f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462

Analysis

max time kernel
40s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/10/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
Size 3.2MB
Sample241022-fm56dayemd
SHA256 f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462
MD5 17a073a9c8986b2b481423d67f9b1751
SHA1 eaa353f21e3f6afcc6f2f38e2a69954d935dacd8
SHA512 1c1546d6acfcd9b524856cc54d778e56518d4ddefaac85ca7a74cc0ee4a3834af3cf4d20f4e93fc0bd613a5fb518bd79bd770871535a562b3bae80f2c07b459f
SSDEEP 49152:M5k1YCdptya507NUUWn043oHS3fTGYwVq1/xT3DDbw0TUqyg/snji6attJM:CNhSqYw8y4EnW6at
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 31 IoCs

pid	Process
476	Process not Found
2608	aspnet_state.exe
2596	mscorsvw.exe
1932	mscorsvw.exe
2264	mscorsvw.exe
2140	mscorsvw.exe
272	ehRecvr.exe
1708	ehsched.exe
2768	elevation_service.exe
1752	IEEtwCollector.exe
1636	GROOVE.EXE
2904	maintenanceservice.exe
2540	msdtc.exe
2156	msiexec.exe
2904	OSE.EXE
2628	perfhost.exe
2588	locator.exe
1580	snmptrap.exe
3112	vds.exe
3212	vssvc.exe
3304	wbengine.exe
4064	WmiApSrv.exe
3272	mscorsvw.exe
3240	wmpnetwk.exe
3960	SearchIndexer.exe
3868	mscorsvw.exe
3948	mscorsvw.exe
3300	mscorsvw.exe
3732	mscorsvw.exe
3696	mscorsvw.exe
3800	mscorsvw.exe

Loads dropped DLL 13 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
2156	msiexec.exe
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
772	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\msdtc.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\vds.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\wbengine.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\System32\alg.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\c93bad3c7c3b6b19.bin	mscorsvw.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\SysWow64\perfhost.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\vssvc.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\dllhost.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\msiexec.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\locator.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{5EB8F02B-573C-439E-BE36-635B3B6563D9}\chrome_installer.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GROOVE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{7E1ED124-AD2D-42C1-9ACC-C88E6069DC61}	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{7E1ED124-AD2D-42C1-9ACC-C88E6069DC61}	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2240	ehRec.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2764	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
Token: SeTakeOwnershipPrivilege	2564	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
Token: SeShutdownPrivilege	2264	mscorsvw.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2140	mscorsvw.exe
Token: 33	3060	EhTray.exe
Token: SeIncBasePriorityPrivilege	3060	EhTray.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeSecurityPrivilege	2156	msiexec.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2264	mscorsvw.exe
Token: SeShutdownPrivilege	2140	mscorsvw.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeBackupPrivilege	3212	vssvc.exe
Token: SeRestorePrivilege	3212	vssvc.exe
Token: SeAuditPrivilege	3212	vssvc.exe
Token: SeDebugPrivilege	2240	ehRec.exe
Token: SeShutdownPrivilege	2264	mscorsvw.exe
Token: SeShutdownPrivilege	2264	mscorsvw.exe
Token: SeShutdownPrivilege	2140	mscorsvw.exe
Token: SeShutdownPrivilege	2140	mscorsvw.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeBackupPrivilege	3304	wbengine.exe
Token: SeRestorePrivilege	3304	wbengine.exe
Token: SeSecurityPrivilege	3304	wbengine.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: 33	3060	EhTray.exe
Token: SeIncBasePriorityPrivilege	3060	EhTray.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: SeShutdownPrivilege	2724	chrome.exe
Token: 33	3240	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	3240	wmpnetwk.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2724	chrome.exe
2724	chrome.exe
2724	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3916	SearchProtocolHost.exe
3916	SearchProtocolHost.exe
3916	SearchProtocolHost.exe
3916	SearchProtocolHost.exe
3916	SearchProtocolHost.exe
3916	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2564	2764	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	30
PID 2764 wrote to memory of 2564	2764	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	30
PID 2764 wrote to memory of 2564	2764	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	30
PID 2764 wrote to memory of 2724	2764	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	31
PID 2764 wrote to memory of 2724	2764	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	31
PID 2764 wrote to memory of 2724	2764	f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe	31
PID 2724 wrote to memory of 2732	2724	chrome.exe	32
PID 2724 wrote to memory of 2732	2724	chrome.exe	32
PID 2724 wrote to memory of 2732	2724	chrome.exe	32
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2788	2724	chrome.exe	36
PID 2724 wrote to memory of 2920	2724	chrome.exe	37
PID 2724 wrote to memory of 2920	2724	chrome.exe	37
PID 2724 wrote to memory of 2920	2724	chrome.exe	37
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39
PID 2724 wrote to memory of 3064	2724	chrome.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
"C:\Users\Admin\AppData\Local\Temp\f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe
  C:\Users\Admin\AppData\Local\Temp\f7b20daa6084a64c49db13eeadbbdfc2d188845a7b516a9752af4f286bb79462.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=92.0.4515.131 --initial-client-data=0x180,0x184,0x188,0x17c,0x18c,0x140221ee0,0x140221ef0,0x140221f00
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6f19758,0x7fef6f19768,0x7fef6f19778
    3⤵
    PID:2732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:2
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:2920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:3064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1408 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:2
    3⤵
    PID:1688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1332 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2892 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:1744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3568 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:2028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3684 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:2512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3740 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:3360
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:3400
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fd67688,0x13fd67698,0x13fd676a8
      4⤵
      PID:3388
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      PID:3756
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fd67688,0x13fd67698,0x13fd676a8
        5⤵
        
