Analysis

  • max time kernel
    138s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 10:33

General

  • Target

    2024-05-15_ace93e4e5cf167e3636e0e0f6b43aa6d_avoslocker.exe

  • Size

    1.3MB

  • MD5

    ace93e4e5cf167e3636e0e0f6b43aa6d

  • SHA1

    3b789ad469e67ebb3307ea4e6345df0299baf047

  • SHA256

    cc36ad76f4c4156dc8ab9aa8fe88a27039deb778949ac6e8ca078555f2c88fb0

  • SHA512

    31841cd8c9028ec10723e64ad39909b0ede3619b716d1b24f72c8b038abcdffddf70745c4fbed2d064c3b32752fd8215e077a0d92a72bbabdb6a0899f3e4973a

  • SSDEEP

    24576:o2zEYytjjqNSlhvpfQiIhKPtehfQ7r9qySkbgedIsRjhm0Ijr/eax8JXO02q3A:oPtjtQiIhUyQd1SkFdIEjhMjSax84

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_ace93e4e5cf167e3636e0e0f6b43aa6d_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_ace93e4e5cf167e3636e0e0f6b43aa6d_avoslocker.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2804
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2980
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2624
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2888
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2492
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 248 -NGENProcess 1f0 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2408
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 240 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1040
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 264 -NGENProcess 254 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2088
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 248 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1104
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1d8 -NGENProcess 26c -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2032
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 270 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 274 -NGENProcess 26c -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2756
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1e0 -NGENProcess 248 -Pipe 1d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2460
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 278 -NGENProcess 24c -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2440
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 26c -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2560
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 1e0 -NGENProcess 284 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 250 -NGENProcess 26c -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2528
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 288 -NGENProcess 27c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1284
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 28c -NGENProcess 1e0 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:948
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 284 -NGENProcess 294 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:240
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 248 -NGENProcess 1e0 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2996
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 298 -NGENProcess 28c -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1088
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 294 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 248 -NGENProcess 2a4 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2308
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 2a4 -NGENProcess 284 -Pipe 2a8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 274 -NGENProcess 1e0 -Pipe 2a4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1612
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:836
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2924
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 200 -NGENProcess 1b0 -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2308
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 250 -NGENProcess 230 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2184
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 228 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:676
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 1b0 -Pipe 224 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2328
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 230 -Pipe 1bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2024
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1b0 -NGENProcess 230 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1708
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 268 -NGENProcess 260 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2856
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 25c -NGENProcess 260 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2820
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 270 -NGENProcess 230 -Pipe 228 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:568
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 230 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2812
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 278 -NGENProcess 260 -Pipe 1b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1604
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2400
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 280 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2604
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 268 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
        PID:1708
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 278 -NGENProcess 260 -Pipe 28c -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:1984
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 260 -NGENProcess 244 -Pipe 288 -Comment "NGen Worker Process"
        2⤵
          PID:2944
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 290 -NGENProcess 280 -Pipe 200 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2800
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 280 -NGENProcess 278 -Pipe 230 -Comment "NGen Worker Process"
          2⤵
            PID:1636
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 298 -NGENProcess 244 -Pipe 268 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1572
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 244 -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"
            2⤵
              PID:1544
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2a0 -NGENProcess 278 -Pipe 260 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2080
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 278 -NGENProcess 298 -Pipe 29c -Comment "NGen Worker Process"
              2⤵
                PID:1656
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 2a8 -NGENProcess 290 -Pipe 280 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2460
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 290 -NGENProcess 2a0 -Pipe 2a4 -Comment "NGen Worker Process"
                2⤵
                  PID:2604
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2b0 -NGENProcess 298 -Pipe 244 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:1032
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 298 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
                  2⤵
                    PID:1200
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2b8 -NGENProcess 2a0 -Pipe 278 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:2816
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2a0 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
                    2⤵
                      PID:2328
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2c0 -NGENProcess 2a8 -Pipe 290 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2480
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2a8 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
                      2⤵
                        PID:1952
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2c8 -NGENProcess 2b0 -Pipe 298 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:628
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
                        2⤵
                          PID:1552
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 2a0 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:3068
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2b8 -NGENProcess 2c8 -Pipe 2cc -Comment "NGen Worker Process"
                          2⤵
                            PID:1952
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2d8 -NGENProcess 2c0 -Pipe 2a8 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:2612
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2d4 -NGENProcess 2c8 -Pipe 2b8 -Comment "NGen Worker Process"
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:2464
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e0 -NGENProcess 2dc -Pipe 2b0 -Comment "NGen Worker Process"
                            2⤵
                              PID:2816
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2e4 -NGENProcess 2c0 -Pipe 270 -Comment "NGen Worker Process"
                              2⤵
                                PID:2820
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2e8 -NGENProcess 2c8 -Pipe 2d0 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2996
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2ec -NGENProcess 2dc -Pipe 254 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:608
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2c0 -Pipe 2d8 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:1952
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2c0 -NGENProcess 2e8 -Pipe 2c8 -Comment "NGen Worker Process"
                                    2⤵
                                    • Loads dropped DLL
                                    • Drops file in Windows directory
                                    PID:2752
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e8 -NGENProcess 2d4 -Pipe 2dc -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2472
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2fc -NGENProcess 2f4 -Pipe 2e4 -Comment "NGen Worker Process"
                                      2⤵
                                      • Loads dropped DLL
                                      • Drops file in Windows directory
                                      PID:1860
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2c0 -NGENProcess 2ec -Pipe 2fc -Comment "NGen Worker Process"
                                      2⤵
                                        PID:628
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 308 -NGENProcess 2e0 -Pipe 304 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:1360
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 308 -NGENProcess 2c0 -Pipe 2d4 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2752
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 284 -NGENProcess 2e0 -Pipe 2e8 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1132
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 314 -NGENProcess 300 -Pipe 2f0 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:3060
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 2c0 -Pipe 310 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2492
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2e0 -Pipe 2f8 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:2008
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 300 -Pipe 30c -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:608
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2c0 -Pipe 308 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:2636
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2e0 -Pipe 284 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:1200
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 300 -Pipe 314 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2020
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2c0 -Pipe 318 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2404
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 338 -NGENProcess 330 -Pipe 324 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2844
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 320 -NGENProcess 328 -Pipe 300 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2604
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 31c -NGENProcess 334 -Pipe 2c0 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2684
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 33c -NGENProcess 330 -Pipe 1b4 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2440
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 328 -Pipe 32c -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:608
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 334 -Pipe 2e0 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:1776
