b7571086d0b9f835865a0f415a14493f05b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.3MB

MD5
854a222c756c692239ce04ece171dae2

SHA1
fea0efb52f14b19280950dbe65e0de020729b862

SHA256
75a7da3bf2978e662c621d967989e7fd6c4036c1d1d621a1ea139ae302a82b49

SHA512
1a425cf028c06d62ed6842a5f6c0e0906bc493e20013e4e92a8f1837cc054837036d707d02480fa48fd44f6b1a4c87d0c5484929ed0ee19136826cb45ef9c893

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
0a6a75db4861ead9ceb8d198e999142c

SHA1
24bdc59611720f1df1f7ff0844a00b108cc5f3ac

SHA256
997dddaa23c572be0c3bbaf37f09b5980c1f5d81168501bc74123f42adfa4712

SHA512
a3553194d361cb126843cfb04d1682f3a4d8e750970422319a04d6356d34bd65532f63f4ab79b29c1f770b7948f00fcb535b1528f4e929af1b8a5504e51ea518

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
0a6a75db4861ead9ceb8d198e999142c

SHA1
24bdc59611720f1df1f7ff0844a00b108cc5f3ac

SHA256
997dddaa23c572be0c3bbaf37f09b5980c1f5d81168501bc74123f42adfa4712

SHA512
a3553194d361cb126843cfb04d1682f3a4d8e750970422319a04d6356d34bd65532f63f4ab79b29c1f770b7948f00fcb535b1528f4e929af1b8a5504e51ea518

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
0a6a75db4861ead9ceb8d198e999142c

SHA1
24bdc59611720f1df1f7ff0844a00b108cc5f3ac

SHA256
997dddaa23c572be0c3bbaf37f09b5980c1f5d81168501bc74123f42adfa4712

SHA512
a3553194d361cb126843cfb04d1682f3a4d8e750970422319a04d6356d34bd65532f63f4ab79b29c1f770b7948f00fcb535b1528f4e929af1b8a5504e51ea518

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
0a6a75db4861ead9ceb8d198e999142c

SHA1
24bdc59611720f1df1f7ff0844a00b108cc5f3ac

SHA256
997dddaa23c572be0c3bbaf37f09b5980c1f5d81168501bc74123f42adfa4712

SHA512
a3553194d361cb126843cfb04d1682f3a4d8e750970422319a04d6356d34bd65532f63f4ab79b29c1f770b7948f00fcb535b1528f4e929af1b8a5504e51ea518

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
80a67178fd396edd741aab71da20d991

SHA1
11c63850b3b85cb8fb2b039f5e0a758c71d9dfe4

SHA256
99c93c35d0c15f4205688f3905361563d8e1f52e7baed6a22fc66561ae11a74a

SHA512
bbf01cbadff3b3959d847139be609f085c496a403fa60f54b1c522ba514403fe28e646e109c746a005c55eff50e1ab6a59dd94c63a0e030b234f806ef0577ecc

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
80a67178fd396edd741aab71da20d991

SHA1
11c63850b3b85cb8fb2b039f5e0a758c71d9dfe4

SHA256
99c93c35d0c15f4205688f3905361563d8e1f52e7baed6a22fc66561ae11a74a

SHA512
bbf01cbadff3b3959d847139be609f085c496a403fa60f54b1c522ba514403fe28e646e109c746a005c55eff50e1ab6a59dd94c63a0e030b234f806ef0577ecc

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
d8e318739375da45925e81561bba4dc4

SHA1
caf03a813d798d5c89dd750ec998e5d1c960b0fd

SHA256
fcbe2197cdb879d4f1f3604ad5f376844a6dfa1b866352534a9d02ac126f9f76

SHA512
a75244e3c26b9a1a9cd9ca8e72404ee586b84e14a6453dbdc8c42764969e2db47d44814d742581f09e441624329aec61346c4ec95c4345b4f07a1cd2c6fc2dfa