        PID:3812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3732 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:3472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4008 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:3480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3776 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:3620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3744 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:3672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3660 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:1
    3⤵
    PID:2664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:4024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4072 --field-trial-handle=1396,i,3511739462727925471,6747844116536568231,131072 /prefetch:8
    3⤵
    PID:2736

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2596

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 268 -NGENProcess 26c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 268 -NGENProcess 26c -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e0 -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2e0 -NGENProcess 2d4 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2cc -NGENProcess 2e8 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2cc -NGENProcess 2e0 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 284 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2f8 -NGENProcess 2d0 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  PID:4028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e0 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:4032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2fc -NGENProcess 2f8 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:3712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2dc -NGENProcess 2e0 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:3732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 300 -NGENProcess 30c -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:2560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2d4 -NGENProcess 2e0 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:3520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2d4 -NGENProcess 300 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:3248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 2d0 -NGENProcess 284 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:3968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 31c -NGENProcess 300 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:3604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 308 -NGENProcess 2d0 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 308 -NGENProcess 300 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:3956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 320 -NGENProcess 2d0 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:1192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 324 -NGENProcess 330 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:3364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 30c -NGENProcess 2d0 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:1424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 334 -NGENProcess 320 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:3256
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 320 -NGENProcess 32c -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:3496

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1556

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2140
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 158 -NGENProcess 15c -Pipe 168 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 16c -InterruptEvent 1e4 -NGENProcess 1c4 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 154 -InterruptEvent 19c -NGENProcess 148 -Pipe 17c -Comment "NGen Worker Process"
  2⤵
  PID:3568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 154 -NGENProcess 1f0 -Pipe 148 -Comment "NGen Worker Process"
  2⤵
  PID:3496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 19c -NGENProcess 204 -Pipe 1dc -Comment "NGen Worker Process"
  2⤵
  PID:3068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 19c -InterruptEvent 1fc -NGENProcess 1f0 -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  PID:2520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 200 -NGENProcess 20c -Pipe 19c -Comment "NGen Worker Process"
  2⤵
  PID:3648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 1fc -NGENProcess 20c -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  PID:924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 1fc -NGENProcess 200 -Pipe 1f8 -Comment "NGen Worker Process"
  2⤵
  PID:2352

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:272

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:1708

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2768

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:1752

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1580

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3960
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:3916
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
  2⤵
  PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OSE.EXE

Path C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 706KB
SHA256 d4f6c7f960bfda0171255afbc048768a9e859b85d56d902835f8f580b763298b
MD5 84789d9c395e532627dbf0fc6832eed6
SHA1 15a726abc4f6878ce7029069b6e935c2c1e3167a
SHA512 7bc665db0e1b61d6b6bd28e37ae29c7a7df4273ab2e493fd924a6d92a3c955cd155d5dfd2df076aab6fe7800c52ac3ae7bd6f2cc05378d27ebe405e4b29615b7
SSDEEP 12288:Pc2rokFXKGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:PcKoMdt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

GROOVE.EXE

Path C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
Size 30.1MB
SHA256 dcd4eccebd9cd07b9d1fc4c52101bba47cb2412512651e8ebac64e4d0e14814a
MD5 d55b7ec97561ee922f6f235c354b96f0
SHA1 710d0a2dc3f8ae3c33fa38f531d0251f7b1e92e1
SHA512 ac17426c31f9fd100405c1aad2664a2a79d8e9508e6e215d795b79d22cac2c9981aa66aba1d03b4724d9501195c26adb095d00878cd663d434817a1fc9f1d2fd
SSDEEP 393216:HCTn7ItpJjH22kopVu/vWrn2hIhF4HPrmdTF64JmiHRjJWoTBxf2u4nc2PJPGa0+:HEcR5kYVu/efhF4vm64Ljg2Kc2PB0zN
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 781KB
SHA256 69df2a7e54739042426cc414e811f9b8ebdfd0daa45cbbef26c8572ee2ffd9f8
MD5 15f9eeb47fb82f8d37810b2984c1ebc8
SHA1 6869192f92555d05eaf6ac02458890dae058b6a6
SHA512 00596d3f5649b8aff516d1139248798165d9b3f557c4aa9c73f4ca5a8d33ff97dc2c192efa877bb331acef38233e027c0c0e2cc8bf81d731ea6b9e5ba5587336
SSDEEP 12288:OCVP9Q/JcuiMGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:vPsJcuiTt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 808bd0a0f1d27c0c745ba1b930ccf2a3c34134b31423e844c0b3e425eb1adb79
MD5 d8bc96b6135f83ec22c8df01a9675cef
SHA1 48824bd35cf91e84a66e02d575663c6cbfd45f1c
SHA512 6b6723852f14a53b0fd54e27de4b56ea447ed84d00c7b1b3c21f0655d5f5d6d64a27d1998f5d299fc8657385f5ddb03363d9053fe9f1c272df2c20309c10eb8d
SSDEEP 49152:3a/3xXBSZ4K5MJ1LvTMxbYsYBYSgxu9+fw4TE/snji6attJM:fZ4K5MJabYsYNpEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