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 330 -Pipe 338 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2292
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 328 -Pipe 320 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1860
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 334 -Pipe 31c -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2008
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 330 -Pipe 33c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1920
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 328 -Pipe 340 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:2832
                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 334 -Pipe 344 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2080
                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 334 -NGENProcess 354 -Pipe 330 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2852
                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 364 -NGENProcess 328 -Pipe 34c -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1652
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 360 -Pipe 350 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:560
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 374 -NGENProcess 354 -Pipe 370 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:608
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 348 -Pipe 36c -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:1132
                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 360 -Pipe 35c -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2512
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 354 -Pipe 334 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2348
                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 348 -Pipe 364 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:2752
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 378 -NGENProcess 360 -Pipe 38c -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:932
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 368 -NGENProcess 388 -Pipe 374 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1636
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 390 -NGENProcess 348 -Pipe 358 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:1816
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 360 -Pipe 37c -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2472
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 388 -Pipe 380 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:652
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 348 -Pipe 384 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2848
                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 360 -Pipe 378 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:932
                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 388 -Pipe 368 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2844
                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 348 -Pipe 390 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:1552
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 360 -Pipe 394 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:844
                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 388 -Pipe 398 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2820
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 348 -Pipe 39c -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2248
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 360 -Pipe 3a0 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:608
                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 388 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:1816
                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 348 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:1868
                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 360 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:1800
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 388 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:320
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 348 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1708
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 360 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:1620
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 388 -Pipe 3bc -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:2852
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1884
                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                          "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:2680
                                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2236
                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1796
                                                                                                                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                                                                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1624
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:1232
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:2408
                                                                                                                                        • C:\Windows\system32\dllhost.exe
                                                                                                                                          C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:1372
                                                                                                                                        • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                          C:\Windows\ehome\ehRecvr.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:400
                                                                                                                                        • C:\Windows\ehome\ehsched.exe
                                                                                                                                          C:\Windows\ehome\ehsched.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2996
                                                                                                                                        • C:\Windows\eHome\EhTray.exe
                                                                                                                                          "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                          1⤵
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                          PID:972
                                                                                                                                        • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                          C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1356
                                                                                                                                        • C:\Windows\System32\msdtc.exe
                                                                                                                                          C:\Windows\System32\msdtc.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:2284
                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2924
                                                                                                                                        • C:\Windows\ehome\ehRec.exe
                                                                                                                                          C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                          1⤵
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2880
                                                                                                                                        • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                          C:\Windows\SysWow64\perfhost.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2312
                                                                                                                                        • C:\Windows\system32\locator.exe
                                                                                                                                          C:\Windows\system32\locator.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1644
                                                                                                                                        • C:\Windows\System32\snmptrap.exe
                                                                                                                                          C:\Windows\System32\snmptrap.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2896
                                                                                                                                        • C:\Windows\System32\vds.exe
                                                                                                                                          C:\Windows\System32\vds.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2416
                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:3008
                                                                                                                                        • C:\Windows\system32\wbengine.exe
                                                                                                                                          "C:\Windows\system32\wbengine.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2052
                                                                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1556
                                                                                                                                        • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                          "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:1692
                                                                                                                                        • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:1936
                                                                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:2840
                                                                                                                                          • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                            "C:\Windows\system32\SearchFilterHost.exe" 0 592 596 604 65536 600
                                                                                                                                            2⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:2732
                                                                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                            2⤵
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:1016

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                                MD5

                                                                                                                                                6829c3109cfa134b3e66799864296043

                                                                                                                                                SHA1

                                                                                                                                                71bc7a7ffde840a1950cb8bed4a12232a2d19d42

                                                                                                                                                SHA256

                                                                                                                                                89c79c01ebf71e3c186761f86b3700008c778066ea2111a094555463e11ea436

                                                                                                                                                SHA512

                                                                                                                                                22a91f0754afbcd9b78b3408f2114865df84f0476a485d0e3826e98811d30412763ae2cfe82eebea1dba53ecf34ddf82a1bfcdf57b04f752cf54d237ac4611ae

