Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
28-04-2024 19:07
General
-
Target
2024-04-28_982e2d80678e1fdd05c1eb1abc36b647_bkransomware.exe
-
Size
1.9MB
-
MD5
982e2d80678e1fdd05c1eb1abc36b647
-
SHA1
2c2359c1dfee74d74ee98ff9d869b076b7a69763
-
SHA256
ca0929bfdd2e09d8a33df3e5b81e2dc85ed79b96d67822610013927b5a5b5112
-
SHA512
2a7f3c4d65d5d6cd0c99e80bfd9d9ce158956864b8666c87763c0700adfd63c75e6fb9dc02a8cab489812211298e6635bf61f263b0d9cda7acc613e609d7b265
-
SSDEEP
12288:v2lWRPfhA9PRWg9vmqmFrfBCgiw4bivhqGoj85sVPL5qw+DmQ:v2lmf4RKqMrfUgYbkhqfj8uqwp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 57 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 20 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 20 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_982e2d80678e1fdd05c1eb1abc36b647_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_982e2d80678e1fdd05c1eb1abc36b647_bkransomware.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 24c -NGENProcess 254 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 23c -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 1d4 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 254 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 23c -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 26c -NGENProcess 24c -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 1d4 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 25c -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 24c -Pipe 1dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 1d4 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 25c -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 280 -NGENProcess 27c -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 26c -NGENProcess 274 -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 28c -NGENProcess 278 -Pipe 1ec -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 27c -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 278 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a4 -NGENProcess 278 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2a8 -NGENProcess 27c -Pipe 290 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2ac -NGENProcess 274 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 23c -NGENProcess 244 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 208 -NGENProcess 20c -Pipe 1b4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 258 -NGENProcess 238 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 22c -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 20c -Pipe 1c8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 238 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 20c -NGENProcess 238 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 270 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 24c -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 208 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 208 -NGENProcess 274 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 284 -NGENProcess 24c -Pipe 1c0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 24c -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 274 -NGENProcess 284 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 24c -NGENProcess 294 -Pipe 28c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 238 -NGENProcess 264 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 284 -NGENProcess 29c -Pipe 24c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 22c -NGENProcess 264 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 264 -NGENProcess 208 -Pipe 238 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2a4 -NGENProcess 29c -Pipe 298 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 29c -NGENProcess 22c -Pipe 2a0 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2ac -NGENProcess 208 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 208 