Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 20:16
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe
Resource
win7-20240221-en
General
-
Target
2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe
-
Size
1.8MB
-
MD5
dfe8d0dd9cfa68b232d57f9c421f7a27
-
SHA1
1d5c5e3926bd5436efd16127ddaa40fa017aa617
-
SHA256
dee90f9389c9e3d770999d076b47b045532f90b59467388d802b62af91bf31be
-
SHA512
1e2122cc078f1478537ab4cc093584b122034758ed0506cd27e17ac696cacde9001bcc32f31e9af3fc791b65e91b66217e4f0d0892b81599244a9ff9dc5404db
-
SSDEEP
49152:sE19+ApwXk1QE1RzsEQPaxHN3mgiTd8DsMcDKGfWbYCGE:R93wXmoK/BiTLMiKGu8CP
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 468 Process not Found 2812 alg.exe 2468 aspnet_state.exe 1800 mscorsvw.exe 2536 mscorsvw.exe 2604 mscorsvw.exe 2448 mscorsvw.exe 1032 dllhost.exe 1656 ehRecvr.exe 924 ehsched.exe 1104 elevation_service.exe 2356 IEEtwCollector.exe 1844 GROOVE.EXE 864 maintenanceservice.exe 2212 msdtc.exe 1588 mscorsvw.exe 848 msiexec.exe 2612 OSE.EXE 2696 OSPPSVC.EXE 1664 perfhost.exe 944 mscorsvw.exe 1644 locator.exe 476 mscorsvw.exe 320 snmptrap.exe 576 vds.exe 2892 vssvc.exe 2136 wbengine.exe 1508 WmiApSrv.exe 2960 wmpnetwk.exe 1564 SearchIndexer.exe 548 mscorsvw.exe 760 mscorsvw.exe 696 mscorsvw.exe 1580 mscorsvw.exe 400 mscorsvw.exe 2772 mscorsvw.exe 1124 mscorsvw.exe 2104 mscorsvw.exe 1680 mscorsvw.exe 1808 mscorsvw.exe 1484 mscorsvw.exe 1124 mscorsvw.exe 2664 mscorsvw.exe 2232 mscorsvw.exe 2936 mscorsvw.exe 2952 mscorsvw.exe 2200 mscorsvw.exe 2652 mscorsvw.exe 2592 mscorsvw.exe 2356 mscorsvw.exe 2936 mscorsvw.exe 3036 mscorsvw.exe 3020 mscorsvw.exe 2728 mscorsvw.exe 548 mscorsvw.exe 2076 mscorsvw.exe 2364 mscorsvw.exe 1284 mscorsvw.exe 1636 mscorsvw.exe 2112 mscorsvw.exe 2936 mscorsvw.exe 2296 mscorsvw.exe 2760 mscorsvw.exe 860 mscorsvw.exe -
Loads dropped DLL 51 IoCs
pid Process 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 848 msiexec.exe 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 740 Process not Found 2364 mscorsvw.exe 2364 mscorsvw.exe 1636 mscorsvw.exe 1636 mscorsvw.exe 2936 mscorsvw.exe 2936 mscorsvw.exe 2760 mscorsvw.exe 2760 mscorsvw.exe 2268 mscorsvw.exe 2268 mscorsvw.exe 2132 mscorsvw.exe 2132 mscorsvw.exe 2572 mscorsvw.exe 2572 mscorsvw.exe 2188 mscorsvw.exe 2188 mscorsvw.exe 2084 mscorsvw.exe 2084 mscorsvw.exe 964 mscorsvw.exe 964 mscorsvw.exe 2296 mscorsvw.exe 2296 mscorsvw.exe 1284 mscorsvw.exe 1284 mscorsvw.exe 1720 mscorsvw.exe 1720 mscorsvw.exe 2692 mscorsvw.exe 2692 mscorsvw.exe 2124 mscorsvw.exe 2124 mscorsvw.exe 2708 mscorsvw.exe 2708 mscorsvw.exe 684 mscorsvw.exe 684 mscorsvw.exe 2112 mscorsvw.exe 2112 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\57e345eeae4ef42b.bin aspnet_state.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\system32\locator.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\System32\vds.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe aspnet_state.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe aspnet_state.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe aspnet_state.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe aspnet_state.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index144.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9702.tmp\Microsoft.Office.Tools.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index143.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPC19A.tmp\ehiVidCtl.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index143.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP86EB.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13f.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe aspnet_state.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAF04.tmp\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPB220.tmp\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index146.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP93B7.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index133.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\syncCenter.dll,-3001 = "Sync files between your computer and network folders" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\XpsRchVw.exe,-102 = "XPS Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\CacheWaitForSize = "32" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10310 = "The aim of the game in Spider Solitaire is to remove cards from play in the fewest moves possible. Line up runs of cards from king through ace, in the same suit, to remove them." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4 = "Windows Media Player" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10305 = "Hearts is a trick-based card game in which the goal is to get rid of cards while avoiding points. The player with the lowest number of points wins." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10054 = "Chess Titans" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-118 = "Sleep Away" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Firewall with Advanced Security" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\displayswitch.exe,-321 = "Connect your computer to a projector by display cable." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-116 = "Kalimba" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074 = "Windows Journal" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\sdcpl.dll,-101 = "Backup and Restore" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020af98c03ba6da01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1500 ehRec.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe 2468 aspnet_state.exe 2468 aspnet_state.exe 2468 aspnet_state.exe 2468 aspnet_state.exe 2468 aspnet_state.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: 33 2692 EhTray.exe Token: SeIncBasePriorityPrivilege 2692 EhTray.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeDebugPrivilege 1500 ehRec.exe Token: SeRestorePrivilege 848 msiexec.exe Token: SeTakeOwnershipPrivilege 848 msiexec.exe Token: SeSecurityPrivilege 848 msiexec.exe Token: SeBackupPrivilege 2892 vssvc.exe Token: SeRestorePrivilege 2892 vssvc.exe Token: SeAuditPrivilege 2892 vssvc.exe Token: 33 2692 EhTray.exe Token: SeIncBasePriorityPrivilege 2692 EhTray.exe Token: SeBackupPrivilege 2136 wbengine.exe Token: SeRestorePrivilege 2136 wbengine.exe Token: SeSecurityPrivilege 2136 wbengine.exe Token: SeManageVolumePrivilege 1564 SearchIndexer.exe Token: 33 1564 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1564 SearchIndexer.exe Token: 33 2960 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 2960 wmpnetwk.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeDebugPrivilege 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe Token: SeDebugPrivilege 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe Token: SeDebugPrivilege 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe Token: SeDebugPrivilege 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe Token: SeDebugPrivilege 2236 2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeDebugPrivilege 2468 aspnet_state.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe Token: SeShutdownPrivilege 2448 mscorsvw.exe Token: SeShutdownPrivilege 2604 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2692 EhTray.exe 2692 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2692 EhTray.exe 2692 EhTray.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1696 SearchProtocolHost.exe 1696 SearchProtocolHost.exe 1696 SearchProtocolHost.exe 1696 SearchProtocolHost.exe 1696 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe 1740 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 1588 2604 mscorsvw.exe 44 PID 2604 wrote to memory of 1588 2604 mscorsvw.exe 44 PID 2604 wrote to memory of 1588 2604 mscorsvw.exe 44 PID 2604 wrote to memory of 1588 2604 mscorsvw.exe 44 PID 2604 wrote to memory of 944 2604 mscorsvw.exe 51 PID 2604 wrote to memory of 944 2604 mscorsvw.exe 51 PID 2604 wrote to memory of 944 2604 mscorsvw.exe 51 PID 2604 wrote to memory of 944 2604 mscorsvw.exe 51 PID 2604 wrote to memory of 476 2604 mscorsvw.exe 53 PID 2604 wrote to memory of 476 2604 mscorsvw.exe 53 PID 2604 wrote to memory of 476 2604 mscorsvw.exe 53 PID 2604 wrote to memory of 476 2604 mscorsvw.exe 53 PID 2604 wrote to memory of 548 2604 mscorsvw.exe 61 PID 2604 wrote to memory of 548 2604 mscorsvw.exe 61 PID 2604 wrote to memory of 548 2604 mscorsvw.exe 61 PID 2604 wrote to memory of 548 2604 mscorsvw.exe 61 PID 2604 wrote to memory of 760 2604 mscorsvw.exe 62 PID 2604 wrote to memory of 760 2604 mscorsvw.exe 62 PID 2604 wrote to memory of 760 2604 mscorsvw.exe 62 PID 2604 wrote to memory of 760 2604 mscorsvw.exe 62 PID 1564 wrote to memory of 1696 1564 SearchIndexer.exe 63 PID 1564 wrote to memory of 1696 1564 SearchIndexer.exe 63 PID 1564 wrote