Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

YammiBeta.exe

windows7-x64

10

YammiBeta.exe

windows10-1703-x64

10

YammiBeta.exe

windows10-2004-x64

10

Resubmissions

26/08/2023, 13:46

230826-q3a1aaaf29 10

26/08/2023, 13:43

230826-q1fsraae94 10

26/08/2023, 13:42

230826-qzw4caae79 10

26/08/2023, 13:42

230826-qzq74aae76 10

26/08/2023, 13:39

230826-qx3hcaae65 10

26/08/2023, 13:37

230826-qw8mzaae57 10

26/08/2023, 13:36

230826-qwa2pscd7t 10

26/08/2023, 13:35

230826-qvphpsae53 10

26/08/2023, 13:34

230826-qvlrtacd7s 10

26/08/2023, 13:34

230826-qt543acd61 10

Analysis

  • max time kernel
    1785s
  • max time network
    1804s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230824-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2023, 13:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    YammiBeta.exe

  • Size

    1.1MB

  • MD5

    6b5050c12abc27bad622f9af8ed7ebe3

  • SHA1

    506be642a7d276c783bfd32a754a9bd1373abaea

  • SHA256

    7de778c5153ba0ae2157f8a3ea78ef402c63d014a9fa719257cee24089e4a88f

  • SHA512

    22ffa4c6afd0661307ca1a3a349e19f9fbb8739e382e2fea7b1ec59200c3d7ca06241b2f5154246ce2b8165da26eac31e70f2a0f4ff586e5b09cf0c993b2d319

  • SSDEEP

    24576:348l0DlMFVPNpQiWq5KMsEINq4pXCxTRg/9QyGTlouInmUf/6ix5GWZ:35yeVPRWq5KMspBpX+wLEojnm3RE

