Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 05:18
Static task
static1
Behavioral task
behavioral1
Sample
57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe
Resource
win7-20240221-en
General
-
Target
57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe
-
Size
1.8MB
-
MD5
f1e4e256486cf4fecb0b84aad90a03a5
-
SHA1
d5285314432b399dfcc60f5fd3c2747bac267d9f
-
SHA256
57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145
-
SHA512
5e85077616001815a7d8d5a5b7a115045e07981d6e1722a094785ccd697f83096247ead18a85c2452fe7f95d23c1852963acfbde45a0e003db1c4104745ea5ce
-
SSDEEP
49152:Ix5SUW/cxUitIGLsF0nb+tJVYleAMz77+WASkQ/qoLEw:IvbjVkjjCAzJVqo4w
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 464 Process not Found 2580 alg.exe 280 aspnet_state.exe 1624 mscorsvw.exe 2768 mscorsvw.exe 872 mscorsvw.exe 1556 mscorsvw.exe 2984 ehRecvr.exe 2960 ehsched.exe 1288 elevation_service.exe 272 IEEtwCollector.exe 2528 dllhost.exe 2520 GROOVE.EXE 588 maintenanceservice.exe 1948 OSE.EXE 2320 OSPPSVC.EXE 1624 mscorsvw.exe 2996 mscorsvw.exe 2440 mscorsvw.exe 1808 mscorsvw.exe 3056 mscorsvw.exe 2564 mscorsvw.exe 876 mscorsvw.exe 3028 mscorsvw.exe 2500 mscorsvw.exe 680 mscorsvw.exe 2692 mscorsvw.exe 2056 mscorsvw.exe 1724 mscorsvw.exe 2440 mscorsvw.exe 904 mscorsvw.exe 1144 mscorsvw.exe 1592 mscorsvw.exe 2512 mscorsvw.exe 3028 mscorsvw.exe 2468 mscorsvw.exe 2688 mscorsvw.exe 3032 mscorsvw.exe 2340 mscorsvw.exe 2972 mscorsvw.exe 1920 mscorsvw.exe 1944 msdtc.exe 2624 msiexec.exe 2700 perfhost.exe 1744 locator.exe 1620 snmptrap.exe 1580 vds.exe 1552 vssvc.exe 768 wbengine.exe 2284 WmiApSrv.exe 2096 wmpnetwk.exe 2224 SearchIndexer.exe 2168 mscorsvw.exe 1636 mscorsvw.exe 2804 mscorsvw.exe 1544 mscorsvw.exe 2728 mscorsvw.exe 2696 mscorsvw.exe 1912 mscorsvw.exe 1872 mscorsvw.exe 1476 mscorsvw.exe 1860 mscorsvw.exe 1304 mscorsvw.exe 2888 mscorsvw.exe -
Loads dropped DLL 51 IoCs
pid Process 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 2624 msiexec.exe 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 464 Process not Found 728 Process not Found 2728 mscorsvw.exe 2728 mscorsvw.exe 1912 mscorsvw.exe 1912 mscorsvw.exe 1476 mscorsvw.exe 1476 mscorsvw.exe 1304 mscorsvw.exe 1304 mscorsvw.exe 2436 mscorsvw.exe 2436 mscorsvw.exe 1720 mscorsvw.exe 1720 mscorsvw.exe 1732 mscorsvw.exe 1732 mscorsvw.exe 2912 mscorsvw.exe 2912 mscorsvw.exe 936 mscorsvw.exe 936 mscorsvw.exe 2352 mscorsvw.exe 2352 mscorsvw.exe 2740 mscorsvw.exe 2740 mscorsvw.exe 2536 mscorsvw.exe 2536 mscorsvw.exe 1672 mscorsvw.exe 1672 mscorsvw.exe 2740 mscorsvw.exe 2740 mscorsvw.exe 2876 mscorsvw.exe 2876 mscorsvw.exe 1912 mscorsvw.exe 1912 mscorsvw.exe 2656 mscorsvw.exe 2656 mscorsvw.exe 2728 mscorsvw.exe 2728 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\system32\msiexec.exe aspnet_state.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\cec2ae42ae4ef42b.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe aspnet_state.exe File opened for modification C:\Windows\system32\wbengine.exe aspnet_state.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe aspnet_state.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe File opened for modification C:\Windows\SysWow64\perfhost.exe aspnet_state.exe File opened for modification C:\Windows\system32\SearchIndexer.exe aspnet_state.exe File opened for modification C:\Windows\system32\fxssvc.exe 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Windows\system32\dllhost.exe 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\locator.exe aspnet_state.exe File opened for modification C:\Windows\System32\snmptrap.exe aspnet_state.exe File opened for modification C:\Windows\System32\vds.exe aspnet_state.exe File opened for modification C:\Windows\system32\vssvc.exe aspnet_state.exe File opened for modification C:\Windows\System32\alg.exe 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe aspnet_state.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe aspnet_state.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\goopdateres_th.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\goopdateres_en.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\goopdateres_hu.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\goopdateres_fr.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\goopdateres_sr.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\psuser.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\goopdateres_no.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\GoogleUpdateSetup.exe 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\goopdateres_vi.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE alg.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM8D23.tmp\goopdateres_uk.dll 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B4DA77CF-C3F4-4914-8367-9949C0CA2314}.crmlog dllhost.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5061.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index146.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index142.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe aspnet_state.exe File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5909.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5274.