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 2b4 -NGENProcess 22c -Pipe 264 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 208 -NGENProcess 2b0 -Pipe 290 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 294 -NGENProcess 2b8 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b8 -NGENProcess 2b4 -Pipe 22c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2c4 -NGENProcess 2b0 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2b0 -NGENProcess 294 -Pipe 2c0 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 208 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 294 -Pipe 2b8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 294 -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 294 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 274 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2e8 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2f4 -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 308 -NGENProcess 300 -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 304 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2f8 -NGENProcess 308 -Pipe 2fc -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 314 -NGENProcess 30c -Pipe 2ec -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2e8 -Pipe 2f4 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 308 -Pipe 310 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 30c -Pipe 2cc -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2e8 -Pipe 300 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 308 -Pipe 2f8 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2e8 -Pipe 318 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 308 -Pipe 31c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 328 -NGENProcess 30c -Pipe 33c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 320 -NGENProcess 338 -Pipe 324 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 340 -NGENProcess 308 -Pipe 2a4 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 32c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 338 -Pipe 330 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 308 -Pipe 334 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 328 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 338 -Pipe 320 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 308 -Pipe 340 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 30c -Pipe 344 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 338 -Pipe 348 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 308 -Pipe 34c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 30c -Pipe 350 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 30c -NGENProcess 360 -Pipe 338 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 370 -NGENProcess 308 -Pipe 358 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 36c -Pipe 35c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 360 -Pipe 364 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 308 -Pipe 354 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 36c -Pipe 368 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 360 -Pipe 30c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 308 -Pipe 370 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 36c -Pipe 374 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 384 -Pipe 380 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 378 -NGENProcess 36c -Pipe 37c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 398 -NGENProcess 388 -Pipe 2e8 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 384 -Pipe 394 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 36c -Pipe 360 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 388 -Pipe 38c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 384 -Pipe 390 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 36c -Pipe 378 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 388 -Pipe 398 