                                                                                                                                              • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

                                                                                                                                                Filesize

                                                                                                                                                30.1MB

                                                                                                                                                MD5

                                                                                                                                                c6103a17e36a4e009c607dc4650e8de7

                                                                                                                                                SHA1

                                                                                                                                                b252b686110a5110d869cfa659247f8234b471ac

                                                                                                                                                SHA256

                                                                                                                                                aeba7369387cb533f6f8e22f4ab096af54fd9c5dcc127e8cb7fa3f5cb1596e19

                                                                                                                                                SHA512

                                                                                                                                                7c5af802fb2a262baa8c218db5f7c9c977eb8ffd4f6ab4c456249e997d53e393850b7cfc99852f1cbc6add4f5ac4c9cd22e0dc11793221ef19b49ff2538b9a55

                                                                                                                                              • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                                MD5

                                                                                                                                                71d1e2e681562bff4587fa2db39200dc

                                                                                                                                                SHA1

                                                                                                                                                096c5283b35f2b7b4a2b8d9deb8ad075e9363ae0

                                                                                                                                                SHA256

                                                                                                                                                520b9f7e2e8670e703c75dca5ddf1bf652fc64a759875bfe58ccd1fe73aa4a82

                                                                                                                                                SHA512

                                                                                                                                                4690f308b7931d7519765d1632ac336d8c782761283ffaf59b0b139544b50ca46088cb5d39b8d7235288432e7d7629ff0088b1eb20f3866225f7ad98f27492f2

                                                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

                                                                                                                                                Filesize

                                                                                                                                                5.2MB

                                                                                                                                                MD5

                                                                                                                                                5661d948e404be2ee9d78b5ea3ce6d6a

                                                                                                                                                SHA1

                                                                                                                                                20ae82190700edf8b6e02df1edddfe8a7f7bfca6

                                                                                                                                                SHA256

                                                                                                                                                88799517386079ffa0290fc109c9ada54cb673dfcdef0226fc7776955f26f0de

                                                                                                                                                SHA512

                                                                                                                                                b903cb4f1c990ee770c7226c44d7614881d8981a6b3f3005837b9526d283f294f345781633bb6669aaac91c766fcd9d9420145cab081cf7c4e8872d561761df5

                                                                                                                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

                                                                                                                                                Filesize

                                                                                                                                                2.1MB

                                                                                                                                                MD5

                                                                                                                                                608a93d67db00c5a559234fd7216645d

                                                                                                                                                SHA1

                                                                                                                                                24f7d4e87167f77f43e7fb20fb1adfe4db72d2ad

                                                                                                                                                SHA256

                                                                                                                                                f0622179358171c369f3618a349c198bfcbc3bc1a736cb2195d7824572b43e7e

                                                                                                                                                SHA512

                                                                                                                                                9abed71235e86205210005ac5a0d1cbba8f4b70f48ca7ec3904776f0ee3d5cd4668d633618b1644e33b3afd4013e446956b88107e861bb89218e882407d89242

                                                                                                                                              • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

                                                                                                                                                Filesize

                                                                                                                                                1024KB

                                                                                                                                                MD5

                                                                                                                                                e4e8bd22f7cb41cb482ed6d096f5454a

                                                                                                                                                SHA1

                                                                                                                                                fd9e9fbb155380f3cebd918891f934e7e2b9939f

                                                                                                                                                SHA256

                                                                                                                                                4e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7

                                                                                                                                                SHA512

                                                                                                                                                a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

                                                                                                                                                Filesize

                                                                                                                                                24B

                                                                                                                                                MD5

                                                                                                                                                b9bd716de6739e51c620f2086f9c31e4

                                                                                                                                                SHA1

                                                                                                                                                9733d94607a3cba277e567af584510edd9febf62

                                                                                                                                                SHA256

                                                                                                                                                7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

                                                                                                                                                SHA512

                                                                                                                                                cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                                MD5

                                                                                                                                                a4594cac8c5f8dc8a8825b8eedc5ff0c

                                                                                                                                                SHA1

                                                                                                                                                032ef4ea63a0e5c174b9a2f2cd2c8026fd1a242d

                                                                                                                                                SHA256

                                                                                                                                                3076e35048a6261a58068d10ccb16cea19238a8fef9292cc8cee27efc4862d42

                                                                                                                                                SHA512

                                                                                                                                                492d11f9d88eb41566c200158a223473f34cc8ad398ce01ae90114ba10647fb4dc7f59f3a1754f10f0fcdb531b1561ef1eada56b7a52680bee6b22e910716719

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

                                                                                                                                                Filesize

                                                                                                                                                872KB

                                                                                                                                                MD5

                                                                                                                                                5a74eb9c6696713a0314f1c597a5f5b3

                                                                                                                                                SHA1

                                                                                                                                                f5bb05c98ffe1a6f2ef4de2ffa87d14555105b4b

                                                                                                                                                SHA256

                                                                                                                                                4446a7c41fec860787883af908014a8c0aa7bf3ec7cac1d2c6f0f922642bc9fd

                                                                                                                                                SHA512

                                                                                                                                                b0b906928624a4af7b14d0931b8f8ab13e2c08af825513eb8182ca97deffe04768daa9ae30746756b40c552f597f30c6d3ef42a7614fb0ee65e0bb0c67754458

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                                MD5