to memory of 1696 1564 SearchIndexer.exe 63 PID 1564 wrote to memory of 1752 1564 SearchIndexer.exe 64 PID 1564 wrote to memory of 1752 1564 SearchIndexer.exe 64 PID 1564 wrote to memory of 1752 1564 SearchIndexer.exe 64 PID 2604 wrote to memory of 696 2604 mscorsvw.exe 65 PID 2604 wrote to memory of 696 2604 mscorsvw.exe 65 PID 2604 wrote to memory of 696 2604 mscorsvw.exe 65 PID 2604 wrote to memory of 696 2604 mscorsvw.exe 65 PID 2604 wrote to memory of 1580 2604 mscorsvw.exe 66 PID 2604 wrote to memory of 1580 2604 mscorsvw.exe 66 PID 2604 wrote to memory of 1580 2604 mscorsvw.exe 66 PID 2604 wrote to memory of 1580 2604 mscorsvw.exe 66 PID 2604 wrote to memory of 400 2604 mscorsvw.exe 67 PID 2604 wrote to memory of 400 2604 mscorsvw.exe 67 PID 2604 wrote to memory of 400 2604 mscorsvw.exe 67 PID 2604 wrote to memory of 400 2604 mscorsvw.exe 67 PID 2604 wrote to memory of 2772 2604 mscorsvw.exe 68 PID 2604 wrote to memory of 2772 2604 mscorsvw.exe 68 PID 2604 wrote to memory of 2772 2604 mscorsvw.exe 68 PID 2604 wrote to memory of 2772 2604 mscorsvw.exe 68 PID 2604 wrote to memory of 1124 2604 mscorsvw.exe 75 PID 2604 wrote to memory of 1124 2604 mscorsvw.exe 75 PID 2604 wrote to memory of 1124 2604 mscorsvw.exe 75 PID 2604 wrote to memory of 1124 2604 mscorsvw.exe 75 PID 2604 wrote to memory of 2104 2604 mscorsvw.exe 70 PID 2604 wrote to memory of 2104 2604 mscorsvw.exe 70 PID 2604 wrote to memory of 2104 2604 mscorsvw.exe 70 PID 2604 wrote to memory of 2104 2604 mscorsvw.exe 70 PID 1564 wrote to memory of 1740 1564 SearchIndexer.exe 71 PID 1564 wrote to memory of 1740 1564 SearchIndexer.exe 71 PID 1564 wrote to memory of 1740 1564 SearchIndexer.exe 71 PID 2604 wrote to memory of 1680 2604 mscorsvw.exe 72 PID 2604 wrote to memory of 1680 2604 mscorsvw.exe 72 PID 2604 wrote to memory of 1680 2604 mscorsvw.exe 72 PID 2604 wrote to memory of 1680 2604 mscorsvw.exe 72 PID 2604 wrote to memory of 1808 2604 mscorsvw.exe 73 PID 2604 wrote to memory of 1808 2604 mscorsvw.exe 73 PID 2604 wrote to memory of 1808 2604 mscorsvw.exe 73 PID 2604 wrote to memory of 1808 2604 mscorsvw.exe 73 PID 2604 wrote to memory of 1484 2604 mscorsvw.exe 74 PID 2604 wrote to memory of 1484 2604 mscorsvw.exe 74 PID 2604 wrote to memory of 1484 2604 mscorsvw.exe 74 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_dfe8d0dd9cfa68b232d57f9c421f7a27_bkransomware.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2812
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1800
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2536
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 258 -NGENProcess 240 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:944
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 1f0 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:476
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1e0 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:548
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 244 -NGENProcess 25c -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:760
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 24c -NGENProcess 258 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 26c -NGENProcess 240 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1580
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1e0 -NGENProcess 258 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:400
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1e0 -NGENProcess 26c -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2772
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 278 -NGENProcess 258 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1124
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 244 -NGENProcess 270 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2104
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 260 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 260 -NGENProcess 244 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 258 -NGENProcess 278 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 278 -NGENProcess 280 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1124
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 268 -NGENProcess 288 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 288 -NGENProcess 264 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 270 -NGENProcess 290 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 270 -NGENProcess 288 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2952
