Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 19:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe
-
Size
4.3MB
-
MD5
c5fa349e28f61c4d3939c90fa02c9cff
-
SHA1
d47654f6f4c05f4203bfed705b64c79068aa29d8
-
SHA256
495633d1e52815876d5a36a16659b50a9e089ac94caafdee88b69ae3146b2b54
-
SHA512
436be719cac9e863d241f7897e860053254ea84717e6e89d6f7045a548501fa9df3a2806e57b1e87b7bcd79cb39c84ee79a626ba09ca0b050c780a0991bf9e36
-
SSDEEP
49152:E5PigeXnpHE21zKhYOPCP1/j2T37gZKUxT2cHF6c9OtutwDmg27RnWGj:EUpH11+hDPS/j4gDx2vD527BWG
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
alg.exeaspnet_state.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRecvr.exeehsched.exeelevation_service.exeIEEtwCollector.exeGROOVE.EXEmaintenanceservice.exemsdtc.exemsiexec.exeOSE.EXEOSPPSVC.EXEperfhost.exelocator.exesnmptrap.exevds.exevssvc.exewbengine.exeWmiApSrv.exewmpnetwk.exeSearchIndexer.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedllhost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid process 480 2496 alg.exe 2360 aspnet_state.exe 2544 mscorsvw.exe 2432 mscorsvw.exe 2416 mscorsvw.exe 2172 mscorsvw.exe 1584 ehRecvr.exe 2284 ehsched.exe 2032 elevation_service.exe 876 IEEtwCollector.exe 2220 GROOVE.EXE 1720 maintenanceservice.exe 1912 msdtc.exe 2128 msiexec.exe 2572 OSE.EXE 2400 OSPPSVC.EXE 2396 perfhost.exe 1444 locator.exe 1804 snmptrap.exe 588 vds.exe 2932 vssvc.exe 1704 wbengine.exe 1876 WmiApSrv.exe 2992 wmpnetwk.exe 2420 SearchIndexer.exe 1872 mscorsvw.exe 1484 mscorsvw.exe 2616 mscorsvw.exe 2080 mscorsvw.exe 2652 mscorsvw.exe 2052 mscorsvw.exe 1600 mscorsvw.exe 2328 mscorsvw.exe 2656 mscorsvw.exe 1076 mscorsvw.exe 1576 mscorsvw.exe 1872 mscorsvw.exe 1580 mscorsvw.exe 2372 mscorsvw.exe 956 mscorsvw.exe 776 mscorsvw.exe 2328 mscorsvw.exe 1620 mscorsvw.exe 1576 mscorsvw.exe 2956 mscorsvw.exe 2576 mscorsvw.exe 1512 mscorsvw.exe 1672 mscorsvw.exe 2104 mscorsvw.exe 2120 mscorsvw.exe 2108 dllhost.exe 576 mscorsvw.exe 2740 mscorsvw.exe 2088 mscorsvw.exe 2404 mscorsvw.exe 1340 mscorsvw.exe 1508 mscorsvw.exe 2432 mscorsvw.exe 1336 mscorsvw.exe 2364 mscorsvw.exe 2372 mscorsvw.exe 1632 mscorsvw.exe 2760 mscorsvw.exe -
Loads dropped DLL 64 IoCs
Processes:
msiexec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid process 480 480 480 480 480 480 480 2128 msiexec.exe 480 480 480 480 480 752 480 1340 mscorsvw.exe 1340 mscorsvw.exe 2432 mscorsvw.exe 2432 mscorsvw.exe 2364 mscorsvw.exe 2364 mscorsvw.exe 1632 mscorsvw.exe 1632 mscorsvw.exe 3008 mscorsvw.exe 3008 mscorsvw.exe 2100 mscorsvw.exe 2100 mscorsvw.exe 2384 mscorsvw.exe 2384 mscorsvw.exe 1508 mscorsvw.exe 1508 mscorsvw.exe 2660 mscorsvw.exe 2660 mscorsvw.exe 2228 mscorsvw.exe 2228 mscorsvw.exe 2372 mscorsvw.exe 2372 mscorsvw.exe 1584 mscorsvw.exe 1584 mscorsvw.exe 1728 mscorsvw.exe 1728 mscorsvw.exe 796 mscorsvw.exe 796 mscorsvw.exe 1584 mscorsvw.exe 1584 mscorsvw.exe 1536 mscorsvw.exe 1536 mscorsvw.exe 2304 mscorsvw.exe 2304 mscorsvw.exe 2528 mscorsvw.exe 2528 mscorsvw.exe 1640 mscorsvw.exe 1640 mscorsvw.exe 1288 mscorsvw.exe 1288 mscorsvw.exe 1568 mscorsvw.exe 1568 mscorsvw.exe 1888 mscorsvw.exe 1888 mscorsvw.exe 872 mscorsvw.exe 872 mscorsvw.exe 304 mscorsvw.exe 304 mscorsvw.exe 1632 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 23 IoCs
Processes:
2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exemsdtc.exeGROOVE.EXEalg.exemscorsvw.exeSearchProtocolHost.exedescription ioc process File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\System32\vds.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\System32\msdtc.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe mscorsvw.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\630270a8bfe435d8.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe mscorsvw.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exealg.exemscorsvw.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe mscorsvw.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe mscorsvw.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe mscorsvw.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\chrome_installer.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe mscorsvw.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe mscorsvw.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe mscorsvw.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe -
Drops file in Windows directory 64 IoCs
Processes:
2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exemsdtc.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exealg.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedescription ioc process File opened for modification C:\Windows\ehome\ehsched.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index14c.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4A49.tmp\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index153.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index150.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6162.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13f.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3BA9.tmp\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPC4C5.tmp\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14e.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAF52.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP19B8.tmp\Microsoft.Office.Tools.Outlook.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14e.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index152.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index148.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe alg.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14f.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13f.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPBFC6.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe alg.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14f.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index148.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchFilterHost.exemscorsvw.exemscorsvw.exewmpnetwk.exeSearchProtocolHost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\ShapeCollector.exe,-299 = "Provide writing samples to help improve the recognition of your handwriting." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\Speech\SpeechUX\sapi.cpl,-5555 = "Windows Speech Recognition" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074 = "Windows Journal" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10308 = "Mahjong Titans is a form of solitaire played with tiles instead of cards. Match pairs of tiles until all have been removed from the board in this classic game." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\wucltux.dll,-2 = "Delivers software updates and drivers, and provides automatic updating options." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exeehRec.exepid process 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 1792 ehRec.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exemscorsvw.exemscorsvw.exeEhTray.exeehRec.exemsiexec.exevssvc.exewbengine.exewmpnetwk.exeSearchIndexer.exealg.exedescription pid process Token: SeTakeOwnershipPrivilege 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: 33 2196 EhTray.exe Token: SeIncBasePriorityPrivilege 2196 EhTray.exe Token: SeDebugPrivilege 1792 ehRec.exe Token: 33 2196 EhTray.exe Token: SeIncBasePriorityPrivilege 2196 EhTray.exe Token: SeRestorePrivilege 2128 msiexec.exe Token: SeTakeOwnershipPrivilege 2128 msiexec.exe Token: SeSecurityPrivilege 2128 msiexec.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeBackupPrivilege 2932 vssvc.exe Token: SeRestorePrivilege 2932 vssvc.exe Token: SeAuditPrivilege 2932 vssvc.exe Token: SeBackupPrivilege 1704 wbengine.exe Token: SeRestorePrivilege 1704 wbengine.exe Token: SeSecurityPrivilege 1704 wbengine.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: 33 2992 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 2992 wmpnetwk.exe Token: SeManageVolumePrivilege 2420 SearchIndexer.exe Token: 33 2420 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2420 SearchIndexer.exe Token: SeDebugPrivilege 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe Token: SeDebugPrivilege 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe Token: SeDebugPrivilege 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe Token: SeDebugPrivilege 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe Token: SeDebugPrivilege 2152 2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeDebugPrivilege 2496 alg.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe Token: SeShutdownPrivilege 2416 mscorsvw.exe Token: SeShutdownPrivilege 2172 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EhTray.exepid process 2196 EhTray.exe 2196 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
EhTray.exepid process 2196 EhTray.exe 2196 EhTray.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
SearchProtocolHost.exepid process 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe 1276 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
mscorsvw.exeSearchIndexer.exedescription pid process target process PID 2416 wrote to memory of 1872 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1872 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1872 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1872 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1484 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1484 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1484 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1484 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2616 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2616 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2616 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2616 2416 mscorsvw.exe mscorsvw.exe PID 2420 wrote to memory of 1276 2420 SearchIndexer.exe SearchProtocolHost.exe PID 2420 wrote to memory of 1276 2420 SearchIndexer.exe SearchProtocolHost.exe PID 2420 wrote to memory of 1276 2420 SearchIndexer.exe SearchProtocolHost.exe PID 2420 wrote to memory of 2320 2420 SearchIndexer.exe SearchFilterHost.exe PID 2420 wrote to memory of 2320 2420 SearchIndexer.exe SearchFilterHost.exe PID 2420 wrote to memory of 2320 2420 SearchIndexer.exe SearchFilterHost.exe PID 2416 wrote to memory of 2080 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2080 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2080 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2080 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2652 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2652 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2652 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2652 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2052 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2052 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2052 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2052 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1600 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1600 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1600 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1600 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2328 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2328 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2328 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2328 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2656 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2656 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2656 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2656 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1076 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1076 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1076 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1076 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1576 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1576 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1576 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1576 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1872 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1872 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1872 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1872 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1580 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1580 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1580 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 1580 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2372 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2372 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2372 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 2372 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 956 2416 mscorsvw.exe mscorsvw.exe PID 2416 wrote to memory of 956 2416 mscorsvw.exe mscorsvw.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-07_c5fa349e28f61c4d3939c90fa02c9cff_magniber_revil.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