                                                                                                                                                febd2f4f4f9815e9ed0bcff8226b8109

                                                                                                                                                SHA1

                                                                                                                                                1675c3d7817c338ad2a4984acad332b319a3670a

                                                                                                                                                SHA256

                                                                                                                                                4b7f5c9695d3c84f1e912fca626f9f01e5ef2d150f05532e9106dd7598d2333f

                                                                                                                                                SHA512

                                                                                                                                                66dbd8ab17cc7d8faed42eee0685a5859379743293d67d8895ac5db2d43e87644fecd7320615b3e7fee4722687590cc0f50763fa7153364ab0c3f8804ee827c6

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

                                                                                                                                                Filesize

                                                                                                                                                8KB

                                                                                                                                                MD5

                                                                                                                                                5b46f902ff5767959c40395a89ebab38

                                                                                                                                                SHA1

                                                                                                                                                2ee515c4b11f9ad786616d24f0ef207c33c000a4

                                                                                                                                                SHA256

                                                                                                                                                b83f0c6a4465c822d1011601cc9e96d5ebebe8ed1d2683c034b3eb615ea72ccf

                                                                                                                                                SHA512

                                                                                                                                                679d3bc3f6ec96e31cde02eb47bb22b1eebb088a98bb16f4acefcf957975aa1abb775c5d0a0f0e52b0a0a426414d605d31974eadd933e567557b5adadbde25da

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                                MD5

                                                                                                                                                10e13df03ca02ca705e1c0af7ac318d0

                                                                                                                                                SHA1

                                                                                                                                                73d0a5f63494f54e370a6a3daf0e3a7ad465c5ad

                                                                                                                                                SHA256

                                                                                                                                                215d7494df03b70668fcbbbf4590ad4d93f2bf50b1af8c96f2dd24d3a66bbb6c

                                                                                                                                                SHA512

                                                                                                                                                7af7b96d5b258ada389ae9287ca751b7627fc3762f48c4adaf1f810fbb1a151fb768f8d3f8971a1c01c3dcf69e2577c8b856c806ec14c76f4fdb642e01b39145

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

                                                                                                                                                Filesize

                                                                                                                                                1003KB

                                                                                                                                                MD5

                                                                                                                                                79e7cf1dd3e2576fda72bd36703ee60c

                                                                                                                                                SHA1

                                                                                                                                                496acaf37e27fa1066790f93ba4a4b7875585f6f

                                                                                                                                                SHA256

                                                                                                                                                14d3135829ee2fb4d757ae439a6eb69a3ab0928f5b0874ec3e1bf64b4d253db8

                                                                                                                                                SHA512

                                                                                                                                                4c32c869b22c36ea5b0c55e20da87121341bd069ee885d1bb33e9527bb4b7d2c480f0070cd21efb1fc7bdfc3614040ae3830a3b21d5783c767dc083ce095fba8

                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                                MD5

                                                                                                                                                2fd6eac895146f7d8af9d75fa25a2b15

                                                                                                                                                SHA1

                                                                                                                                                1255954c25f5dfef08ed6cc44cfd60aa43280de6

                                                                                                                                                SHA256

                                                                                                                                                3d8dde02b8f6046c4599b5cdf33992237e38b04ea6c96a03781c1ab65d43b0a6

                                                                                                                                                SHA512

                                                                                                                                                ea0ab2d264909052a635d96058029748a09f913615b6515a8b9f0d62a8e4adf4be35d7f71a4dbf4a1b9272f231b46b6991a84e3bdbf7f669d1d05eb946327bd6

                                                                                                                                              • C:\Windows\SysWOW64\perfhost.exe

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                                MD5

                                                                                                                                                dda1a87c80f5d07cb179701691dde610

                                                                                                                                                SHA1

                                                                                                                                                a1524ce77e54b1f736038a914a2ac3eaca896e59

                                                                                                                                                SHA256

                                                                                                                                                b3dfa69849517b5f50b63a96235f59d3a426090178f54823016dac7dabb1da71

                                                                                                                                                SHA512

                                                                                                                                                fbc2294845b7c76f7fc1eabb55eded892fb8d11f1563a44982c1a3601f020c4f1cb46ebf8d31bae4b64c5151badcfc96dd75972da5f29cce1e61351778b3fa61

                                                                                                                                              • C:\Windows\System32\msiexec.exe

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                                MD5

                                                                                                                                                fb89d380bb41f05ecbf4a96197df95e4

                                                                                                                                                SHA1

                                                                                                                                                8608385d638525bb4ee4a4898dc72c1d75c7595d

                                                                                                                                                SHA256

                                                                                                                                                cf6a6df4ca20bc646a77e90d0741324564461f0d139c0e33ddaf9538d8123d06

                                                                                                                                                SHA512

                                                                                                                                                2873734e33f480fdeaae927544a8664a34ee2723875100762e1f0c4fb4a0dd755cd1e1a0ae3421d7837ebbb34e406a8748d57f9b0af23cfab450f69fb9d566b6

                                                                                                                                              • C:\Windows\System32\vds.exe

                                                                                                                                                Filesize

                                                                                                                                                1.9MB

                                                                                                                                                MD5

                                                                                                                                                dbcbc873a5c7d974fa444a3b13ad7810

                                                                                                                                                SHA1

                                                                                                                                                faae829ed6d18a42b68686f0b22e310bf26bd83f

                                                                                                                                                SHA256

                                                                                                                                                a2414e934aa356339a07f2c5afc0c96898c261e05e7a6fa9ab597bbfe1d2b811

                                                                                                                                                SHA512

                                                                                                                                                76136d2b721502c2332c0093c88f0a859d6877097f13bbaa1b925309ced078f344b98b291f6348adb62f17721ade9e68af93957b00b98160314373c04b447eb8