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 244 -NGENProcess 290 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2200
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 244 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2a4 -NGENProcess 290 -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 2ac -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2356
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 1ec -NGENProcess 268 -Pipe 1f8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1e8 -NGENProcess 278 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2728
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 23c -NGENProcess 24c -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:548
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 248 -NGENProcess 268 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2076
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 254 -NGENProcess 278 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2364
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 268 -NGENProcess 278 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1d0 -NGENProcess 224 -Pipe 1c4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 224 -NGENProcess 254 -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2112
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 290 -NGENProcess 278 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 278 -NGENProcess 1d0 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2296
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 288 -NGENProcess 254 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2760
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 254 -NGENProcess 290 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:860
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 2ac -NGENProcess 1d0 -Pipe 224 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2268
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 1d0 -NGENProcess 288 -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:1784
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 290 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 290 -NGENProcess 2ac -Pipe 2a4 -Comment "NGen Worker Process"2⤵PID:1500
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 298 -NGENProcess 288 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 288 -NGENProcess 258 -Pipe 270 -Comment "NGen Worker Process"2⤵PID:2044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2b4 -NGENProcess 2ac -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2188
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2ac -NGENProcess 298 -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:1780
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2bc -NGENProcess 258 -Pipe 290 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2084
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 258 -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:2948
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2c4 -NGENProcess 298 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 298 -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:112
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2296
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:2344
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 258 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:1824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 298 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1720
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:528
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:3052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2124
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2d4 -NGENProcess 2e4 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2708
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2dc -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2760
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2fc -NGENProcess 2e4 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:3048
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2f8 -Pipe 25c -Comment "NGen Worker Process"2⤵PID:2184
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2ec -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:2580