PID:2360
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2544
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2432
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1cc -NGENProcess 1d0 -Pipe 1dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1872
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1cc -NGENProcess 1d0 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 254 -NGENProcess 244 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2616
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 244 -NGENProcess 250 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2080
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 264 -NGENProcess 238 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 254 -NGENProcess 268 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 25c -NGENProcess 238 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 270 -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 25c -NGENProcess 278 -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1076
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1e8 -NGENProcess 248 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 280 -NGENProcess 274 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1872
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 284 -NGENProcess 238 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1580
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 264 -NGENProcess 25c -Pipe 278 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 264 -NGENProcess 284 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:956
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 294 -NGENProcess 25c -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:776
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 294 -NGENProcess 264 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 288 -NGENProcess 29c -Pipe 298 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1620
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 280 -NGENProcess 23c -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a4 -NGENProcess 29c -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2956
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a8 -NGENProcess 268 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 288 -NGENProcess 294 -Pipe 2a0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1512
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 23c -NGENProcess 290 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1672
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 1e4 -NGENProcess 280 -Pipe 224 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 26c -NGENProcess 25c -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 244 -NGENProcess 27c -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2088
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1e4 -NGENProcess 260 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2404
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 280 -NGENProcess 27c -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 27c -NGENProcess 270 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 260 -NGENProcess 21c -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2432
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 280 -NGENProcess 1bc -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1336
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 270 -NGENProcess 1c8 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2364
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1c8 -NGENProcess 21c -Pipe 1bc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 2b0 -NGENProcess 280 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 270 -NGENProcess 288 -Pipe 1c8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2760
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2a0 -NGENProcess 280 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 280 -NGENProcess 284 -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:1780
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 21c -NGENProcess 244 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2100
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 2a0 -NGENProcess 290 -Pipe 27c -Comment "NGen Worker Process"2⤵PID:1720
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 280 -NGENProcess 294 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2384
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 294 -NGENProcess 244 -Pipe 290 -Comment "NGen Worker Process"2⤵PID:2204
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 268 -NGENProcess 2a0 -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 280 -NGENProcess 264 -Pipe 294 -Comment "NGen Worker Process"2⤵PID:2820
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2ac -NGENProcess 2a0 -Pipe 2b4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2a0 -NGENProcess 284 -Pipe 270 -Comment "NGen Worker Process"2⤵PID:1728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2a0 -NGENProcess 2ac -Pipe 268 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2228
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2ac -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"2⤵PID:1164
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2c4 -NGENProcess 21c -Pipe 240 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 2a0 -NGENProcess 2c8 -Pipe 264 -Comment "NGen Worker Process"2⤵PID:2100
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2cc -NGENProcess 21c -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1584
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 21c -NGENProcess 260 -Pipe 244 -Comment "NGen Worker Process"2⤵PID:2968