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                105KB

                                                                                                                                                MD5

                                                                                                                                                d9c0055c0c93a681947027f5282d5dcd

                                                                                                                                                SHA1

                                                                                                                                                9bd104f4d6bd68d09ae2a55b1ffc30673850780f

                                                                                                                                                SHA256

                                                                                                                                                dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

                                                                                                                                                SHA512

                                                                                                                                                5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                248KB

                                                                                                                                                MD5

                                                                                                                                                4bbf44ea6ee52d7af8e58ea9c0caa120

                                                                                                                                                SHA1

                                                                                                                                                f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

                                                                                                                                                SHA256

                                                                                                                                                c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

                                                                                                                                                SHA512

                                                                                                                                                c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                58KB

                                                                                                                                                MD5

                                                                                                                                                3d6987fc36386537669f2450761cdd9d

                                                                                                                                                SHA1

                                                                                                                                                7a35de593dce75d1cb6a50c68c96f200a93eb0c9

                                                                                                                                                SHA256

                                                                                                                                                34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

                                                                                                                                                SHA512

                                                                                                                                                1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                205KB

                                                                                                                                                MD5

                                                                                                                                                0a41e63195a60814fe770be368b4992f

                                                                                                                                                SHA1

                                                                                                                                                d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

                                                                                                                                                SHA256

                                                                                                                                                4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

                                                                                                                                                SHA512

                                                                                                                                                1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                43KB

                                                                                                                                                MD5

                                                                                                                                                68c51bcdc03e97a119431061273f045a

                                                                                                                                                SHA1

                                                                                                                                                6ecba97b7be73bf465adf3aa1d6798fedcc1e435

                                                                                                                                                SHA256

                                                                                                                                                4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

                                                                                                                                                SHA512

                                                                                                                                                d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                198KB

                                                                                                                                                MD5

                                                                                                                                                9d9305a1998234e5a8f7047e1d8c0efe

                                                                                                                                                SHA1

                                                                                                                                                ba7e589d4943cd4fc9f26c55e83c77559e7337a8

                                                                                                                                                SHA256

                                                                                                                                                469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

                                                                                                                                                SHA512

                                                                                                                                                58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\5bb18fc3a9dea82b3e9710a0108508a8\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                305KB

                                                                                                                                                MD5

                                                                                                                                                df03b9ee15a8d69501dd89f3582b6672

                                                                                                                                                SHA1

                                                                                                                                                1c0a78d33899b478652ddcb8be3d41c539434a07

                                                                                                                                                SHA256

                                                                                                                                                09738ea535fe7623735822016df7ee7f319599d121f160cd1ac704ba3f74d0b6

                                                                                                                                                SHA512

                                                                                                                                                f8e7759b62330c4c1b43dd3069c8a5275a1896a96242f4dec84dbd8f5586b5ece54fc72945825e6de12cb8805a607ee402bda3ac7a5f657ac77a92432e6a378b

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6bbdc6d725b803074062afc8399682a5\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                271KB

                                                                                                                                                MD5

                                                                                                                                                d95816566ebb1d893cde289a63c822d6

                                                                                                                                                SHA1

                                                                                                                                                f5ab5e4c5a69f0d11c06ae3de4f224aafbec45fb

                                                                                                                                                SHA256

                                                                                                                                                d021c5ac81018dc9ed9ef49c8d55ca16a2e6979c6b3209cac874314c08c31503

                                                                                                                                                SHA512

                                                                                                                                                e3b658d516082b174828c471d762d914fea03e8340d6b0b25dd1bf1e387e2db0cc677e88861b4f635f909247106663f9d17e5bdf08b6c749ebfd90a6c905238e

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                70KB

                                                                                                                                                MD5

                                                                                                                                                57b601497b76f8cd4f0486d8c8bf918e

                                                                                                                                                SHA1

                                                                                                                                                da797c446d4ca5a328f6322219f14efe90a5be54

                                                                                                                                                SHA256

                                                                                                                                                1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

                                                                                                                                                SHA512

                                                                                                                                                1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                87KB

                                                                                                                                                MD5

                                                                                                                                                ed5c3f3402e320a8b4c6a33245a687d1

                                                                                                                                                SHA1

                                                                                                                                                4da11c966616583a817e98f7ee6fce6cde381dae

                                                                                                                                                SHA256

                                                                                                                                                b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

                                                                                                                                                SHA512

                                                                                                                                                d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\8d66a175baea8643cadeae11cad99b73\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                122KB

                                                                                                                                                MD5

                                                                                                                                                155ca9b984a25959301acdb67fb55f2e

                                                                                                                                                SHA1

                                                                                                                                                1c178d1da461fb06f020b9ef65f97f770d6e56d4

                                                                                                                                                SHA256

                                                                                                                                                6ae7c6a6b09fe3194f51ef5d7773b372a459970f916d1b4bd140541670034e0a

                                                                                                                                                SHA512

                                                                                                                                                755f4236db28cf5ddc3666ccee4d226c2d1d84e46d5c36402ac17f8fd86b43347ea5b21e2ec086a2d4f77c52a6e691af1931f894118b774bfcce4cd2ec509293