b46577be-a556-404e-a55e-94eba7976283.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\b46577be-a556-404e-a55e-94eba7976283.tmp
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.0MB
SHA256 e2743872f945130414553f3b9415d9df297d14e3f8e5a5b335a8cc597d1736a1
MD5 bcf73ee3f97bd49421d68bc3c3a86daa
SHA1 e707e9bf2bc043621983a0d28337955ae8e83ea9
SHA512 ef3f4e5830ba33ad901a958109e10962c655689df34c0af1483e1a9cb31d8aa2eca17af95c8952980e49f5fefbe1e6ce1d1b687eabec015dc74bdc846ae063af
SSDEEP 24576:jj9F3pnjgGHVVPZRR+riYiPe2QrUuxDn/Hu8Bsjt/sBlDqgZQd6XKtiMJYiPU:lMgVRWpdnrUuxD/O8W/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSS.log

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
Size 1024KB
SHA256 1dad898b201bbca3ba2484872447d1e184522c88178e4da6d9a374920980fb20
MD5 e0707a7fc169d2dafee527a575942dd4
SHA1 9934b6f171208092a010f8b5437a9023a50a489e
SHA512 7c863def97ce71dd123070a2d0b63e9787c0e5671f552eced86fac5fdbb082adbf895d94e88b731e48f9ff2de8d7f03a7ade02113e84577eb50c1a638508b23a
SSDEEP 6144:kfrJ6WFenTfjIwCIGY6yIGY6pHY42RPWzLIa7yzLIa7vmP:DTfHgwHY428e4
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 44b5004d498de3043d1f4775bdbeecf54135c83125021a3e68fcded07299936b
MD5 ba9989410d716a22402772f7579c497b
SHA1 e382fd8a875080e0bc8d207a7714f1bb80e49166
SHA512 bc9b14c99089e450cae307b7439b4624265925eeee20a89bf6dc13a9e6f4a54ab242d095d0549cbffa3cd88ea622eb1ea9d6ad9154a3b75a09448aabae4c1c5b
MD5 SHA1 SHA512

Submit Download

CURRENT~RFf76b616.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT~RFf76b616.TMP
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000004.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000004.dbtmp
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 70246fc6e5256bdf8d44bb72f9ebc1032ccfaee8bf7e7d2b2819cfa681b1e56c
MD5 07c2fe9c126d99949ffac7adddbd8bb0
SHA1 6ad2d589d3540af6c97e42a901dbd77e2192dad8
SHA512 62bded74e1f4d7ab3aa226d0071ef490aef8b4639eac10fb9043cf498fb10feedd4758f6310fc04a0fe154edbf0eae7de4d8fdd8ab61b423915c356c23487257
SSDEEP 96:A4CTbzusi8iZRy7Di+6MsmdeMBOt6kgjVlVup:ApX1i8syy+FljjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 4KB
SHA256 612ad89bdda030c64701c0e04affa773dc8e730ed0a511d032c1e619b8fb80f5
MD5 ff4af6811421fcb7138f26a4206f444c
SHA1 67ca145de24d4d87e74be094626cf5b5efe30d0e
SHA512 e66dc4e1bcd76ce77b7532552dede47f5b317d729774517622fdd77178dcd21b2ae7d19d21dc64191fe8d4e89661de994e36659be66127d4160e7c053cdbaf25
SSDEEP 96:A4CT0XO/Bzusi8iZRy7Di+6Msmde4Ot6kgjVlVup:Ap0U1i8syy+FVjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 10KB
SHA256 690d6188ac79ecf663a743a82c0195c3aec4b44e4548db4589f8fb2609f4e043
MD5 fb8075294c1730bbb3b813d5d7303ed6
SHA1 f3803c5a0592d34998d60a699aa5a5bc387f99f7
SHA512 c71d1d00eac02c89ef9728594b9658b11b673649079b1b47c2206291ef754b6f15d63e5d0608447c9fe882bce3d7e1eb888b5db36724714d68b55e16f5f06242
SSDEEP 192:M440X+Z1kXqK4I40pUZNCgVLHrKHfFyxrUKKT0KPTLgFxz9Xy:M+XK1kXqKf/pUZNCgVLH2HfkxrU2KbLH
MD5 SHA1 SHA512 SSDEEP