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.3MB

MD5
21e05255e6333324cfc235033a75db8b

SHA1
a21c953bc199b8d003047c62bd38f5e311c56a25

SHA256
2429c93735494d64f329bc0680026fd436eb5b9d575682b97ef0e10aca4b5a88

SHA512
de00321470c27446d5e6f81c956ab617ed07bdd2fa003db0f2acbc6dbbcaf8d24d1d062c885af996fe6e76a4459029bfa9a5a9c94af3b2570c77cf01685fd6d3

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
16dfaf03b1ab87b836e3da5fdd588d69

SHA1
a560c7ce11681d6a7d3c3c55b8b11b0ac7f850d0

SHA256
d440cf79cb48f2557e39a7dddc67341472758d47cfbb83a2fe029cfc0cc35662

SHA512
b5707e5bcce3a304baaa713362d9ade46f950d5c565c19262eb418e6185d79aa4f8def7dea6ba8d65ac8cfbb3a402496cd92300e499ab6d63076caecc35bf731

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
d357764d34c57ebfcc6d6e29dd05ffa4

SHA1
c71bd258cf79689a669c53fe08e119622cdc0b86

SHA256
0036477c05d67859bc1400f2b8ca5e5753319008375aa03a2c61d9b57e8f1aac

SHA512
911c7d341226a5f5561fa271aab1a0d4b02ca4dc1a3e33dfa2e3a65dfaab5d2f37fb7bb5eb78ba063a1ffae42e3a183e511660040ca101b69a95eaa4a93f82d1

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.1MB

MD5
0027f0988faa669ee95fce7eb0616f25

SHA1
7ad08940145a64a607597a19822227fd82bf63d5

SHA256
e85d3e8ea351c321a05cadcbf30c4d5f96ce14c37b877dcc67049beb0f486d9d

SHA512
d26340c28d8e14e66428226e7a8a380a4ab79a21712392fd11aab8f5d997a86b5791dccfe815a4c54202bebef4e1e87c0aa617926672e5efa7ecefa152373659

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.1MB

MD5
f2b254b45a2866d280947b5afee8c78e

SHA1
06014aa55dae68d0facc6f3e39fbe19520122b5c

SHA256
7c2ce74980d62782bb2f65b6b65ca1e405f00b95ead7a559423b5334e4d05868

SHA512
e710ada766ec59d4819e740a4815c64fb93c9d4cfea61fbef0daeff0dbe8cee6b50ad1cf3c1944c04d8634323c837a4dbb16b099401e6c7002626eebcd638d62

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
f8455e865a4a36bb1a9fdc321bdf2d88

SHA1
c3b02ef1fc575e437a0fd94c8f858bb416713808

SHA256
9ed72de078974a0da85d1239d5f3f0ba649420949397630139b28469679a1948

SHA512
596bcf7a813cecd55d06fd135d9ef6ec92c658e624940ca956fd03df255e38699ed0ffc4238da331e6c44c84de2bcf315d9b61eeb01edc37ce855c75477f733b

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
4b65f060815c6de75c66b72d727612ce

SHA1
427908aaf49e52b9a76c646e574e4eb5418bd478

SHA256
579c17603a3bd40f65e7a88f5155b5b72a7d9a23e58620b406d780bb258ac71e

SHA512
027cc05d99b63fba1b36885b8b07b4a4fe5dab35e3abefd71e8ba0a8b1917c8888b7bae1cab90ecfe498e069637146948be30f5c8695cbf5c4f69527b2f977bc

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
d31ae45c467a3a822f6bc43ce9a1a948

SHA1
785aca884a93f94c9d30a36ece835752626a31d4

SHA256
a24cbe0e8aab3cb1c245b5e007d768d52fa1c29359daf201ce6ca25afe7b344b

SHA512
8f45a1c30539b456492d7a44729edad0cd8575efb84264cbe2e831be16ce15f2bbf94ac22fd0c20087d1d39badfa0c549e44455ccaa69c88835a7875cb3f27ea