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 384 -Pipe 39c -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 36c -Pipe 3a0 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 388 -Pipe 3a4 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 384 -Pipe 3a8 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 36c -Pipe 3ac -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 388 -Pipe 3b0 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 384 -Pipe 3b4 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 36c -Pipe 3b8 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 388 -Pipe 3bc -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 384 -Pipe 3c0 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 36c -Pipe 3c4 -Comment "NGen Worker Process"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 388 -Pipe 3c8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 384 -Pipe 3cc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 3d0 -Pipe 1f8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 1c4 -NGENProcess 308 -Pipe 3e0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 5962⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
1.6MB
MD58a027e0faeb2f54be66fb64d22fc3faa
SHA14d16f03a7f1e7a1b699a16ef0444ebae8476f954
SHA25629900130582f2e601d4b8465f49c9fa7afb19f893627bf6c0cf4faec18e6febc
SHA512bd701dae86af61aaf1062e53afcb97c6ac9b7157832adef5ec18d67352a37b6bd2618cba24156ed259c0def4ec3add31d7a01d4e771b4d24dcacda8f7195fe17
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXEFilesize
30.1MB
MD5a1c7172ecdcc4aa18e8939b5856a1c94
SHA1c92b71b8b03faeb12dd8e05c0cc9aec379b12361
SHA256663619e68a09162a0ba2a7a09e8c6f18755e305055e96ab883c26504cbf243bc
SHA5124d2a95c9aaf3b7f7d8f0c7b53da42f38e00f594323f37d3f4fd3a5bab4d5e2abfcc284396d380bb463e26d62e04aac85694fdf63b938705e6bcc77ec3bf02d16
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
1.6MB
MD5deec57cdf312846b7b1d9531666c49bc
SHA196b6fbf5038e9a95cfdfc6d0986b5ad9c605702f
SHA2561ceb359868dd77065c41945964b661bcc5a9f37480b48d091271ab02282e502e
SHA512cfeb0f26a5080a7c4ab45ed90da1c01817ee41685a61b1ecf0ce6e0ec3a224cc34918d1025b8f09e1265f818c13b84ffd2d22daa914c503e0834b20efb08fe79
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEFilesize
5.2MB
MD5d1327cf240f14dcf663c4dece48401de
SHA1fa879b38de8a0484b8cb52007a07e278845cf33e
SHA256be4b92ddb048d5e214bd509fc704055f6a73873521df47705ffb47a181f55844
SHA51278cc46d580d3723f3dca3bb1f98a2d723a86da0b4f3778d27bca935d593f9f6d3230f53dfaae8e8f74d6b66f28b3721a0968b4a7bc3c4242fd68fcdee8211d69
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exeFilesize
2.1MB
MD565853f2b3d6c97ea493340be2ee66233
SHA1ee12f5f94d79adc5868983afa2af54f5c4b1549d
SHA256ab57c08abf9379ad0761ed4cbc2b41e9238ef275022c784d63a372c95adf29fa
SHA512b31731c5d787018d04cf86662509352d134858892f4c68105b83be27025091a84959d671576e401894489082685922029c2623fc66dfb55ba078e072b3a7213b
-
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.logFilesize
1024KB
MD5e7f8217c603bfef3dac6c52ce5f0e0b6
SHA10098786af56fcd5cb825f50904c8b9e557dd7d17
SHA25662bad3f3509cb7790f8af73fa74a331f93f10a3243e2fa5412bc446fe48229f3
SHA512a0d0df51486f79f6531d221fb947d668f3b51e660ad62318e097fc7e0a842ee011ea84eadea5ddea446504ef9d70117e3664dca2fc7cdfb5d977d73003f1f40c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-msFilesize
24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.logFilesize
872KB
MD5b02b35b6defe233eff5d800445dd1a7b
SHA1e1e71087c651529e59daad0fbe281a9996b3e667
SHA256274fd456d315928e3c609cabb7841ec385080664b3efe83b429461a987755879
SHA512a4dc4b7ae63645f9c7641f86fa0d9e0c224f8d4ac18d7024303051c74c7e9f3fbc6e4acbfe3a9de7cb3642bbe74088902c2d34f01dee9080d3006c59bf61643e
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeFilesize
1.5MB
MD54fecf4797304589722975bc8a6b2f3f5
SHA12244554c073511cca69b41fc26de7520eca912aa
SHA25693de00846ddd5a41b2b193e43f26a241436e7cebb8747a38b34c4aaf5324cd51