Submit Download

000007.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Size 16B
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 346KB
SHA256 08ed9eabe5e650fa42082589072fd1a3af4bd541e09a81f3f8956d5073c1a35d
MD5 a192ecff9766b7c2f70439bacb22a83c
SHA1 d04697f8d6b6a6e72f77e1d8cda8e0f5c8b0cacf
SHA512 af5c2ada7e3e8ff5f093982458481cacdffc59c910ee1aebe0696300dbd2e8801b6d5e7a1ad87e663e4830e61253d69d9557d758bf0d0d4f4970345f16525697
SSDEEP 6144:khbqQrMULg5Akua6/UoYxVm3xrV1fxUkVUQ8X3iepo9+zJwEBL1jXwmoi90yyp:RnqBkulshzm3xVlmPQySewIPKmoiiyyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 346KB
SHA256 a3d2afbde60bd062fca63c618c60b1b71992c163b54284bd697c53233e596677
MD5 6e9ce15c183dd0056bccffc3a64d9a4a
SHA1 94fd2cc2950485da1a9fac8def7fb164e27cda4e
SHA512 210060b9d66415571775f69a9452708fec21b502ae779a06d4666078d1d47dc38a26b5644afeb9a0ce001a0e7c75fb11a28525eb6b2668418a7fd2afe89a952b
SSDEEP 6144:k5bqQrMULg5Akua6/UoYxVm3xrV1fxUkVUQ8X3iepo9+zJwEBL1jXwmoi90yyp:LnqBkulshzm3xVlmPQySewIPKmoiiyyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 363KB
SHA256 a2b13cc5f0c769f5b7ffde0586f443a6b4aae765e2531083772c65587164bd21
MD5 b95c52f804a8be7314eb89ae997054cc
SHA1 008fe71a4b7a6f96c08c08ae620c08df8c9e5600
SHA512 2575c6f98356ec065c019a5e7222ed7801f5833690c6555521cb5d307792311ec69a3bf3dd7b8b6ec720e487de30ab9a443d0428bf9aad86c1ea92c2d97b9e63
SSDEEP 6144:k/O52SbqQrMULg5Akua6/UoYxVm3xrV1fxUkVUQ8X3iepo9+zJwEBL1jXwmoi90H:MnqBkulshzm3xVlmPQySewIPKmoiiyyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 170KB
SHA256 143b642dd63245f1e240e690d3cd1c675005973d5efe1401b283afb6490d544f
MD5 f279cb6cc7bbb8f67ef26a3a6835c95e
SHA1 b8b5ce11c1bbb7407262075135847fae62212b2d
SHA512 11098a80ec3cd83aff64432209bd9d59fe1f01b1de156ce7721d032acb3d9595f1e18b2677d0e083be9bc0239a80c61477784ed8cf01e3a4f50a267717d11e9f
SSDEEP 3072:qgkVoNQ8X32zepo9+jnk+NuZhU36CL1fsMXNmfWrbH09BjrAKWxCSJ0yyobL:qgkVUQ8X3iepo9+zJwEBL1jXwmoi90yn
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 8KB
SHA256 4e0e286986947d5e3744af4289f3637c9e2c48e5e9d375c1ac28c44f78fdbc93
MD5 e77a66daf2c1503d02705dd822002b26
SHA1 6d627d5a275e91343fa832e33a4e0f7955b1c73c
SHA512 2e4155fb4d8a20fb5df622cb7440c1ec923990a507aefc22bfe37da7ee21aded5d52deca8615475f6f2a0f89157663b9d232a67f5694c02301abb360c003beac
SSDEEP 96:a3ajzvE62pRpRa2ixK3nTK3NPC//ocI5qPxK2rK2QEmHH5rO:UEoXK6Z//oT5ihwHH5rO
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 9KB
SHA256 7f18b5cefa70dbcfb83f24670a4352f7ea0ca828eed83f2325016298c383070e
MD5 f1a2041ae62305dafda84182a11fc3c7
SHA1 a5eeee7135be04b6b71a1232c46bcfd8dad2185f
SHA512 d00c175afc7f016c7076bd423befa883faf6157fd212f6b2579657de739ffd9112e40a2d9b03be68cd25b2aef6d36e995f2a2c2936eacd4ce9ec4a468af8c38c
SSDEEP 96:a3ajzvE62pRpRa2ixK3nTK3NPC//ocI5qPxK2rK2QEmHH5r9hKxK33K3d:UEoXK6Z//oT5ihwHH5r9hC6+
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2724_989419304\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

e2f5d2e4-f69c-4f0a-ac01-b4e264ec22fb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2724_989419304\e2f5d2e4-f69c-4f0a-ac01-b4e264ec22fb.tmp
Size 88KB
SHA256 d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
MD5 2cc86b681f2cd1d9f095584fd3153a61
SHA1 2a0ac7262fb88908a453bc125c5c3fc72b8d490e
SHA512 14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
SSDEEP 1536:bCwdkDMb+jCnnSGIdfT9zcbF6gNoLNdN4XhCJQS1pOn5IJ1pD:uwyAbvShdf5CkgN6nmkOup2oLD
MD5 SHA1 SHA512 SSDEEP

Submit Download

b91050d8b077a4e8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Size 24B
SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
MD5 b9bd716de6739e51c620f2086f9c31e4
SHA1 9733d94607a3cba277e567af584510edd9febf62
SHA512 cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
MD5 SHA1 SHA512

Submit Download

c93bad3c7c3b6b19.bin

Path C:\Users\Admin\AppData\Roaming\c93bad3c7c3b6b19.bin
Size 12KB
SHA256 d23e14eebd80014740a1c96ad677f6c8cef08faf3bbe0197b4507925b9a54b93
MD5 1dd99d91cb57d1405065f1d240c4bf70
SHA1 90d9f42f59fe35c3bdf86e03314b944dbe80b59f
SHA512 53342fa3659a11b74b7da76383ad2b367ff281bca19b1c4ca61373dbb27b968225f7a12270e52268148cb65d08240ba9c5660832f19610d081e067585e187c9e
SSDEEP 384:XdCyN2OQaiDY4V+jXqAwJmd/qZ/X/Tpfage:tCfdai8gojycge
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscorsvw.exe