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index134.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index143.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index133.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe aspnet_state.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP672C.tmp\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13f.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe aspnet_state.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5F11.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index144.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4C2D.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6558.tmp\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index144.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe alg.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" ehRec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit ehRecvr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f0cce58f6298da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{A5C10A14-9550-43E6-82D7-A0E5A0BEA08D} wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000306c77976298da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-102 = "Desert" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-106 = "Tulips" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{A5C10A14-9550-43E6-82D7-A0E5A0BEA08D} wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2396 ehRec.exe 280 aspnet_state.exe 280 aspnet_state.exe 280 aspnet_state.exe 280 aspnet_state.exe 280 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2872 57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: 33 1008 EhTray.exe Token: SeIncBasePriorityPrivilege 1008 EhTray.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeDebugPrivilege 2396 ehRec.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: 33 1008 EhTray.exe Token: SeIncBasePriorityPrivilege 1008 EhTray.exe Token: SeDebugPrivilege 2580 alg.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeTakeOwnershipPrivilege 280 aspnet_state.exe Token: SeRestorePrivilege 2624 msiexec.exe Token: SeTakeOwnershipPrivilege 2624 msiexec.exe Token: SeSecurityPrivilege 2624 msiexec.exe Token: SeBackupPrivilege 1552 vssvc.exe Token: SeRestorePrivilege 1552 vssvc.exe Token: SeAuditPrivilege 1552 vssvc.exe Token: SeBackupPrivilege 768 wbengine.exe Token: SeRestorePrivilege 768 wbengine.exe Token: SeSecurityPrivilege 768 wbengine.exe Token: SeDebugPrivilege 280 aspnet_state.exe Token: SeManageVolumePrivilege 2224 SearchIndexer.exe Token: 33 2224 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2224 SearchIndexer.exe Token: 33 2096 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 2096 wmpnetwk.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe Token: SeShutdownPrivilege 872 mscorsvw.exe Token: SeShutdownPrivilege 1556 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1008 EhTray.exe 1008 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1008 EhTray.exe 1008 EhTray.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1548 SearchProtocolHost.exe 1548 SearchProtocolHost.exe 1548 SearchProtocolHost.exe 1548 SearchProtocolHost.exe 1548 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe 2708 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 872 wrote to memory of 1624 872 mscorsvw.exe 45 PID 872 wrote to memory of 1624 872 mscorsvw.exe 45 PID 872 wrote to memory of 1624 872 mscorsvw.exe 45 PID 872 wrote to memory of 1624 872 mscorsvw.exe 45 PID 872 wrote to memory of 2996 872 mscorsvw.exe 46 PID 872 wrote to memory of 2996 872 mscorsvw.exe 46 PID 872 wrote to memory of 2996 872 mscorsvw.exe 46 PID 872 wrote to memory of 2996 872 mscorsvw.exe 46 PID 872 wrote to memory of 2440 872 mscorsvw.exe 60 PID 872 wrote to memory of 2440 872 mscorsvw.exe 60 PID 872 wrote to memory of 2440 872 mscorsvw.exe 60 PID 872 wrote to memory of 2440 872 mscorsvw.exe 60 PID 872 wrote to memory of 1808 872 mscorsvw.exe 48 PID 872 wrote to memory of 1808 872 mscorsvw.exe 48 PID 872 wrote to memory of 1808 872 mscorsvw.exe 48 PID 872 wrote to memory of 1808 872 mscorsvw.exe 48 PID 872 wrote to memory of 3056 872 mscorsvw.exe 49 PID 872 wrote to memory of 3056 872 mscorsvw.exe 49 PID 872 wrote to memory of 3056 872 mscorsvw.exe 49 PID 872 wrote to memory of 3056 872 mscorsvw.exe 49 PID 872 wrote to memory of 2564 872 mscorsvw.exe 50 PID 872 wrote to memory of 2564 872 mscorsvw.exe 50 PID 872 wrote to memory of 2564 872 mscorsvw.exe 50 PID 872 wrote to memory of 2564 872 mscorsvw.exe 50 PID 872 wrote to memory of 876 872 mscorsvw.exe 53 PID 872 wrote to memory of 876 872 mscorsvw.exe 53 PID 872 wrote to memory of 876 872 mscorsvw.exe 53 PID 872 wrote to memory of 876 872 mscorsvw.exe 53 PID 872 wrote to memory of 3028 872 mscorsvw.exe 65 PID 872 wrote to memory of 3028 872 mscorsvw.exe 65 PID 872 wrote to memory of 3028 872 mscorsvw.exe 65 PID 872 wrote to memory of 3028 872 mscorsvw.exe 65 PID 872 wrote to memory of 2500 872 mscorsvw.exe 55 PID 872 wrote to memory of 2500 872 mscorsvw.exe 55 PID 872 wrote to memory of 2500 872 mscorsvw.exe 55 PID 872 wrote to memory of 2500 872 mscorsvw.exe 55 PID 872 wrote to memory of 680 872 mscorsvw.exe 56 PID 872 wrote to memory of 680 