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 57 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 44 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Downloads MZ/PE file
  • Executes dropped EXE 31 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 57 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\YammiBeta.exe
    "C:\Users\Admin\AppData\Local\Temp\YammiBeta.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HyperCrtsvc\RlJdCeTbjnR.vbe"
        3⤵
          PID:4472
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HyperCrtsvc\xD4oxlRfvWBkgaTyTKGRnb.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3584
            • C:\Users\Admin\AppData\Local\Temp\HyperCrtsvc\MsServerfont.exe
              "C:\Users\Admin\AppData\Local\Temp\HyperCrtsvc\MsServerfont.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1152
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4576
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5068
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:560
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4500
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4724
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1044
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3pG4nn4hzO.bat"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:5060
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  7⤵
                    PID:4272
                  • C:\Program Files\Java\jre1.8.0_66\bin\services.exe
                    "C:\Program Files\Java\jre1.8.0_66\bin\services.exe"
                    7⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4192
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:780
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:836
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4328
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3660
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5064
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3516
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\odt\TextInputHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4596
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1156
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\Help\backgroundTaskHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2712
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Help\Help\backgroundTaskHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1688
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4736
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\Help\backgroundTaskHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4652
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\NetHood\taskhostw.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:5100
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\taskhostw.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4356
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\taskhostw.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3816
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2660
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2232
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:64
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2752
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sihost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3736
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\sihost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3672
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\sihost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3196
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3468
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Windows\IdentityCRL\sihost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4404
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Windows\IdentityCRL\sihost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3204
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\sihost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1620
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\InputMethod\CHT\dllhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3228
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\InputMethod\CHT\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4416
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2776
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\InputMethod\CHT\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:5004
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\dllhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2024
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Music\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:352
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Music\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:488
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2896
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2424
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2772
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1576
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2844
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Application Data\RuntimeBroker.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4208
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3008
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1844
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3636
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3640
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:5108
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2336
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3172
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4696
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2308
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4124
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Java\jre1.8.0_66\bin\services.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3412
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre1.8.0_66\bin\services.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3084
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre1.8.0_66\bin\services.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3464
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2668
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\SchCache\dllhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4824
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\odt\dwm.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:300
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\odt\dwm.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1540
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\odt\fontdrvhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2016
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\SchCache\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1184
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3220
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\SchCache\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4360
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2412
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4120
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4952
      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        "C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4880
      • C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe
        "C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:488
      • C:\Windows\SchCache\dllhost.exe
        C:\Windows\SchCache\dllhost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1848
      • C:\odt\fontdrvhost.exe
        C:\odt\fontdrvhost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2908
      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        "C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3696
      • C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe
        "C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
      • C:\odt\dwm.exe
        C:\odt\dwm.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4316
      • C:\odt\TextInputHost.exe
        C:\odt\TextInputHost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3392
      • C:\Users\All Users\Application Data\RuntimeBroker.exe
        "C:\Users\All Users\Application Data\RuntimeBroker.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3388
      • C:\Program Files\Java\jre1.8.0_66\bin\services.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\services.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2460
      • C:\Recovery\WindowsRE\taskhostw.exe
        C:\Recovery\WindowsRE\taskhostw.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5048
      • C:\Recovery\WindowsRE\backgroundTaskHost.exe
        C:\Recovery\WindowsRE\backgroundTaskHost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3764
      • C:\Windows\IdentityCRL\sihost.exe
        C:\Windows\IdentityCRL\sihost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4400
      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        "C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1720
      • C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe
        "C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1328
      • C:\Windows\SchCache\dllhost.exe
        C:\Windows\SchCache\dllhost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4976
      • C:\odt\fontdrvhost.exe
        C:\odt\fontdrvhost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1348
      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        "C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3224
      • C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe
        "C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1616
      • C:\odt\dwm.exe
        C:\odt\dwm.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1032
      • C:\odt\TextInputHost.exe
        C:\odt\TextInputHost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:116
      • C:\Users\All Users\Application Data\RuntimeBroker.exe
        "C:\Users\All Users\Application Data\RuntimeBroker.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3336
      • C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe
        "C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3464
      • C:\Windows\SchCache\dllhost.exe
        C:\Windows\SchCache\dllhost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3264
      • C:\Program Files\Java\jre1.8.0_66\bin\services.exe
        "C:\Program Files\Java\jre1.8.0_66\bin\services.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4872
      • C:\Recovery\WindowsRE\backgroundTaskHost.exe
        C:\Recovery\WindowsRE\backgroundTaskHost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2916
      • C:\Recovery\WindowsRE\taskhostw.exe
        C:\Recovery\WindowsRE\taskhostw.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2072
      • C:\Windows\IdentityCRL\sihost.exe
        C:\Windows\IdentityCRL\sihost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4008

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files (x86)\Windows Media Player\fr-FR\cmd.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files\Java\jre1.8.0_66\bin\services.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files\Java\jre1.8.0_66\bin\services.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files\Java\jre1.8.0_66\bin\services.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Program Files\Mozilla Firefox\browser\VisualElements\SppExtComObj.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\ProgramData\RuntimeBroker.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\ProgramData\RuntimeBroker.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Recovery\WindowsRE\backgroundTaskHost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Recovery\WindowsRE\backgroundTaskHost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Recovery\WindowsRE\taskhostw.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Recovery\WindowsRE\taskhostw.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        28d4235aa2e6d782751f980ceb6e5021

        SHA1

        f5d82d56acd642b9fc4b963f684fd6b78f25a140

        SHA256

        8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

        SHA512

        dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        ecceac16628651c18879d836acfcb062

        SHA1

        420502b3e5220a01586c59504e94aa1ee11982c9

        SHA256

        58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

        SHA512

        be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        e243a38635ff9a06c87c2a61a2200656

        SHA1

        ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

        SHA256

        af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

        SHA512

        4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        e243a38635ff9a06c87c2a61a2200656

        SHA1

        ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

        SHA256

        af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

        SHA512

        4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        e243a38635ff9a06c87c2a61a2200656

        SHA1

        ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

        SHA256

        af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

        SHA512

        4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        e243a38635ff9a06c87c2a61a2200656

        SHA1

        ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

        SHA256

        af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

        SHA512

        4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        22fbec4acba323d04079a263526cef3c

        SHA1

        eb8dd0042c6a3f20087a7d2391eaf48121f98740

        SHA256

        020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

        SHA512

        fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\3pG4nn4hzO.bat
        Filesize