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
Size 648KB
SHA256 f9c0071bb57208c903ed1e9ca11118d410d65cc8f49fc4eed9ce800758e84928
MD5 7bba5a415e70d7cc8d99000c78ab6aa9
SHA1 484d55245faf5abcd3a7bd967e8db8f9160aa99d
SHA512 191ece853ca2e71695a2d99d98a0ad050cfbba9a1865641cff7b87d680361983d497e254df9ab087c4cb644410d2bf034f8c99a0e299d08f17646b490a72dd5c
SSDEEP 12288:yyz2DWUTGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:nz2DWTt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen_service.log

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
Size 872KB
SHA256 802ad8821575049c24ea2081c38b8725ecddb2bf3db2a366d84c59837b03ef80
MD5 d9216394782daaa5bed4f425ed951bf5
SHA1 4f0324c17c7b9a165e705fff9f8f7a166aa93eb3
SHA512 d89be33ccb9a25cbecbd0a61d95f24bcbc8c1dbc81bf9bce838ccba7809853bfad93c707a0caba457850807de38a8b571b5d98039078a2476056e8f79db78e5d
SSDEEP 3072:BJlin7NO9ihISrXd+VDIIlLoHxGKDDLkHKaFF4j1kDy8ySiaL/FCXkO+Mi5FOtaF:1Gen1
MD5 SHA1 SHA512 SSDEEP

Submit Download

aspnet_state.exe

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
Size 603KB
SHA256 f9519e1fd3debaa6c36af9d38a08993ef73489408b54c662528cd43dba82647a
MD5 d1b94b4c3e4e5f7d82de48927b8e581f
SHA1 491ce7ed34cfc042554be75c61c937bdfb54239b
SHA512 e46b356ff2f797e69c52865adab1b7e7cf28b0913941dea5ad2cd4222c6c64fde8e166783eccafe93a2c21d5c376cfd5032dd0d4fff03d0c10d844b6ce925b3b
SSDEEP 12288:JRg1Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:JKYt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscorsvw.exe

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
Size 678KB
SHA256 b2af49858f9246980cc19bf5f6a9713d09b60b039cfddd3ab5024f83ab764e37
MD5 134d8cc7b3ec8d6eada04c390d14da05
SHA1 75d14483604fb51e06f157b9b385e4196692fd1d
SHA512 32f5d73ac2125d8003d8e824c6d514d6a0cd36d99590ae6530588adb549e3be4e4c7b9917f89a2c7104c0233dde71d443a03e9c26cad88df6d2731f11784f4a0
SSDEEP 12288:9uU58XM6Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:1wMdt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscorsvw.exe

Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
Size 625KB
SHA256 ef7a2dc8f35ff08e18fa671606c376cedcf2c45d530ddd555701e55664a9bd4c
MD5 ca344b2eff8af9715a15c541b1789e38
SHA1 ec0c711ef50b351c44b64abadf9ac314abc64055
SHA512 d9920ed9ea775f6597fdda1100a58d68433743ddfe4ef7448e4162ac7790920b59c627cc8cf0ff39140ff84a82bb72a4522e00fbf4134eee00e75719ac93e39a
SSDEEP 12288:QB8Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Cjt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen_service.log

Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
Size 1003KB
SHA256 046b6dd506d9a671afe684d6b7c96c88363ba9ab6845239668464b5e57812957
MD5 e8a5a711791f3b83c9efd0a5d83c953b
SHA1 6ec24cc66fb5148ca5f6474ade72faffa7400b7e
SHA512 9a51c61ea2a03467b0ec1863d6f3b37bee6877540fbe06d17cedca3d24d44cb4427d589cd9d58c1fb8c93306eb425c7c99b0f9e82835bb79fd9f1bc133927508
SSDEEP 3072:GRMah2vsXHPXVstx03rOROkxkZV4CDZLXvqX+RX/VaW0wjxl/Kl4R5jozK2S9q/l:+lHzwky6M
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscorsvw.exe

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
Size 656KB
SHA256 08dce3e1e22bf80d70196c7d52f7c37d71db9e09a2b7e78a91d899b1b79ee392
MD5 4d090b5027ba2e7dadec0582148496e9
SHA1 d6d7d8492c0ae51842b1a46692ca358c4d3600da
SHA512 ea6f094e3cc716b052917d6a5892e5bed81856a91973a13998b67d9c618b8b1da05742c90ee8063c6e43422d70f3ece7b5d3d9e0206fb6a21c79fdc46fc07996
SSDEEP 12288:KjVvGOBGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:KjVlkt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