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                82KB

                                                                                                                                                MD5

                                                                                                                                                2eeeff61d87428ae7a2e651822adfdc4

                                                                                                                                                SHA1

                                                                                                                                                66f3811045a785626e6e1ea7bab7e42262f4c4c1

                                                                                                                                                SHA256

                                                                                                                                                37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

                                                                                                                                                SHA512

                                                                                                                                                cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                58KB

                                                                                                                                                MD5

                                                                                                                                                a8b651d9ae89d5e790ab8357edebbffe

                                                                                                                                                SHA1

                                                                                                                                                500cff2ba14e4c86c25c045a51aec8aa6e62d796

                                                                                                                                                SHA256

                                                                                                                                                1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

                                                                                                                                                SHA512

                                                                                                                                                b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ac189ca1e341ec6ba475dc0f493db2b8\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                221KB

                                                                                                                                                MD5

                                                                                                                                                6585731df93b6de9916d84343f93e95b

                                                                                                                                                SHA1

                                                                                                                                                20d41e7edc56f35955389d5c1949e30aecf9a0e7

                                                                                                                                                SHA256

                                                                                                                                                f95a763ecc664b9ce40ef78a696d8c60b8d09310113109fb1e3e1ab11b19c7cb

                                                                                                                                                SHA512

                                                                                                                                                7a7486e541188f52920ad1e39bc836a4036275e8680bbeaa1acc0b77fea139cccf629b05c4a1e7907a93836ac07c5499584990257cdf04f1ea10949629bfc46a

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                85KB

                                                                                                                                                MD5

                                                                                                                                                5180107f98e16bdca63e67e7e3169d22

                                                                                                                                                SHA1

                                                                                                                                                dd2e82756dcda2f5a82125c4d743b4349955068d

                                                                                                                                                SHA256

                                                                                                                                                d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

                                                                                                                                                SHA512

                                                                                                                                                27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                298KB

                                                                                                                                                MD5

                                                                                                                                                5fd34a21f44ccbeda1bf502aa162a96a

                                                                                                                                                SHA1

                                                                                                                                                1f3b1286c01dea47be5e65cb72956a2355e1ae5e

                                                                                                                                                SHA256

                                                                                                                                                5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

                                                                                                                                                SHA512

                                                                                                                                                58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                43KB

                                                                                                                                                MD5

                                                                                                                                                dd1dfa421035fdfb6fd96d301a8c3d96

                                                                                                                                                SHA1

                                                                                                                                                d535030ad8d53d57f45bc14c7c7b69efd929efb3

                                                                                                                                                SHA256

                                                                                                                                                f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

                                                                                                                                                SHA512

                                                                                                                                                8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                124KB

                                                                                                                                                MD5

                                                                                                                                                929653b5b019b4555b25d55e6bf9987b

                                                                                                                                                SHA1

                                                                                                                                                993844805819ee445ff8136ee38c1aee70de3180

                                                                                                                                                SHA256

                                                                                                                                                2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

                                                                                                                                                SHA512

                                                                                                                                                effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                2.1MB

                                                                                                                                                MD5

                                                                                                                                                10b5a285eafccdd35390bb49861657e7

                                                                                                                                                SHA1

                                                                                                                                                62c05a4380e68418463529298058f3d2de19660d

                                                                                                                                                SHA256

                                                                                                                                                5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

                                                                                                                                                SHA512

                                                                                                                                                19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

                                                                                                                                              • C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

                                                                                                                                                Filesize

                                                                                                                                                88KB

                                                                                                                                                MD5

                                                                                                                                                1f394b5ca6924de6d9dbfb0e90ea50ef

                                                                                                                                                SHA1

                                                                                                                                                4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

                                                                                                                                                SHA256

                                                                                                                                                9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

                                                                                                                                                SHA512

                                                                                                                                                e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

                                                                                                                                              • C:\Windows\ehome\ehrecvr.exe

                                                                                                                                                Filesize

                                                                                                                                                1.2MB

                                                                                                                                                MD5

                                                                                                                                                204750f5943e40be234ae61bffa9249c

                                                                                                                                                SHA1

                                                                                                                                                de02520044fb11c42c5a869dec1b4f8cf828a1a2

                                                                                                                                                SHA256

                                                                                                                                                25265de0d039c876bdb0aa5f7935cdaaabbcdff77436198d1f06cb1e91784393

                                                                                                                                                SHA512

                                                                                                                                                62e8ef6c534e34b8fc6b8e240c0b58f27fe6c26152614910365dc53fcfc931a9a5a94760e0dc53f2a8b6118b7c83e5d3a3bf3b1ee06cac82c6985591e45477b6

                                                                                                                                              • C:\Windows\ehome\ehsched.exe

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                                MD5

                                                                                                                                                c1710b55743ad9f2eaae405264fda3f9

                                                                                                                                                SHA1

                                                                                                                                                67cc4c3c7143f41308fa4d339757dddaaa49cdd6

                                                                                                                                                SHA256

                                                                                                                                                99a2f9fe0f53ae2ca0072b296d4b4f0e29743a5f678917b01668cc6f09c90a82

                                                                                                                                                SHA512

                                                                                                                                                3112bc0c2bfa8a6e4fab8eaa14e50bfddca206dc7b04305204e99c09302062d53104d36433ae5a8b41556448b0c82da20a146775d5aa249e9071fb0ea64e753e

                                                                                                                                              • \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                                MD5