SHA51295a6d8e4f97a8664f2142ded0e5ba12b827a50bf18d5ccea2a70db59afacfb9ec404b0c775df0309688dbac601c8025b58cad42fe980494bed5deafafe057033
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.logFilesize
8KB
MD5c85a03c1f0ecdd4e02e20a70efa50e43
SHA15912d00d45043f227d6b7993bc9ef2ef686a419c
SHA256e49dcb88f1b4bfdaa282a87fb0d80f34666f8cf49ab1af23227991aa98645061
SHA512069694b279e6ce496640e7682f6863804a39ad67b3b97b3dcdbbaee5bf571f1aca3a02868b94dd1975cd2619f631b912c14de86a27194494ab0985f2ab9e3504
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeFilesize
1.5MB
MD571946d2acf61e35bf7851c665d85ce60
SHA1244c7d788c448c9913904c01e77399d45c3dfd15
SHA256a92d92712aa6f18ec8493b1e786fc21095b30c61c6f6d84025defcdf7079a5d0
SHA5125f83d46e4365ba37e0b1af1ef5566601e4ea0eabbc6747a50dfa4815a32d712d4cc37ee96e95c492d9689c16ba1ef9728982115d51f262af415858445863a371
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.logFilesize
1003KB
MD59f9213ac2d0728f77c3aa90c7de893d1
SHA1408d861b969a6bead668fc062725f9076f56b367
SHA256f113f97dfa38abec9c1410cc1f9e0b93027705502955443894508b3408bc3c6b
SHA5129fb52ca3e2c7a9ec49f919372692957a412326ece74f488bc202b399da80bfaf31d106b249b01b91fba04656f2c024a80d0db883b0ef0d4b32f3e2c9ae265071
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeFilesize
1.5MB
MD571a99bbe0716bb9f5a5652d8435932dc
SHA1c0a2b18b909eb12fd87c43d0193852acd2457676
SHA25647f97797da860c5b2aa9c9eb1588b037ff4b8cd66136bbed09ac24837372f439
SHA512d06535b4d9435ea076bebc0559443a70f877b65870bde4413b98c2e88f064a9f09e7edeb00852021f82daa0d4ef184c6024ae7db993dc36c4b7e78180e92ca25
-
C:\Windows\SysWOW64\perfhost.exeFilesize
1.4MB
MD525f68ebbe59d448f278c88bb67781111
SHA178a2dd3343fb6860dc09b5431901b47a054caa59
SHA256364c22c62de59751aba933c8ab1eff4f015235a201d28ae964566b45b0f6e00b
SHA5123792b46440b29a47b2272d89c638fff9d870b76a1fbecbbac552cbba3a40843672fe254df160c2beb2c336054ed8cfd80672a00e756f6c4e78381be002210950
-
C:\Windows\System32\dllhost.exeFilesize
1.4MB
MD595a0338d696e62f6a40529e7e3553ea9
SHA116ddc25b55f17e21fbc44f1523c3b3511a6b6eac
SHA2561c89ce02bbeeb1c31aa8c1ad25f11d1dab2bc5acb3782b3828bc30de6c4feb03
SHA5121c5c3bde92950794ac06092a9b3c9fdf1603bf5b03c1b895b287a46350ed210ac52a6f20d737b865a21eabad4f8612016b8a2be2e2fa0a591712f587a7b217d2
-
C:\Windows\System32\msdtc.exeFilesize
1.6MB
MD5a0c0e6a037acd1f85c604160ac94b8ff
SHA1f10ba1ac652239caf9d1da968ed59e93feb1f7e3
SHA2567a86be8966014605672329545a76714dd042d5231a8124775fab8f0c3f99fbd9
SHA512418f7ca8cc60b77f45f71d94f936566c81a4aa9f5c316f5b1af7a502bf248538319d50a85e0d3d75c08f3fa142652a8b10d2745c538aae24950d506638151480
-
C:\Windows\System32\vds.exeFilesize
1.9MB
MD5b364b1137f2bfd95e2a7087460185bc8
SHA1dd5caf09816a59e2a30dda855bd424988e5e9c88
SHA256b7cba74909ba554809cc12fbf75b9a6ace5bb3015b14d210492a24a1293e0da4
SHA512287f29f0ca1c2fcd54d2a5f51fbd88eb3eb1d18522c16b919db30deacecd782db18efeec46a2ad0b3f7d48c8dc861b3913c9338bb66d5eae384d44b290ae3c80
-
C:\Windows\Temp\CabE0ED.tmpFilesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
C:\Windows\Temp\Tar85C.tmpFilesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dllFilesize
105KB
MD5d9c0055c0c93a681947027f5282d5dcd
SHA19bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA256dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
SHA5125404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dllFilesize
248KB
MD54bbf44ea6ee52d7af8e58ea9c0caa120
SHA1f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dllFilesize
1.0MB
MD5598a06ea8f1611a24f86bc0bef0f547e
SHA15a4401a54aa6cd5d8fd883702467879fb5823e37
SHA256e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
SHA512774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dllFilesize
58KB
MD53d6987fc36386537669f2450761cdd9d
SHA17a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA25634c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA5121d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dllFilesize