c93bad3c7c3b6b19.bin

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\c93bad3c7c3b6b19.bin
Size 12KB
SHA256 a981b5a2b4b6392ec374818d2210a11abe262dd486bc9d5d38076a4979f6aac5
MD5 bb4bb47d18c7cb94b97e398af3e645a2
SHA1 2cc72883433c6cd7d9652d1eadf6d77ace0a9cfa
SHA512 4b3ed050315812ede7bd4c73ece68255b1bd9666144e8c65a1dd161364c6a14a2fefc79b87689c8d11208b1a622a6cb90e110ad094d95c4281e9495db83e6083
SSDEEP 192:Fyb9WvLnxRr/Hp5xH5ZnrszLQ12f6WjkpTL+syRctQr/tLodSWJNoyGQ9M1+o1+:Fw9qnxh/pHQ3kTL6c+qiIMJ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 587KB
SHA256 742ac39ec0936391722e9dd2e81bcc7c39d042bf6cff8a462476880d983c2eab
MD5 4a6f02fc88441673cf146a6acc43cd0d
SHA1 78c787821dd33db5f6835f9de0b908d5d158aad1
SHA512 bb1994edbd8919b6d1dab653b8518b06b7a216590088b9a9870a036334ba21214e2ded78baebe03b644cec3de5b2dc1b0d340570b78a9d2461f1d6e4da3d3d36
SSDEEP 12288:yGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Vt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.1MB
SHA256 dd34bf148b8fc2b3df2bd382b317d85a7e2b5200b42ccc110b5cab8f5c959321
MD5 49c0d633bd7d380f0a43f86093e42e0d
SHA1 580c74c96bd9c3d62987101995a3340662a26aab
SHA512 cac2da4d52e35adbab11da3027fb3b4ce08384d0b1cfc5771711b916904eddfb68b1c69a34ec460f762a03b7141e56fe53cc4eebc3bb5531b0486e66edf19fad
SSDEEP 24576:2hp0/eqbFM4Et/sBlDqgZQd6XKtiMJYiPU:NmqbFM4+/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.1MB
SHA256 6d2c3617897146826117f7dd37bff2b8443b501973f75ef6208109ef2ea89e5e
MD5 415a1074c1a96e1167603dd2bc68ba72
SHA1 d026d6afbaea0fd779ce517bd530445a00ae93d5
SHA512 01c825f558adf77131ce7d29e0a102022be0c0dabec0e081383818b13d11691d006909f9780c85ef87327fe3aa693a2f944057eaba1b28641fa5ccd9d946a9f6
SSDEEP 49152:X4W+J/pHuR7n20mT4FE2LnhUxf+/snji6attJM:o/x2EnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 644KB
SHA256 30151aa18af84dafb1470b006ce0e31027b508cedb7eb08c51b5894b69f3d52f
MD5 672bce98436874da97e78f1c766a9e80
SHA1 ccf1c14261972327b0f9b4386d8bf521d6c3839a
SHA512 b6f92ffadfb7238164ef5693c19d1096371ade9d8c8f1c684be74a1420a890d399dff2ef48686b0d73ee88a8a99a66a6cdf220592d108d644dd9dd392d925550
SSDEEP 12288:TLW4Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:TLW/t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 581KB
SHA256 5dc409681e6266b0d1c7c9b1a3a5db9b641524cfd04bc7b9204c3dc8af33577c
MD5 23769edeffdb00ddd7a05fa81f75a65f
SHA1 87dad40654e7840bec75045e45ab2a99498ef1bc
SHA512 4c6695201ade11150235cf6411f66a1794b20dd298eb5341b10d67aa62ca67cb6667976fe7f43696ce83e51562742d96ddef611828ee826e46c22889c40a43f3
SSDEEP 12288:0ZGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:0ct/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.1MB
SHA256 4de545ba1c4c8e38679c96c94819b08feb97193b815d3f9ea4341a4a740622bc
MD5 99ee73902223bfa1b99ff8b0d0f8aa7c
SHA1 585f0b5a530831b5bb11e7a009791f129cb40a4b
SHA512 818ec645222fc512ac4ef1627a45632692076660a5e77a25d73ab3b5ca59f49532f890360759145881fec9dec9e2fd26960553b960455cc2af6b2618a5ee0617
SSDEEP 24576:QvMgzNciyYe13kvoU8t/sBlDqgZQd6XKtiMJYiPU:2cibeUoUm/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\TEMP\Crashpad\settings.dat
Size 40B
SHA256 b7aeb8790dd68c456516fb0df8b76f856fb798b342559ef663c22ccf749dc9df
MD5 2e7f92a8e310a130fb8b4ea7610b2a87
SHA1 30e6d59da04c6c2c397d0da17e46a13f0bba8478
SHA512 a3c157d9bd26402e2ef307d7c9822a973f1e9a95bccaabffab0837db1b6b615dbd58448dd6fbba4e3bdd5dfd01022da0c424f305d35c3ca9da08222d4e5f4aab
MD5 SHA1 SHA512

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Size 85KB
SHA256 d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
MD5 5180107f98e16bdca63e67e7e3169d22
SHA1 dd2e82756dcda2f5a82125c4d743b4349955068d
SHA512 27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
SSDEEP 768:AiQR6AHSZn4NTUVkNEwztMGgRFiJiGqKlyzzCZ62MPFeA:aR6AHSZn4NTUVkNlhMGREKt62MPFe
MD5 SHA1 SHA512 SSDEEP