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2cc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2d4 -NGENProcess 2ac -Pipe 260 -Comment "NGen Worker Process"2⤵PID:1164
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 21c -NGENProcess 2e0 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:2904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 2e4 -NGENProcess 2dc -Pipe 2a0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:1584
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2c8 -NGENProcess 2ec -Pipe 2ac -Comment "NGen Worker Process"2⤵PID:2728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2c8 -NGENProcess 2e8 -Pipe 2dc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:1536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f4 -NGENProcess 2c8 -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1596
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2b8 -NGENProcess 280 -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:1424
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 21c -NGENProcess 2f8 -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:1944
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 2fc -NGENProcess 280 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:2696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2d4 -NGENProcess 300 -Pipe 21c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2f4 -NGENProcess 304 -Pipe 2c8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2528
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 280 -NGENProcess 308 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:1536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2f8 -NGENProcess 304 -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:2536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2c0 -NGENProcess 310 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2364
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2f4 -NGENProcess 314 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:2412
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2e4 -NGENProcess 310 -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:2116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 31c -NGENProcess 2c0 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:884
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2f8 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 2e4 -NGENProcess 328 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:1508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 310 -NGENProcess 32c -Pipe 324 -Comment "NGen Worker Process"2⤵PID:2080
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 310 -NGENProcess 314 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f4 -NGENProcess 334 -Pipe 304 -Comment "NGen Worker Process"2⤵PID:2748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 330 -NGENProcess 2c0 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:2840
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 330 -NGENProcess 320 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:2880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 32c -NGENProcess 33c -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:1792
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2c0 -NGENProcess 340 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:2060
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 338 -NGENProcess 344 -Pipe 310 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1292
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 33c -NGENProcess 348 -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:2116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 340 -NGENProcess 34c -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:1816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 330 -NGENProcess 348 -Pipe 32c -Comment "NGen Worker Process"2⤵PID:2280
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 314 -NGENProcess 354 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:956
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 33c -NGENProcess 358 -Pipe 350 -Comment "NGen Worker Process"2⤵PID:1472
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 35c -NGENProcess 354 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:1220
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 2c0 -NGENProcess 364 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:1500
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 2c0 -NGENProcess 360 -Pipe 354 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 2c0 -NGENProcess 338 -Pipe 364 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1648
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 2c0 -NGENProcess 314 -Pipe 360 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 36c -NGENProcess 374 -Pipe 34c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 338 -NGENProcess 35c -Pipe 36c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1212
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 378 -NGENProcess 358 -Pipe 374 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2100
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 368 -NGENProcess 338 -Pipe 314 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 348 -NGENProcess 330 -Pipe 35c -Comment "NGen Worker Process"2⤵PID:2404
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 378 -NGENProcess 384 -Pipe 368 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1104
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 344 -NGENProcess 330 -Pipe 388 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2204
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 38c -Pipe 378 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 370 -NGENProcess 390 -Pipe 37c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2784
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 338 -NGENProcess 38c -Pipe 348 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1640
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 2c0 -NGENProcess 398 -Pipe 370 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 384 -NGENProcess 38c -Pipe 358 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:1288
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 38c -NGENProcess 394 -Pipe 338 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1668
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 344 -NGENProcess 3a4 -Pipe 384 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1568
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 398 -NGENProcess 3a8 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:1816
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 2c0 -NGENProcess 3ac -Pipe 330 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2164
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 3a4 -NGENProcess 3b0 -Pipe 380 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a8 -NGENProcess 3b4 -Pipe 390 -Comment "NGen Worker Process"2⤵PID:1464
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3ac -NGENProcess 3b8 -Pipe 39c -Comment "NGen Worker Process"2⤵PID:2372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 344 -NGENProcess 3b4 -Pipe 398 -Comment "NGen Worker Process"2⤵PID:1508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 38c -NGENProcess 3c0 -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:2312
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 3a8 -NGENProcess 3c4 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:2660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b4 -NGENProcess 3c8 -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:780
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3c8 -NGENProcess 3b0 -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:1588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3b8 -NGENProcess 3a4 -Pipe 344 -Comment "NGen Worker Process"2⤵PID:1944
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3b4 -NGENProcess 3d4 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:1748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 38c -NGENProcess 3a4 -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3dc -NGENProcess 3b8 -Pipe 3d8 -Comment "NGen Worker Process"2⤵PID:2676
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3b4 -NGENProcess 3e0 -Pipe 38c -Comment "NGen Worker Process"2⤵PID:576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3e4 -NGENProcess 3b8 -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:488
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 394 -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:1632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3b4 -NGENProcess 3ec -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:2044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 3e0 -NGENProcess 450 -Pipe 3dc -Comment "NGen Worker Process"2⤵PID:1152
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 448 -NGENProcess 3ec -Pipe 444 -Comment "NGen Worker Process"2⤵PID:1004
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 44c -NGENProcess 458 -Pipe 3e0 -Comment "NGen Worker Process"2⤵PID:2328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 440 -NGENProcess 3ec -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:944
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 440 -NGENProcess 44c -Pipe 448 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:872
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 3b4 -NGENProcess 464 -Pipe 45c -Comment "NGen Worker Process"2⤵PID:2304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3ec -NGENProcess 468 -Pipe 43c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 460 -NGENProcess 468 -Pipe 450 -Comment "NGen Worker Process"2⤵PID:1868
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 460 -NGENProcess 464 -Pipe 46c -Comment "NGen Worker Process"2⤵PID:1584
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 474 -NGENProcess 468 -Pipe 454 -Comment "NGen Worker Process"2⤵PID:1648
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 474 -NGENProcess 460 -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:1888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 480 -NGENProcess 474 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:3008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 480 -NGENProcess 468 -Pipe 470 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:1632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 47c -NGENProcess 484 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:1652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 460 -NGENProcess 468 -Pipe 464 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:3044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 458 -NGENProcess 488 -Pipe 47c -Comment "NGen Worker Process"2⤵PID:2660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 458 -NGENProcess 440 -Pipe 468 -Comment "NGen Worker Process"2⤵PID:580
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 474 -NGENProcess 490 -Pipe 2a4 -Comment "NGen Worker Process"2⤵PID:1220
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 484 -NGENProcess 440 -Pipe 44c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 478 -NGENProcess 498 -Pipe 474 -Comment "NGen Worker Process"2⤵PID:1680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 460 -NGENProcess 440 -Pipe 48c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:2200
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 440 -NGENProcess 494 -Pipe 484 -Comment "NGen Worker Process"2⤵PID:1388
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 49c -NGENProcess 4a4 -Pipe 460 -Comment "NGen Worker Process"2⤵PID:2928
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 4a8 -NGENProcess 494 -Pipe 498 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1140
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 480 -NGENProcess 4ac -Pipe 49c -Comment "NGen Worker Process"2⤵PID:2012
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 490 -NGENProcess 4ac -Pipe 494 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:2080
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 480 -NGENProcess 4b4 -Pipe 4b0 -Comment "NGen Worker Process"2⤵PID:2652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 4b8 -NGENProcess 4ac -Pipe 4a4 -Comment "NGen Worker Process"2⤵PID:2312
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4b8 -NGENProcess 480 -Pipe 488 -Comment "NGen Worker Process"2⤵PID:2076
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 478 -NGENProcess 4ac -Pipe 490 -Comment "NGen Worker Process"2⤵PID:904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4bc -NGENProcess 4c4 -Pipe 4b8 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1256
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4a8 -NGENProcess 4ac -Pipe 458 -Comment "NGen Worker Process"2⤵PID:1432
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4b4 -NGENProcess 440 -Pipe 480 -Comment "NGen Worker Process"2⤵PID:2424
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4d0 -NGENProcess 4c4 -Pipe 4cc -Comment "NGen Worker Process"2⤵PID:1856
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4d4 -NGENProcess 478 -Pipe 4c0 -Comment "NGen Worker Process"2⤵PID:1044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4d8 -NGENProcess 440 -Pipe 4ac -Comment "NGen Worker Process"2⤵PID:1944
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2104
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 230 -NGENProcess 238 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2120
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
PID:1584
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:2284
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2032
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2196
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:876
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2220
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1720
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1912
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2572
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:2400
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2396
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1444
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1804
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:588
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1876
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 6002⤵
- Modifies data under HKEY_USERS
PID:2320
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5cd50a96a258e2e741ce62ac579538e63
SHA1f2067a8fba66dcea86da6629aaa38794444c92d3
SHA2562b4bc737dd75ffe0740e9a50ac3dddf6fd54d98fca3eee54b0174be86d50318d
SHA512419171d003f0ebad1d1328e3189e4ba12c06db9e8a092dba4119a9af7da5a0ae4b6ed3d28699f056f5045e3de61a2b36e4d17b0d7cfbd801a9f28fa2f1c0afe3
-
Filesize
30.1MB
MD5b8fba9d3e0a00d1d70600eeeb3326a67
SHA1fe77b6ceffe79a84cbad8006a19f1175f14d867e
SHA2563026617faa560323c83e45e1460649cdd404857f2a1b9f747305ffced3756ec7
SHA512abc9a97b114191a809bf8ae1a21fbd075c0be3cc1bb6158cb11b9ce3c70169d113b62dbc4eaf8e1945bdc7e501383b2f8fc7f13bae1892f897e2928ac0e6f673
-
Filesize
1.4MB
MD53230c380c20197f3768d8bf49f439012
SHA15866a86c77c6fbc63c0469e2d7848827543e4d5d
SHA2564567c470b2e4dd4d09d2d024004d974fdcd5b5760dbc2f892060a688a501ff72
SHA512d50f94a8cd9a109937ffec5e7732834fc0a432e6c60c3918c1f8893527de276a1719480593446f15908a172b7a642bd0bc31e85039429f5532eed43814031272
-
Filesize
5.2MB
MD57a5e258d16f46af67624695fb504c066
SHA11d656d43f1dff1d767a7c7ad2eb6632a3a010d09
SHA2561356c7635371453607cac50bcf8d072e5d79aac1311e91267a0a0867d55fca0a
SHA5123d99eaba91bb5670d722f10ce8828f8ea4900daf3cd9592340a87beac9fc0cb54df2bd2cd774521cc31d07b991344303df3218feb814db7e2488845dfde23109
-
Filesize
2.1MB
MD52e7db13bf1d113187de2f20c95365fc1
SHA1a97de789299fd7eef5732a95185ffe14cfb34673
SHA256d5df67ba084b8cbf5034eb47ea368793d1db256d8959d902080b1c3d962c7bfd
SHA5123db0c3c050418571518e69966df03baacfbc619dcaf7cd1b5d8e283aef4c3db8c931bac1b2d01a65771e5c23156fbc989a030699770279f7c2843d32819d42f7
-
Filesize
2.0MB
MD542c1d37c231a4ad863d2f561e50aca7c
SHA1de5d12cb75ef387eade557d39867aa3ff4704bce
SHA256e2c057af40e334d8ee78ce8d1014b5b98218a7f593ffec274d8f3d9f39fab68c
SHA5127bcf99537eb064e234a596e8c440b9fad3e21d725800c45b6d4abc634a3cfc489a544b257db71d4fd2e8a1fa573b402a59e586a9fac2a2f1404d5fd2b97f0c66
-
Filesize
1024KB
MD586f9ea1f543ed9ad5c957988a75bfca9
SHA1cf70699e5d2d14385b9e194ed8e4d97ae9fae718
SHA256fc48be2f19f2a58f4628ceed62e509aa14a84cfef15a9f3170e85202c9f96001
SHA51224066285e1fa84bf59b0a4a6757660c102451a525edf057c28415f43f7abec2fde2b30346a661e19fdc4f83468c85ee43db80a196b2ed452b58e259f53984b94
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
1.3MB
MD588def2fb7ebabd22283a6979187c8d88
SHA1a283a2429ae0124b77b148cba6a736d27660b839
SHA256a2ff3b132f0749069bb10a13fe653e4b08643d37e85cfcd8de7ccab562b410a6
SHA512ccf100f4e2190ed536d4ce93d5935b8a9d7411257ea0f3153f434e49522b33a1c38ae4cf3d8cd1520b10015601c71b754fe9e462c3c5d8dd54b5b0485de291b4
-
Filesize
872KB
MD5fe7f740f25b7eb88c73bf870dc364438
SHA19d30b507f1d6abd17f785088f2afa551c77abe8d
SHA256add1cd1c3519c94604b5b8f62013d5c5b9c28d7e9992f4aee3be47c7ef02e505
SHA51279bea565c77e42e9abc12477d18373962ea3f28f390baacf955aea3e514504f54aa5e0bb92d2e1516fb8cfbec314827a6b65b6e45892acc6c6d7fabb33ad5fd3
-
Filesize
1.2MB
MD52cb15218a8762ec5253429feca760137
SHA1a631af03140b536eb1517d4658626e618064f685
SHA2564398a4ab58d283e454c29b8280353a14d0ac9e420fff40dba4a374b347378854
SHA51267bbaf7246f60320779204cbb0a2ffb0961de9a52d21f3dd38eb907a914d5b23f9a56ff4ac2331deea14bc24301c5ba57eb57f6fd1ef6cdcd5499849ad1d6e04
-
Filesize
1.3MB
MD5d4bef6f44d7bb727430402ee37026736
SHA15e05bca953c88db1210cd66c38d354227ef88027
SHA256f5a379409f56c27e461f9f0416062894c8a5cc86f8d6d081bb0e60186b3ff356
SHA5121e6138eb4f451682d6632fca5cece047f2c43af01feb780c3f9d844d2c0b6d045c4bca6b4d25f1e9603d8ee088c18c2c714e6528a8a22445c61fdd5fed18e549
-
Filesize
1.2MB
MD50a5760a98a758c77c6c6242c6b3ece9a
SHA1080e902f890ab8156b5e3196e2291dc6340d2be6
SHA2566ac5b8b549d3aa964a99cfecf707d19ca601c1f2f65e74f752f608a4f8bfb327
SHA51205a12021faa4a39b835a9a520db784ab4f0fe90daf4059693c10a0f136962c3e549035c39bd95c8dfb36b18fc6cae2fcf384315658350f9abf90d65f84da8963
-
Filesize
1003KB
MD56ecf6cb6c6b2f252a398f99ae4e76966
SHA1e744dfcf34103f60c5031a4b5f2f353f1fed0303
SHA256cd126858a9d78a3190dcf5c075e61562888ae5d05d66b55eb8d9d48eaca3bbba
SHA512ed04758a00980d65bb2d3a5fd0447b4c62b9bc2b9c6f66031272f468f30091b291a91ca61eabedf487acf7b4d1f34a7bd343b9e94a751d5943e23afb6cfe2410
-
Filesize
1.3MB
MD5cd59342e285554ee7f34a9b7cb628fc2
SHA1ace2a0ef267a46d0d26b345a36bf24e718ad9278
SHA25664a6b57031f5c3d339a2aaa6a03f25d89e5f3554df0cbb96c5185270e6531753
SHA5126ad7adcaac1c17cf8caddb339349dc0445b3970f5c7d6853538ba0c4b8d7f477f26865f537a525f700784e0ade3789f27593c9474663c2429b8721930b9a02e8
-
Filesize
8KB
MD5e6d0420bae52b2c50ce09d6c14dba692
SHA141b0bed33db677614c4d4c9d1ccf689c10091dcb
SHA256a5b7192c6d35eaca3f712239b5f1dda1b89d0b14b8cbf99e1eb1942d454b5f50
SHA512cc50fdf3d3ae0b67530b7dcc16df494968806b02722dde8ba546895c95f1455f8b4537afa26b76514a333d373d0e32aa56ae0496c6c00d012604784624b4cd5d
-
Filesize
1.2MB
MD586b4cecf6cdcbfa5a789c88d089a7954
SHA13d46fe632fba78681f7ca4deda840555be24623a
SHA256e45ae0cc7f5cf742d9bf3a00b88ec73c4e32b04f0283009e3bc073d00e7a1f84
SHA512b2dabbb63fdfe269cf79a91025ad164ffdc267ba15812b844c852ee0a14991a89d3b6811028249d925f976c0603ad62b91d51161f355673e7f0f747d63713a03
-
Filesize
1.2MB
MD5bd2754da0140947ee6376b688b44e569
SHA1afbd892d0bd5f0ccd66e3d768b12836317d23c69
SHA2567edebc73c8f20784f67a5d261c60d929e50d394aeb4a68040cbef1b0e8cf4ce1
SHA512942bfcf521aeabc433ae51e07b8fef885713b98da4faba6bfa3873198e046255766d56c8dee1dd58708b549719457e373bf6e426cc9245f19f7054deb2d4a238
-
Filesize
1.1MB
MD5045abac9e5e974385aa20d437b068423
SHA122b7ddefde60dff151991447f02a5e74bda593c7
SHA2561e37dbee7c6fff39d85cc31a8ba8a70b444a0c09242658e0fafcb5aae53bd807
SHA512d21414fea1d35fed550fbc7b2b9da6f938ee8d298e9577933b8057f6ed4a5a97d1529af59188e590abfa90aefbad347bb8d8fd221085e0e1836cd36c5ff1f7ac
-
Filesize
2.1MB
MD52b82735beaa9daeaeb964284b772b8dd
SHA1198b03af18b6f77331dc7b066601c24daca53f34
SHA256ba17caf2886f669e3dfc8aec9515d1fdeeda367d852ca302317fa69e01450bb4
SHA512a63942dccf64912c9043bd68043891efdd654cc10597b43e489e156720cca345246e9fa303a5aa5564f9169d8df365e84e2d40b3f0c1805449c1f631d51fc885
-
Filesize
1.3MB
MD536811d4b96f2a077ece9cfbf6e275307
SHA1bd91a545eca4d2d7c4763aefdaafb4fa54e43b26
SHA256065f43eaf9ab73dac7d4b7f265883413610b9c8abbeaf791ca9110212f673d75
SHA5121cb90cd48e98599640fbfb48d130f40e12d5b459b7be5741ba25758853d3218c4ba55e677839e30bfe198bbc7d19742dca950cf6cb999ae7c07eac8af36e6a08
-
Filesize
1.2MB
MD58af1224320bcd02bd20f7814e9cead53
SHA1d7d3bde52f072d97d74f3e01e3c55f8668d47758
SHA256a7d87055ef94cdbaacbc5e6e8dda4c3a8027cc082a1d3e0f2bb6450b2ce8ee95
SHA5127c04dee0e1aace7b2c2365d6bca6f4b3d942a030c1b4eb9bc85c3525be0fdd500dce068056037010a34d58a94a81b2cac6e783c7743493a6a35bc1e7b2f84572
-
Filesize
1.7MB
MD5ddd614fb48d48fb0bed0fff17231b1b1
SHA1fd8fb68df54f303dcea7361ea2078b7c2516ab17
SHA2567542930be494cfaad7cfa4011b7c3e51501ee251df6e7eca8184b14af9d39018
SHA512f989fe6ac1655dc0fe38be04fbdcefaf58c24c8355f36ed2d87d928eb3cba16f10343e6eb39042e579469d61136c21ef45c942e28903183e5fc6cbf097ea7c4b
-
Filesize
1.4MB
MD5ffdccb282089094422c74de381d705bb
SHA1459c29cd5a8882d01bde8e046a7bd16a29994432
SHA2567ce615f01fe6d443a618ef1fef6e8fa5f8d2faba2fcfcb55306726bbd16a286f
SHA5121273c0f502aa183265007cb3d10d7b98f50c12b8fb7b230acdd8c57569625e5e33e7d6743cbcdbe966635ec97d61f4ba58933d9de6ad49707a2c9dc9bc552f5c
-
Filesize
2.0MB
MD598ff2a4e55bcf556dc46f2660634cd90
SHA1e57176a279fd94ed5b2f24b43cb8ae4b6c5e9054
SHA256094f244123001b3772bc2b3c13c87c686e97b50a842c12e8303fd1635486b804
SHA5120d09b3783fc270a85c316fa6321b598bceab8cf9ad32a62aec277262b44f7bff927e2e9034fa2ee372250c5f0defb7e71ad111ff07c936f7481627876fdde5ac
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
Filesize834KB
MD5c76656b09bb7df6bd2ac1a6177a0027c
SHA10c296994a249e8649b19be84dce27c9ddafef3e0
SHA256a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
SHA5128390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize797KB
MD5aeb0b6e6c5d32d1ada231285ff2ae881
SHA11f04a1c059503896336406aed1dc93340e90b742
SHA2564c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
SHA512e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Filesize163KB
MD5e88828b5a35063aa16c68ffb8322215d
SHA18225660ba3a9f528cf6ac32038ae3e0ec98d2331
SHA25699facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
SHA512e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Filesize1.3MB
MD5006498313e139299a5383f0892c954b9
SHA17b3aa10930da9f29272154e2674b86876957ce3a
SHA256489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
SHA5126a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
Filesize148KB
MD5ac901cf97363425059a50d1398e3454b
SHA12f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA5126a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize34KB
MD5c26b034a8d6ab845b41ed6e8a8d6001d
SHA13a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize109KB
MD50fd0f978e977a4122b64ae8f8541de54
SHA1153d3390416fdeba1b150816cbbf968e355dc64f
SHA256211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
Filesize158KB
MD5a763a9348ab4ee3bd593bb17d854e51b
SHA14d0c97ba6877e2f9ab32fe1316936a4f2e0ff2c9
SHA256b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
SHA512e8d3896d4bd788d3ed923e0c9d3ba19fe9fc507060e2e5e8e410964f4c9d7331928324a79336079ccc84c050d8f0acfb03126a2e3622daac3846b0bfd028f602
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize41KB
MD53c269caf88ccaf71660d8dc6c56f4873
SHA1f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
Filesize296KB
MD57687295a6e19cc656b077e6a61629d4e
SHA1fa1025de5cffb56a3d1f8cae9d09b7171b33326e
SHA256ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
SHA51219de95fd90bc6f091e785074ee71dc15d450d65fbdea933e26650fb9c747d81ae2fca7f5f83192f17451a49a314d264cabea2202c805b6ffab729d381675734c
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
Filesize356KB
MD587111e9d98dc79165dfc98a1fb93100b
SHA14f5182e5ce810f6ba3bdb3418ad33c916b6013c8
SHA256971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
SHA512abbb246d620e8a2ab1973dde19ff56ea1c02afa39e889925fe2a1ba43af1ad4ff6eb017e68578ae520109b3e290b3d9054d7537eb2df0ede6e0fbca8519cc104
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4a8896d852a9720cb17207eea8c059b0\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize83KB
MD5a454b6328f066abf9571bfbf4dc8a13a
SHA1dfe8ca1781b454ec993a5ca1c694c55d1aea9701
SHA2560c405bca832bd98d635915c6beb50109415bb5198ba0b60c2a76447460007dc4
SHA512cfcc93314113354eb01fb716413e2e4ac07ed2e1aeb919e8cc0b87dbab3aaf348efdf8a47c734c5159b782e33fbd6d6140805a052ca50a1793be6d6914b6dc86
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
Filesize648KB
MD57ebbba07bc6d54efd912bcd78b560b7b
SHA1a6aee1a80ddcdf201301ac29293c62d58bcc941d
SHA256637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