872 mscorsvw.exe 56 PID 872 wrote to memory of 680 872 mscorsvw.exe 56 PID 872 wrote to memory of 680 872 mscorsvw.exe 56 PID 872 wrote to memory of 2692 872 mscorsvw.exe 57 PID 872 wrote to memory of 2692 872 mscorsvw.exe 57 PID 872 wrote to memory of 2692 872 mscorsvw.exe 57 PID 872 wrote to memory of 2692 872 mscorsvw.exe 57 PID 872 wrote to memory of 2056 872 mscorsvw.exe 58 PID 872 wrote to memory of 2056 872 mscorsvw.exe 58 PID 872 wrote to memory of 2056 872 mscorsvw.exe 58 PID 872 wrote to memory of 2056 872 mscorsvw.exe 58 PID 872 wrote to memory of 1724 872 mscorsvw.exe 59 PID 872 wrote to memory of 1724 872 mscorsvw.exe 59 PID 872 wrote to memory of 1724 872 mscorsvw.exe 59 PID 872 wrote to memory of 1724 872 mscorsvw.exe 59 PID 872 wrote to memory of 2440 872 mscorsvw.exe 60 PID 872 wrote to memory of 2440 872 mscorsvw.exe 60 PID 872 wrote to memory of 2440 872 mscorsvw.exe 60 PID 872 wrote to memory of 2440 872 mscorsvw.exe 60 PID 872 wrote to memory of 904 872 mscorsvw.exe 61 PID 872 wrote to memory of 904 872 mscorsvw.exe 61 PID 872 wrote to memory of 904 872 mscorsvw.exe 61 PID 872 wrote to memory of 904 872 mscorsvw.exe 61 PID 872 wrote to memory of 1144 872 mscorsvw.exe 62 PID 872 wrote to memory of 1144 872 mscorsvw.exe 62 PID 872 wrote to memory of 1144 872 mscorsvw.exe 62 PID 872 wrote to memory of 1144 872 mscorsvw.exe 62 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe"C:\Users\Admin\AppData\Local\Temp\57db6e27eec0ac7baa87d89205a7ec03857bbe0b310cd6c5ae1a7cf40ea85145.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:280
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1624
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2768
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1624
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2996
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2440
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 254 -NGENProcess 258 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 244 -NGENProcess 25c -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1d4 -NGENProcess 268 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2564
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 260 -NGENProcess 25c -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 270 -NGENProcess 244 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3028
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 264 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2500
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 27c -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 280 -NGENProcess 264 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 244 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 284 -NGENProcess 280 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1724
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 250 -NGENProcess 244 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2440
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 250 -NGENProcess 1d4 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 25c -NGENProcess 244 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1144
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 290 -NGENProcess 284 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 1d4 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2512
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 244 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3028
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 284 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 1d4 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 1d4 -NGENProcess 294 -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3032
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 294 -NGENProcess 244 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 28c -NGENProcess 1f8 -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2168
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 23c -NGENProcess 274 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 274 -NGENProcess 278 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 254 -NGENProcess 248 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 21c -NGENProcess 28c -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 248 -NGENProcess 28c -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 290 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 1c4 -NGENProcess 21c -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1872
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 1d4 -NGENProcess 28c -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1476
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 28c -NGENProcess 290 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 294 -NGENProcess 21c -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 28c -NGENProcess 280 -Pipe 1f8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 244 -Pipe 1c4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2436
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 244 -NGENProcess 294 -Pipe 21c -Comment "NGen Worker Process"2⤵PID:688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 29c -NGENProcess 260 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1720