Submit Download

ehsched.exe

Path C:\Windows\ehome\ehsched.exe
Size 691KB
SHA256 4d91f926b05c3e9bdae5e58f48dde6b0e7435ee33fcc4e979e46522552b0ec1f
MD5 b4d76247fddfee126ef5f985eb230e5c
SHA1 1a44d01da596c03161ab3fa40d93b40abf4b5f97
SHA512 296aed58904e21ac302e8a81ddb1f83fa2f6fabdeb935ec12e4d78dfa40a02c89b9fbce0cba3d751160c9231ebdad1f8d52c5b5f6ec626396cb6829e3c7bfa36
SSDEEP 12288:OwXAwhVGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:pQwh4t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path \Windows\System32\Locator.exe
Size 577KB
SHA256 9320712ce983ead47dc8f6a4901b716d04c852caddb34c081cabfd85a1311b5e
MD5 e8c0ac9838183b42752eead34b3e042c
SHA1 1c272894fb48249679f730ded87e0e8873429aab
SHA512 3079a285dbf31e1a666ffc2f67487ea63b3ccb5c7cbc4813139832d3120982772140319d389d7b22ee28d6a2397a3a03a86df1c816537777998336f5a21c4baa
SSDEEP 12288:zGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Ct/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ieetwcollector.exe

Path \Windows\System32\ieetwcollector.exe
Size 674KB
SHA256 4338946b11875679c75caf3654b12d57b71b244779e0737ea94c4b5644497749
MD5 8f5f176c61899e58f80563ba01974f63
SHA1 2170f300a8dcd91f5fae4439dbeb8d9a14f46922
SHA512 8f9a2f290bbc8a7dda3c363e93b083bc0e70b8a618f4c4f14893e1e4eb80f5f24c7945235a4928aeda86b40ca8f7ebc0c6cd31fa636ca35b6b1acd0c65909895
SSDEEP 12288:2IWELGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:53at/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path \Windows\System32\msdtc.exe
Size 705KB
SHA256 328446b17faba495f2dbde1c0640ffb8d80f7aaf4eeac76131301cc367e80b8a
MD5 d5d71ebcb5c4b37d03c2d473fc6f2d75
SHA1 ba886ddd8ca66eacea08c6895e85799f5952d08e
SHA512 fc710f73e37bd5d9025e5f5ce280cc112b123fd6a123876da0b6417484d31819f6a4fc217ebd878e7205598a24f0faf3230048d023c83c3f8c315e1bd2a40954
SSDEEP 12288:PkykGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:8yrt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path \Windows\System32\msiexec.exe
Size 691KB
SHA256 d702f94192779a7a5bbcbee6e398477123fbe399af21c1df57946bb9da688111
MD5 9b6b08333c7d88d8091f9d52d3bc49c3
SHA1 ae8dac8391aa8053b965f6df68720f241e891f64
SHA512 b5d363db8d4ccf1faf31aea7cd71b9cb5c35819a1646e4204c2517f33260b92cc38d4e13148aa02357c181267040dad27e4b348e4f4a77e31f2743c482b7525b
SSDEEP 12288:icCvO70oQkGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:7LQrt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path \Windows\System32\wbem\WmiApSrv.exe
Size 765KB
SHA256 05bd454fe9c89eadf0c67d503a95c626ef1ae98f02e96c7b53c530b39ae67594
MD5 b0e5c02feb0e9e029d5c7c661f602ce2
SHA1 874e9ac256dc14b5193b2f0c934e3ef6fd5ecf3f
SHA512 d8f6c6022547a048d2ee5b08b7d98bd996c64f7484b64f6fc941575f44abcf037bc5d1a8b31219ab590e5de64704c7ee9623c78d1b8e3abb534e4875acba2bb6
SSDEEP 12288:8Re8U71QtEhTGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:KZtjt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path \Windows\System32\wbengine.exe
Size 2.0MB
SHA256 5958a6c33fbf11fa56f391ae36bd5d078f80b356ec893c756949392d620f43ac
MD5 9ef81dcd56b288a55a03bb0a52d4dccb
SHA1 5a7e8d792ae09534f855cb4d84e28ec291f2ebdc
SHA512 8eaaa8b7108d10b9a835a67ca9efae3aa8686e79f9feb821c9cc9181e876e68a72e4c1cdea503cb7cfdc1a247e1a692abc091a5dc91159fefcaff24defa19012
SSDEEP 49152:tLbYI4I0bVKBUhx8CRSrzQ8vbeKgSRpXxmDYeQeaUx7qE7Yc/snji6attJM:VYZkBU6ZvCK/phm8eQN8NEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

ehrecvr.exe

Path \Windows\ehome\ehrecvr.exe
Size 1.2MB
SHA256 10e75955ebfc8f21d5a55992f4b2d9d15d6d024dacd753639a1b0979d3b1f9db
MD5 6d9356c3d4b35c974d1b07640f33fa9b
SHA1 afd8fefbabd9022fca85bd2d8c65dbd998e162e0
SHA512 d93d38871c3bbbac8eab7219d794e66dec120e4aad416a97ee78ddb1638c64a5f42855549e43f4399d6d3904fe298c334578685761cc92d012049573721bc4d8
SSDEEP 24576:GGne3OZEIOLMCldIgbYt/sBlDqgZQd6XKtiMJYiPU:I+ZizdIgbS/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/272-275-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/272-149-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/272-147-0x00000000001B0000-0x0000000000210000-memory.dmp

Download

memory/272-141-0x00000000001B0000-0x0000000000210000-memory.dmp

Download

memory/272-1403-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/1192-1356-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1424-1377-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1580-307-0x0000000100000000-0x0000000100096000-memory.dmp

Download

memory/1580-516-0x0000000100000000-0x0000000100096000-memory.dmp

Download

memory/1636-229-0x000000002E000000-0x000000002FE1E000-memory.dmp

Download

memory/1636-318-0x000000002E000000-0x000000002FE1E000-memory.dmp

Download

memory/1708-159-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1708-153-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1708-292-0x0000000140000000-0x00000001400B2000-memory.dmp

Download

memory/1708-1118-0x0000000140000000-0x00000001400B2000-memory.dmp

Download

memory/1708-161-0x0000000140000000-0x00000001400B2000-memory.dmp

Download

memory/1752-177-0x0000000000160000-0x00000000001C0000-memory.dmp

Download

memory/1752-1101-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/1752-185-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/1932-83-0x0000000010000000-0x00000000100A7000-memory.dmp

Download

memory/2140-137-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/2156-249-0x0000000100000000-0x00000001000B2000-memory.dmp

Download

memory/2156-250-0x0000000000560000-0x0000000000612000-memory.dmp

Download

memory/2156-360-0x0000000000560000-0x0000000000612000-memory.dmp

Download

memory/2156-359-0x0000000100000000-0x00000001000B2000-memory.dmp

Download

memory/2264-111-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2264-95-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/2264-90-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/2540-230-0x0000000140000000-0x00000001400B6000-memory.dmp

Download

memory/2548-1207-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2548-1193-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2560-1276-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2560-1263-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2564-19-0x0000000001D30000-0x0000000001D90000-memory.dmp

Download

memory/2564-12-0x0000000001D30000-0x0000000001D90000-memory.dmp

Download

memory/2564-24-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/2564-205-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/2588-293-0x0000000100000000-0x0000000100095000-memory.dmp

Download

memory/2588-508-0x0000000100000000-0x0000000100095000-memory.dmp

Download

memory/2596-41-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/2596-46-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/2596-40-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2596-131-0x0000000010000000-0x000000001009F000-memory.dmp

Download

memory/2608-231-0x0000000140000000-0x000000014009D000-memory.dmp

Download

memory/2608-33-0x0000000140000000-0x000000014009D000-memory.dmp

Download

memory/2628-271-0x0000000001000000-0x0000000001096000-memory.dmp

Download

memory/2628-494-0x0000000001000000-0x0000000001096000-memory.dmp

Download

memory/2752-1218-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2764-28-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/2764-9-0x00000000001E0000-0x0000000000240000-memory.dmp

Download

memory/2764-23-0x00000000001E0000-0x0000000000240000-memory.dmp

Download

memory/2764-11-0x00000000026F0000-0x0000000002A2D000-memory.dmp

Download

memory/2764-0-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/2764-1-0x00000000001E0000-0x0000000000240000-memory.dmp

Download

memory/2768-174-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2768-306-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/2768-171-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2768-165-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2876-1335-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/2904-471-0x000000002E000000-0x000000002E0B5000-memory.dmp

Download

memory/2904-232-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2904-236-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2904-258-0x000000002E000000-0x000000002E0B5000-memory.dmp

Download

memory/3112-319-0x0000000100000000-0x0000000100114000-memory.dmp

Download

memory/3112-528-0x0000000100000000-0x0000000100114000-memory.dmp

Download

memory/3212-546-0x0000000100000000-0x0000000100219000-memory.dmp

Download

memory/3212-326-0x0000000100000000-0x0000000100219000-memory.dmp

Download

memory/3240-496-0x0000000100000000-0x000000010020A000-memory.dmp

Download

memory/3240-835-0x0000000100000000-0x000000010020A000-memory.dmp

Download

memory/3248-1298-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3248-1287-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3256-1388-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3256-1374-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3272-1036-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/3272-495-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/3272-834-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/3300-1149-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3300-1127-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3304-338-0x0000000100000000-0x0000000100202000-memory.dmp

Download

memory/3304-687-0x0000000100000000-0x0000000100202000-memory.dmp

Download

memory/3364-1352-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3364-1366-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3496-1460-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/3496-1379-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3496-1391-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3520-1286-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3568-1459-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/3604-1306-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3604-1324-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3696-1186-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3696-1174-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3712-1238-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3712-1251-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3732-1266-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3732-1176-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3800-1197-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3868-1110-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/3868-882-0x0000000140000000-0x00000001400AE000-memory.dmp

Download

memory/3948-1137-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3948-1119-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3956-1345-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3956-1332-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3960-535-0x0000000100000000-0x0000000100123000-memory.dmp

Download

memory/3960-875-0x0000000100000000-0x0000000100123000-memory.dmp

Download

memory/3968-1309-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3968-1295-0x0000000003BE0000-0x0000000003C9A000-memory.dmp

Download

memory/4028-1215-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4028-1230-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4032-1241-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/4064-470-0x0000000100000000-0x00000001000C4000-memory.dmp

Download

memory/4064-757-0x0000000100000000-0x00000001000C4000-memory.dmp

Download