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
23ee3020add6f3530e7b98fe9ac322b3

SHA1
758c8ec0475d47da3147983be779ce33df562579

SHA256
1e2f47459c9c6a6ba6a312e8a33d42f40487d10540d59b249599605db059b688

SHA512
a10136866fdbce05e5766dbfdf2d04eb64ef15d5df412911d2ed70aa62ef380d8d5a5e3adcb23fe533565dbd09624b940bfe46e5c905d34cef12bbab36710859

Download Submit
C:\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
1f6bc6cbd96615059d19435fd435ca33

SHA1
6b491a99f568f2a54376522f907dc56ca587fb42

SHA256
74bf4a28e7bcd733de6b37c426c6fc0077024ebb0a56ad084802e2257228dec3

SHA512
8743ab55a93c98cb67f8348ece907d3a4af1ee416cbdfeef6a1c0fa674d4938e415d4b1b3fef261affe8ec9548bd0053ed3c550a31ec01e97685800dc2095eef

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
b646310f448e0b4111218663fdba092f

SHA1
583acf7a9228d47311c09f0fd9286683694ed090

SHA256
e62dbfaf7758ca85f202a25d762c02c8db3bcb8c113357bd9e43d67e480deba6

SHA512
06a75970a87ebfcb3d73cc3d1023aeb5cc6520a6c3cd0dd9cc4c8ec6d6635b0bba63a259eda3e98c51a71bf06e49e824dd219e884abf4de81e02f2d54ae41195

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.7MB

MD5
3e01f6556453c303720f5658aa010b64

SHA1
7fb821c02fad67e5a838b67c1e00dc463cd72945

SHA256
965518ae02aad220e494073b194e2d0b7c9b381c99b6fd65e9f5d445a394785b

SHA512
e0bcd5ffaa3574d6195b9c35a4bf2bfdbe3c9ad3371073bca7a36548a8e02ab14327984544a33e83eca8495128ceb15575f393f5df4fdd456f1b0eca3f0dcf16

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
14c502079ce086bbea0cb890cd144cd0

SHA1
7a96a51c1bc26f855f7d2e294162fdb71ae96ef7

SHA256
9741bfb20bd1894e4e3bfc61478435ad19db9f3cbb30a1d451e7dc71b1e3115d

SHA512
2c1764f85a69323f5dd0f595f5774c7e8c9500510052ee103f5a1ace45a227eda30310ed39b9938a40dd0b5783c83b48d2d866d9bba3f4c2199ab84712a1c7eb

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
3e14e5e7987ad68c374244c2abcefbac

SHA1
089ca9aff4ca92506075e863dba164e398eedbe1

SHA256
21acc7ad0666a7598e26ae243c0e88fd7c9a6032d3c88743414e1a59df10fff2

SHA512
f6d39e5bf6e38b02fec766e70159fb7af323cca008a363a359666687601c4fe3e72cb85c98fd6b8950e20cb464f7ff79808dbe5c4d4ac33043b1cc2f47b84254

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
601b689e96a52e12b715de57f208fcf1

SHA1
608275b4e828b5b1b47e7e1cd7f54c42ef861a88

SHA256
1f2c6647bf77fd3423c2cfe0b9a4d41643785a49080c89514589c8279010120d

SHA512
678499bf487832bb2f99255450b70e69b8e2e7f7a37254062d1262c0f63c1f3976f458e4b38d0c31178836700675bd2359878ed4b5b01e22581983e7e9035c0b

Download Submit
C:\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
0e9d303b36210f25f13f382e41499f99

SHA1
13b686cd77336f00ad7680f25a23b1d4fceda2e7

SHA256
1eebef3b6227998e976bda898d1f0bc3cd673de8860272ee6c0c7787e6145b02

SHA512
e15ede998ed37d4fafae23bf34436cfc59d40f3f6e078e95d55ec22033509ea369a3b488b9cc3cf0bd14acfddf9b04782de96070c980c06a8b40f71a90b43420