        215B

        MD5

        7ec9b7b132e1ab83688f2aa60d5321fc

        SHA1

        204ce924ad06cb1eb543ffaab0a4fbec2397f080

        SHA256

        b30a4f0433bd94c325cc0381a9457e1a75beb190bddaade32cfb5f5538c0757d

        SHA512

        5ed3b30d9b9fa82816dd660ee76c8a8b8966a867ffabfce673275eb557583fcbe7980879123b670b277ad107d4b10f6b2e163f81b6e8a845b28092e91d9cfab1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\HyperCrtsvc\MsServerfont.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\HyperCrtsvc\MsServerfont.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\HyperCrtsvc\RlJdCeTbjnR.vbe
        Filesize

        214B

        MD5

        f246d91170758c560dcc804e79b689ce

        SHA1

        8e9820729c33e492c5d76722607a38379b1cbd38

        SHA256

        8558d7ec61aa5e0e6162d9f59103a6d3340cc359ee0526e765a061c6673a9665

        SHA512

        dcc48971a6a4a1b3af13a420a8de6ddfd765c780bfe76cbf1a459a855c14f0ca6510994fc988dfecd92257b99b41e2caf68025991ca80663331ce1c61110e5c8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\HyperCrtsvc\xD4oxlRfvWBkgaTyTKGRnb.bat
        Filesize

        37B

        MD5

        c87d31ff7b6bc8e971808bc819561137

        SHA1

        000f77a2d2596c87d3e2085ad74794b0627c034a

        SHA256

        738675ead6e7e54b7f0298824578cdfb659584a16f4f0cc2a0bdba654a482872

        SHA512

        34d995cf1fd3908a190aac08cefae4fb0d4fae7fd0cef2fb625a5e2d76864ce99724a2da4d1f05327bad80dab08f08038e17785e23c49087968e6c569964ffde

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
        Filesize

        1.7MB

        MD5

        fea5051ff55437d8510d9dba5159efba

        SHA1

        cc6dcfad3e10dc075ba815f2a1d815c97c95e0c3

        SHA256

        9d81caf5187bce5f5d2c1bf2b50d5c15b7f26bdc6ec954c8801bc358f0cfba5f

        SHA512

        796f7e8663206c9acbaf06aae656291821c02111a812bd9c71d62a18247ac6b2ef0cd27993dded6d08f6268e854207bba3c62e020afa8d06fee1e693b920daf5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
        Filesize

        1.7MB

        MD5

        fea5051ff55437d8510d9dba5159efba

        SHA1

        cc6dcfad3e10dc075ba815f2a1d815c97c95e0c3

        SHA256

        9d81caf5187bce5f5d2c1bf2b50d5c15b7f26bdc6ec954c8801bc358f0cfba5f

        SHA512

        796f7e8663206c9acbaf06aae656291821c02111a812bd9c71d62a18247ac6b2ef0cd27993dded6d08f6268e854207bba3c62e020afa8d06fee1e693b920daf5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
        Filesize

        1.7MB

        MD5

        fea5051ff55437d8510d9dba5159efba

        SHA1

        cc6dcfad3e10dc075ba815f2a1d815c97c95e0c3

        SHA256

        9d81caf5187bce5f5d2c1bf2b50d5c15b7f26bdc6ec954c8801bc358f0cfba5f

        SHA512

        796f7e8663206c9acbaf06aae656291821c02111a812bd9c71d62a18247ac6b2ef0cd27993dded6d08f6268e854207bba3c62e020afa8d06fee1e693b920daf5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pnlmdhax.l5x.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\All Users\Application Data\RuntimeBroker.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Windows\Help\Help\backgroundTaskHost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Windows\IdentityCRL\sihost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Windows\IdentityCRL\sihost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Windows\SchCache\dllhost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Windows\SchCache\dllhost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Windows\SchCache\dllhost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\Windows\SchCache\dllhost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\TextInputHost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\TextInputHost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\TextInputHost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\dwm.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\dwm.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\dwm.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\fontdrvhost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\fontdrvhost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • C:\odt\fontdrvhost.exe
        Filesize

