Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 22:15
Static task
static1
Behavioral task
behavioral1
Sample
8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe
Resource
win7-20240221-en
General
-
Target
8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe
-
Size
1.8MB
-
MD5
64b81624b91a1ccc0b1718011e601681
-
SHA1
3c8ff35c3fd1b158d54ab65bdfdb5f804b73e514
-
SHA256
8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4
-
SHA512
0bdcfbafe43ef9ef152416d9ed4c95701e829785bffadde20293bae7aa424d2f7f7f9f082378b47d0d5fec0c4db0247a76ea0277e48abaea8ecb57159ffdc6ac
-
SSDEEP
49152:px5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAlgDUYmvFur31yAipQCtXxc0H:pvbjVkjjCAzJbU7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
alg.exeaspnet_state.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRecvr.exeehsched.exeelevation_service.exeIEEtwCollector.exeGROOVE.EXEmaintenanceservice.exemsdtc.exemsiexec.exedllhost.exeOSE.EXEOSPPSVC.EXEmscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeperfhost.exelocator.exesnmptrap.exevds.exevssvc.exewbengine.exeWmiApSrv.exewmpnetwk.exeSearchIndexer.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid process 480 2476 alg.exe 1228 aspnet_state.exe 2912 mscorsvw.exe 1928 mscorsvw.exe 1004 mscorsvw.exe 2216 mscorsvw.exe 728 ehRecvr.exe 636 ehsched.exe 1300 elevation_service.exe 788 IEEtwCollector.exe 1532 GROOVE.EXE 2288 maintenanceservice.exe 2492 msdtc.exe 2548 msiexec.exe 2912 dllhost.exe 324 OSE.EXE 1252 OSPPSVC.EXE 1932 mscorsvw.exe 2980 mscorsvw.exe 2984 mscorsvw.exe 1520 mscorsvw.exe 2092 mscorsvw.exe 352 mscorsvw.exe 2672 mscorsvw.exe 1544 mscorsvw.exe 2904 mscorsvw.exe 1568 mscorsvw.exe 2732 mscorsvw.exe 1872 mscorsvw.exe 2020 mscorsvw.exe 1964 mscorsvw.exe 2456 mscorsvw.exe 2752 mscorsvw.exe 1848 mscorsvw.exe 2232 mscorsvw.exe 1444 mscorsvw.exe 1928 mscorsvw.exe 1736 mscorsvw.exe 544 mscorsvw.exe 1124 mscorsvw.exe 2612 mscorsvw.exe 2072 mscorsvw.exe 1536 perfhost.exe 2836 locator.exe 1928 snmptrap.exe 884 vds.exe 1212 vssvc.exe 692 wbengine.exe 2896 WmiApSrv.exe 1660 wmpnetwk.exe 1940 SearchIndexer.exe 500 mscorsvw.exe 2360 mscorsvw.exe 1512 mscorsvw.exe 2756 mscorsvw.exe 1420 mscorsvw.exe 2632 mscorsvw.exe 2264 mscorsvw.exe 2576 mscorsvw.exe 308 mscorsvw.exe 2952 mscorsvw.exe 2516 mscorsvw.exe 2204 mscorsvw.exe -
Loads dropped DLL 64 IoCs
Processes:
msiexec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid process 480 480 480 480 480 480 480 2548 msiexec.exe 480 480 480 480 480 480 772 1420 mscorsvw.exe 1420 mscorsvw.exe 2264 mscorsvw.exe 2264 mscorsvw.exe 308 mscorsvw.exe 308 mscorsvw.exe 2516 mscorsvw.exe 2516 mscorsvw.exe 2028 mscorsvw.exe 2028 mscorsvw.exe 1544 mscorsvw.exe 1544 mscorsvw.exe 1188 mscorsvw.exe 1188 mscorsvw.exe 1964 mscorsvw.exe 1964 mscorsvw.exe 960 mscorsvw.exe 960 mscorsvw.exe 1788 mscorsvw.exe 1788 mscorsvw.exe 1364 mscorsvw.exe 1364 mscorsvw.exe 1520 mscorsvw.exe 1520 mscorsvw.exe 2460 mscorsvw.exe 2460 mscorsvw.exe 1656 mscorsvw.exe 1656 mscorsvw.exe 1848 mscorsvw.exe 1848 mscorsvw.exe 1900 mscorsvw.exe 1900 mscorsvw.exe 2192 mscorsvw.exe 2192 mscorsvw.exe 2560 mscorsvw.exe 2560 mscorsvw.exe 2628 mscorsvw.exe 2628 mscorsvw.exe 800 mscorsvw.exe 800 mscorsvw.exe 1224 mscorsvw.exe 1224 mscorsvw.exe 944 mscorsvw.exe 944 mscorsvw.exe 944 mscorsvw.exe 944 mscorsvw.exe 2264 mscorsvw.exe 2264 mscorsvw.exe 944 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
Processes:
SearchProtocolHost.exe8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exeaspnet_state.exemscorsvw.exealg.exemsdtc.exeGROOVE.EXEdescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\System32\alg.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Windows\system32\dllhost.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Windows\System32\msdtc.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Windows\SysWow64\perfhost.exe aspnet_state.exe File opened for modification C:\Windows\System32\snmptrap.exe aspnet_state.exe File opened for modification C:\Windows\System32\vds.exe aspnet_state.exe File opened for modification C:\Windows\system32\SearchIndexer.exe aspnet_state.exe File opened for modification C:\Windows\system32\fxssvc.exe mscorsvw.exe File opened for modification C:\Windows\system32\fxssvc.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Windows\system32\msiexec.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\locator.exe aspnet_state.exe File opened for modification C:\Windows\system32\wbengine.exe aspnet_state.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\vssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe mscorsvw.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\de5d653aaad3ae89.bin alg.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe aspnet_state.exe -
Drops file in Program Files directory 64 IoCs
Processes:
aspnet_state.exemscorsvw.exealg.exe8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe aspnet_state.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM2359.tmp\goopdateres_sl.dll 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File created C:\Program Files (x86)\Google\Temp\GUM2359.tmp\goopdateres_ur.dll 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File created C:\Program Files (x86)\Google\Temp\GUM2359.tmp\goopdateres_zh-CN.dll 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM2359.tmp\goopdateres_ko.dll 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe mscorsvw.exe File created C:\Program Files (x86)\Google\Temp\GUM2359.tmp\GoogleUpdateCore.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE mscorsvw.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM2359.tmp\GoogleCrashHandler64.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe mscorsvw.exe File created C:\Program Files (x86)\Google\Temp\GUM2359.tmp\GoogleUpdateComRegisterShell64.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{5CF72A45-AD68-472B-BBFF-38A947BD74EE}\chrome_installer.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe mscorsvw.exe -
Drops file in Windows directory 64 IoCs
Processes:
mscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedllhost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exe8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeaspnet_state.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedescription ioc process File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index147.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA19C.tmp\Microsoft.Office.Tools.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA506.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14f.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index150.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA737.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA998.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP19D7.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll mscorsvw.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{55C6160B-0E29-4947-842F-A08614168AB9}.crmlog dllhost.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index150.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14e.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14f.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index147.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPDA7.tmp\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index146.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE1E6.tmp\Microsoft.Office.Tools.Word.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14a.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index14d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index153.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe aspnet_state.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAE2A.tmp\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index143.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index14b.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index148.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA1E.tmp\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14e.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe aspnet_state.exe File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeSearchFilterHost.exeSearchProtocolHost.exemscorsvw.exemscorsvw.exemscorsvw.exeSearchIndexer.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86} SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-308 = "Landscapes" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-116 = "Kalimba" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-117 = "Maid with the Flaxen Hair" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe,-298 = "Personalize Handwriting Recognition" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ehRec.exeaspnet_state.exepid process 1020 ehRec.exe 1228 aspnet_state.exe 1228 aspnet_state.exe 1228 aspnet_state.exe 1228 aspnet_state.exe 1228 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exemscorsvw.exemscorsvw.exeEhTray.exeehRec.exemsiexec.exealg.exeaspnet_state.exevssvc.exewbengine.exewmpnetwk.exeSearchIndexer.exedescription pid process Token: SeTakeOwnershipPrivilege 1728 8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: 33 1480 EhTray.exe Token: SeIncBasePriorityPrivilege 1480 EhTray.exe Token: SeDebugPrivilege 1020 ehRec.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeRestorePrivilege 2548 msiexec.exe Token: SeTakeOwnershipPrivilege 2548 msiexec.exe Token: SeSecurityPrivilege 2548 msiexec.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: 33 1480 EhTray.exe Token: SeIncBasePriorityPrivilege 1480 EhTray.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeDebugPrivilege 2476 alg.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeTakeOwnershipPrivilege 1228 aspnet_state.exe Token: SeBackupPrivilege 1212 vssvc.exe Token: SeRestorePrivilege 1212 vssvc.exe Token: SeAuditPrivilege 1212 vssvc.exe Token: SeBackupPrivilege 692 wbengine.exe Token: SeRestorePrivilege 692 wbengine.exe Token: SeSecurityPrivilege 692 wbengine.exe Token: SeDebugPrivilege 1228 aspnet_state.exe Token: 33 1660 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 1660 wmpnetwk.exe Token: SeManageVolumePrivilege 1940 SearchIndexer.exe Token: 33 1940 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1940 SearchIndexer.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe Token: SeShutdownPrivilege 2216 mscorsvw.exe Token: SeShutdownPrivilege 1004 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EhTray.exepid process 1480 EhTray.exe 1480 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
EhTray.exepid process 1480 EhTray.exe 1480 EhTray.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
SearchProtocolHost.exepid process 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe 1924 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
mscorsvw.exedescription pid process target process PID 1004 wrote to memory of 1932 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1932 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1932 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1932 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2980 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2980 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2980 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2980 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2984 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2984 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2984 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2984 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1520 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1520 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1520 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1520 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2092 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2092 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2092 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2092 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 352 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 352 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 352 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 352 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2672 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2672 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2672 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2672 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1544 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1544 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1544 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1544 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2904 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2904 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2904 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2904 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1568 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1568 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1568 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1568 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2732 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2732 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2732 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2732 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1872 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1872 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1872 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1872 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2020 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2020 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2020 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2020 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1964 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1964 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1964 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 1964 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2456 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2456 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2456 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2456 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2752 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2752 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2752 1004 mscorsvw.exe mscorsvw.exe PID 1004 wrote to memory of 2752 1004 mscorsvw.exe mscorsvw.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe"C:\Users\Admin\AppData\Local\Temp\8cc0e4773290863a1b4c6c455958f22c358867644b781afd34932765fb98cac4.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2912
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1928
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 240 -NGENProcess 238 -Pipe 1ec -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 25c -NGENProcess 250 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 248 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:352 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 240 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 26c -NGENProcess 248 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 264 -NGENProcess 270 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 260 -NGENProcess 248 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1d0 -NGENProcess 278 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 268 -NGENProcess 248 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 268 -NGENProcess 1d0 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 284 -NGENProcess 248 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 250 -NGENProcess 278 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 250 -NGENProcess 284 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2752 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 270 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 27c -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 288 -NGENProcess 298 -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 27c -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2a0 -NGENProcess 278 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1736 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a8 -NGENProcess 250 -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2b0 -NGENProcess 268 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1124 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 270 -NGENProcess 1f4 -Pipe 21c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1ec -NGENProcess 26c -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 244 -NGENProcess 254 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1e4 -NGENProcess 1f4 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 220 -NGENProcess 26c -Pipe 29c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 1f4 -NGENProcess 26c -Pipe 1ec -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 268 -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1c0 -NGENProcess 220 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 2a0 -NGENProcess 26c -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 26c -NGENProcess 268 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2b0 -NGENProcess 220 -Pipe 1f4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2516 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 220 -NGENProcess 2a0 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 1d0 -NGENProcess 268 -Pipe 1c0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 268 -NGENProcess 2b0 -Pipe 2a8 -Comment "NGen Worker Process"2⤵PID:1948
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 284 -NGENProcess 2a0 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:1544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2a0 -NGENProcess 1d0 -Pipe 2b4 -Comment "NGen Worker Process"2⤵PID:2436
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 290 -NGENProcess 2b0 -Pipe 220 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1188 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2b0 -NGENProcess 284 -Pipe 250 -Comment "NGen Worker Process"2⤵PID:2748
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 278 -NGENProcess 1d0 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 1d0 -NGENProcess 290 -Pipe 27c -Comment "NGen Worker Process"2⤵PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 2bc -NGENProcess 284 -Pipe 2a0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 284 -NGENProcess 278 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:1008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2c4 -NGENProcess 290 -Pipe 2b0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1788 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 290 -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:1604
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2cc -NGENProcess 278 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 278 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:2772
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 284 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:2676
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 290 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:2460 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 278 -Comment "NGen Worker Process"2⤵PID:1964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 270 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1656 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:1324
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1848 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2d4 -NGENProcess 2e4 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:1604
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:1900 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2dc -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1008 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2fc -NGENProcess 2e4 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:2608
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2f8 -Pipe 25c -Comment "NGen Worker Process"2⤵PID:2824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2ec -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:1652
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2e4 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2192 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2e4 -NGENProcess 300 -Pipe 2f8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 300 -NGENProcess 2f4 -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:2764
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 314 -NGENProcess 30c -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:1008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 310 -Pipe 304 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2f4 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:2944
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 30c -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:2880
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 310 -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:2464
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2f4 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:2928
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"2⤵PID:2040
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 310 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2f4 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:1544
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 30c -Pipe 320 -Comment "NGen Worker Process"2⤵PID:1040
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 310 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:1864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2f4 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:2352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 32c -Comment "NGen Worker Process"2⤵PID:2560
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 310 -Pipe 330 -Comment "NGen Worker Process"2⤵PID:2764
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2f4 -Pipe 334 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 338 -Comment "NGen Worker Process"2⤵PID:1516
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 310 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:2192
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2f4 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:1540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 30c -Pipe 344 -Comment "NGen Worker Process"2⤵PID:1324
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 310 -Pipe 348 -Comment "NGen Worker Process"2⤵PID:280
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 2f4 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:2576
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 30c -Pipe 350 -Comment "NGen Worker Process"2⤵PID:3028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 310 -Pipe 354 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 2f4 -Pipe 358 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 30c -Pipe 35c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2396 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 310 -Pipe 360 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 310 -NGENProcess 378 -Pipe 37c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2264 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 380 -NGENProcess 30c -Pipe 368 -Comment "NGen Worker Process"2⤵PID:2632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 364 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 378 -Pipe 370 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2380 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 30c -Pipe 2f4 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 364 -Pipe 374 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1324 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 378 -Pipe 310 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 30c -Pipe 380 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:636 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 364 -Pipe 384 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 364 -NGENProcess 394 -Pipe 378 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 3a4 -NGENProcess 30c -Pipe 38c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:800 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 30c -NGENProcess 39c -Pipe 3a0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 3ac -NGENProcess 394 -Pipe 398 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1224 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 394 -NGENProcess 3a4 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:500
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b4 -NGENProcess 39c -Pipe 364 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 3b0 -Pipe 390 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3b0 -NGENProcess 394 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:1976
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3c0 -NGENProcess 39c -Pipe 388 -Comment "NGen Worker Process"2⤵PID:1008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 3bc -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:1472
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 394 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:2264
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 39c -Pipe 30c -Comment "NGen Worker Process"2⤵PID:1712
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3bc -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:1188
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 394 -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:2020
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 39c -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:2620
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 3bc -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:1728
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 394 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:3028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 39c -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:2828
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3bc -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:2024
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 394 -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:2632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 39c -Pipe 3d8 -Comment "NGen Worker Process"2⤵PID:1864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 3bc -Pipe 3dc -Comment "NGen Worker Process"2⤵PID:1512
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 394 -Pipe 3e0 -Comment "NGen Worker Process"2⤵PID:2952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3fc -NGENProcess 39c -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:1964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 404 -NGENProcess 3ec -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:2560
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 408 -NGENProcess 394 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:2892
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 40c -NGENProcess 39c -Pipe 3f0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 39c -NGENProcess 404 -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:1628
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 414 -NGENProcess 394 -Pipe 3f8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2264 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 394 -NGENProcess 40c -Pipe 410 -Comment "NGen Worker Process"2⤵PID:2288
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 41c -NGENProcess 404 -Pipe 408 -Comment "NGen Worker Process"2⤵PID:1600
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 418 -Pipe 3f4 -Comment "NGen Worker Process"2⤵PID:2180
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 40c -Pipe 39c -Comment "NGen Worker Process"2⤵PID:1420
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 404 -Pipe 3fc -Comment "NGen Worker Process"2⤵PID:2720
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 418 -Pipe 414 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 418 -NGENProcess 424 -Pipe 40c -Comment "NGen Worker Process"2⤵PID:1712
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 428 -NGENProcess 404 -Pipe 438 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:2828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 404 -NGENProcess 42c -Pipe 434 -Comment "NGen Worker Process"2⤵PID:2824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 43c -NGENProcess 424 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:2344
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 41c -Pipe 394 -Comment "NGen Worker Process"2⤵PID:1420
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 42c -Pipe 418 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:2192 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 42c -NGENProcess 43c -Pipe 424 -Comment "NGen Worker Process"2⤵PID:1224
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 44c -NGENProcess 41c -Pipe 428 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1264 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 41c -NGENProcess 444 -Pipe 448 -Comment "NGen Worker Process"2⤵PID:2916
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 454 -NGENProcess 43c -Pipe 440 -Comment "NGen Worker Process"2⤵PID:2772
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 458 -NGENProcess 450 -Pipe 420 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1728 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 450 -NGENProcess 41c -Pipe 444 -Comment "NGen Worker Process"2⤵PID:1520
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 41c -NGENProcess 450 -Pipe 460 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 450 -NGENProcess 43c -Pipe 45c -Comment "NGen Worker Process"2⤵PID:2752
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 468 -NGENProcess 404 -Pipe 454 -Comment "NGen Worker Process"2⤵PID:1124
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 46c -NGENProcess 464 -Pipe 42c -Comment "NGen Worker Process"2⤵PID:1320
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 470 -NGENProcess 43c -Pipe 458 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1952 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 474 -NGENProcess 404 -Pipe 44c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 404 -NGENProcess 46c -Pipe 464 -Comment "NGen Worker Process"2⤵PID:1976
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 47c -NGENProcess 43c -Pipe 450 -Comment "NGen Worker Process"2⤵PID:2096
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 480 -NGENProcess 478 -Pipe 468 -Comment "NGen Worker Process"2⤵PID:2088
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 484 -NGENProcess 46c -Pipe 470 -Comment "NGen Worker Process"2⤵PID:3064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 488 -NGENProcess 43c -Pipe 41c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1120 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 43c -NGENProcess 480 -Pipe 478 -Comment "NGen Worker Process"2⤵PID:832
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 490 -NGENProcess 46c -Pipe 404 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1384 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 494 -NGENProcess 48c -Pipe 47c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1556 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 498 -NGENProcess 494 -Pipe 204 -Comment "NGen Worker Process"2⤵PID:2516
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 430 -NGENProcess 43c -Pipe 488 -Comment "NGen Worker Process"2⤵PID:1888
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 474 -NGENProcess 484 -Pipe 48c -Comment "NGen Worker Process"2⤵PID:352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 49c -NGENProcess 494 -Pipe 208 -Comment "NGen Worker Process"2⤵PID:932
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 4a0 -NGENProcess 43c -Pipe 490 -Comment "NGen Worker Process"2⤵PID:2164
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4a4 -NGENProcess 484 -Pipe 480 -Comment "NGen Worker Process"2⤵PID:2764
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 4a8 -NGENProcess 494 -Pipe 498 -Comment "NGen Worker Process"2⤵PID:1048
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4ac -NGENProcess 43c -Pipe 430 -Comment "NGen Worker Process"2⤵PID:2756
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4b0 -NGENProcess 484 -Pipe 474 -Comment "NGen Worker Process"2⤵PID:2448
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4b4 -NGENProcess 494 -Pipe 49c -Comment "NGen Worker Process"2⤵PID:1324
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4b8 -NGENProcess 43c -Pipe 4a0 -Comment "NGen Worker Process"2⤵PID:920
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 4bc -NGENProcess 484 -Pipe 4a4 -Comment "NGen Worker Process"2⤵PID:2928
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4c0 -NGENProcess 494 -Pipe 4a8 -Comment "NGen Worker Process"2⤵PID:500
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4c4 -NGENProcess 43c -Pipe 4ac -Comment "NGen Worker Process"2⤵PID:1544
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 4c8 -NGENProcess 484 -Pipe 4b0 -Comment "NGen Worker Process"2⤵PID:1480
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 4cc -NGENProcess 494 -Pipe 4b4 -Comment "NGen Worker Process"2⤵PID:2780
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 4d0 -NGENProcess 43c -Pipe 4b8 -Comment "NGen Worker Process"2⤵PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4d4 -NGENProcess 484 -Pipe 4bc -Comment "NGen Worker Process"2⤵PID:2372
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4d8 -NGENProcess 494 -Pipe 4c0 -Comment "NGen Worker Process"2⤵PID:848
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 4dc -NGENProcess 43c -Pipe 4c4 -Comment "NGen Worker Process"2⤵PID:2416
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4e0 -NGENProcess 484 -Pipe 4c8 -Comment "NGen Worker Process"2⤵PID:2636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4e4 -NGENProcess 494 -Pipe 4cc -Comment "NGen Worker Process"2⤵PID:2560
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4e8 -NGENProcess 43c -Pipe 4d0 -Comment "NGen Worker Process"2⤵PID:1412
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4ec -NGENProcess 484 -Pipe 4d4 -Comment "NGen Worker Process"2⤵PID:2488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 4f0 -NGENProcess 494 -Pipe 4d8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:836 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 4f4 -NGENProcess 43c -Pipe 4dc -Comment "NGen Worker Process"2⤵PID:2012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 4f8 -NGENProcess 484 -Pipe 4e0 -Comment "NGen Worker Process"2⤵PID:2460
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 4fc -NGENProcess 494 -Pipe 4e4 -Comment "NGen Worker Process"2⤵PID:688
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 500 -NGENProcess 43c -Pipe 4e8 -Comment "NGen Worker Process"2⤵PID:2464
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 504 -NGENProcess 484 -Pipe 4ec -Comment "NGen Worker Process"2⤵PID:1048
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 508 -NGENProcess 494 -Pipe 4f0 -Comment "NGen Worker Process"2⤵PID:948
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 50c -NGENProcess 43c -Pipe 4f4 -Comment "NGen Worker Process"2⤵PID:2088
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 510 -NGENProcess 484 -Pipe 4f8 -Comment "NGen Worker Process"2⤵PID:1728
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 514 -NGENProcess 494 -Pipe 4fc -Comment "NGen Worker Process"2⤵PID:2520
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 518 -NGENProcess 43c -Pipe 500 -Comment "NGen Worker Process"2⤵PID:1944
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 51c -NGENProcess 484 -Pipe 504 -Comment "NGen Worker Process"2⤵PID:2636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 520 -NGENProcess 494 -Pipe 508 -Comment "NGen Worker Process"2⤵PID:280
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 520 -InterruptEvent 524 -NGENProcess 43c -Pipe 50c -Comment "NGen Worker Process"2⤵PID:2752
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 528 -NGENProcess 484 -Pipe 510 -Comment "NGen Worker Process"2⤵PID:2684
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 52c -NGENProcess 494 -Pipe 514 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:3064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 530 -NGENProcess 43c -Pipe 518 -Comment "NGen Worker Process"2⤵PID:2608
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 534 -NGENProcess 484 -Pipe 51c -Comment "NGen Worker Process"2⤵PID:2556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 538 -NGENProcess 494 -Pipe 520 -Comment "NGen Worker Process"2⤵PID:2764
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 53c -NGENProcess 43c -Pipe 524 -Comment "NGen Worker Process"2⤵PID:1544
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 540 -NGENProcess 484 -Pipe 528 -Comment "NGen Worker Process"2⤵PID:2620
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 544 -NGENProcess 494 -Pipe 52c -Comment "NGen Worker Process"2⤵PID:1960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 548 -NGENProcess 43c -Pipe 530 -Comment "NGen Worker Process"2⤵PID:1888
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 54c -NGENProcess 484 -Pipe 534 -Comment "NGen Worker Process"2⤵PID:1520
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 550 -NGENProcess 494 -Pipe 538 -Comment "NGen Worker Process"2⤵PID:984
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 554 -NGENProcess 43c -Pipe 53c -Comment "NGen Worker Process"2⤵PID:1716
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 558 -NGENProcess 484 -Pipe 540 -Comment "NGen Worker Process"2⤵PID:900
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 55c -NGENProcess 494 -Pipe 544 -Comment "NGen Worker Process"2⤵PID:2244
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 560 -NGENProcess 43c -Pipe 548 -Comment "NGen Worker Process"2⤵PID:2360
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 558 -NGENProcess 564 -Pipe 55c -Comment "NGen Worker Process"2⤵PID:2328
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 550 -NGENProcess 43c -Pipe 46c -Comment "NGen Worker Process"2⤵PID:2488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 568 -NGENProcess 560 -Pipe 494 -Comment "NGen Worker Process"2⤵PID:2012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 56c -NGENProcess 564 -Pipe 1c4 -Comment "NGen Worker Process"2⤵PID:1188
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 56c -InterruptEvent 570 -NGENProcess 43c -Pipe 484 -Comment "NGen Worker Process"2⤵PID:2556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 574 -NGENProcess 560 -Pipe 54c -Comment "NGen Worker Process"2⤵PID:2632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 578 -NGENProcess 564 -Pipe 558 -Comment "NGen Worker Process"2⤵PID:1652
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 57c -NGENProcess 43c -Pipe 550 -Comment "NGen Worker Process"2⤵PID:636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 580 -NGENProcess 560 -Pipe 568 -Comment "NGen Worker Process"2⤵PID:2268
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 584 -NGENProcess 564 -Pipe 56c -Comment "NGen Worker Process"2⤵PID:1728
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 588 -NGENProcess 43c -Pipe 570 -Comment "NGen Worker Process"2⤵PID:2520
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 58c -NGENProcess 560 -Pipe 574 -Comment "NGen Worker Process"2⤵PID:988
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 590 -NGENProcess 564 -Pipe 578 -Comment "NGen Worker Process"2⤵PID:912
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 594 -NGENProcess 43c -Pipe 57c -Comment "NGen Worker Process"2⤵PID:1900
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 598 -NGENProcess 560 -Pipe 580 -Comment "NGen Worker Process"2⤵PID:1412
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 59c -NGENProcess 564 -Pipe 584 -Comment "NGen Worker Process"2⤵PID:1124
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 5a0 -NGENProcess 43c -Pipe 588 -Comment "NGen Worker Process"2⤵PID:1420
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 5a4 -NGENProcess 560 -Pipe 58c -Comment "NGen Worker Process"2⤵PID:944
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 5a8 -NGENProcess 59c -Pipe 5a0 -Comment "NGen Worker Process"2⤵PID:2124
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 5ac -NGENProcess 43c -Pipe 594 -Comment "NGen Worker Process"2⤵PID:1716
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ac -InterruptEvent 5b0 -NGENProcess 560 -Pipe 598 -Comment "NGen Worker Process"2⤵PID:1848
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 5b4 -NGENProcess 59c -Pipe 5a4 -Comment "NGen Worker Process"2⤵PID:2620
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 5b8 -NGENProcess 43c -Pipe 564 -Comment "NGen Worker Process"2⤵PID:2752
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 5bc -NGENProcess 560 -Pipe 590 -Comment "NGen Worker Process"2⤵PID:580
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 5c0 -NGENProcess 59c -Pipe 5a8 -Comment "NGen Worker Process"2⤵PID:2056
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 5c4 -NGENProcess 43c -Pipe 5ac -Comment "NGen Worker Process"2⤵PID:2772
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c4 -InterruptEvent 5c8 -NGENProcess 560 -Pipe 5b0 -Comment "NGen Worker Process"2⤵PID:3024
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 5cc -NGENProcess 5c0 -Pipe 5bc -Comment "NGen Worker Process"2⤵PID:1168
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 610 -InterruptEvent 614 -NGENProcess 5dc -Pipe 5fc -Comment "NGen Worker Process"2⤵PID:2640
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 630 -NGENProcess 5dc -Pipe 610 -Comment "NGen Worker Process"2⤵PID:1892
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 634 -NGENProcess 61c -Pipe 624 -Comment "NGen Worker Process"2⤵PID:1604
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 638 -NGENProcess 614 -Pipe 618 -Comment "NGen Worker Process"2⤵PID:2164
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 638 -InterruptEvent 63c -NGENProcess 5dc -Pipe 5cc -Comment "NGen Worker Process"2⤵PID:1040
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 63c -InterruptEvent 640 -NGENProcess 61c -Pipe 620 -Comment "NGen Worker Process"2⤵PID:2520
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 644 -NGENProcess 614 -Pipe 62c -Comment "NGen Worker Process"2⤵PID:1472
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 644 -InterruptEvent 648 -NGENProcess 5dc -Pipe 630 -Comment "NGen Worker Process"2⤵PID:688
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 64c -NGENProcess 61c -Pipe 634 -Comment "NGen Worker Process"2⤵PID:1864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 650 -NGENProcess 614 -Pipe 638 -Comment "NGen Worker Process"2⤵PID:2352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 650 -InterruptEvent 654 -NGENProcess 5dc -Pipe 63c -Comment "NGen Worker Process"2⤵PID:2372
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 654 -InterruptEvent 658 -NGENProcess 61c -Pipe 640 -Comment "NGen Worker Process"2⤵PID:2608
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 65c -NGENProcess 614 -Pipe 644 -Comment "NGen Worker Process"2⤵PID:2772
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 660 -NGENProcess 5dc -Pipe 648 -Comment "NGen Worker Process"2⤵PID:2928
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 660 -InterruptEvent 664 -NGENProcess 61c -Pipe 64c -Comment "NGen Worker Process"2⤵PID:1972
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 664 -InterruptEvent 668 -NGENProcess 614 -Pipe 650 -Comment "NGen Worker Process"2⤵PID:540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 65c -NGENProcess 5dc -Pipe 670 -Comment "NGen Worker Process"2⤵PID:1960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 654 -NGENProcess 66c -Pipe 658 -Comment "NGen Worker Process"2⤵PID:2268
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 654 -InterruptEvent 674 -NGENProcess 614 -Pipe 628 -Comment "NGen Worker Process"2⤵PID:1728
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 678 -NGENProcess 5dc -Pipe 660 -Comment "NGen Worker Process"2⤵PID:944
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 67c -NGENProcess 66c -Pipe 664 -Comment "NGen Worker Process"2⤵PID:1976
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 680 -NGENProcess 614 -Pipe 668 -Comment "NGen Worker Process"2⤵PID:912
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 684 -NGENProcess 5dc -Pipe 65c -Comment "NGen Worker Process"2⤵PID:1048
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 688 -NGENProcess 66c -Pipe 654 -Comment "NGen Worker Process"2⤵PID:2628
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 688 -InterruptEvent 68c -NGENProcess 614 -Pipe 674 -Comment "NGen Worker Process"2⤵PID:1124
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 68c -InterruptEvent 690 -NGENProcess 5dc -Pipe 678 -Comment "NGen Worker Process"2⤵PID:2024
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 690 -InterruptEvent 694 -NGENProcess 66c -Pipe 67c -Comment "NGen Worker Process"2⤵PID:2828
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 698 -NGENProcess 614 -Pipe 680 -Comment "NGen Worker Process"2⤵PID:2028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 69c -NGENProcess 5dc -Pipe 684 -Comment "NGen Worker Process"2⤵PID:1264
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 6a0 -NGENProcess 66c -Pipe 688 -Comment "NGen Worker Process"2⤵PID:2564
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 6a4 -NGENProcess 614 -Pipe 68c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a4 -InterruptEvent 6a8 -NGENProcess 5dc -Pipe 690 -Comment "NGen Worker Process"2⤵PID:1952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 6ac -NGENProcess 66c -Pipe 694 -Comment "NGen Worker Process"2⤵PID:2168
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6ac -InterruptEvent 6b0 -NGENProcess 614 -Pipe 698 -Comment "NGen Worker Process"2⤵PID:3028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 6b4 -NGENProcess 5dc -Pipe 69c -Comment "NGen Worker Process"2⤵PID:2072
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b4 -InterruptEvent 6b8 -NGENProcess 66c -Pipe 6a0 -Comment "NGen Worker Process"2⤵PID:2380
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 6bc -NGENProcess 614 -Pipe 6a4 -Comment "NGen Worker Process"2⤵PID:912
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 6c0 -NGENProcess 5dc -Pipe 6a8 -Comment "NGen Worker Process"2⤵PID:2564
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 6c4 -NGENProcess 66c -Pipe 6ac -Comment "NGen Worker Process"2⤵PID:1516
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 6c8 -NGENProcess 614 -Pipe 6b0 -Comment "NGen Worker Process"2⤵PID:2328
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 6cc -NGENProcess 5dc -Pipe 6b4 -Comment "NGen Worker Process"2⤵PID:2648
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6cc -InterruptEvent 6d0 -NGENProcess 66c -Pipe 6b8 -Comment "NGen Worker Process"2⤵PID:2288
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2216 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 238 -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2072
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
PID:728
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:636
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1480
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1300
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:788
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2288
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2492
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2912
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:324
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:1252
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1536
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2836
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1928
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:884
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:692
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2896
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1924 -
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 5922⤵
- Modifies data under HKEY_USERS
PID:2248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
1.6MB
MD54cf363c74cf4eaa0e4a8db7b272f404c
SHA1d9a66a488b27f4d407a65976a79322a4a725e276
SHA2569eea4871ff3c7b12fcbff3671760201ace02cc770df6f6bd11c21b94b60c52bb
SHA51243da600fadeed685dc11d6fea81c0b88bb65c0c92b77fcffaecca974a234fca9649bd2ec6befc45f110f63903208a713b097ec4a51717636c7a25d428562d137
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXEFilesize
30.1MB
MD50f4ee491f57d12ae8f263975e53f02ae
SHA154df918044f45247456858b2efc9e9d27b726f45
SHA2562a2b6569823fed2b70a2feafc75f5712b104a08cf9587da22a73b63fcae1bf6d
SHA5123666b00108657644d21799322d2686e1172a01ed9aac8c793f59291bcc704de5d5d4adc03da946f60381bfa0ac58eee901bbc00175da971dab6c08e7ff29e88a
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
1.6MB
MD5e51eacd2f4ab481b11a18559901f8425
SHA1b1ffa0f808a266c18fb1de11dcd85daaba55a675
SHA256d2ef3477f9883d7d2302b0249cd9dcaefa800d4527a2a5896293062174bb515d
SHA5123378efc012e67c22373e9246dd8b7ac2a8d3e5ab1dfa1cefce131c04ce2123ec3b0a3f63390551fffa2d89431dc9cde2999767bcd8306f49b655d12e8f4c2e8a
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEFilesize
5.2MB
MD5b794b55d2f9d70a4885fcd2b05d27b76
SHA156e970f6def2d9f4425ac866079088f38b6c3331
SHA2567493ab6453347737436bcd9ef1ac84dd499194dfcecd815e045eca735c02c989
SHA51281d1c5b5639c4cb7d9c0839ba6d6f6b4e664b6264ef7995c9a043ae68a69e4048bf4216ae717f4eb980488874fcd671c50e3e38d403c93f0a18abfef03664d41
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exeFilesize
2.1MB
MD5cafbd83cbc4f71d6f8e82c117c4a4970
SHA12b9b0204a67300ba785bd6c02c00770274dfb2cb
SHA256466cffa87af913a4351a833d17c0e5a5c59919b29eb8eec78871ecb2755fdbbf
SHA51274a8283c44d302a16ffe91c9871a5c3c6eb6d956a2464e98a39ee9a8b71c290d70d0bc8f5e21faed512bc2ca63e06f0bbb66f23e8c19a26fba05dd08cb3302c7
-
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.logFilesize
1024KB
MD59ded9f4bcb8d0ad51b483314d5d1d129
SHA13206c547210651a9d76b8f3f35d76f587bb6872f
SHA2562a1b2b269e2f4e3cb058a12e442af2b0942166b85e0de6de880178bf96398abd
SHA5124e300bb50f3cf0345b40bc0b0e1696d788defa3f1b22c0c1a9accba19eb2c2181f8efae67f26dec10df36a5b8e0d46a7cf944c83b0f6bd730820227edacbf106
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-msFilesize
24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeFilesize
1.5MB
MD56916c4f4a86cb238cc8ba42d7e55d6c1
SHA18efca161f4ddd87033663680f07ed9c103db0cc3
SHA256253e641e4034141919ea6d23957818bba7eeb424bd01fe7bec7e8cb260a23915
SHA5126f97850ed8bfb349f6ad227b5b0b97ef6ce024f39cb9e2a6d41a82638b9d12193291396bffce135e2bdd4101f41f247ee0637e536c291831a24ebb3d878cd021
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.logFilesize
872KB
MD5ec60d4941fb2c74b653850ed30e76171
SHA179feb1b7571d621c9e3eb866e15ddfd023dad8c1
SHA256e9f3356720da43c7edc5a846f460e9ec411e4c98101e360249c4f0240206de91
SHA512b0b5507aae520ca1fdc0cee192c476d3ea5bde042d7051a298fad34b91644f63f664f9b5cf4b6c706d0c283effd3515ea30734285680bfee6932e0bf1235ca3a
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeFilesize
1.5MB
MD5b0aa2d0fc224b246bb88ac5fd7bf5e90
SHA16583f3e6a862aa9ca99ba6efe86fc01b0fd24a89
SHA256c3a3c8f0cd57f13e87cb69a7a36f8cc11e74439cfbf84f2fcc470bda331507de
SHA5126ba87d32561731d94b046b4c7797123f14d877fbc6e57fea43329f002fb8bea70bb8d737e8a09ecae81dd43634772599cca1e7d266400f9ee2607f461dd0ba68
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeFilesize
1.5MB
MD5ade7cd8c0470620e388b8da2a30730aa
SHA17451965ebb4a4ab16c460f451c11194bb2c97005
SHA256b265f4f2f230f03217a51cc3603ffa5cf13be5e885b87e2409dd139d7152a4ec
SHA512e1a1035a5f44b6d7486d1964fae5bfbc9f42b3bd742575d5bec3ee68e6ddbdad266d16cf54be32903dfa982ce6081d481ff1323d8b1cd2f5a0df93d818b7c884
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeFilesize
1.5MB
MD5de7d69920fbae0be7a22b1a14f698b0c
SHA1878db00ecb6c76aa8bf560b43febc0bb8657f3ab
SHA256db24ed23ceb6dd0799169140b38aa214ff6e07899796bdf816dc30a381a4c519
SHA5129d4ad16037de1acca7777d23bfdc51d815085c5040afef33cab82a7b5f1f4fe2db0f6873e54d50a67df829149ca8a55e5e3422648faabe2fc854f6c868bb66ba
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.logFilesize
1003KB
MD5e3b84cf4f1abdd8f3ea38a5a72b745c4
SHA18304ad7cb8a35aab136174ae82671f7046995ba7
SHA256f410c6d6669e8a92ea4ad36af2100c541c19cb3ecf013d96a96ef520e1690467
SHA51284c8d12a2bebb168c2032a85be81166e29c649e460f2b45751732fc27c6df84d17af3239c58b862813181577130a834dedf3a8b6a66bc4b9ae616b1348803bcc
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeFilesize
1.5MB
MD548cbda8cee3e2e6a9e10cd62d4d4da32
SHA16799526d10a87d539bf3453a4b628e04442a6d38
SHA256473d74f7926bac9e53da2396f834f5c8b56dbf93d21cdd2be73f0e03ff5f4078
SHA512f94f6d226df47569f118d3acb8f154dde40e68ddfae05294e943846872f6490cc3125316c8fdffce348d83f6c89db70f4e045dcb43c319435ce21cd84fb4cf44
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.logFilesize
8KB
MD551b21e6ec8acb281614d93485ba448ef
SHA1fcd61a64a3b54f022ed8008ac722359aab48c1b9
SHA2562785557b2292317ba8e8a06324e792ebb0f991a9376c8bd2726c41fb41250e8a
SHA51253af9924d4dc5ecfc1ef88d6125233a3dae3c839a88b92e8fdc51d931ad2ccfea3800830fca7fa6feda1b3776d93732f6f4950342c47301e777e541ee3d8ab5e
-
C:\Windows\SysWOW64\perfhost.exeFilesize
1.4MB
MD512dd9217729d8244cc708a78ff8e40ff
SHA1e0b2d8b7761a6c2017de8b3040ff5b99ffc39227
SHA2562a655c543f339af662ce1428af656610baf7c4926f57d5ae29584ce04a02da38
SHA5121a812d80b9473e5fd4e1417f70178a624188b9cad33f0e30cd5287846dc5e38a9499a1d83a0fc4e61685867995af6266beab3c0c0e5cb35a0cfd6c3f39d542d7
-
C:\Windows\System32\dllhost.exeFilesize
1.4MB
MD5f1b6604f9211d48fa079c34b8b5d6bd5
SHA11c1ce948ad6e7229bcf79518d36c09418a583955
SHA2566ec5f92806daa55fb53798b0006e528960a1386a989b31dbdd9ecf9c66846094
SHA512a52359fea8d11e9c067ffbb383bb97b9cfdeda6c8e19139ee11dd50bc178315125e2e3b693a2910b3dd73194b12c492760ec3a5e0fa48a2b5ed4a089775a467a
-
C:\Windows\System32\msdtc.exeFilesize
1.6MB
MD5996b99a02e5a66b03d2d34378b756323
SHA14dc4a2d1c6f6f7222761aa0d859c460e6b73eb55
SHA256d9c9c58db971a0216e6585255be6e06ffa55867bbb1b6f82b9a58c3ba91d4f80
SHA51288b78acdd005c73f57a6681a35809631333ab601c019a467bd984461ea126db5f66d7c4c7debcbd8bd54a22761a764c3002093b05091662e73a1439ab383341b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dllFilesize
834KB
MD5c76656b09bb7df6bd2ac1a6177a0027c
SHA10c296994a249e8649b19be84dce27c9ddafef3e0
SHA256a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
SHA5128390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dllFilesize
797KB
MD5aeb0b6e6c5d32d1ada231285ff2ae881
SHA11f04a1c059503896336406aed1dc93340e90b742
SHA2564c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
SHA512e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dllFilesize
163KB
MD5e88828b5a35063aa16c68ffb8322215d
SHA18225660ba3a9f528cf6ac32038ae3e0ec98d2331
SHA25699facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
SHA512e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dllFilesize
1.3MB
MD5006498313e139299a5383f0892c954b9
SHA17b3aa10930da9f29272154e2674b86876957ce3a
SHA256489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
SHA5126a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dllFilesize
148KB
MD5ac901cf97363425059a50d1398e3454b
SHA12f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA5126a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dllFilesize
34KB
MD5c26b034a8d6ab845b41ed6e8a8d6001d
SHA13a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dllFilesize
109KB
MD50fd0f978e977a4122b64ae8f8541de54
SHA1153d3390416fdeba1b150816cbbf968e355dc64f
SHA256211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\14deee276bb976fb348dce622fc9cfdd\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dllFilesize
187KB
MD5501e04fc3ef014db1270d5e36ed0fca6
SHA157a4007b1bd11f4c2dab4a8f3833b17d9316f884
SHA25678178a17d70ecb2742dbc76560b668401d821b4b3ebe9022de36a7478c97f05b
SHA51205a285eae392b12a8bd2f6799ec609692648660bd3c3507576dc614e4469933ad76bb77caefd03650d2fc2701b4c96f7219ba0b2edfe514cbc14e201087e8180
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dllFilesize
158KB
MD5a763a9348ab4ee3bd593bb17d854e51b
SHA14d0c97ba6877e2f9ab32fe1316936a4f2e0ff2c9
SHA256b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
SHA512e8d3896d4bd788d3ed923e0c9d3ba19fe9fc507060e2e5e8e410964f4c9d7331928324a79336079ccc84c050d8f0acfb03126a2e3622daac3846b0bfd028f602
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\23c6a5eb096857b19948202d436f1b9f\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dllFilesize
83KB
MD51d7bb1480ee461d42ff98b3953538c62
SHA14572e043e7a28254e35aae7a06553c425812a992
SHA256df15742e04811b6d449f50e92dfbeef8495abd4421b6f5155b05a82e22225951
SHA512c237d5367ec192c890a6b584fbb212a45a6fe007b64ce2b3ecec7622258e56a185665889f6810cfff3b028710e08808cb5f43cb37ed29830719a32dd7c03a561
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\353e62f5ee1a9b2f29e6e6e201d9b633\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dllFilesize
143KB
MD5e2bea2f3ef730bd79344bd8068a1fa6f
SHA187a6fa27b4d12e6da93d25e4857466587c40e478
SHA2561bf6c12edc639e712855a11e7f5954a10379babc4c7c3c53234a07600f42546b
SHA512604a0850dd2aaf50c05db2e967525f4feb3a22cbfe899b61cf8717886ff160b142828425831b0d3b7bf441d41898a9f811894083d62b78ff9a2c3ff78415a43d
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dllFilesize
41KB
MD53c269caf88ccaf71660d8dc6c56f4873
SHA1f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dllFilesize
296KB
MD57687295a6e19cc656b077e6a61629d4e
SHA1fa1025de5cffb56a3d1f8cae9d09b7171b33326e
SHA256ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
SHA51219de95fd90bc6f091e785074ee71dc15d450d65fbdea933e26650fb9c747d81ae2fca7f5f83192f17451a49a314d264cabea2202c805b6ffab729d381675734c
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dllFilesize
356KB
MD587111e9d98dc79165dfc98a1fb93100b
SHA14f5182e5ce810f6ba3bdb3418ad33c916b6013c8
SHA256971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
SHA512abbb246d620e8a2ab1973dde19ff56ea1c02afa39e889925fe2a1ba43af1ad4ff6eb017e68578ae520109b3e290b3d9054d7537eb2df0ede6e0fbca8519cc104
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dllFilesize
157KB
MD57bdf8e0c9aa04b71a52dd964005f4363
SHA1a87e809146d3c70093a189c37f0a96b8bd0ce525
SHA2560406be7235661a62f68bff4c7640b4e241a0c392d548bf242ed08ba0eeaee66b
SHA5124983ebf42241723cf258407c7d2a0773f395c861741f4e98bd7ac86e1ef0a597f89263bb5a986b69ffd43836a5e49d8f03342736b4c3183ea0c58b8099af2051
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dllFilesize
648KB
MD57ebbba07bc6d54efd912bcd78b560b7b
SHA1a6aee1a80ddcdf201301ac29293c62d58bcc941d
SHA256637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
SHA5122139a0d520ed70b72dc76fdd0555185386c9c22de1e1fb7eaac0607b313500c44f856c76ac6e2cd72148ea0b86b10bdd2b0ab7daacfc945cb66a637b8d99cfe8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dllFilesize
1.2MB
MD50637ad2bf6fc5ac1d29e547155bc818c
SHA1a502879466b6dd37eae5881bbb18353f97623852
SHA256868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
SHA5121d18a16ec3b91c3143c4371de305a7ea464d41661752ece65bf1ce19a8342a265c024a740afa6be8baf4d1edfdac6c6fcdad7395c1294342cd1f4388428e52c1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dllFilesize
210KB
MD54f40997b51420653706cb0958086cd2d
SHA10069b956d17ce7d782a0e054995317f2f621b502
SHA2568cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dllFilesize
607KB
MD5e9ca062e4958cc25400c804029a5bf62
SHA11ed4374d0d0f568936fdebe17d9110481d6b3344
SHA256a09436c1df8fcd8ecd1732d6e4e68f32b092e71e0c5d3308b0f3f20abd03d4e0
SHA51243a9ea20d1e636201c0ce7098c198b893465b45f747ed2a002e8dd0bfc7739c28e166d259faf3a0087ae1fe59c74cc8e598f2b283cc7ebc345b6f3b5c388e520
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dllFilesize
53KB
MD5e3a7a2b65afd8ab8b154fdc7897595c3
SHA1b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA5126537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dllFilesize
65KB
MD5da9f9a01a99bd98104b19a95eeef256c
SHA1272071d5bbc0c234bc2f63dfcd5a90f83079bbab
SHA256b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
SHA512dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dllFilesize
28KB
MD5aefc3f3c8e7499bad4d05284e8abd16c
SHA17ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA2564436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA5121d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b1286062b0f35fbc6e34e3ab37127ea2\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dllFilesize
180KB
MD59181a899c037ade3a230cb78531d1410
SHA1465e2af771b100b464134293338e0fbdb2dd509d
SHA256192304eeb2d2c5e068a1bd96b833a9f4f0539967ebdbcfbdbe21a6a866159d05
SHA5124278b2ec090282025456533936f466ef19fb05aabab0cdaeb1dbf4dce70d42eff7d50172aee4f50b851eb2a1f60c4e56eb1af23489fa715dc72840a78daa53d5
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dllFilesize
329KB
MD5eb09a7062a66a50fe2cb16c4a80561a7
SHA133b4c71ced7644be9802374a4f04c866394daaca
SHA256e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
SHA512c57a4c626c87032ca422df04ce7c3322662a9b0c6c06a46e93f08ca8f431295c9ae802cd79f53cae5de2b39a30bbeb756c966880e874ed44115cf511cc1ff920
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dllFilesize
141KB
MD558cacef7cbc000bb5ddeedc08a598f36
SHA1f8963d4ac1f7b72c2ee4a0a6d45b921f4f88bab7
SHA256124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
SHA5129cf04e365abcdcfcb9c1f927da83a2dfe0791cccb80cd84ed63b03264d1e253060c455ed8664f35aee0a59e8c172f859ba49c67c9eec811a53e656c076c6bf66
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dllFilesize
278KB
MD5d74d434aa70ce827715b5e0ac7eda5be
SHA1b53f3374be4c96af51c78fd873de1360f17c200f
SHA25654701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
SHA512631d09a0ff39ece829f5c23278c2c030e5ff758b285128edb7805682de75b5be1aedd914d2325f79ec98d0103660a39ae1f1a5782f5dad038b143f3774c098df
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dllFilesize
27KB
MD59c60454398ce4bce7a52cbda4a45d364
SHA1da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dllFilesize
57KB
MD56eaaa1f987d6e1d81badf8665c55a341
SHA1e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA2564b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dllFilesize
130KB
MD52735d2ab103beb0f7c1fbd6971838274
SHA16063646bc072546798bf8bf347425834f2bfad71
SHA256f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dllFilesize
59KB
MD58c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dllFilesize
42KB
MD571d4273e5b77cf01239a5d4f29e064fc
SHA1e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA51241fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dllFilesize
855KB
MD57812b0a90d92b4812d4063b89a970c58
SHA13c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA256897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
SHA512634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dllFilesize
43KB
MD53e72bdd0663c5b2bcd530f74139c83e3
SHA166069bcac0207512b9e07320f4fa5934650677d2
SHA2566a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
SHA512b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
-
C:\Windows\system32\fxssvc.exeFilesize
1.2MB
MD50ba9c2a63b64031cd9555399d066e265
SHA1446c17f508999734fe6dd282a80144b7bd9ea19b
SHA256bf3e98bbe41eec2e2a14eec8b4d579b0e0357adf0b360103ddecebdfa01447b7
SHA512617aefa3fa26064d03a98090d4ab2ba23e1e82a8182fc9621d411481785c1a8b99eadbb365fb80a85367ac578fb42aec744f07d3aab8821141a1b19fdf8c361c
-
\Windows\System32\Locator.exeFilesize
1.4MB
MD5da652c7a05437f01588a96b30e926443
SHA14c8c328dfbd860c0f60252df0e39aa1ac65f6547
SHA256fd374a8e702c2386b5f702da0174a6514f299a1bc7c4d761ae73495fc28e2793
SHA512073b09d5a828b754f25a2f04853e57d89fddba95161066e98f50f1e30e20daf0b0575bea401bf5cadd59eafd3ac1a720bdb90e3f6b81f8286c82d69b8521325c
-
\Windows\System32\alg.exeFilesize
1.5MB
MD545dd5baa30cf546052bc48390fa47410
SHA15b50210e8810fac0a1435f2923b77d3190242982
SHA2564c9dfefeee9a756cfb9239c2820deb62b81540fabfd07c720b5a665a7eec9e70
SHA512004d7bbe5de685da08c7583af0b676081dcc58695df27e636ea5f7a8720a0589bbd64be7bc4ccba6b5002d11825aaec7d0b9021883621a81226a13b9892d6e49
-
\Windows\System32\ieetwcollector.exeFilesize
1.5MB
MD50529c229f2c2a5ecdcc3c4b141217f81
SHA1cf7fbf40ce9ae8b3238c6947b2ccaea948fdf964
SHA25687de3a1b3f9e965731a76749d51ec1fc6c0610c054ad083872d5f112c93b9237
SHA5127322d6f0fcc82c594acb71c3be57bb46049d4abf9823039c71d57418b47591ffabaf90bf0b77b984cd5e7e5f5cecdcda1f229a39cb92197ba3dbfc4a24d60c68
-
\Windows\System32\msiexec.exeFilesize
1.5MB
MD59182201285c504d19335da0a65b5bbf7
SHA176f1e43adf9e0106cac57cceb75293e018b2d685
SHA256fc6469982f1da54bda815ab7b4bb751256e96c0439e7cd19008dc1a325d2979d
SHA51267a4a388d76e0f05c1f3754c6b0fc48ec75e17284c28a870011185bf7f718fd5a13e7d51318f06e1148ae35e6b673e336545aa8b9aea3b11c3e1d05d90be6c96
-
\Windows\ehome\ehrecvr.exeFilesize
1.2MB
MD5ac66c632734dcb7375d899b9b716bb95
SHA118e7e5c895abeae440d1f0a0c7e8d7ed7b4d4eef
SHA256d4fb50c98d16957087f3f9d089d98209101bbd2ff3f319f55affed72415ab3ae
SHA512d23fb04cc4d86d23c038b05cbf2d55b1b2a8b085ce29a04c42a69e9198494ac2ac09429490e4aab2bf5bf055968f28363c1fdf113091b7c3dd137e7497886bc7
-
\Windows\ehome\ehsched.exeFilesize
1.6MB
MD57d941d7848e62ed6f40b56b682fd3852
SHA1b7d79761f29cbaf17b14e7cf6183047d84dd4abe
SHA25614017174f130d65cd18677224260b2ffdc14d3d23d6ad83b4285725510a4b535
SHA51201b56045fe156d4dd189109dde55c0f2ee1429412a76b3b3a31ba123a79f61a3f16a35ec130127bce9d1b7c1586d2ea90fa603886e1c0eebc1b8ec10511eac4e
-
memory/324-378-0x000000002E000000-0x000000002E195000-memory.dmpFilesize
1.6MB
-
memory/324-626-0x000000002E000000-0x000000002E195000-memory.dmpFilesize
1.6MB
-
memory/352-590-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/352-564-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/544-822-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/636-857-0x0000000140000000-0x0000000140192000-memory.dmpFilesize
1.6MB
-
memory/636-389-0x0000000140000000-0x0000000140192000-memory.dmpFilesize
1.6MB
-
memory/636-194-0x0000000140000000-0x0000000140192000-memory.dmpFilesize
1.6MB
-
memory/728-181-0x0000000000A70000-0x0000000000AD0000-memory.dmpFilesize
384KB
-
memory/728-866-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/728-370-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/728-187-0x0000000000A70000-0x0000000000AD0000-memory.dmpFilesize
384KB
-
memory/728-180-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/788-860-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/788-464-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/788-225-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1004-1054-0x0000000002350000-0x000000000243C000-memory.dmpFilesize
944KB
-
memory/1004-1050-0x0000000002350000-0x000000000236A000-memory.dmpFilesize
104KB
-
memory/1004-1055-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1004-1053-0x0000000002350000-0x00000000024EE000-memory.dmpFilesize
1.6MB
-
memory/1004-1052-0x0000000002350000-0x00000000023F4000-memory.dmpFilesize
656KB
-
memory/1004-1060-0x0000000002350000-0x00000000023B6000-memory.dmpFilesize
408KB
-
memory/1004-1051-0x0000000002350000-0x00000000023DC000-memory.dmpFilesize
560KB
-
memory/1004-340-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1004-1056-0x0000000002350000-0x00000000023D8000-memory.dmpFilesize
544KB
-
memory/1004-1059-0x0000000002350000-0x000000000237A000-memory.dmpFilesize
168KB
-
memory/1004-1049-0x0000000002350000-0x000000000236E000-memory.dmpFilesize
120KB
-
memory/1004-1048-0x0000000002350000-0x000000000235A000-memory.dmpFilesize
40KB
-
memory/1004-1057-0x0000000002350000-0x0000000002374000-memory.dmpFilesize
144KB
-
memory/1004-1058-0x0000000002350000-0x0000000002358000-memory.dmpFilesize
32KB
-
memory/1004-145-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1004-146-0x0000000000590000-0x00000000005F7000-memory.dmpFilesize
412KB
-
memory/1004-151-0x0000000000590000-0x00000000005F7000-memory.dmpFilesize
412KB
-
memory/1124-828-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1228-96-0x0000000000A60000-0x0000000000AC0000-memory.dmpFilesize
384KB
-
memory/1228-104-0x0000000000A60000-0x0000000000AC0000-memory.dmpFilesize
384KB
-
memory/1228-95-0x0000000140000000-0x000000014017D000-memory.dmpFilesize
1.5MB
-
memory/1228-214-0x0000000140000000-0x000000014017D000-memory.dmpFilesize
1.5MB
-
memory/1252-638-0x0000000100000000-0x0000000100542000-memory.dmpFilesize
5.3MB
-
memory/1252-390-0x0000000100000000-0x0000000100542000-memory.dmpFilesize
5.3MB
-
memory/1300-402-0x0000000140000000-0x0000000140237000-memory.dmpFilesize
2.2MB
-
memory/1300-215-0x0000000140000000-0x0000000140237000-memory.dmpFilesize
2.2MB
-
memory/1444-787-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1520-526-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1520-534-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1532-237-0x000000002E000000-0x000000002FE1E000-memory.dmpFilesize
30.1MB
-
memory/1532-484-0x000000002E000000-0x000000002FE1E000-memory.dmpFilesize
30.1MB
-
memory/1544-606-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1544-618-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1568-639-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1568-654-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1728-8-0x0000000001E50000-0x0000000001EB7000-memory.dmpFilesize
412KB
-
memory/1728-336-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/1728-0-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/1728-1-0x0000000001E50000-0x0000000001EB7000-memory.dmpFilesize
412KB
-
memory/1728-144-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/1736-810-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1848-766-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1872-688-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1928-130-0x0000000000210000-0x0000000000270000-memory.dmpFilesize
384KB
-
memory/1928-123-0x0000000000210000-0x0000000000270000-memory.dmpFilesize
384KB
-
memory/1928-122-0x0000000010000000-0x0000000010187000-memory.dmpFilesize
1.5MB
-
memory/1928-172-0x0000000010000000-0x0000000010187000-memory.dmpFilesize
1.5MB
-
memory/1928-798-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1932-403-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1932-470-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1964-718-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2020-692-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2092-542-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2092-569-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2168-3786-0x0000000001BF0000-0x0000000001C1C000-memory.dmpFilesize
176KB
-
memory/2216-168-0x00000000004C0000-0x0000000000520000-memory.dmpFilesize
384KB
-
memory/2216-359-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2216-161-0x00000000004C0000-0x0000000000520000-memory.dmpFilesize
384KB
-
memory/2216-162-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2232-769-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2232-764-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2288-242-0x0000000140000000-0x00000001401AA000-memory.dmpFilesize
1.7MB
-
memory/2288-245-0x0000000140000000-0x00000001401AA000-memory.dmpFilesize
1.7MB
-
memory/2456-735-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2456-724-0x0000000003CD0000-0x0000000003D8A000-memory.dmpFilesize
744KB
-
memory/2476-25-0x0000000000840000-0x00000000008A0000-memory.dmpFilesize
384KB
-
memory/2476-16-0x0000000100000000-0x0000000100184000-memory.dmpFilesize
1.5MB
-
memory/2476-17-0x0000000000840000-0x00000000008A0000-memory.dmpFilesize
384KB
-
memory/2476-160-0x0000000100000000-0x0000000100184000-memory.dmpFilesize
1.5MB
-
memory/2492-536-0x0000000140000000-0x0000000140196000-memory.dmpFilesize
1.6MB
-
memory/2492-249-0x0000000140000000-0x0000000140196000-memory.dmpFilesize
1.6MB
-
memory/2548-339-0x00000000006A0000-0x0000000000832000-memory.dmpFilesize
1.6MB
-
memory/2548-561-0x0000000100000000-0x0000000100192000-memory.dmpFilesize
1.6MB
-
memory/2548-334-0x0000000100000000-0x0000000100192000-memory.dmpFilesize
1.6MB
-
memory/2548-591-0x00000000006A0000-0x0000000000832000-memory.dmpFilesize
1.6MB
-
memory/2672-614-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2672-592-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2732-658-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2752-745-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2904-640-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2904-627-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2912-108-0x00000000005E0000-0x0000000000647000-memory.dmpFilesize
412KB
-
memory/2912-107-0x0000000010000000-0x000000001017F000-memory.dmpFilesize
1.5MB
-
memory/2912-140-0x0000000010000000-0x000000001017F000-memory.dmpFilesize
1.5MB
-
memory/2912-603-0x0000000100000000-0x0000000100175000-memory.dmpFilesize
1.5MB
-
memory/2912-360-0x0000000100000000-0x0000000100175000-memory.dmpFilesize
1.5MB
-
memory/2912-113-0x00000000005E0000-0x0000000000647000-memory.dmpFilesize
412KB
-
memory/2980-491-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2980-469-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2984-488-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2984-530-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/3028-3796-0x0000000003CD0000-0x0000000003CD8000-memory.dmpFilesize
32KB