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 260 -NGENProcess 280 -Pipe 294 -Comment "NGen Worker Process"2⤵PID:1092
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 2b0 -NGENProcess 274 -Pipe 290 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1732
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2b8 -Pipe 260 -Comment "NGen Worker Process"2⤵PID:2888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 274 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:2912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 274 -NGENProcess 2b4 -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:1372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2c4 -NGENProcess 2b8 -Pipe 2c0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2b8 -NGENProcess 284 -Pipe 280 -Comment "NGen Worker Process"2⤵PID:1500
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2c8 -NGENProcess 29c -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2352
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 29c -NGENProcess 2c4 -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:1848
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2d0 -NGENProcess 284 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 29c -Comment "NGen Worker Process"2⤵PID:2176
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a4 -NGENProcess 2dc -Pipe 2d4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2dc -NGENProcess 284 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:1936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2b4 -NGENProcess 2e4 -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1672
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2c8 -NGENProcess 2e8 -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:1544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2cc -NGENProcess 2e4 -Pipe 2d0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2e4 -NGENProcess 2c4 -Pipe 2b4 -Comment "NGen Worker Process"2⤵PID:2796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2e8 -NGENProcess 2cc -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:2436
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2f8 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2f0 -NGENProcess 300 -Pipe 2e8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2b8 -NGENProcess 2c4 -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:916
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 304 -NGENProcess 2f8 -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:3044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 304 -NGENProcess 2b8 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:2036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 284 -NGENProcess 2f8 -Pipe 2e4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2f8 -NGENProcess 308 -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 308 -NGENProcess 2cc -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:1476
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 318 -NGENProcess 310 -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 314 -Pipe 304 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:672
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 320 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:1440
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 284 -NGENProcess 314 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:2460
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 328 -NGENProcess 318 -Pipe 2c4 -Comment "NGen Worker Process"2⤵PID:2008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 308 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:2308
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 314 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:1672
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 318 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:1012
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 334 -NGENProcess 330 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:2468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 320 -NGENProcess 318 -Pipe 284 -Comment "NGen Worker Process"2⤵PID:1800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 340 -NGENProcess 32c -Pipe 310 -Comment "NGen Worker Process"2⤵PID:2556
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 330 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:2704
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 320 -NGENProcess 34c -Pipe 340 -Comment "NGen Worker Process"2⤵PID:3064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 328 -NGENProcess 330 -Pipe 338 -Comment "NGen Worker Process"2⤵PID:2860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 354 -NGENProcess 344 -Pipe 350 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 320 -NGENProcess 358 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:1636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 32c -NGENProcess 35c -Pipe 314 -Comment "NGen Worker Process"2⤵PID:1680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 35c -NGENProcess 348 -Pipe 360 -Comment "NGen Worker Process"2⤵PID:2556