205KB
MD50a41e63195a60814fe770be368b4992f
SHA1d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA2564a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA5121c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dllFilesize
43KB
MD568c51bcdc03e97a119431061273f045a
SHA16ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA2564a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dllFilesize
198KB
MD59d9305a1998234e5a8f7047e1d8c0efe
SHA1ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA51258b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4e5c0ff502649a9c9ae057e4cc659c7f\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dllFilesize
305KB
MD5e0d25970833d82759c3bbfdf276cd945
SHA177965d9f334fbdebbaba95ba49c3e6a8e0148d76
SHA2562d2e94bd61d78c5146f26214506fafb01a23b6af97059550161ece1411880833
SHA5121fb69f19a9bed6638b44f1912f02e6572d1f612ff6e8f603fbeac795b346a0ffca3fa9f20e651f89bab2dad635492dd1056fdbccd149af87eee1271a6c583d99
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6d5c01c31673c5d4e5ad818bfea91e63\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dllFilesize
122KB
MD58e73f67f07d9c8f0093c0ad7c56b846d
SHA1c5bce15ecd3f3abcb546815782d5de96a53d1e8a
SHA256c9bfbdb569c4c405441dd30101dcffb89eb8125856b514a9060ef2a93110f44f
SHA512fe84e28086f8af9d892e6e760d5a8cdbe9acc27ce60e479ead7adffe91c2a2a522ace883ed30aa151cef959e4f2fb0d4843dcfba6e77dfd97ee2332ceeb8185d
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dllFilesize
70KB
MD557b601497b76f8cd4f0486d8c8bf918e
SHA1da797c446d4ca5a328f6322219f14efe90a5be54
SHA2561380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA5121347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dllFilesize
87KB
MD5ed5c3f3402e320a8b4c6a33245a687d1
SHA14da11c966616583a817e98f7ee6fce6cde381dae
SHA256b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dllFilesize
82KB
MD52eeeff61d87428ae7a2e651822adfdc4
SHA166f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA25637f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dllFilesize
58KB
MD5a8b651d9ae89d5e790ab8357edebbffe
SHA1500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA2561c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dllFilesize
85KB
MD55180107f98e16bdca63e67e7e3169d22
SHA1dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA51227d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dllFilesize
298KB
MD55fd34a21f44ccbeda1bf502aa162a96a
SHA11f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA2565d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA51258c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dcff33700dec7ebbf0c6aa3df6b99540\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dllFilesize
221KB
MD5a02a110869278b41c13ad2f259575a55
SHA11f4a76ef666b7fdbf67d3dd43f85e6eba99bfae3
SHA2568f69cc66616a51fa1f2cbd406e3ecc7ca1b2ff5f01189bc33f0cc959ab18e860
SHA5122bf9b1c718081aba809d39ecb3118f814dfa16a78d851bdc03c766ecfd0cecb675387ba2b700dea061df7aab063e1e125ecf3caeca9962458b31548a0ff53bf3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\eddc4a466df9d85740a46e9c95fba43d\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dllFilesize
271KB
MD5289de808b054af805b637833cea30e48
SHA1dd9d56156f7a69e5366b2d5d3461c0368fa09a14
SHA256eb719bc6c6b93c7382791e681c1c7258f2fc5036cf7d9262a2663bd64d89103f
SHA512ce5ecaab291598f5d7e9de95c762c893795d46653d78d0203458924c8608235006a16a0affe171c69df19b791541e7f4eeef6b2a9f4b55d5cb384a2479093d73
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dllFilesize
43KB
MD5dd1dfa421035fdfb6fd96d301a8c3d96
SHA1d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA5128e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dllFilesize
124KB
MD5929653b5b019b4555b25d55e6bf9987b
SHA1993844805819ee445ff8136ee38c1aee70de3180
SHA2562766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