Download Submit
C:\Windows\system32\msiexec.exe

Filesize
1.3MB

MD5
1f6bc6cbd96615059d19435fd435ca33

SHA1
6b491a99f568f2a54376522f907dc56ca587fb42

SHA256
74bf4a28e7bcd733de6b37c426c6fc0077024ebb0a56ad084802e2257228dec3

SHA512
8743ab55a93c98cb67f8348ece907d3a4af1ee416cbdfeef6a1c0fa674d4938e415d4b1b3fef261affe8ec9548bd0053ed3c550a31ec01e97685800dc2095eef

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
c220f57e9f38c2ff47b25124685182af

SHA1
c1f4fbbcd273907490361858bd42867f9ebf4a36

SHA256
6bedcb79978ad2a5b06fadcfb95233f2df24ffbbc115faf1dad4a43569627e92

SHA512
1d4db53541ddeb62d3a379c63ce863491026cc74f56c35bf832b0beb6fa49fc982e083cc4ec3182b4ad15bdadeb22ce117de53cf99425d832124e1caec81f4b6

Download Submit
\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
c220f57e9f38c2ff47b25124685182af

SHA1
c1f4fbbcd273907490361858bd42867f9ebf4a36

SHA256
6bedcb79978ad2a5b06fadcfb95233f2df24ffbbc115faf1dad4a43569627e92

SHA512
1d4db53541ddeb62d3a379c63ce863491026cc74f56c35bf832b0beb6fa49fc982e083cc4ec3182b4ad15bdadeb22ce117de53cf99425d832124e1caec81f4b6

Download Submit
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.3MB

MD5
09afc069c1de7c1453f0537671fd8811

SHA1
a0bad1b9c6504a817eabb0f99a51de3cee71a3d2

SHA256
c39f1e0f3ee98f9bfdbbbd9d613877a514a886cf25fc691771091563bea2bf59

SHA512
e407a14c521938c7053a6746ff87036c13a3dd06808ba194b9754bf38fe9b6cfea3f48ee1512a1e48920a539e18e2d9981f4182c9a3ef8014503bd68f4a632d1

Download Submit
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.3MB

MD5
854a222c756c692239ce04ece171dae2

SHA1
fea0efb52f14b19280950dbe65e0de020729b862

SHA256
75a7da3bf2978e662c621d967989e7fd6c4036c1d1d621a1ea139ae302a82b49

SHA512
1a425cf028c06d62ed6842a5f6c0e0906bc493e20013e4e92a8f1837cc054837036d707d02480fa48fd44f6b1a4c87d0c5484929ed0ee19136826cb45ef9c893

Download Submit
\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
d357764d34c57ebfcc6d6e29dd05ffa4

SHA1
c71bd258cf79689a669c53fe08e119622cdc0b86

SHA256
0036477c05d67859bc1400f2b8ca5e5753319008375aa03a2c61d9b57e8f1aac

SHA512
911c7d341226a5f5561fa271aab1a0d4b02ca4dc1a3e33dfa2e3a65dfaab5d2f37fb7bb5eb78ba063a1ffae42e3a183e511660040ca101b69a95eaa4a93f82d1

Download Submit
\Windows\System32\alg.exe

Filesize
1.3MB

MD5
f8455e865a4a36bb1a9fdc321bdf2d88

SHA1
c3b02ef1fc575e437a0fd94c8f858bb416713808

SHA256
9ed72de078974a0da85d1239d5f3f0ba649420949397630139b28469679a1948

SHA512
596bcf7a813cecd55d06fd135d9ef6ec92c658e624940ca956fd03df255e38699ed0ffc4238da331e6c44c84de2bcf315d9b61eeb01edc37ce855c75477f733b