                                                                                                                                                2afc649bf8ea2eb062ca48592fa7282f

                                                                                                                                                SHA1

                                                                                                                                                5d713e1822ec0c5df21d4fe61800d1604b2e7700

                                                                                                                                                SHA256

                                                                                                                                                cfc87a74045f38cc45e5b1d90bdf97b8ec11e735108a1c60d2cabc468c63cf12

                                                                                                                                                SHA512

                                                                                                                                                c4dabe8324cf5d1efdc8f5b87a0d1e7bd07c448dc076107ee1f0710e20cbdae26f83b9f2031028a9160343a952da67c9c03eaccb0009f22aec274aff88123dd8

                                                                                                                                              • \Windows\System32\Locator.exe

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                                MD5

                                                                                                                                                c5574d5b80f5234d197be68240bd941e

                                                                                                                                                SHA1

                                                                                                                                                c00697811f06d884f410fc2cdcedd2132eb486c0

                                                                                                                                                SHA256

                                                                                                                                                277ea409c250006f6fb72cabf30a8b15975df48bec310bc55602ac84cd74c60d

                                                                                                                                                SHA512

                                                                                                                                                2f8d71d2c88f2f43123d79c03b26929aa3f99792b6a1795a9670e7570d86c4a32be8b5467b187209b9e0e39e34be4c2acf0a990ffbb0bcb2c57440e9000bb08e

                                                                                                                                              • \Windows\System32\alg.exe

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                                MD5

                                                                                                                                                41c4089a83a3678d93c2f26936d9c42e

                                                                                                                                                SHA1

                                                                                                                                                1183e06179d52dd33768fdd4d4adbc329fc36e68

                                                                                                                                                SHA256

                                                                                                                                                ede1e3f1938fa52849af5ecd9f16a054bd2a54ce55995dff9464c56cb0111608

                                                                                                                                                SHA512

                                                                                                                                                c5f4f3cd5a5c07e24b1e3ddba08394cb2c361f6cf03980cfefe52953bcd25f33dbb29a14e5556a65d50514d227c2d43e964268dbc550edf3276b02a1a75b9eee

                                                                                                                                              • \Windows\System32\dllhost.exe

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                                MD5

                                                                                                                                                ed18a2f7188e77684a7be6954bfbf176

                                                                                                                                                SHA1

                                                                                                                                                0dcb67ff0bf89e3df0aedc6a01f539d214132cb8

                                                                                                                                                SHA256

                                                                                                                                                e89aff74277d0918ad6996e92438a7450544c1303fb9879c26b8b20e1a9a276f

                                                                                                                                                SHA512

                                                                                                                                                58f4abf8f2b2cca53d75b642db5012e650002ea070b92b8adee68480a394ac515a9e411f7c6a6fc295dd353799af185b46fcaa27ed768922e155dda3aedd3df7

                                                                                                                                              • \Windows\System32\ieetwcollector.exe

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                                MD5

                                                                                                                                                ab962162961adf641f97e8835f2c8240

                                                                                                                                                SHA1

                                                                                                                                                dfd511d9d81ab0a6d5cfe5902ce7a45d157c477e

                                                                                                                                                SHA256

                                                                                                                                                72f91a11856c85dac8443ae25e992fc1356e9fc006492a720e7a7ff6fea124e2

                                                                                                                                                SHA512

                                                                                                                                                cadb1d6d74d082e0827140f83efa4f187cb91e382d972687a44f9fee59af7751c7acc3068107b069aa689f5b37a9bbfc9664c8c58c9fc00ccbd59f99c13d6d44

                                                                                                                                              • \Windows\System32\msdtc.exe

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                                MD5

                                                                                                                                                3977bf842c5a15f8a734ec21e9caf0f5

                                                                                                                                                SHA1

                                                                                                                                                dfe7570d37d8c9d85c0228c2707cf002abed8868

                                                                                                                                                SHA256

                                                                                                                                                13c52f3e79ff455d59f8bc0d91d07b8abb447d1eb716a027a1abb5b79a52e091

                                                                                                                                                SHA512

                                                                                                                                                6b5fb99961c85d94be3753591f4c96ae3876a27720d6314a5874eacce5e3b0ff0a70deddea03d5547b42c528f96ed25dd5784feb531c853279b53c1d86438843

                                                                                                                                              • \Windows\System32\snmptrap.exe

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                                MD5

                                                                                                                                                53566bae4c274bf0d6b26b0a8a4265b4

                                                                                                                                                SHA1

                                                                                                                                                89c040b7d6e92a4222d65560a3767e1f349c1470

                                                                                                                                                SHA256

                                                                                                                                                1c719056a569d5937f01efaca267a347f788178cefe5b2cddb14ce3573dd9250

                                                                                                                                                SHA512

                                                                                                                                                e63b4f25220185e80b12396ab88d2ed150928e7399cafd7d0f57070feaaa41593a06bcef0574ad62a2cc793525fdb4084f6a5a14db33ca5828c89e031f9a125c

                                                                                                                                              • memory/240-525-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/400-656-0x0000000140000000-0x000000014013C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.2MB

                                                                                                                                              • memory/836-225-0x0000000140000000-0x000000014018E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/836-239-0x0000000140000000-0x000000014018E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/948-500-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/948-506-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1040-330-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1040-347-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1088-549-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1088-536-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1104-366-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1104-387-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1232-605-0x0000000010000000-0x000000001017F000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1232-644-0x0000000010000000-0x000000001017F000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1284-489-0x0000000003CC0000-0x0000000003D7A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                744KB