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2e4 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:684
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2e4 -NGENProcess 300 -Pipe 2f8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2112
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 300 -NGENProcess 2f4 -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:2964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 314 -NGENProcess 30c -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:2388
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 310 -Pipe 304 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2104
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2f4 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:1656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 30c -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:2620
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 310 -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2f4 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:1908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"2⤵PID:2476
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 310 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:1320
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2f4 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:1328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 30c -Pipe 320 -Comment "NGen Worker Process"2⤵PID:2216
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 310 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:1052
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2f4 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:3048
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 32c -Comment "NGen Worker Process"2⤵PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 310 -Pipe 330 -Comment "NGen Worker Process"2⤵PID:1036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2f4 -Pipe 334 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 338 -Comment "NGen Worker Process"2⤵PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 310 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:760
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2f4 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:1348
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 30c -Pipe 344 -Comment "NGen Worker Process"2⤵PID:2564
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 310 -Pipe 348 -Comment "NGen Worker Process"2⤵PID:1588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 2f4 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:2644
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 30c -Pipe 350 -Comment "NGen Worker Process"2⤵PID:3040
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 310 -Pipe 354 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1376
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 2f4 -Pipe 358 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 360 -Pipe 35c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1500
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 310 -Pipe 1ec -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:624
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 310 -NGENProcess 378 -Pipe 37c -Comment "NGen Worker Process"2⤵PID:888
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2936
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3036
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
PID:1032
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
PID:1656
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:924
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2692
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1104
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:2356
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1844
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:864
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2212
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:848
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2612
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:2696
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1664
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1644
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:320
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:576
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1508
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:1696
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 5962⤵
- Modifies data under HKEY_USERS
PID:1752
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD582ad753169b49f54232c1137f2917ba8
SHA1ae6919dcefadf2317b26a2ad8238052467e6e1b0
SHA256b912abbb44f853d7253e94d74c39f50691bf5905f2c7e92dcc6f9edbc91f551e
SHA51270554770c36dc6db2ada15f54eb1000451eb46b9eb62fa1c57af48e59d4bf06427ec924e64694be35fef544406143e3d1062007169e9a3838940889a10dc5b20
-
Filesize
30.1MB
MD5db8017eda91b35ef7c8f459d336f0008
SHA11468fa1cbf971d0d577d72237032622efe3babe4
SHA256c118381fa1ae9991e78d1e77602375e2e0d0869e1ce04e37972d2eb115f10d7d
SHA5124bd48d4e2d3fb613b5f4c70a12578bdd8ac365d6c4266d640915bf141323b69574faf856e0bfaaa3c8cde26f7936c1632ff5642a4ad16e27307ba16eaee04253
-
Filesize
1.6MB
MD5599ad823940714c26c31a8499ae15b36
SHA119293a6ee003c82064c61a1af215ca4fe1a9f95a
SHA2569621c995383d7d2a02739e23dc82eb784dda4fb2e795b6b2f6d56d5d8799891a
SHA51243479a17f22f29b664d572a80e17c8feb9940d8a21ee7ef4d07103c4a10be72d26101d1d6b952a955306affe89abd75a491da2f714c9c5a293b1483d45c87f12
-
Filesize
5.2MB
MD5de2d8dd93f2b3e443ba10437a0fbae2e
SHA181bc448971676e530479faccd228cf1b8e3172fd
SHA256c569e43669fb1b1ea8aa4e30b15daadf05238478c07958c808c945fc0dbdc104
SHA512acd3ec68262dc82999b47b30b0dd7cf32bea9f34d86ebcd09d68886a5c13c1a23d2fe7eba4c25f9ca3660eb7cf5bd9074aacb1f4cda91390aeaf039fd42e137d
-
Filesize
2.1MB
MD5964c26b10c81f76c7a01069396ba6c63
SHA1b8c69671102a1ec538496f6be3d74f5ebc5faff5
SHA256021ab8b7c7422fc799e8abafd00727bc7c66fb8a8c3eb7320ecb344fb33142ec
SHA5123f6ab046c2bc1b1112b3ce93a70ac9d6134de60d7f737a55658b9042daf74ce96d7dcb201ef5c87df7af6d9629bf60a2fd3ff289272a6477914d5f3e274ec1ac
-
Filesize
1024KB
MD5e4e8bd22f7cb41cb482ed6d096f5454a
SHA1fd9e9fbb155380f3cebd918891f934e7e2b9939f
SHA2564e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7
SHA512a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
872KB
MD5b6b5cc9afbe0ab05b5e43ed80415b0ff
SHA157ff57dc6252c317290b14aa503b688900b32139
SHA256dc1fc49eda82e4921f2d8d652ee23dab44704e062bfb0f695670f1d6048f601e
SHA5122049f56a8f38fdb0e4d4906deea181a2abd06979a06fea3eabddad5c0349b006d1a656a90c18fc7bacdb2b0b73c37654bb3a6064ae9de33fb1c10041d600d686
-
Filesize
1.5MB
MD585f12afea58195bcf9de57efa06e767c
SHA1df9c7624e534df3b56624bac0473da77a6a2ac93
SHA25668db9d3c3ccba09babfc6598004ed11264a3c97212155bbc0e4de481fe48f5de
SHA5126eb4a153d7404130ecff6c7bf4a5b8cc59d070a229d91317e133840bd166b07c34a4e8690e7760f6a29507e228b46c66434a1e346f22106d67cde23ade142dbc
-
Filesize
1.4MB
MD5b0b5bb2508ff1dd360a597447752f8fd
SHA12f56336e725fb522124895d944a08d70df8d5977
SHA2560944c203d43173ef2b4a0bfacd6d3c99f44fc26064dd610c588675978fcc048e
SHA512895722563e9b7b8513c050104d09cbe869d10dc1fd5f352b96e4a0deb690dd6ffc29a7f7adc906dbc2ebcf8cece41a6753c1ec6ec9f6ad017809a08a5e0ec79e
-
Filesize
1003KB
MD562f7036444d3ab1ffbbc05bde2057da1
SHA178b0430287bb572b5979536eb481b9b5e6900c0b
SHA2560f5d568fe5fa036b8dfd745b1124671a03deb05d7f171d17ab38d1ad486047dc
SHA512cb08780689e7c1ad231bd612ebbcffd7ab1f14fdf6ab88b7918ebb453e2e2898c7d2dc93607c13511d7428585d94f4a51249b65e6f9b532b181478d48546b7cb
-
Filesize
1.5MB
MD5d8b008e31d38d42ec9ca4fdbb6483293
SHA1e52050dab54cbb0bebef2a5bbb072749139dfc66
SHA256a4d142ed3a69a861d2c2649f1d76abb16656045c40482f3c0146810090a63487
SHA5120b969dad2b5928f66a76d3f99171d4a0249476bf3fdd697d2a4a1be9ed9c0ed26243d245fda8a3ec2665c1073249b5c7f98b8a05d32b4933672869306b42bad1
-
Filesize
8KB
MD54ec41621b196d242bdd9cdd4e1b35415
SHA1fac383a979c94cfd3f394659e78adb56ed5f9ae1
SHA25621b437b6259e02c0492433b2ed5a4a164cb039b6f57b61efbc8d013796aea1f7
SHA512a419bb1d69dc56958c89d7fe6ca3a0e3788706c7f6a1a14b9259af0f35a60cd5b2afc08b57c565b3ddd6a0fa8072142043d81de2a9380fc013c045ff692299e9
-
Filesize
1.4MB
MD5e099441b893d001e27d5b2d1282c8eba
SHA18514eee9659c18b9b349487d17c7dfe89913295e
SHA2564318809552a32600014ed36771706b4bcb7cb61935e15aafee2426f728a842f7
SHA5128483ad327ab783f645ffc2155089628fb31a03ab32430cdf44b1d03d44823c814eceabbea28a20d4fa3537561ee4dac8813e68f6367f57e206d9a91542579b99
-
Filesize
1.1MB
MD535024e2775c6d928b5636b8cdb8f2b7c
SHA1715c329722f2b06f1e96f2c343bcec9e5b522054
SHA256bf5e4ee607329fa442b61979c12e7456330b415f0c51f304aac88a9925adf198
SHA512e8bf693ba9cd42c7602799955d1b6e03dd982b5707b04c5920ba8f564981d586e1905f483e55efa8169e12a0cfd00a59572565a67ab9c3f79e7f035eba02efdf
-
Filesize
2.1MB
MD5aa06b763d4e855ad69a533b9ff9a2b10
SHA10bf67f8487be1ba53f774469defa74ae15fb439c
SHA2567cec44af4b6bf71e19c802961dff5d758378b49d74e744e56329175b670badcf
SHA5123192174906a41a9bf10d6090247118da287bc80d7638f6751ce4157e7dd2a87ced570bf691699ed5a35f234f07788cc8f82813904aeecdd65dfd50038a8930ee
-
Filesize
1.5MB
MD50653462c6632e8705951c70fdd387b32
SHA1ed3f4e90919cbbc60f7a79f6e8a2157cdb1cefe8
SHA256cfed6b4d3da0958e84ffe6aa2023d3688f68d2e057be5a25330668f0bfcafd6f
SHA512f083aa2695e592094d2476d19cce9d8c4ca3d35cb0b8157e89ff6f1f408efdbaf0a0f0946ca7f4661d8dff45e18994e84de714a617b1942bfb3a9de8f023d8e9
-
Filesize
1.4MB
MD505da29e7f699c63f0f90b59f1ecea028
SHA19aed7d1d92090cd47ce66fedec197db768eb3d47
SHA256fc3033e45860e7e4fe5b360a8e1ab0504f3a9b4bcb1b5bb0727e76b5715790bc
SHA51222be9918ecc38156c8185dfe669dee91c1aab9e1ebd11d1bcdeaa6fee0186770587c17f15eb055ee5c04494c03c46f99848e4328c153a8d15fd3a132c157b881
-
Filesize
1.9MB
MD56df239142351de6ac9b2aca9f1dede5a
SHA186d5bbdf7867064f569294623756c9904c76981f
SHA2565dcb30d3a2340d9469590ed395bc5530545541db0ea6bd7c1a175c04aac5aea9
SHA51252be8c51a45f4f6520a2d97fba6124f655a4221e7afb0d472153cc8c534f9c46d6580b6af85970f4cf02df88e37b9fe39c70973bd42878c7c1604cb3d289a42d
-
Filesize
2.0MB
MD5c950852ddbe6c0836123d8226add7a65
SHA179c6130e3cc9ee154a5f48f7c80bbd2f2ab75ab2
SHA256d3569aa70a3dce97e0de3a32f1bbe8e54b7a05f93d2a9e5b3a08d6a230ed642b
SHA51282bebb6886b538c93b42c896220b30e1fff6357031ca93b4b7e1f5b05968b6612d278efc7102dec95f66548b380776c717dab00c25cdaa5563bb1b17db441867
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
Filesize148KB
MD5ac901cf97363425059a50d1398e3454b
SHA12f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA5126a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize34KB
MD5c26b034a8d6ab845b41ed6e8a8d6001d
SHA13a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize109KB
MD50fd0f978e977a4122b64ae8f8541de54
SHA1153d3390416fdeba1b150816cbbf968e355dc64f
SHA256211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\2007d1be3db6636c531a8c64c345ccf1\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize83KB
MD51113c24ee15dc47df0add1d7c18d88e3
SHA132f79ac6ccc3b83b547103bf67e5a9b834074930
SHA25699526b93e2e849ad7e430122053e04999406b69639ded93c8cb51761b132eacf
SHA5128aacf524a124f2a4d0ac1e83085d410b11dee2e76e0bb8b134887968bcf6212f6ec702197fc923376a316130f81347236b8e3c51436417a6b2de13f0a5d4a059
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize41KB
MD53c269caf88ccaf71660d8dc6c56f4873
SHA1f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4099ddf4991a876506267bdf44fb1613\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize143KB
MD5b8c32c938a8dd190cfb3c96d274f7450
SHA1e05fa6b71533e8d558a48908b3415a616d5ff011
SHA2568b32dfb6eacc14eb685aeb0fe3bfb64e7a4f25c8626cfc3f943d83584d1025e2
SHA512d61f0dfb96b4d884757739adf87c6a7f4bc9d0172f49a78e4a99e9b8db97682926070264b8bde680aa0522808191c2f1761828cbc0f8bc53284d40c28f4b1cf2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\611a9cd487715c826658349d1d84f118\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize187KB
MD5824e4daed50c6c9353dac93ebcc15d66
SHA170b0071b168921c73d77f0f7e0e8d814b4c539cc
SHA2563938c0c2cd0cab6b710b08b2910bbcb41374426ebe880a26c9f24af9866d24f6
SHA51201f9bdab83a883408fd91a0a9375213807d6c59bca22abf93563b1a1661aabaa855506d77b3dc0d95bd25fbf1e29b444b197f7f82bd16bc69131ed5e06de40b3
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize210KB
MD54f40997b51420653706cb0958086cd2d
SHA10069b956d17ce7d782a0e054995317f2f621b502
SHA2568cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize53KB
MD5e3a7a2b65afd8ab8b154fdc7897595c3
SHA1b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA5126537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a06de7e602db2cb6faef38c180fd6d64\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize180KB
MD5e5f8eada727db4e443fa81b936a56a18
SHA105a20df94c55f9010af2cf4e0b29420147fd7c6b
SHA256a3fa034acffc5fcb9dc2e598a834dfb01cf52fd30adebdc55d241bd17e16c6fb
SHA5121fbeedbe344e97c8ef4877c9a3894a6ddcc878b8d5dc8a07520b7f05f65b809e11269850c4f254a3c0d3b901380e691dcc308c89d17534e162d7d0d605d9a000
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize28KB
MD5aefc3f3c8e7499bad4d05284e8abd16c
SHA17ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA2564436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA5121d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize27KB
MD59c60454398ce4bce7a52cbda4a45d364
SHA1da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize57KB
MD56eaaa1f987d6e1d81badf8665c55a341
SHA1e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA2564b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize130KB
MD52735d2ab103beb0f7c1fbd6971838274
SHA16063646bc072546798bf8bf347425834f2bfad71
SHA256f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize59KB
MD58c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize42KB
MD571d4273e5b77cf01239a5d4f29e064fc
SHA1e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA51241fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
Filesize855KB
MD57812b0a90d92b4812d4063b89a970c58
SHA13c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA256897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
SHA512634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
Filesize43KB
MD53e72bdd0663c5b2bcd530f74139c83e3
SHA166069bcac0207512b9e07320f4fa5934650677d2
SHA2566a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
SHA512b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
-
Filesize
2.0MB
MD5d0f39f69d48de4004eaea7414862f557
SHA1e969a04e56141c864d6deeb980e45c884bac22a1
SHA256901c4497cc3b0efb23564dd91e07a1d2dde0fd3e3ef8ddc02bc2059cfa8b8a77
SHA5121ec2065f8bb76b1f042f3611a90a70fde41a87e2ef0894d5b6c6afc921213b4cd6c929cac643e703444310dcf8d3054b6c2d443f355cade40d780462ab19f34d
-
Filesize
1.5MB
MD55b9375f7ff98fb2fd064fd29cbf8f145
SHA1fa4368423ffbc29505186705e16788ddedf79a06
SHA2562f33181b58b83c66676e319b1726662de13e7576e9330535ba74aab66e5fcabb
SHA512a946694ebe10520fc390a99ad86a2470ba6d75df0807232cbda8dc44d1b09e1f4bd49411b06a0f29e33c0e42b4e6f5af41a5c611931d0461777506ed728eb561
-
Filesize
1.4MB
MD5a0995a809da4b99b1a4f3d3247a4515b
SHA1dcfda280b792b6eb24fac52befc6fe8416fd8289
SHA2562b3de4cd5847f25771b14a2a9705853f6a6195b4b9e5f8cf77cefd14b46ffb55
SHA51247bef70821115034ddb2dd1d18338aa6089268355781a0f560af6b96c453d27f7522b5e3349cded5278c737ed4330d6dc44e63a7614dddebd80308d7d904960f
-
Filesize
1.4MB
MD5eb6691d4b565873cf43e81f07cd883bc
SHA12f02ef7f78f7d36645fbf94171ceb05c640ee23e
SHA256e79df14ee58c9b35d88c20d67149cd81d6361a9c3695db2b6ccd926fe19abd73
SHA512922ff7ac3ed8b3b3c0165fbce462f8fbd52cd27e344e79b5987c56e0ea0205eaf100463ce76ea1f1f0dea25997a6fb5c16c7b02e830a2a5e14fd8cd0be810ddf
-
Filesize
1.4MB
MD5bba364bb19aaf786c6db6272ad6df69e
SHA15755f2c3f3af33240bbeb99e1e0044e9f873bf7b
SHA256a1f275caee21e7727246a9f4b3ce5d52cde282d15b14dad756b782bff2f1fc9b
SHA512ca0f7ae3409a88f89a79e706d60c691c66a615088f201a09380c6fd815ef2a91b5adfbb1a5d6607c298a46e57c892846cff5fddeabd71cda3f3737967e1cdd98
-
Filesize
1.4MB
MD5f2c3b2ffc15a5de6f11312bc561bb7fe
SHA191e8f3687554f9032b4e7fad9a18362c140fcb15
SHA256afdd6ed5bad2a18dbd55a3f2731a33d51b3d25a2dc1be34d2f39af82f933b571
SHA51260bebfa4a36a7ca063929db1bf6bc8ab9a794df3f34430516c3322cb1dabc09f6cc707bfce5beb3c082ca2de4572dfd5353f5cd04c58bba8e89ab2cadfb962e3
-
Filesize
1.5MB
MD57a0dcdeed03f3ec61db94943d20ebc50
SHA1dab1084ba65c0c51ab2b2035674a4c64eaf9caa2
SHA25684e786da91a863470b3b74019de1a903fe2c4b8ba61f12b72a97f279d247d536
SHA5121275a89f11f7c1a91bb474a9c6084f83d8f131d18ba4d4ec4f81be0641aa161bc670a8b8b23cb685bc211b0557d552ba1c32532743b0df927be881dd0c53e766
-
Filesize
1.5MB
MD5e086f9fd1a4d09aeffe0a7e402d07666
SHA17f3f97fbbd4a624ddcb6cf3576afb15ab57872c0
SHA256f4a35c06247d4aa9ef47526cfe3e288d4e0849c0fcda3122beb4b32dd5fe1da1
SHA512b863644f8a43b18c12868e85517113d6944dd6e7359f6d8d28a63859f7d758fa119aff23929b6c3e7f368bbda2c0d03a578a29fab69e54d4e130834cf3dd5325
-
Filesize
1.6MB
MD5ab118bf3c088807c012b39e44bed67e8
SHA1950cd06eb9f4ac4d4b93f9f979bd995e5766de36
SHA2568582d21c8b752c7403be0973fea447e9c115a685f5defcaed8e52557cfa986dc
SHA512741da865bc4219a76660fc15518ca7534d9c76a68eccc70d1d3e1053829220e1944bcc918b189fbe6aa9e99e5b752d47aa94138ef23d1f440393cdbd351ba1a8
-
Filesize
1.2MB
MD56411d42f03815776dd82d769526c9c84
SHA13ff2cde01447ae7e78d45d61eb7928a7f44ff2fc
SHA2561c5ee830bfc17ab28edc9b2d7a3ecb719634280ca8598b492e079a602ea68ac8
SHA512c0324e690f0c11b3acef2d907f6ef3fdff17798b28eeae9f12a1bb3ad80a5040a88f652c889f4b39ae6c1cc6ae11fc62ad24f70d5594668964be4b34c413d48d
-
Filesize
1.5MB
MD508e40a8ead4e312e7199c6af49590c1f
SHA1ef50770ca4c76410989fe75491570d714a65a64c
SHA256ef9162b1c1e8a01af10224754df03e1930d0a746e7239172670559304f4a1972
SHA51290a06d52dad1d1a1d99071022e030d62212abf604547390c8fbfab47458b0961650ab136561a9574bc98040637d33b942ba47637e3ba175ebaf88e26e2250953