Download Submit
\Windows\System32\dllhost.exe

Filesize
1.2MB

MD5
4b65f060815c6de75c66b72d727612ce

SHA1
427908aaf49e52b9a76c646e574e4eb5418bd478

SHA256
579c17603a3bd40f65e7a88f5155b5b72a7d9a23e58620b406d780bb258ac71e

SHA512
027cc05d99b63fba1b36885b8b07b4a4fe5dab35e3abefd71e8ba0a8b1917c8888b7bae1cab90ecfe498e069637146948be30f5c8695cbf5c4f69527b2f977bc

Download Submit
\Windows\System32\ieetwcollector.exe

Filesize
1.3MB

MD5
d31ae45c467a3a822f6bc43ce9a1a948

SHA1
785aca884a93f94c9d30a36ece835752626a31d4

SHA256
a24cbe0e8aab3cb1c245b5e007d768d52fa1c29359daf201ce6ca25afe7b344b

SHA512
8f45a1c30539b456492d7a44729edad0cd8575efb84264cbe2e831be16ce15f2bbf94ac22fd0c20087d1d39badfa0c549e44455ccaa69c88835a7875cb3f27ea

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
23ee3020add6f3530e7b98fe9ac322b3

SHA1
758c8ec0475d47da3147983be779ce33df562579

SHA256
1e2f47459c9c6a6ba6a312e8a33d42f40487d10540d59b249599605db059b688

SHA512
a10136866fdbce05e5766dbfdf2d04eb64ef15d5df412911d2ed70aa62ef380d8d5a5e3adcb23fe533565dbd09624b940bfe46e5c905d34cef12bbab36710859

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
1f6bc6cbd96615059d19435fd435ca33

SHA1
6b491a99f568f2a54376522f907dc56ca587fb42

SHA256
74bf4a28e7bcd733de6b37c426c6fc0077024ebb0a56ad084802e2257228dec3

SHA512
8743ab55a93c98cb67f8348ece907d3a4af1ee416cbdfeef6a1c0fa674d4938e415d4b1b3fef261affe8ec9548bd0053ed3c550a31ec01e97685800dc2095eef

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.3MB

MD5
1f6bc6cbd96615059d19435fd435ca33

SHA1
6b491a99f568f2a54376522f907dc56ca587fb42

SHA256
74bf4a28e7bcd733de6b37c426c6fc0077024ebb0a56ad084802e2257228dec3

SHA512
8743ab55a93c98cb67f8348ece907d3a4af1ee416cbdfeef6a1c0fa674d4938e415d4b1b3fef261affe8ec9548bd0053ed3c550a31ec01e97685800dc2095eef

Download Submit
\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
b646310f448e0b4111218663fdba092f

SHA1
583acf7a9228d47311c09f0fd9286683694ed090

SHA256
e62dbfaf7758ca85f202a25d762c02c8db3bcb8c113357bd9e43d67e480deba6

SHA512
06a75970a87ebfcb3d73cc3d1023aeb5cc6520a6c3cd0dd9cc4c8ec6d6635b0bba63a259eda3e98c51a71bf06e49e824dd219e884abf4de81e02f2d54ae41195

Download Submit
\Windows\System32\vds.exe

Filesize
1.7MB

MD5
3e01f6556453c303720f5658aa010b64

SHA1
7fb821c02fad67e5a838b67c1e00dc463cd72945

SHA256
965518ae02aad220e494073b194e2d0b7c9b381c99b6fd65e9f5d445a394785b

SHA512
e0bcd5ffaa3574d6195b9c35a4bf2bfdbe3c9ad3371073bca7a36548a8e02ab14327984544a33e83eca8495128ceb15575f393f5df4fdd456f1b0eca3f0dcf16

Download Submit
\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
14c502079ce086bbea0cb890cd144cd0