SHA512effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dllFilesize
2.1MB
MD510b5a285eafccdd35390bb49861657e7
SHA162c05a4380e68418463529298058f3d2de19660d
SHA2565f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
SHA51219ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dllFilesize
88KB
MD51f394b5ca6924de6d9dbfb0e90ea50ef
SHA14e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA2569db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
SHA512e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476
-
C:\Windows\ehome\ehsched.exeFilesize
1.6MB
MD579166aff5902192038436a16654a1a97
SHA1a1fb0c65ad0f85930a8c89e3967a3f319b14d2b9
SHA256610f94dfc6553bf94a71547c2d2dac7b70d3b5f4151237266205b1b574f5f047
SHA512576bd5c74d71227e615c850342e2ade6d1a4672f968eb79ec9b66123372e7117b02e1c808070cf2298c493d71c2bd82d3ad395cd99ee718a9e91377eab4af21f
-
\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeFilesize
1.5MB
MD5d30cac5aa6a138cc3e34b6d054e7fbf9
SHA1a4c64e14fe10149f1c4711ae359c3f0cb072c919
SHA2566b97121c0dad1ecf1d24fb13024b98345cd02c7293e616ad920b3bd1b9a23baa
SHA512be645ab6232f12ddaed789a604250eb335faf41c9806e5cfd320638970f834cc928d756634e80fe672bb2f4add5af8adf5c0371009bf2e4ad049b52a8671fc45
-
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeFilesize
1.5MB
MD5a40cddea55b98f7e7ae9d53f434960d4
SHA1f97bce4b811ecdcda78dd6a00e1957a95f0251b8
SHA2565753b14b8643067d1a6c1b4d2f386491d735e9eb4ad6c77fb40c45852d9163b6
SHA51214a8dfdb0f3fbffb6750709194ba9ad342d48c4d8f23726d27b6ecff27fa09b03e37f153133186e27bbae6233b0b635a1270ae786ef835668c158929d695c85d
-
\Windows\System32\Locator.exeFilesize
1.4MB
MD58c88e30b3bb662afab71f7d90e903676
SHA1c76b2821d4a47aaec36e97e6f031017925e71073
SHA2563b7548b788a47beb5647a64ccef449d976099baa707e644e16f416babc953f42
SHA512733450dc9e287e1b166e26706b882ab1fd702973c8a4abdff89b1c00da516cb26ce03fdc63a990630969984796e985ee0bc821f235d172862f53c153f57a25d1
-
\Windows\System32\alg.exeFilesize
1.5MB
MD5902c3a769c4df296d09da60b4efd6395
SHA1e1b23240d6c430f7714f6466798a4e80eae5a229
SHA256574d47b88f063f43ca89cbcfe7cc3af7ded5f9ff54eceb0e056256cafa4e7fbc
SHA512147589fea5f8a7c6138259735b4ad66aa8f8592eab5800920b2ab9e3d5236a64896dc05c6235f7b98de0cb10b81ece76c5af144d86994ac69b6909bb5166859f
-
\Windows\System32\ieetwcollector.exeFilesize
1.5MB
MD5c7be75a449cb84991a393921c498c4e5
SHA1ae459eb56d03ea0c71f3713985104dfffd7866b2
SHA256762ccd8d558788049b96c7534308e61233be159238d2d69f7f0271823ec63afe
SHA512cbfbc42de83b521ad700783719eaaafe1afb5fb00a05b1d501fa33aa554b940b574421cd8449a24926b1f6e5c1cac90949d378befe89e6a46651ef4d91ea3075
-
\Windows\System32\msiexec.exeFilesize
1.5MB
MD5c80cae59e185ec4043a98e1e8f05ec77
SHA14c9845962cf148a4ebf680bd26cd61051601f7b3
SHA2560c4f762dff17a8ce76b380ba0a5bed1324df923440ff69ba2edac4f13c2142bc
SHA512f469ee51570f2c6e9464a6236f22ce4b7c847c5a114ba6e611a5701783e52d5bcb7c98ef8b4fdaf4f7662fa47af0271f458271d5a2cf47e8b1057b51ea926b08
-
\Windows\System32\snmptrap.exeFilesize
1.4MB
MD5b1c1260baf63830b9e0d1d7ba3b59baa
SHA1291009ee04317a12e02d93652507630ed4b312d7
SHA256cabd9d19affb64b0287fa34ed8450575bf862752396227844da6ff9042bb9880
SHA512eeee541a7766df6f69b2e16969ab8d5a13f77cf8e14d142b93362717c025cf96169de64273a38c65a5d721b17b9522d9928d445bfb37e233b13653c4c8f4fc37
-
\Windows\ehome\ehrecvr.exeFilesize
1.2MB
MD5f124a5770d046e95b753c7edb4bb155f
SHA1b369a3a7c4cb9d6f454232bc5fe70863cfbd8e6a
SHA2561510e362bc16b5a3b94981733ac641607070123079167f356a4a00654005f29b
SHA512c68e3bffc4164f85955677e1afff9b124e079262cb6d2bfe7e8171f503d9b3134f85193aaa7c7698d4fd2c3ab800063f67567af1645613da26c4173af679a244
-
memory/596-395-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/596-386-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/840-377-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/840-366-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/844-526-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/844-523-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/868-703-0x0000000100000000-0x0000000100192000-memory.dmpFilesize