        1.5MB

        MD5

        18ae88963bf2b89b3ea24f1cd998c0dd

        SHA1

        0200af4fb7dbe83bb230f2ebf14c3561b4f2af85

        SHA256

        1b1e4e67bcb116b6e6a7fd6f9f717853b8b8c490b959f161eae356eda25992e9

        SHA512

        16c280ab0a242a13075c249b615a8f013e614eed240e37e20565c31078d14f917fb96559915a056279c4747d1d319b3ed9915141883991fa019ea6e6332d9157

        Download Submit

      • memory/560-86-0x0000024EC2520000-0x0000024EC2530000-memory.dmp

        Filesize

        64KB

        Download

      • memory/560-231-0x0000024EC2520000-0x0000024EC2530000-memory.dmp

        Filesize

        64KB

        Download

      • memory/560-95-0x0000024EC2470000-0x0000024EC2492000-memory.dmp

        Filesize

        136KB

        Download

      • memory/560-258-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/560-221-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/780-102-0x0000026C80430000-0x0000026C80440000-memory.dmp

        Filesize

        64KB

        Download

      • memory/780-96-0x0000026C80430000-0x0000026C80440000-memory.dmp

        Filesize

        64KB

        Download

      • memory/780-223-0x0000026C80430000-0x0000026C80440000-memory.dmp

        Filesize

        64KB

        Download

      • memory/780-94-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/836-263-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/836-214-0x000001EAAAFD0000-0x000001EAAAFE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/836-213-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/836-225-0x000001EAAAFD0000-0x000001EAAAFE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1044-224-0x000002507EBA0000-0x000002507EBB0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1044-261-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1044-227-0x000002507EBA0000-0x000002507EBB0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1044-212-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1152-36-0x0000000000750000-0x00000000008D0000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/1152-40-0x0000000002CC0000-0x0000000002D10000-memory.dmp

        Filesize

        320KB

        Download

      • memory/1152-38-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1152-103-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1152-39-0x00000000010A0000-0x00000000010B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3516-220-0x0000024643B20000-0x0000024643B30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3516-222-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3516-226-0x0000024643B20000-0x0000024643B30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3516-215-0x0000024643B20000-0x0000024643B30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3660-256-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3660-230-0x0000021EB0180000-0x0000021EB0190000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3660-135-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4328-229-0x0000021ACCCF0000-0x0000021ACCD00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4328-177-0x0000021ACCCF0000-0x0000021ACCD00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4328-218-0x0000021ACCCF0000-0x0000021ACCD00000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4328-164-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4376-3-0x0000000005970000-0x0000000005980000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4376-0-0x0000000000580000-0x00000000008FE000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/4376-6-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/4376-7-0x0000000005970000-0x0000000005980000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4376-2-0x0000000000580000-0x00000000008FE000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/4376-1-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/4376-37-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/4376-4-0x0000000000580000-0x00000000008FE000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/4376-35-0x0000000000580000-0x00000000008FE000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/4376-26-0x0000000006C60000-0x0000000007204000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4376-27-0x00000000067A0000-0x0000000006832000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4500-232-0x0000018B20A50000-0x0000018B20A60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4500-262-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4500-85-0x0000018B20A50000-0x0000018B20A60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4500-83-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4500-84-0x0000018B20A50000-0x0000018B20A60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4500-216-0x0000018B20A50000-0x0000018B20A60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4576-88-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4576-228-0x000001D455A30000-0x000001D455A40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4576-260-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4724-206-0x0000023B29990000-0x0000023B299A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4724-217-0x0000023B29990000-0x0000023B299A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4724-257-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4724-201-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4724-207-0x0000023B29990000-0x0000023B299A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/5064-210-0x00000173EA250000-0x00000173EA260000-memory.dmp

        Filesize

        64KB

        Download

      • memory/5064-208-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5064-264-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5068-211-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5068-219-0x0000018B3C210000-0x0000018B3C220000-memory.dmp

        Filesize

        64KB

        Download

      • memory/5068-259-0x00007FFF80800000-0x00007FFF812C1000-memory.dmp

        Filesize

        10.8MB

        Download