SHA1
7a96a51c1bc26f855f7d2e294162fdb71ae96ef7

SHA256
9741bfb20bd1894e4e3bfc61478435ad19db9f3cbb30a1d451e7dc71b1e3115d

SHA512
2c1764f85a69323f5dd0f595f5774c7e8c9500510052ee103f5a1ace45a227eda30310ed39b9938a40dd0b5783c83b48d2d866d9bba3f4c2199ab84712a1c7eb

Download Submit
\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
3e14e5e7987ad68c374244c2abcefbac

SHA1
089ca9aff4ca92506075e863dba164e398eedbe1

SHA256
21acc7ad0666a7598e26ae243c0e88fd7c9a6032d3c88743414e1a59df10fff2

SHA512
f6d39e5bf6e38b02fec766e70159fb7af323cca008a363a359666687601c4fe3e72cb85c98fd6b8950e20cb464f7ff79808dbe5c4d4ac33043b1cc2f47b84254

Download Submit
\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
601b689e96a52e12b715de57f208fcf1

SHA1
608275b4e828b5b1b47e7e1cd7f54c42ef861a88

SHA256
1f2c6647bf77fd3423c2cfe0b9a4d41643785a49080c89514589c8279010120d

SHA512
678499bf487832bb2f99255450b70e69b8e2e7f7a37254062d1262c0f63c1f3976f458e4b38d0c31178836700675bd2359878ed4b5b01e22581983e7e9035c0b

Download Submit
\Windows\ehome\ehsched.exe

Filesize
1.3MB

MD5
0e9d303b36210f25f13f382e41499f99

SHA1
13b686cd77336f00ad7680f25a23b1d4fceda2e7

SHA256
1eebef3b6227998e976bda898d1f0bc3cd673de8860272ee6c0c7787e6145b02

SHA512
e15ede998ed37d4fafae23bf34436cfc59d40f3f6e078e95d55ec22033509ea369a3b488b9cc3cf0bd14acfddf9b04782de96070c980c06a8b40f71a90b43420

Download Submit
memory/268-146-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/468-398-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/468-212-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/520-184-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/520-182-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/520-152-0x00000000003B0000-0x0000000000410000-memory.dmp

Filesize
384KB

Download
memory/520-158-0x00000000003B0000-0x0000000000410000-memory.dmp

Filesize
384KB

Download
memory/520-160-0x0000000001380000-0x0000000001390000-memory.dmp

Filesize
64KB

Download
memory/520-162-0x0000000001390000-0x00000000013A0000-memory.dmp

Filesize
64KB

Download
memory/628-99-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/628-119-0x00000000049F0000-0x0000000004AAC000-memory.dmp

Filesize
752KB

Download
memory/628-98-0x00000000000D0000-0x0000000000136000-memory.dmp

Filesize
408KB

Download
memory/628-108-0x00000000000D0000-0x0000000000136000-memory.dmp

Filesize
408KB

Download
memory/628-100-0x00000000000D0000-0x0000000000136000-memory.dmp

Filesize
408KB

Download
memory/628-104-0x00000000000D0000-0x0000000000136000-memory.dmp

Filesize
408KB

Download
memory/764-165-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/764-171-0x0000000000820000-0x0000000000880000-memory.dmp

Filesize
384KB

Download
memory/764-186-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/764-417-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/764-550-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/832-226-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/1200-118-0x0000000010000000-0x00000000101F6000-memory.dmp

Filesize
2.0MB

Download
memory/1336-183-0x0000000000920000-0x0000000000980000-memory.dmp

Filesize
384KB

Download
memory/1336-188-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1336-176-0x0000000000920000-0x0000000000980000-memory.dmp

Filesize
384KB

Download
memory/1368-148-0x0000000100000000-0x00000001001EC000-memory.dmp

Filesize
1.9MB

Download
memory/1472-91-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/1472-322-0x0000000100000000-0x00000001001FB000-memory.dmp

Filesize
2.0MB

Download
memory/1472-82-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/1472-88-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/1524-121-0x0000000010000000-0x00000000101FE000-memory.dmp