                                                                                                                                              • memory/1284-501-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1356-688-0x0000000140000000-0x000000014018E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/1372-640-0x0000000100000000-0x0000000100175000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1612-588-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1616-555-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1616-548-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1624-129-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.3MB

                                                                                                                                              • memory/1624-343-0x0000000100000000-0x0000000100542000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.3MB

                                                                                                                                              • memory/1656-409-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1656-392-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/1708-973-0x0000000001980000-0x0000000001998000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                96KB

                                                                                                                                              • memory/1708-975-0x000000001AD60000-0x000000001AD7A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                104KB

                                                                                                                                              • memory/1708-974-0x0000000001B60000-0x0000000001B6E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/1708-976-0x000000001AD80000-0x000000001AD9E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                120KB

                                                                                                                                              • memory/1796-115-0x000000002E000000-0x000000002E195000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/1796-329-0x000000002E000000-0x000000002E195000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/1796-108-0x00000000002B0000-0x0000000000317000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                              • memory/1884-82-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.2MB

                                                                                                                                              • memory/1884-292-0x0000000140000000-0x0000000140237000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.2MB

                                                                                                                                              • memory/1884-80-0x00000000001F0000-0x0000000000250000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/1884-74-0x00000000001F0000-0x0000000000250000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2024-954-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/2024-949-0x000000001A950000-0x000000001A95E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/2024-950-0x000000001ACB0000-0x000000001ACBC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/2024-955-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/2024-951-0x000000001ACC0000-0x000000001AD08000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                288KB

                                                                                                                                              • memory/2024-952-0x000000001AD10000-0x000000001AD26000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                88KB

                                                                                                                                              • memory/2032-404-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2088-344-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2088-367-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2236-118-0x0000000140000000-0x00000001401AA000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.7MB

                                                                                                                                              • memory/2236-103-0x0000000140000000-0x00000001401AA000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.7MB

                                                                                                                                              • memory/2236-101-0x00000000008E0000-0x0000000000940000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2236-95-0x00000000008E0000-0x0000000000940000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2284-697-0x0000000140000000-0x0000000140196000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/2308-563-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2308-574-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2328-934-0x0000000000CA0000-0x0000000000CAE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/2328-935-0x00000000018C0000-0x00000000018CC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/2328-936-0x0000000001970000-0x00000000019B8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                288KB

                                                                                                                                              • memory/2328-937-0x00000000019C0000-0x00000000019D6000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                88KB

                                                                                                                                              • memory/2408-620-0x0000000010000000-0x0000000010187000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2408-332-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2408-311-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2408-647-0x0000000010000000-0x0000000010187000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2432-58-0x00000000005E0000-0x0000000000640000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2432-64-0x00000000005E0000-0x0000000000640000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2432-274-0x0000000140000000-0x000000014018E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/2432-66-0x0000000140000000-0x000000014018E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/2440-454-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2440-439-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2460-433-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2492-309-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2492-296-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2528-488-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2560-450-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2560-459-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2584-477-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2624-178-0x0000000140000000-0x000000014017D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2624-33-0x0000000140000000-0x000000014017D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2624-35-0x0000000000A70000-0x0000000000AD0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2624-41-0x0000000000A70000-0x0000000000AD0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2672-45-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2672-46-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                              • memory/2672-51-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                              • memory/2672-226-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2680-90-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                              • memory/2680-310-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                30.1MB

                                                                                                                                              • memory/2680-93-0x000000002E000000-0x000000002FE1E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                30.1MB

                                                                                                                                              • memory/2696-584-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2756-429-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2804-1-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                              • memory/2804-6-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                              • memory/2804-7-0x0000000000230000-0x0000000000297000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                412KB

                                                                                                                                              • memory/2804-19-0x0000000000400000-0x0000000000554000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.3MB

                                                                                                                                              • memory/2804-0-0x0000000000400000-0x0000000000554000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.3MB

                                                                                                                                              • memory/2856-994-0x000000001B250000-0x000000001B26E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                120KB

                                                                                                                                              • memory/2856-989-0x0000000001A00000-0x0000000001A0C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/2856-988-0x00000000019A0000-0x00000000019B8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                96KB

                                                                                                                                              • memory/2856-993-0x000000001AD60000-0x000000001AD7A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                104KB

                                                                                                                                              • memory/2856-992-0x000000001AD10000-0x000000001AD58000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                288KB

                                                                                                                                              • memory/2856-999-0x000000001B6B0000-0x000000001B6C8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                96KB

                                                                                                                                              • memory/2856-991-0x000000001ACF0000-0x000000001AD06000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                88KB

                                                                                                                                              • memory/2856-990-0x000000001ACE0000-0x000000001ACEE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/2888-276-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2888-298-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2924-246-0x0000000140000000-0x000000014018E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/2924-236-0x0000000140000000-0x000000014018E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/2924-704-0x0000000100000000-0x0000000100192000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                              • memory/2980-27-0x0000000000910000-0x0000000000970000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2980-21-0x0000000000910000-0x0000000000970000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                384KB

                                                                                                                                              • memory/2980-20-0x0000000100000000-0x0000000100184000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2980-107-0x0000000100000000-0x0000000100184000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2996-537-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2996-524-0x0000000000400000-0x0000000000588000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.5MB

                                                                                                                                              • memory/2996-663-0x0000000140000000-0x0000000140192000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.6MB