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 344 -NGENProcess 364 -Pipe 32c -Comment "NGen Worker Process"2⤵PID:1572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 354 -NGENProcess 348 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:2208
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 344 -NGENProcess 11c -Pipe 348 -Comment "NGen Worker Process"2⤵PID:2768
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 330 -NGENProcess 364 -Pipe 370 -Comment "NGen Worker Process"2⤵PID:2112
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 368 -NGENProcess 36c -Pipe 35c -Comment "NGen Worker Process"2⤵PID:2052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 374 -NGENProcess 11c -Pipe 318 -Comment "NGen Worker Process"2⤵PID:1636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 364 -Pipe 354 -Comment "NGen Worker Process"2⤵PID:1720
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 36c -Pipe 358 -Comment "NGen Worker Process"2⤵PID:2900
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 36c -NGENProcess 37c -Pipe 380 -Comment "NGen Worker Process"2⤵PID:2360
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 384 -NGENProcess 364 -Pipe 330 -Comment "NGen Worker Process"2⤵PID:1056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 344 -Pipe 368 -Comment "NGen Worker Process"2⤵PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 37c -Pipe 374 -Comment "NGen Worker Process"2⤵PID:2856
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 364 -Pipe 11c -Comment "NGen Worker Process"2⤵PID:1652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 344 -Pipe 378 -Comment "NGen Worker Process"2⤵PID:1544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 38c -NGENProcess 39c -Pipe 390 -Comment "NGen Worker Process"2⤵PID:1860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 36c -NGENProcess 344 -Pipe 384 -Comment "NGen Worker Process"2⤵PID:1492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 3a0 -NGENProcess 394 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:1500
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 394 -NGENProcess 38c -Pipe 39c -Comment "NGen Worker Process"2⤵PID:2016
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 3a8 -NGENProcess 3a4 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:1436
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3a4 -NGENProcess 398 -Pipe 38c -Comment "NGen Worker Process"2⤵PID:1196
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3b0 -NGENProcess 3a0 -Pipe 344 -Comment "NGen Worker Process"2⤵PID:2660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3a0 -NGENProcess 3a8 -Pipe 37c -Comment "NGen Worker Process"2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3b8 -NGENProcess 398 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:1664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3b4 -Pipe 364 -Comment "NGen Worker Process"2⤵PID:2856
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3b4 -NGENProcess 3a0 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:2668
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3c4 -NGENProcess 398 -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:2208
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3c0 -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:1800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3a0 -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:1472
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d4 -NGENProcess 398 -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:1960
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3a4 -NGENProcess 388 -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:1752
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3d8 -NGENProcess 3c4 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:1304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 398 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:1652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3a4 -NGENProcess 3e4 -Pipe 3d8 -Comment "NGen Worker Process"2⤵PID:2176
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3c8 -NGENProcess 398 -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:2860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3e8 -NGENProcess 3dc -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:1680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3e8 -NGENProcess 3c8 -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:2660
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3d4 -NGENProcess 3dc -Pipe 388 -Comment "NGen Worker Process"2⤵PID:1188
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3f8 -NGENProcess 3a4 -Pipe 3f4 -Comment "NGen Worker Process"2⤵PID:2596
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3fc -NGENProcess 398 -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:1496
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3fc -NGENProcess 3f8 -Pipe 3dc -Comment "NGen Worker Process"2⤵PID:1872
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3e0 -NGENProcess 408 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:2996
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3e0 -NGENProcess 3ec -Pipe 3f8 -Comment "NGen Worker Process"2⤵PID:588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3a4 -NGENProcess 408 -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:2828
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 410 -NGENProcess 398 -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:1764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 3e0 -NGENProcess 418 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:2556
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 40c -NGENProcess 398 -Pipe 404 -Comment "NGen Worker Process"2⤵PID:2768
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 398 -NGENProcess 414 -Pipe 410 -Comment "NGen Worker Process"2⤵PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 420 -NGENProcess 418 -Pipe 3f0 -Comment "NGen Worker Process"2⤵PID:912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 420 -NGENProcess 398 -Pipe 41c -Comment "NGen Worker Process"2⤵PID:1848
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 42c -NGENProcess 418 -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:1544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 3e0 -NGENProcess 414 -Pipe 40c -Comment "NGen Worker Process"2⤵PID:2380
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 430 -NGENProcess 428 -Pipe 408 -Comment "NGen Worker Process"2⤵PID:1652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 428 -NGENProcess 42c -Pipe 418 -Comment "NGen Worker Process"2⤵PID:2468
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1556 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1cc -NGENProcess 1d0 -Pipe 1dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2972
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1cc -NGENProcess 1d0 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1920
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2984
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:2960
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1008
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1288
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:272
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2528
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2520
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:588
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1948
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:2320
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1944
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2700
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1744
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1620
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1580
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2284
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 6002⤵
- Modifies data under HKEY_USERS
PID:2120
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5bc2319d5ee9156b8fbe9f5530f02648f
SHA134168675940461437a115d83c8c0acab56e1e6e7
SHA25634315848f73265524a83059ffff89be03f7d21b827a0816d9ff998c713bf935e
SHA5127936d4e13626c6c12b4e902f2edf3a70ced8686d2deed5ee43977b3165ebf893edfcc5ba520a6634249b9e3c03b778ef6457d88ef5e4809db4987ca212f0c8b1
-
Filesize
30.1MB
MD5c9515490e551f8dff9bf13be593dccaa
SHA16a46d3d211088b14e599b2163fc73db46a20ea04
SHA256a92435174f3032a6eaae658b3d7ee2f2855e368f2583e5cf5cbcc10d9a8842e5
SHA512931cbb24afdfb75a6cd1977e01de1a1a91ab462541170efa743cee5ea902d456d78a676db200f511bd16a69f0e4fd4e8769a95167e248e87bd79c56bed4b0fdb
-
Filesize
1.4MB
MD578b428dff14d2a702d8bc6e91a93fd33
SHA15d53899ddb3ccd36d0cd3da98c3ad462f4760cfd
SHA25610ce4f217494b2582e20fd2bd8df6262856d5eaf3e6469ad8b7cf0109ce2fee9
SHA512eb33258370d131d9e9bfd83b54842326ce3f97a5a0bd098729b215d8057da922c2cbe94de3cbfc23009b52e97b06df775facf2264c55c23f131bb77feae66c25
-
Filesize
5.2MB
MD5997bb9239f44b0f9e382ff4196dbd234
SHA1eca1d16e754b5b685592ed9763b1d10df16acbde
SHA2561f21785fb64f8629b64141c3c2b35302a617580dbf7bc3986ff309a4329de925
SHA512e1714784b9fc7b75dbb1385f47e4ea2c1e29c76771bd6dcf125b537d7466e969f46e747a1dfa9890d1c58d029d6a8379e8c6ce8667efbccdb2198aa1156114c1
-
Filesize
2.1MB
MD5282819a2b927ee1e79f4ea220f82b022
SHA1d84ffb0e75d8c7b6c63272a0c5d02a659b284e2f
SHA256ca9c2ce5273165b919262054393c381fe8671522467f59090b5ade210591a863
SHA512d681179ef31db9f2831826190876e9b7d12e70325a63d14d07b204abb93b163c9088a2e0188245a92c2295502a26c0a53ea0473ab8595919239a916bc22a6285
-
Filesize
1024KB
MD5e4e8bd22f7cb41cb482ed6d096f5454a
SHA1fd9e9fbb155380f3cebd918891f934e7e2b9939f
SHA2564e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7
SHA512a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
872KB
MD58bdf3dca1b1eff91ff8e877d2cec4195
SHA1f4c70b28641a8c5e78f4c14ad75e4aa85333a6dc
SHA25620ab22521b2ce614a801c081d15c22582006eaafebdf94fcfd02ee4387711b37
SHA5121b577105c7df31c45eb1badd5ce8e888502070967835d079978d8e87d0c12994442706a839ecb31eebaddb27665806877aa15c17e3ec0962d15f51440411d7c7
-
Filesize
1.3MB
MD5744852a6f61f6182ff6c1945c9940c39
SHA1af78beead14690d931b347d3d77ffd01d0d7df2b
SHA256aaf84fcddce5b40eb64c854b9fe99c879e71f447e179404f50624de6086797c0
SHA512f39f753b96b3033b66098323c5c964831bf0f5b88b679ae0c11f512ecc8fa17d755ec6f784dafe6f43f85070cf9fbe1ef53eaf6750cfdbd732629adf5e7370f6
-
Filesize
1.2MB
MD5e5f15dae3fcade1785554c49231121f7
SHA1a1569d90f9163a3229081afabe4639ee86a6246d
SHA256f4143ff3a4a3f30768c9d12b2e63bc282703fa508c929a69fcd685f15bb9d60f
SHA5128203ef58ac54a265d1816fceb8950d9ef2a8f21ef0f0dcba743c7f7c935d395abb5b7203a16c3a96045642e1d9998b0b771e7c7c91d790f196dcff2778ca8786
-
Filesize
1003KB
MD5670714bd60e1d63d15e9042662751071
SHA19207616ebc0848b16501f8621e1d67640a350c1b
SHA2568f3964ec3b8aba857594fd5301746b4cc95ebb5173f2b2d7661effb2417d0d0e
SHA512b6b5d05c647f1fe5af4ede5ffe7221b2fa1bff8587ee594a56d170f7cc80db0885a947493b1fffd11db3167d1b211026ce190217436318521519e7af12d84287
-
Filesize
1.2MB
MD51f52cc6b02681e1185acd61b37f99de9
SHA1a4aff6179545df44422c057dae7a296c70459754
SHA25619ab60f4628cb1ee5b657bd8d19fce579dee5fb8fd1f67d6be9f2efbf412e8c3
SHA512e0ed77bbfa7699cf38f2b9ad7b8f28e755163b09aa235099896d88805affde9ba848c27a869e570f528717b665b44462373642749cf0a8a721893ef85099f17d
-
Filesize
8KB
MD5fd04cd1b75d861d281733606722ebb4b
SHA1e3eaf5ec527bce1d17c7c510c9eec0d5904e091e
SHA256f29aca1400500f0efd278b2f25ea0ab683fd8099b4f338c4f6fc4a73f0043f50
SHA5125564c6aff2fc5c49409d0885292d702073c8dbe90ca0bd0234a3651ec2d329b971493903cd210612a88bb506f45c1389fcaf8f4b9a620e6afabd40940dc0a862
-
Filesize
1.2MB
MD5c1f141a683d1c89b14a0544d98e7cc77
SHA11e8212cf7b20e6682826145f704b3a21f2c5e61c
SHA2566a706ba0590ca374938d5eeb168e49e0bad5a1d69a70cc1c3d76ab0129a169d1
SHA5125cfd8dc0f44fe66b12ee609bf82b0f71a7757d8fff0d1428aebc409648eb8d01a2c12a32599ddea842932ccfc5f1a1c41e3fe15478156bfb8c2444cd920ae202
-
Filesize
1.2MB
MD5ba9e2c0cc0dc1fe4739f62717ff6bb7f
SHA1a6433af9316a9958ac7d2c6e35e2bb2cedf7e6f1
SHA2565a518ace59e7470597b80aad2bae6b44c6e1ec571ba9d2edd7c924e46df1c9bf
SHA51296eb47a6e0cb1bc720adda82a8802a406614b548d39a65a622dee85595f8f7174ea7773887935e70bba2425d71bb446caff77af8230270fd4df631ea0cb6590c
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
Filesize834KB
MD5c76656b09bb7df6bd2ac1a6177a0027c
SHA10c296994a249e8649b19be84dce27c9ddafef3e0
SHA256a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
SHA5128390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize797KB
MD5aeb0b6e6c5d32d1ada231285ff2ae881
SHA11f04a1c059503896336406aed1dc93340e90b742
SHA2564c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
SHA512e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Filesize163KB
MD5e88828b5a35063aa16c68ffb8322215d
SHA18225660ba3a9f528cf6ac32038ae3e0ec98d2331
SHA25699facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
SHA512e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Filesize1.3MB
MD5006498313e139299a5383f0892c954b9
SHA17b3aa10930da9f29272154e2674b86876957ce3a
SHA256489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
SHA5126a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
Filesize148KB
MD5ac901cf97363425059a50d1398e3454b
SHA12f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA5126a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize34KB
MD5c26b034a8d6ab845b41ed6e8a8d6001d
SHA13a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\040f21fd8b68dd2e912e5f9f73adf642\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize187KB
MD5199dfee2faf592e1362023276d51b67a
SHA1fc462bf5607a2a84df5f2b0de22fc5780f637422
SHA2565d7d9d40b343059b07c42c992142949fb63581ed4995755c2a4312f54cb1327f
SHA51203d0b8ce131092c56e4f5cefa2d33cd6b3fe80487c5f8ade5d81b854bfaa28cc0960adec1f881491d69c3bb9ca0de0d5aac323406e3d81532ed256c29df524cf
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize109KB
MD50fd0f978e977a4122b64ae8f8541de54
SHA1153d3390416fdeba1b150816cbbf968e355dc64f
SHA256211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\10fcc3a271c7408b5f2ac8aaf766be97\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize180KB
MD5fe61614675c3e6a05e1de66714ea177d
SHA1550283edca18646680e0ec61b7508887bcec765f
SHA2562e9904a9393855e7fdfe6860055799dc10a42a468beee5ba40caa6a7c1c2f4f5
SHA5124c6a7c6d62d43477c0f7c4668d73a17b5312e0f5cc263cd2ecf5077b7a7552d87c5c8058fc1e9f43cdcbfc7304e2c7e3295bb24e83941ba06ad9a95a9db2f008
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize41KB
MD53c269caf88ccaf71660d8dc6c56f4873
SHA1f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
Filesize356KB
MD587111e9d98dc79165dfc98a1fb93100b
SHA14f5182e5ce810f6ba3bdb3418ad33c916b6013c8
SHA256971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
SHA512abbb246d620e8a2ab1973dde19ff56ea1c02afa39e889925fe2a1ba43af1ad4ff6eb017e68578ae520109b3e290b3d9054d7537eb2df0ede6e0fbca8519cc104
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4cffbd6c354740026d7a3a29dd63e3bc\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize143KB
MD51fa4c663eb7f4f3f5e7547c8d2849c90
SHA17a2e4dc0eacfaab69d5ddfcbf9fcec8ff55b035f
SHA2563febbc6242bafabbb51659ed696758cc75dadcb7ffc8217b8a032590d97d9166
SHA5123a40a81785cf707abfb6b5f88b98e6cf413391b4098d1199a1cb7f030fa2e45c3c8502ae6baa7ff56f1476ee700d5f126c14a99433802a1dd328cd66bd9dfdd9
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
Filesize1.2MB
MD50637ad2bf6fc5ac1d29e547155bc818c
SHA1a502879466b6dd37eae5881bbb18353f97623852
SHA256868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
SHA5121d18a16ec3b91c3143c4371de305a7ea464d41661752ece65bf1ce19a8342a265c024a740afa6be8baf4d1edfdac6c6fcdad7395c1294342cd1f4388428e52c1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize210KB
MD54f40997b51420653706cb0958086cd2d
SHA10069b956d17ce7d782a0e054995317f2f621b502