Filesize
2.0MB

Download
memory/1616-111-0x0000000140000000-0x00000001401F4000-memory.dmp

Filesize
2.0MB

Download
memory/1676-128-0x0000000000860000-0x00000000008C6000-memory.dmp

Filesize
408KB

Download
memory/1676-123-0x0000000000860000-0x00000000008C6000-memory.dmp

Filesize
408KB

Download
memory/1676-149-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/1792-61-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1792-92-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1792-68-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1792-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1792-69-0x0000000001FC0000-0x0000000002026000-memory.dmp

Filesize
408KB

Download
memory/1792-74-0x0000000001FC0000-0x0000000002026000-memory.dmp

Filesize
408KB

Download
memory/1792-323-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1792-63-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1792-62-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1792-66-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/1852-60-0x0000000008760000-0x0000000008910000-memory.dmp

Filesize
1.7MB

Download
memory/1852-58-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/1852-57-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download
memory/1852-54-0x00000000000B0000-0x0000000000216000-memory.dmp

Filesize
1.4MB

Download
memory/1852-56-0x0000000000370000-0x0000000000382000-memory.dmp

Filesize
72KB

Download
memory/1852-59-0x0000000008390000-0x00000000084C8000-memory.dmp

Filesize
1.2MB

Download
memory/1852-55-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download
memory/1852-209-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/1948-272-0x0000000000C80000-0x0000000000D00000-memory.dmp

Filesize
512KB

Download
memory/1948-228-0x0000000000C80000-0x0000000000D00000-memory.dmp

Filesize
512KB

Download
memory/1948-210-0x0000000000C80000-0x0000000000D00000-memory.dmp

Filesize
512KB

Download
memory/2104-501-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2104-527-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2116-498-0x0000000140000000-0x000000014020D000-memory.dmp

Filesize
2.1MB

Download
memory/2116-233-0x0000000140000000-0x000000014020D000-memory.dmp

Filesize
2.1MB

Download
memory/2148-391-0x0000000100000000-0x00000001001ED000-memory.dmp

Filesize
1.9MB

Download
memory/2168-502-0x0000000100000000-0x000000010020A000-memory.dmp

Filesize
2.0MB

Download
memory/2176-253-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2176-290-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2280-395-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2320-306-0x0000000000570000-0x0000000000779000-memory.dmp

Filesize
2.0MB

Download
memory/2320-276-0x0000000100000000-0x0000000100209000-memory.dmp

Filesize
2.0MB

Download
memory/2396-536-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2424-296-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2432-418-0x0000000100000000-0x000000010026B000-memory.dmp

Filesize
2.4MB

Download
memory/2444-424-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2564-443-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2564-468-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2608-308-0x000000002E000000-0x000000002E20C000-memory.dmp

Filesize
2.0MB

Download
memory/2660-301-0x0000000100000000-0x0000000100542000-memory.dmp

Filesize
5.3MB

Download
memory/2680-419-0x0000000100000000-0x0000000100219000-memory.dmp

Filesize
2.1MB

Download
memory/2700-538-0x0000000100000000-0x0000000100123000-memory.dmp

Filesize
1.1MB

Download
memory/2756-324-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2756-334-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2804-325-0x0000000001000000-0x00000000011ED000-memory.dmp

Filesize
1.9MB

Download
memory/2824-442-0x0000000100000000-0x0000000100202000-memory.dmp

Filesize
2.0MB

Download
memory/2872-352-0x0000000100000000-0x00000001001EC000-memory.dmp

Filesize
1.9MB

Download
memory/2896-354-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/2900-500-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/3020-349-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/3020-382-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/3036-464-0x0000000100000000-0x000000010021B000-memory.dmp

Filesize
2.1MB

Download
memory/3068-480-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download
memory/3068-466-0x0000000000400000-0x00000000005FF000-memory.dmp

Filesize
2.0MB

Download