SHA5122139a0d520ed70b72dc76fdd0555185386c9c22de1e1fb7eaac0607b313500c44f856c76ac6e2cd72148ea0b86b10bdd2b0ab7daacfc945cb66a637b8d99cfe8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
Filesize1.2MB
MD50637ad2bf6fc5ac1d29e547155bc818c
SHA1a502879466b6dd37eae5881bbb18353f97623852
SHA256868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
SHA5121d18a16ec3b91c3143c4371de305a7ea464d41661752ece65bf1ce19a8342a265c024a740afa6be8baf4d1edfdac6c6fcdad7395c1294342cd1f4388428e52c1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize210KB
MD54f40997b51420653706cb0958086cd2d
SHA10069b956d17ce7d782a0e054995317f2f621b502
SHA2568cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize53KB
MD5e3a7a2b65afd8ab8b154fdc7897595c3
SHA1b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA5126537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
Filesize65KB
MD5da9f9a01a99bd98104b19a95eeef256c
SHA1272071d5bbc0c234bc2f63dfcd5a90f83079bbab
SHA256b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
SHA512dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize28KB
MD5aefc3f3c8e7499bad4d05284e8abd16c
SHA17ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA2564436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA5121d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
Filesize329KB
MD5eb09a7062a66a50fe2cb16c4a80561a7
SHA133b4c71ced7644be9802374a4f04c866394daaca
SHA256e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
SHA512c57a4c626c87032ca422df04ce7c3322662a9b0c6c06a46e93f08ca8f431295c9ae802cd79f53cae5de2b39a30bbeb756c966880e874ed44115cf511cc1ff920
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
Filesize141KB
MD558cacef7cbc000bb5ddeedc08a598f36
SHA1f8963d4ac1f7b72c2ee4a0a6d45b921f4f88bab7
SHA256124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
SHA5129cf04e365abcdcfcb9c1f927da83a2dfe0791cccb80cd84ed63b03264d1e253060c455ed8664f35aee0a59e8c172f859ba49c67c9eec811a53e656c076c6bf66
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
Filesize278KB
MD5d74d434aa70ce827715b5e0ac7eda5be
SHA1b53f3374be4c96af51c78fd873de1360f17c200f
SHA25654701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
SHA512631d09a0ff39ece829f5c23278c2c030e5ff758b285128edb7805682de75b5be1aedd914d2325f79ec98d0103660a39ae1f1a5782f5dad038b143f3774c098df
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize27KB
MD59c60454398ce4bce7a52cbda4a45d364
SHA1da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize57KB
MD56eaaa1f987d6e1d81badf8665c55a341
SHA1e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA2564b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e6c6cea3fe67130f7ff354461da639bd\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize180KB
MD56c016ac3f89ea8916a11f4308b719400
SHA1c84c473841ecf21dec953be1e56512cff714a091
SHA2566073bb51cb9092722a7f79069084a035bcac4f5bfb87544b1190a178fecc0a8a
SHA512c962b19f0db6e6cc3ecace4e86ce31d89f1deaabe56d34755d703ce3c32aa35e7e2a5284140df2cf271650ce2122174fa470423acfb2a95d4be34ba497b8bc47
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ec9e86580caa2de2fb85bdf8badccbc9\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize187KB
MD5d614da46852631e4074ea4bd2ea23159
SHA1225137fbfbfb1b0b2d0f5a1cd1c6aeb382b60a3c
SHA2566f9f30e86128b7554a95b2be2ef92b16b7a8719abd71fba1291377192ac2a67c
SHA51261697cf177b3f6cbcbe717118bbd6bcd86f6b6b8a956b7eceaea14c6a849cb5c8dcff81cb18e9bdfce7bceafcfb01896747228df640aa1c033e96011bb6f9ed2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize130KB
MD52735d2ab103beb0f7c1fbd6971838274
SHA16063646bc072546798bf8bf347425834f2bfad71
SHA256f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize59KB
MD58c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f6aafb58fdc1d6a31147aa777abe98b6\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize143KB
MD57db71ac552ab06db76705fde07a4be34
SHA1774b57e082a1d379a4953d4453c05e69ec1159a1
SHA256def56d7efdfb0c9abacef103c09789c118dfd6dbb580486c2e807c760938a81e
SHA5120b7fadf2aef201aa2df1cd3eb9c68dd71af52de55a13d1b10593eb5a6238ae5be42d556be9a59c2e178f36f713d83bc13143b0f86e5ccdca1fe1f1a79a08d452
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize42KB
MD571d4273e5b77cf01239a5d4f29e064fc
SHA1e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA51241fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
Filesize855KB
MD57812b0a90d92b4812d4063b89a970c58
SHA13c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA256897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
SHA512634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
Filesize43KB
MD53e72bdd0663c5b2bcd530f74139c83e3
SHA166069bcac0207512b9e07320f4fa5934650677d2
SHA2566a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
SHA512b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
-
Filesize
1.2MB
MD5f8351d0354566ae2504db68a54f81539
SHA179612aea2eedbadf96367e75877e68fc2667f26c
SHA25608331524b36f3a94a9a2ca8918caae2ed7e19593993df43a41440f0594935fd4
SHA5122e0ae505a1bc00a6a7166e8270d67cf3407f431b44ad0c52a53c3a377b28155e69ebcb6f79fc62b1ba3a55a637f8765e7abe55fd7e31743280caf7c65b85801c
-
Filesize
1.3MB
MD58b1ecf1474a98dbc7ecbb3bdc5f0e66b
SHA143ab33562b2e95acbd759e5a11ead5bd54e29db7
SHA2562adf7388b36e3bd8856edc55f336e0d34d699ea8c84d17cc23d7a5805caacb59
SHA5127f7feed0621444349c067f0b0a111dc419ed37727f7da00bee858835cda48c206f236b232167db0baf2f62cc10acaeb6c34b92e6ed6a0c874c14b913d31822f4
-
Filesize
1.3MB
MD5e0970f1ec48b4f58b1e6b8c4ea373764
SHA17a2566874662f74caa9583ce8382245a13a710fc
SHA25689de6cb990afcd7af3bc7f384d7cd003f2142258038e6e3eef3add4cf3f8ee92
SHA512314c4c37bd8729c368e2eeb1355c0a365d82e8ab75b736243dd5217f889e84b993256853e35d61c62db390beeb71bd222a647948173a2812d930378a3c4bc786
-
Filesize
1.3MB
MD51e42e7a0cc0492db58381fb0fb17fb51
SHA1a59c84ce7d32ea533721b74d18519d0b4780dd4a
SHA25671b47da2e4067551bb9f725d29810570f767e4c0f6640a52b055bcaffaf6eb88
SHA51272134c4b644625fa83d58263149be428c1d1b9ef946f6d2c237276befa530e97638acafc7472ca6fd3699eae709aae68e3aa0a1ced6fc9e47f25a22b2fadde2b
-
Filesize
1.3MB
MD51fd0d572be352fb8cbe94f7398cbca58
SHA1e7d59b33b96ae40eb0edf3bf2cf9b827d1a2e074
SHA25634166fd44e0e517225ce179c2ac5badbefbcc02ca796523d9de288a5532ae7a4
SHA512e24a6344b272fb85d017bb012e0f42f5908f6f996ba752fad394ae53ded3b38f1103c3d8c571ef8d51ed00a96de7505e8f35aa4fc4f067afb818d70bef01cfb5