1.6MB
-
memory/976-399-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/976-403-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1040-561-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1132-357-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1224-304-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1224-312-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1232-991-0x0000000001890000-0x00000000018A8000-memory.dmpFilesize
96KB
-
memory/1232-992-0x00000000018F0000-0x00000000018FE000-memory.dmpFilesize
56KB
-
memory/1232-993-0x000000001AD60000-0x000000001AD7A000-memory.dmpFilesize
104KB
-
memory/1232-994-0x000000001AD80000-0x000000001AD9E000-memory.dmpFilesize
120KB
-
memory/1240-582-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1304-89-0x000000002E000000-0x000000002FE1E000-memory.dmpFilesize
30.1MB
-
memory/1304-82-0x0000000000600000-0x0000000000667000-memory.dmpFilesize
412KB
-
memory/1304-87-0x0000000000600000-0x0000000000667000-memory.dmpFilesize
412KB
-
memory/1304-360-0x000000002E000000-0x000000002FE1E000-memory.dmpFilesize
30.1MB
-
memory/1476-673-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1536-425-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1540-969-0x0000000001B90000-0x0000000001BD8000-memory.dmpFilesize
288KB
-
memory/1540-973-0x000000001AED0000-0x000000001AEDE000-memory.dmpFilesize
56KB
-
memory/1540-968-0x00000000019D0000-0x00000000019DC000-memory.dmpFilesize
48KB
-
memory/1540-972-0x000000001AED0000-0x000000001AEDE000-memory.dmpFilesize
56KB
-
memory/1540-970-0x00000000019E0000-0x00000000019F6000-memory.dmpFilesize
88KB
-
memory/1540-967-0x0000000001980000-0x000000000198E000-memory.dmpFilesize
56KB
-
memory/1608-469-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1612-550-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1612-680-0x0000000140000000-0x0000000140196000-memory.dmpFilesize
1.6MB
-
memory/1648-92-0x0000000000FC0000-0x0000000001020000-memory.dmpFilesize
384KB
-
memory/1648-515-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1648-105-0x0000000140000000-0x00000001401AA000-memory.dmpFilesize
1.7MB
-
memory/1648-100-0x0000000140000000-0x00000001401AA000-memory.dmpFilesize
1.7MB
-
memory/1648-98-0x0000000000FC0000-0x0000000001020000-memory.dmpFilesize
384KB
-
memory/1720-480-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1812-436-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1832-504-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1896-108-0x000000002E000000-0x000000002E195000-memory.dmpFilesize
1.6MB
-
memory/1896-385-0x000000002E000000-0x000000002E195000-memory.dmpFilesize
1.6MB
-
memory/1952-292-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1952-307-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1968-421-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1972-572-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1996-528-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1996-539-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2100-398-0x0000000100000000-0x0000000100542000-memory.dmpFilesize
5.3MB
-
memory/2100-126-0x0000000100000000-0x0000000100542000-memory.dmpFilesize
5.3MB
-
memory/2180-334-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2180-319-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2288-901-0x0000000100000000-0x0000000100175000-memory.dmpFilesize
1.5MB
-
memory/2288-619-0x0000000100000000-0x0000000100175000-memory.dmpFilesize
1.5MB
-
memory/2340-493-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2340-489-0x0000000003E00000-0x0000000003EBA000-memory.dmpFilesize
744KB
-
memory/2340-484-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2372-7-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB
-