SHA2568cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize53KB
MD5e3a7a2b65afd8ab8b154fdc7897595c3
SHA1b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA5126537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
Filesize65KB
MD5da9f9a01a99bd98104b19a95eeef256c
SHA1272071d5bbc0c234bc2f63dfcd5a90f83079bbab
SHA256b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
SHA512dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\af7bed6f291307be662dd70bc219709a\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize83KB
MD58869ff3f561a4f8b6cfdb196f283c1bf
SHA1cf3eb7a4b0801b846e490e9424cb38c6d4314420
SHA256226b325a80b779c1500f91a1aae2aefbcd102bdfaea7dce62517e5377164ecac
SHA51298c0169d3b58d156bc28cd668feed7642f9606b912ba8b520efbbe637d556279b943506e30ea2b475079bcf12eeb7db9b6810c8ce74e7ee867450f5f78c20e7c
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize28KB
MD5aefc3f3c8e7499bad4d05284e8abd16c
SHA17ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA2564436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA5121d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize27KB
MD59c60454398ce4bce7a52cbda4a45d364
SHA1da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize57KB
MD56eaaa1f987d6e1d81badf8665c55a341
SHA1e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA2564b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize130KB
MD52735d2ab103beb0f7c1fbd6971838274
SHA16063646bc072546798bf8bf347425834f2bfad71
SHA256f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize59KB
MD58c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize42KB
MD571d4273e5b77cf01239a5d4f29e064fc
SHA1e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA51241fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
Filesize855KB
MD57812b0a90d92b4812d4063b89a970c58
SHA13c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA256897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
SHA512634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
Filesize43KB
MD53e72bdd0663c5b2bcd530f74139c83e3
SHA166069bcac0207512b9e07320f4fa5934650677d2
SHA2566a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
SHA512b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
-
Filesize
1.2MB
MD5426c853088500274d24b853c8f9ecbbc
SHA1abf86dd133ed33ae8e928446ecc435d00f358302
SHA2564dea14a5f29e923c8fe4f220d246f7779b2e108eb413390a9988a33e0e8347f4
SHA5121d1897b039be3104852d3c8e9ddc6b1e69ff888f8fdab72fa60a9d5427708d2efe32d1f683c8df677b842be510930acab704cf08552bebaada8fa5c23e317689
-
Filesize
1.2MB
MD550f52786841a9c01789581e44a296c80
SHA17abcef2f0fb713a32378209da479ab60fccd7c8e
SHA25625775dba7a63a7770d9480792c15341cd791d5c4256d686a2151a14e70391013
SHA512003eac42105876dbdae4e83c3dbdbfa459c464844cac81bc091bf0266ccebd92320a2066c1e88c21962cb89f44c9f4468938e275dc95183e951a44bdc78d4775
-
Filesize
1.2MB
MD50781dab77c7b78a02cc7bd03b3f19c3d
SHA1d1f59166e0895f71068f2f559b8539b795829624
SHA2561e9c49c66a94ca16e88d9fb1cd72c207abd8a191e9cc951ec1c1f5b0f569734b
SHA512c07d39df7e77b2b8260f1e471b1e45de0018acaaadf3193ce3fca27ff0f10112abd05acdd24f0ee1aaf35841477bf112dd9ab53689f755fb657c5ce370ec0847
-
Filesize
1.2MB
MD5630ecb1fc12e97602035f433200c788e
SHA11e7885d1e17904689bc052d67ccb9688db41ffce
SHA25630e4455cc02316492d8942cef33619ee8652bb50357b7146a9b1bdaffdeb9fe0
SHA51260df9da454f6b004f4f160e3ede7d18b5337c9d6c95e9cf5bfad83f7b1162cc23a1cb42338e2271b6e10a270b81c7fa124964a67ebffafc00c8888a4aac0eeed
-
Filesize
1.2MB
MD56a9ee6427fb85b0f4169667f4cb2d4ac
SHA1bd03c97eef804d9819bacad757174b99c4da3050
SHA2561b7681d49f673b1691a20b7560c7d5de953e89d69dfb3ddd73ca5a0a838d74c0
SHA5122d9c639893808c3cb6c172f63a1438e2e5c8f41925f3d4f625a32298d20241275ca29b3e23588e889bfd1525ecbba542047bd0f322f365f120760933b8f09d5f
-
Filesize
1.2MB
MD556947384a0675aba9200627aa47e2321
SHA1b1d3379b23281be4641c010bcbf135c80a2b7392
SHA25636a9260599feb1f31290b3181d2ca7a21eaf1b998177597530d97adea64d76db
SHA512c84189e9da7b5ed1fac6349ce2880f3c8788274e7932e4e04fbc154696ef8d6fd98c4200254ca87421a793cef851e302ee8bd935d1594672fea364a2acda7059
-
Filesize
1.3MB
MD5c7251685517ef89798843443585f8640
SHA104aca30f8bdc2d2f70ab8e211f2cc2c865428be0
SHA2566a196fb3a14c0d8e3bdbb73e2dba91f9a653bf00ab2b74bfa340c6a5e920d276
SHA5124ecee88bfbf245112c779f027eb7d397c69d0a619b1036381760bac51e62cf6becda990dc72eb0e494e656b6ffbc2be42374b68aad6249b29fa31b94a83e5d4d
-
Filesize
1.3MB
MD5061897120f5911447b1529e7116c42e7
SHA120ff527d4858cff25bd52764b01b8aecbc7e6826
SHA2565a7a9a0a4aa92cb7790dd2ca7d01d91c07a09fcaa5bc897a76ff6e9e9ff947d6
SHA5129696a2d1fcae9eb3e32de6192f9f3edb60995cff2483278ae30eb6baf9ed80d0dd5a0d0ecd1964933722f382d2e37090f255793d75e9f0a73e5f4a1544fe70bc
-
Filesize
1.2MB
MD5ce759a72825510bc0122f5a2c5ff9f30
SHA144db79d081c9a850e3f931b3a999ad48af0de878
SHA2562c58566cd436eae453b27c6b6b85690697894e70f26b822b3ca3d6f4b661b19c
SHA51245a3f3054d2ebe3c70128a79ab70bcd5ae1e6b227a281578aeb4a37186146e7a849aa1a0349a0b37090bc66f1724c0a026e4e778532dabb2bd81ebf026d58e55
-
Filesize
1.3MB
MD55ff4b73e86541ad18977b20092e19839
SHA12c6b4e2e3980ed67908e4ca00845305a7d0d2d59
SHA25629ca0000ddf5075d8856ba22761bf0b8b8bea363ef8d8882e2c3a95435e2f340
SHA512f11f0d19fc86cf47936267e32b92844f886dc17d0d022bac2d9e6c1294628c4f13181c4dc6d49d39f01cdde0f961d5cc5cbe25cb1f04e8a5c50a54fb0d05f7ec