memory/2372-0-0x00000000005F0000-0x0000000000657000-memory.dmpFilesize
412KB
-
memory/2372-8-0x00000000005F0000-0x0000000000657000-memory.dmpFilesize
412KB
-
memory/2372-14-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB
-
memory/2376-1035-0x0000000000CA0000-0x0000000000CAC000-memory.dmpFilesize
48KB
-
memory/2444-447-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2528-587-0x0000000010000000-0x000000001017F000-memory.dmpFilesize
1.5MB
-
memory/2528-633-0x0000000010000000-0x000000001017F000-memory.dmpFilesize
1.5MB
-
memory/2596-62-0x0000000000A80000-0x0000000000AE0000-memory.dmpFilesize
384KB
-
memory/2596-56-0x0000000000A80000-0x0000000000AE0000-memory.dmpFilesize
384KB
-
memory/2596-55-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2596-332-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2612-17-0x00000000008D0000-0x0000000000930000-memory.dmpFilesize
384KB
-
memory/2612-23-0x00000000008D0000-0x0000000000930000-memory.dmpFilesize
384KB
-
memory/2612-24-0x00000000008D0000-0x0000000000930000-memory.dmpFilesize
384KB
-
memory/2612-16-0x0000000100000000-0x0000000100184000-memory.dmpFilesize
1.5MB
-
memory/2612-107-0x0000000100000000-0x0000000100184000-memory.dmpFilesize
1.5MB
-
memory/2644-30-0x0000000140000000-0x000000014017D000-memory.dmpFilesize
1.5MB
-
memory/2644-37-0x0000000000310000-0x0000000000370000-memory.dmpFilesize
384KB
-
memory/2644-31-0x0000000000310000-0x0000000000370000-memory.dmpFilesize
384KB
-
memory/2644-279-0x0000000140000000-0x000000014017D000-memory.dmpFilesize
1.5MB
-
memory/2692-1006-0x0000000001900000-0x0000000001918000-memory.dmpFilesize
96KB
-
memory/2692-1008-0x0000000001980000-0x000000000198E000-memory.dmpFilesize
56KB
-
memory/2692-1007-0x0000000001970000-0x000000000197C000-memory.dmpFilesize
48KB
-
memory/2692-1011-0x000000001B260000-0x000000001B27E000-memory.dmpFilesize
120KB
-
memory/2692-1016-0x000000001B6B0000-0x000000001B6C8000-memory.dmpFilesize
96KB
-
memory/2692-1017-0x000000001B6B0000-0x000000001B6C8000-memory.dmpFilesize
96KB
-
memory/2692-1009-0x0000000001990000-0x00000000019A6000-memory.dmpFilesize
88KB
-
memory/2692-1010-0x000000001AD70000-0x000000001AD8A000-memory.dmpFilesize
104KB
-
memory/2696-902-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/2696-637-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/2704-285-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2704-41-0x0000000000290000-0x00000000002F7000-memory.dmpFilesize
412KB
-
memory/2704-49-0x0000000000290000-0x00000000002F7000-memory.dmpFilesize
412KB
-
memory/2704-48-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2712-660-0x0000000140000000-0x0000000140192000-memory.dmpFilesize
1.6MB
-
memory/2712-903-0x0000000140000000-0x0000000140192000-memory.dmpFilesize
1.6MB
-
memory/2752-364-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2752-361-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2856-79-0x0000000140000000-0x0000000140237000-memory.dmpFilesize
2.2MB
-
memory/2856-77-0x00000000004F0000-0x0000000000550000-memory.dmpFilesize
384KB
-
memory/2856-71-0x00000000004F0000-0x0000000000550000-memory.dmpFilesize
384KB
-
memory/2856-344-0x0000000140000000-0x0000000140237000-memory.dmpFilesize
2.2MB
-
memory/2868-601-0x0000000010000000-0x0000000010187000-memory.dmpFilesize
1.5MB
-
memory/2868-649-0x0000000010000000-0x0000000010187000-memory.dmpFilesize
1.5MB
-
memory/2872-955-0x0000000001A40000-0x0000000001A56000-memory.dmpFilesize
88KB
-
memory/2872-954-0x00000000019F0000-0x0000000001A38000-memory.dmpFilesize
288KB
-
memory/2872-953-0x00000000019D0000-0x00000000019DC000-memory.dmpFilesize
48KB
-
memory/2872-952-0x0000000000D40000-0x0000000000D4E000-memory.dmpFilesize
56KB
-
memory/2984-458-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/3036-333-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/3036-337-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB