Analysis
-
max time kernel
127s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe
Resource
win7-20240221-en
General
-
Target
d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe
-
Size
1.8MB
-
MD5
6eb1e36ef99c3438b3bf5099066a01e3
-
SHA1
f41efcb6cd0f29d2a92273b68b479ff76900d250
-
SHA256
d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff
-
SHA512
eb629ff47d5798e9e61baf195717bf2bf6e9955d64395cbaf0ebd2d138ac1ebf8dff1a933b8eaeab4626d36fddb87be9a731c6033faf6b8cdac570ef0b8c63e7
-
SSDEEP
49152:bKJ0WR7AFPyyiSruXKpk3WFDL9zxnStgDUYmvFur31yAipQCtXxc0H:bKlBAFPydSS6W6X9ln9U7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
alg.exeaspnet_state.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRecvr.exeehsched.exeelevation_service.exeIEEtwCollector.exedllhost.exemaintenanceservice.exeOSE.EXEOSPPSVC.EXEmscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemsdtc.exemsiexec.exeperfhost.exelocator.exesnmptrap.exevds.exevssvc.exewbengine.exeWmiApSrv.exewmpnetwk.exeSearchIndexer.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid process 468 2612 alg.exe 644 aspnet_state.exe 2572 mscorsvw.exe 2756 mscorsvw.exe 1100 mscorsvw.exe 896 mscorsvw.exe 2312 ehRecvr.exe 2316 ehsched.exe 1480 elevation_service.exe 2932 IEEtwCollector.exe 2400 dllhost.exe 3040 maintenanceservice.exe 2700 OSE.EXE 2736 OSPPSVC.EXE 2160 mscorsvw.exe 2184 mscorsvw.exe 1688 mscorsvw.exe 2716 mscorsvw.exe 2512 mscorsvw.exe 2908 mscorsvw.exe 2992 mscorsvw.exe 1524 mscorsvw.exe 1564 mscorsvw.exe 1432 mscorsvw.exe 2488 mscorsvw.exe 2056 mscorsvw.exe 2740 mscorsvw.exe 2528 mscorsvw.exe 2512 mscorsvw.exe 2852 mscorsvw.exe 1748 mscorsvw.exe 776 mscorsvw.exe 1792 mscorsvw.exe 2040 mscorsvw.exe 2144 mscorsvw.exe 2900 mscorsvw.exe 1512 mscorsvw.exe 2340 mscorsvw.exe 1368 mscorsvw.exe 2524 msdtc.exe 2396 msiexec.exe 2792 perfhost.exe 864 locator.exe 1936 snmptrap.exe 1472 vds.exe 324 vssvc.exe 2012 wbengine.exe 2316 WmiApSrv.exe 1640 wmpnetwk.exe 676 SearchIndexer.exe 2436 mscorsvw.exe 1464 mscorsvw.exe 2812 mscorsvw.exe 1272 mscorsvw.exe 2960 mscorsvw.exe 2544 mscorsvw.exe 308 mscorsvw.exe 1704 mscorsvw.exe 2064 mscorsvw.exe 1964 mscorsvw.exe 2168 mscorsvw.exe 2688 mscorsvw.exe 840 mscorsvw.exe -
Loads dropped DLL 53 IoCs
Processes:
msiexec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid process 468 468 468 468 468 468 468 468 2396 msiexec.exe 468 468 468 468 468 756 2960 mscorsvw.exe 2960 mscorsvw.exe 308 mscorsvw.exe 308 mscorsvw.exe 2064 mscorsvw.exe 2064 mscorsvw.exe 2168 mscorsvw.exe 2168 mscorsvw.exe 840 mscorsvw.exe 840 mscorsvw.exe 2436 mscorsvw.exe 2436 mscorsvw.exe 2560 mscorsvw.exe 2560 mscorsvw.exe 2576 mscorsvw.exe 2576 mscorsvw.exe 1148 mscorsvw.exe 1148 mscorsvw.exe 2032 mscorsvw.exe 2032 mscorsvw.exe 1672 mscorsvw.exe 1672 mscorsvw.exe 1712 mscorsvw.exe 1712 mscorsvw.exe 2960 mscorsvw.exe 2960 mscorsvw.exe 2940 mscorsvw.exe 2940 mscorsvw.exe 1756 mscorsvw.exe 1756 mscorsvw.exe 2544 mscorsvw.exe 2544 mscorsvw.exe 2256 mscorsvw.exe 2256 mscorsvw.exe 2108 mscorsvw.exe 2108 mscorsvw.exe 1844 mscorsvw.exe 1844 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 21 IoCs
Processes:
alg.exed414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exeaspnet_state.exeSearchProtocolHost.exemsdtc.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b1250fd8ae4ef42b.bin alg.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Windows\system32\msiexec.exe aspnet_state.exe File opened for modification C:\Windows\system32\locator.exe aspnet_state.exe File opened for modification C:\Windows\system32\vssvc.exe aspnet_state.exe File opened for modification C:\Windows\System32\alg.exe d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Windows\system32\dllhost.exe d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Windows\SysWow64\perfhost.exe aspnet_state.exe File opened for modification C:\Windows\system32\wbengine.exe aspnet_state.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe aspnet_state.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\fxssvc.exe d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\SearchIndexer.exe aspnet_state.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe File opened for modification C:\Windows\System32\msdtc.exe aspnet_state.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\snmptrap.exe aspnet_state.exe File opened for modification C:\Windows\System32\vds.exe aspnet_state.exe -
Drops file in Program Files directory 64 IoCs
Processes:
aspnet_state.exealg.exed414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe aspnet_state.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM93E6.tmp\goopdateres_ja.dll d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM93E6.tmp\goopdateres_en.dll d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe aspnet_state.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM93E6.tmp\goopdateres_ur.dll d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe aspnet_state.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUT93E7.tmp d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM93E6.tmp\goopdateres_ta.dll d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM93E6.tmp\goopdateres_no.dll d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe alg.exe File created C:\Program Files (x86)\Google\Temp\GUM93E6.tmp\goopdateres_en-GB.dll d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{D9005A2B-BC2A-4153-8911-AE3B3F543790}\chrome_installer.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUM93E6.tmp\goopdateres_fr.dll d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe -
Drops file in Windows directory 64 IoCs
Processes:
mscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeaspnet_state.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exed414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exealg.exemscorsvw.exemscorsvw.exedescription ioc process File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3D10.tmp\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3F42.tmp\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP29EE.tmp\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index143.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2BB2.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP387E.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe aspnet_state.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3044.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4DF1.tmp\ehiVidCtl.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13f.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index143.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index133.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP36AA.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index144.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP319B.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe aspnet_state.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3312.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mscorsvw.exemscorsvw.exemscorsvw.exeSearchProtocolHost.exemscorsvw.exeehRec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeSearchFilterHost.exemscorsvw.exeehRecvr.exewmpnetwk.exemscorsvw.exeSearchIndexer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b03a8678f0adda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-107 = "Lighthouse" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-116 = "Kalimba" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" ehRecvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{2A6C735E-CD25-45DA-987D-EFAAF8A72559} wmpnetwk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE ehRec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ehRec.exeaspnet_state.exepid process 2772 ehRec.exe 644 aspnet_state.exe 644 aspnet_state.exe 644 aspnet_state.exe 644 aspnet_state.exe 644 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exemscorsvw.exemscorsvw.exeEhTray.exeehRec.exealg.exeaspnet_state.exemsiexec.exevssvc.exewbengine.exeSearchIndexer.exewmpnetwk.exedescription pid process Token: SeTakeOwnershipPrivilege 2860 d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: 33 1756 EhTray.exe Token: SeIncBasePriorityPrivilege 1756 EhTray.exe Token: SeDebugPrivilege 2772 ehRec.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: 33 1756 EhTray.exe Token: SeIncBasePriorityPrivilege 1756 EhTray.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeDebugPrivilege 2612 alg.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeTakeOwnershipPrivilege 644 aspnet_state.exe Token: SeRestorePrivilege 2396 msiexec.exe Token: SeTakeOwnershipPrivilege 2396 msiexec.exe Token: SeSecurityPrivilege 2396 msiexec.exe Token: SeBackupPrivilege 324 vssvc.exe Token: SeRestorePrivilege 324 vssvc.exe Token: SeAuditPrivilege 324 vssvc.exe Token: SeBackupPrivilege 2012 wbengine.exe Token: SeRestorePrivilege 2012 wbengine.exe Token: SeSecurityPrivilege 2012 wbengine.exe Token: SeDebugPrivilege 644 aspnet_state.exe Token: SeManageVolumePrivilege 676 SearchIndexer.exe Token: 33 676 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 676 SearchIndexer.exe Token: 33 1640 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 1640 wmpnetwk.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 896 mscorsvw.exe Token: SeShutdownPrivilege 1100 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EhTray.exepid process 1756 EhTray.exe 1756 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
EhTray.exepid process 1756 EhTray.exe 1756 EhTray.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
SearchProtocolHost.exeSearchProtocolHost.exepid process 2808 SearchProtocolHost.exe 2808 SearchProtocolHost.exe 2808 SearchProtocolHost.exe 2808 SearchProtocolHost.exe 2808 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe 2244 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
mscorsvw.exedescription pid process target process PID 1100 wrote to memory of 2160 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2160 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2160 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2160 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2184 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2184 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2184 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2184 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1688 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1688 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1688 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1688 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2716 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2716 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2716 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2716 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2512 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2512 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2512 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2512 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2908 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2908 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2908 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2908 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2992 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2992 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2992 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2992 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1524 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1524 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1524 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1524 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1564 1100 mscorsvw.exe WMIADAP.EXE PID 1100 wrote to memory of 1564 1100 mscorsvw.exe WMIADAP.EXE PID 1100 wrote to memory of 1564 1100 mscorsvw.exe WMIADAP.EXE PID 1100 wrote to memory of 1564 1100 mscorsvw.exe WMIADAP.EXE PID 1100 wrote to memory of 1432 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1432 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1432 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 1432 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2488 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2488 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2488 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2488 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2056 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2056 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2056 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2056 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2740 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2740 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2740 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2740 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2528 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2528 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2528 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2528 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2512 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2512 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2512 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2512 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2852 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2852 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2852 1100 mscorsvw.exe mscorsvw.exe PID 1100 wrote to memory of 2852 1100 mscorsvw.exe mscorsvw.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe"C:\Users\Admin\AppData\Local\Temp\d414cb504bca971a46d18ddf65cc5baba8358bed933475dddb0660aefd37edff.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2572
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2756
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 248 -NGENProcess 254 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 24c -NGENProcess 260 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 240 -NGENProcess 254 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 264 -NGENProcess 248 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 248 -NGENProcess 244 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 268 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 270 -NGENProcess 240 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 244 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 244 -NGENProcess 248 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 24c -NGENProcess 278 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 280 -NGENProcess 270 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 248 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 278 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 28c -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 28c -NGENProcess 288 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 244 -NGENProcess 270 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 298 -NGENProcess 284 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 288 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 244 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 280 -NGENProcess 288 -Pipe 290 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a8 -NGENProcess 298 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 290 -NGENProcess 214 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 250 -NGENProcess 248 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 224 -NGENProcess 26c -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2812 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 24c -NGENProcess 290 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 1d0 -NGENProcess 23c -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 23c -NGENProcess 224 -Pipe 1c4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 244 -NGENProcess 1d0 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1d0 -NGENProcess 248 -Pipe 290 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 2ac -NGENProcess 280 -Pipe 1f8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 280 -NGENProcess 244 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 298 -NGENProcess 248 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2168 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 248 -NGENProcess 2ac -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 29c -NGENProcess 244 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:840 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 244 -NGENProcess 298 -Pipe 288 -Comment "NGen Worker Process"2⤵PID:836
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 270 -NGENProcess 2ac -Pipe 280 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2ac -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"2⤵PID:2080
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2b4 -NGENProcess 298 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 298 -NGENProcess 270 -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:2168
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2bc -NGENProcess 29c -Pipe 244 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 29c -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:2068
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 29c -NGENProcess 2bc -Pipe 270 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1148 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 298 -Pipe 2b4 -Comment "NGen Worker Process"2⤵PID:2044
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2cc -NGENProcess 2a4 -Pipe 224 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2a4 -NGENProcess 29c -Pipe 2ac -Comment "NGen Worker Process"2⤵PID:2136
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2d4 -NGENProcess 298 -Pipe 2c4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1672 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 298 -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:1464
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2dc -NGENProcess 29c -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1712 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 29c -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:1148
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:1816
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 298 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2d4 -NGENProcess 2e4 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:2328
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 29c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1756 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2dc -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"2⤵PID:2556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2fc -NGENProcess 2e4 -Pipe 2cc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2e4 -NGENProcess 2f4 -Pipe 2f8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 304 -NGENProcess 2c8 -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:1556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2c8 -NGENProcess 308 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:2028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 1d8 -NGENProcess 2d4 -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:1928
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 310 -NGENProcess 2e4 -Pipe 300 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2256 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 2c8 -NGENProcess 318 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 318 -NGENProcess 308 -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:980
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 310 -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:2080
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2f4 -Pipe 304 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 318 -NGENProcess 328 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:2764
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 314 -NGENProcess 2f4 -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:2372
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 32c -NGENProcess 320 -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:2324
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 328 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:2024
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2f4 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:2960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 320 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:2336
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 330 -NGENProcess 340 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:1960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 318 -NGENProcess 320 -Pipe 314 -Comment "NGen Worker Process"2⤵PID:1760
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 344 -NGENProcess 338 -Pipe 310 -Comment "NGen Worker Process"2⤵PID:1844
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 340 -Pipe 32c -Comment "NGen Worker Process"2⤵PID:1460
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 320 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:1908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 338 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:2616
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 340 -Pipe 330 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 320 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:2864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 350 -NGENProcess 360 -Pipe 354 -Comment "NGen Worker Process"2⤵PID:2900
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 338 -NGENProcess 364 -Pipe 35c -Comment "NGen Worker Process"2⤵PID:2764
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 338 -NGENProcess 344 -Pipe 360 -Comment "NGen Worker Process"2⤵PID:2472
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 2f4 -NGENProcess 364 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:2328
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 36c -NGENProcess 320 -Pipe 358 -Comment "NGen Worker Process"2⤵PID:1680
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 344 -Pipe 368 -Comment "NGen Worker Process"2⤵PID:804
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 344 -NGENProcess 338 -Pipe 378 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 34c -NGENProcess 374 -Pipe 348 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2008 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 37c -NGENProcess 36c -Pipe 350 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 338 -Pipe 364 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 380 -NGENProcess 384 -Pipe 34c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:292 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 2f4 -NGENProcess 338 -Pipe 370 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 390 -NGENProcess 37c -Pipe 38c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2136 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 380 -NGENProcess 394 -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:2644
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 37c -Pipe 344 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2784 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 398 -NGENProcess 390 -Pipe 338 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2168 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 380 -NGENProcess 3a0 -Pipe 384 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2556 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 388 -NGENProcess 390 -Pipe 36c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1712 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 388 -NGENProcess 380 -Pipe 398 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 380 -NGENProcess 394 -Pipe 390 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2904 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 3ac -NGENProcess 39c -Pipe 37c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2908 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 39c -NGENProcess 388 -Pipe 374 -Comment "NGen Worker Process"2⤵PID:1060
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3b4 -NGENProcess 394 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:1680
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 394 -NGENProcess 3ac -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:580
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3bc -NGENProcess 388 -Pipe 380 -Comment "NGen Worker Process"2⤵PID:2068
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 3b8 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:1256
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 394 -NGENProcess 3c8 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:2300
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 39c -NGENProcess 3b8 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:1784
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3cc -NGENProcess 3c0 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:1272
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 210 -NGENProcess 394 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:1760
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 210 -InterruptEvent 388 -NGENProcess 3cc -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:3020
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 3ac -NGENProcess 3b4 -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:1712
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 210 -NGENProcess 3d8 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:2960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 208 -NGENProcess 394 -Pipe 210 -Comment "NGen Worker Process"2⤵PID:2632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 394 -NGENProcess 3dc -Pipe 3e0 -Comment "NGen Worker Process"2⤵PID:1368
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b8 -NGENProcess 3d0 -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:1984
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3e4 -NGENProcess 39c -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:1832
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3dc -Pipe 3d8 -Comment "NGen Worker Process"2⤵PID:2668
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3e8 -NGENProcess 3e4 -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:2784
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3dc -NGENProcess 3b4 -Pipe 208 -Comment "NGen Worker Process"2⤵PID:1400
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3f4 -NGENProcess 3b8 -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:2908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 3e4 -Pipe 3f0 -Comment "NGen Worker Process"2⤵PID:2496
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3dc -NGENProcess 404 -Pipe 3f4 -Comment "NGen Worker Process"2⤵PID:1888
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 394 -NGENProcess 3e4 -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:956
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 404 -NGENProcess 3fc -Pipe 394 -Comment "NGen Worker Process"2⤵PID:2552
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 408 -NGENProcess 3e4 -Pipe 39c -Comment "NGen Worker Process"2⤵PID:1564
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3b4 -NGENProcess 414 -Pipe 404 -Comment "NGen Worker Process"2⤵PID:2840
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3e8 -NGENProcess 3e4 -Pipe 40c -Comment "NGen Worker Process"2⤵PID:1792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 410 -NGENProcess 41c -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:1908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3b8 -NGENProcess 3e4 -Pipe 3f8 -Comment "NGen Worker Process"2⤵PID:2812
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 418 -NGENProcess 424 -Pipe 410 -Comment "NGen Worker Process"2⤵PID:980
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 3fc -NGENProcess 3e4 -Pipe 3dc -Comment "NGen Worker Process"2⤵PID:2528
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3e4 -NGENProcess 3e8 -Pipe 42c -Comment "NGen Worker Process"2⤵PID:1904
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 3e4 -NGENProcess 3fc -Pipe 428 -Comment "NGen Worker Process"2⤵PID:2372
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3fc -NGENProcess 3b8 -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:2576
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 434 -NGENProcess 420 -Pipe 424 -Comment "NGen Worker Process"2⤵PID:1492
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 420 -NGENProcess 3e4 -Pipe 408 -Comment "NGen Worker Process"2⤵PID:1908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 43c -NGENProcess 430 -Pipe 420 -Comment "NGen Worker Process"2⤵PID:572
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 444 -NGENProcess 3e4 -Pipe 414 -Comment "NGen Worker Process"2⤵PID:980
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 41c -NGENProcess 438 -Pipe 434 -Comment "NGen Worker Process"2⤵PID:2528
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 43c -NGENProcess 44c -Pipe 444 -Comment "NGen Worker Process"2⤵PID:1576
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 418 -NGENProcess 438 -Pipe 440 -Comment "NGen Worker Process"2⤵PID:1816
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 448 -NGENProcess 454 -Pipe 43c -Comment "NGen Worker Process"2⤵PID:1272
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 430 -NGENProcess 438 -Pipe 3fc -Comment "NGen Worker Process"2⤵PID:804
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 458 -NGENProcess 418 -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:1844
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 448 -NGENProcess 45c -Pipe 430 -Comment "NGen Worker Process"2⤵PID:2208
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 45c -NGENProcess 448 -Pipe 41c -Comment "NGen Worker Process"2⤵PID:1236
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 448 -NGENProcess 418 -Pipe 458 -Comment "NGen Worker Process"2⤵PID:2200
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 464 -NGENProcess 44c -Pipe 1c8 -Comment "NGen Worker Process"2⤵PID:2108
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 468 -NGENProcess 460 -Pipe 454 -Comment "NGen Worker Process"2⤵PID:1540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 46c -NGENProcess 418 -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:2064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 470 -NGENProcess 44c -Pipe 438 -Comment "NGen Worker Process"2⤵PID:2128
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 468 -NGENProcess 478 -Pipe 46c -Comment "NGen Worker Process"2⤵PID:2372
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 45c -NGENProcess 44c -Pipe 448 -Comment "NGen Worker Process"2⤵PID:2032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 47c -NGENProcess 470 -Pipe 450 -Comment "NGen Worker Process"2⤵PID:588
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 480 -NGENProcess 478 -Pipe 464 -Comment "NGen Worker Process"2⤵PID:2644
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 45c -NGENProcess 488 -Pipe 47c -Comment "NGen Worker Process"2⤵PID:1632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 488 -NGENProcess 44c -Pipe 478 -Comment "NGen Worker Process"2⤵PID:1620
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 48c -NGENProcess 480 -Pipe 418 -Comment "NGen Worker Process"2⤵PID:1332
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 490 -NGENProcess 460 -Pipe 468 -Comment "NGen Worker Process"2⤵PID:2712
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 460 -NGENProcess 488 -Pipe 44c -Comment "NGen Worker Process"2⤵PID:2888
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 498 -NGENProcess 480 -Pipe 474 -Comment "NGen Worker Process"2⤵PID:3020
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 490 -NGENProcess 4a0 -Pipe 460 -Comment "NGen Worker Process"2⤵PID:580
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 45c -NGENProcess 480 -Pipe 48c -Comment "NGen Worker Process"2⤵PID:1632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 4a4 -NGENProcess 498 -Pipe 470 -Comment "NGen Worker Process"2⤵PID:1960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 4a8 -NGENProcess 4a0 -Pipe 484 -Comment "NGen Worker Process"2⤵PID:1576
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4ac -NGENProcess 480 -Pipe 494 -Comment "NGen Worker Process"2⤵PID:2140
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4b0 -NGENProcess 498 -Pipe 470 -Comment "NGen Worker Process"2⤵PID:1236
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4b4 -NGENProcess 4a0 -Pipe 490 -Comment "NGen Worker Process"2⤵PID:2456
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4b8 -NGENProcess 480 -Pipe 45c -Comment "NGen Worker Process"2⤵PID:2096
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4b8 -NGENProcess 4b4 -Pipe 498 -Comment "NGen Worker Process"2⤵PID:2368
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 4a4 -NGENProcess 480 -Pipe 4a8 -Comment "NGen Worker Process"2⤵PID:2832
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:896 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2340 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 1c4 -NGENProcess 1c8 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1368
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2312
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:2316
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1756
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1480
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:2932
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
PID:2400
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3040
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2700
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:2736
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1564
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2524
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:2792
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:864
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1936
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1472
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:324
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2316
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:676 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:2808 -
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 596 600 608 65536 6042⤵
- Modifies data under HKEY_USERS
PID:1544 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
1.6MB
MD518aa30c49605e2d710b4ed09d5017b71
SHA1ad861e8800638eb3f9e1536f20f6da8c6fb6c922
SHA256c7f4671cb434a036627d98690c3eda6e1ceb4d6ce76d4096b77df0119a570695
SHA512bb0442368dbcfb8c0d1dd4603eeb13889e63dd6744798b21d82c380c93df42b79df0c1e767ae2b17b71b60be1dda72e7c7dc57b4e1af43424d59481109417451
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXEFilesize
30.1MB
MD5bc4019ebabc5b947c9e908f7f5e7bad7
SHA1a92fbd024078189051147d8db86386074b889635
SHA2567490342299e7d9369b19921fb431a961230f6a7f688afa6451a01effc780cc1b
SHA51279ae7fdb3033aae4b372f3062d495e1275bef7d57008390013c28689a0731cecd1c8c2392fd7cb1295f6eef60566e6dbd616471d4d4689297b4fec58a6e01055
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
1.6MB
MD53629f9745f672db31c49911d94da3802
SHA1076a14bdf5c5f926573a0b204ee92ab1e1d7a580
SHA2563037dfc850cb082914fe5038f3a3565744fe819b21d57b04fbc836c4649d7b57
SHA512c31e5ce29e7865a8b40ce71561b9d2e1c6a9dc4699ba6ab7726531191913bd09b3b41e703c996e873d06d3d9feb91711246c92d547110fed3b0b3d42c86c9e48
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEFilesize
5.2MB
MD5680fb60a74ed472f5bf2f7da95eb0499
SHA19514d893d711b913e55ed6970cbd6363e0cd8dfc
SHA25656d41de14a92f69d1f3bf3bfe2c75239fb0727e73ee15130694ff10b29c04721
SHA512073636a501fe17cf689ff79e6fb2604f1b8c75416cf960280bd133342e9ba251349bc50d3cdbf7951b40367cb2654ff6c65e7af2f402f2dba967bd4e0d6adbe9
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exeFilesize
2.1MB
MD5c4a28aaa7f3a35a0fef45d45738fad2c
SHA153bc453f7a549ea20d9ba9f959db70f33ad4b57e
SHA25696245a30c35f4e270b31bf532a1c98cb4cea0b4e4df49450e2c5225252b6db5f
SHA512d9dd390685362482e7b0adbb59b766e269ddb92ab0b46d87b0056ce70c8358375a87408c936ad620d8f3baeb7883ed242351c9e2d2d418c6b4d5edf7289a779e
-
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.logFilesize
1024KB
MD5e4e8bd22f7cb41cb482ed6d096f5454a
SHA1fd9e9fbb155380f3cebd918891f934e7e2b9939f
SHA2564e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7
SHA512a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-msFilesize
24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeFilesize
1.5MB
MD52b5ebf45593a20e32daae6dcbdaa821f
SHA12a6029703f266ce9704b8488e291813123d59c7c
SHA256b9b5a36dd6e5fb0ab5f61793af3193397b7eace0e550ec8ff3787b8c55957b25
SHA51216e7bbdb005da26df09363b5663320379764fce60a962172b4d9c54da3f62df32a771fc36e32ac9dfcc23dc7ad6566c4415bc696f09ddce8ec762a8a5763b6cc
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.logFilesize
872KB
MD526b8f028c2c8367eced7708fb19a5fd4
SHA19519dc27ba1f1a8c00cc54a14523ff7253f58fed
SHA256c7b67b22e278a249e1d4f4b459f597b369c368118ffe0926f270f62aa5d0bb14
SHA5121372b48a1c674605e2468d885c171793661ad42dd29132f7bba39fb949bc29b1f21eb1fa69fc9226a1de491f776cd21958d9065a40169102576a70504f5445f8
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeFilesize
1.5MB
MD542a5abd8286b923e75351c82f12a1837
SHA18a460b7b5b6786fab7dbbf7444f95ddc1472ff61
SHA256cf7aec7a68b6605ee0843c779f0458cfda3ad0a5b39e852874c9975ff5b3a57e
SHA512e4f09e4dfb1b5d9cf32c720318497bbe319d32d58d27b8bd0e7c19e51b9e8c579181ce8971464a7eaee05aaf108069bba7808fa1e47a3a9a7d609baf140e3f83
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeFilesize
1.5MB
MD5502e6de36876b31e4fdff61231681376
SHA10a577071b953d2ce8d691009045defc22611be5a
SHA2563437783f1753ea4c23fb9b8743d8f06aeef754c4f6b09561da1dae4b9949bc28
SHA51200ecc1d0f56d73315420b776fb1792ba1dd511234863cdd3443b3d29dd8dfc390e623935f772b106e777d0a6f2bf9f30dc1139e5216973c8bbacfe517a664d91
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.logFilesize
1003KB
MD5919a20702f4f0eb399a1b542e2c2c89c
SHA10add5d70e72416de5146f29e628ec58c609b1e24
SHA2569a8b787f06f94064eabf07163ef43bb1c6c013e447d4d77d01d4dffdfefe515b
SHA5122dca833ac3ab9db81ad750b82702c2e70513174f9665621a48f8b19d7f0daa4a25ddced1574c896195c76bed917c38471b6b80ee4b89ce0add4d83d63ffa5246
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeFilesize
1.5MB
MD546f28d1192a2650044d79b16af3c4733
SHA1a37823d17c860b3780648716ef30ec91710932f6
SHA25678cea631ca1745086699a1d24163ce3ef1fdea9f26ecd33961693a70886cc05e
SHA5121e48b2f739afb354a254053404525b2049a5606e572aa1fe56b298b4ff74e782c6b33bd76884e51de87639af75d037b78cf03a8f3a96422130086db32d435d4f
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.logFilesize
8KB
MD576ab567dd215af03f3f3a52252aa5a3b
SHA13905eb93a66a7603748e30df7cfe0b0fbd20d37a
SHA2563cb3713fd9059454d816fd8d7a7522b60ebb4c7b680827f26cedf40122334fc4
SHA512f9f0d73726849a93dc19706d62d7fdc1fc963bb770bc4745fdfe34fc3717ab3fb9b5e4865ba12d25c5c06739d07e1065b389669b07780a4cdcabb74c2cad18f6
-
C:\Windows\SysWOW64\perfhost.exeFilesize
1.4MB
MD50166c95a50e12194cbbc1ae5fe0c0c7c
SHA15e560cfe047582ad55cb1863e1fc48c591a9bc3c
SHA256da129ba375d77d760fc1970c85b928f090141c174bf5403edd3a2f46bff39e54
SHA512b9944e3986703228d5a9bb9ca7389db9a6b03a5db71701714fb587f3844e39ffd8f362fa4238b5209a06163fecbfec965de31d3c1fd55dc8fa1891d91475f9a3
-
C:\Windows\System32\alg.exeFilesize
1.5MB
MD5580291d3c6e079acab7cb95fd794cf27
SHA1c3d01b57c13ba60d6c88bd0e55cd78a2a3a58caf
SHA2564f9918cb2a63432248a154f2f05122587dbf0ef3c2a52fde3bd9ff47c1cba436
SHA512920d30ff3d7692d3c5037dd11e5112a776b5ba187abd5795d69f17505341fc80fb8f68f17e66d6a2e0f55dc711b2c10d4082b5cf7f7399f20aad1d4526f71f3f
-
C:\Windows\System32\dllhost.exeFilesize
1.4MB
MD5d536357339f4462db318df6abaf572f3
SHA17ae277a06326b989d71e241ed2de6bf65f08c71c
SHA25673c2bb4fb73c72cfe3f965a6f6395b28c06f83df6ba16a6eb653af6de34f4298
SHA512057e6612a88f22342424b9817ef285cda75436cd017cfea0e06e2ce7ad78d40cce87cfcf03ccab1fdf9058db44a0ad3ca070a74d461123c9d3207d2c7dde5728
-
C:\Windows\System32\ieetwcollector.exeFilesize
1.5MB
MD5a75cb94441fab43b9e5ea615fe3195d4
SHA19d40eb00ba4039c03e562e3de0bbb42505391dd2
SHA256fcf159e7d45569deedd124072f93cddcc65f995638c20d7a373f439db57661ca
SHA512e517bcebd64023099a5f7823eac25770f20b6d2e9ac7f05577d5eb783101b27cf60cc005a1bfbaae474b3731c1336bc7730401f6b7649cce7ada889abe93925c
-
C:\Windows\System32\msiexec.exeFilesize
1.5MB
MD5275703e0916b0dc22ab043b5a0b28c66
SHA16b444bb936ea95aed8fa33ec2bd5d966db098c42
SHA256d24be425eea6cfbf230ece0f69ca85a702388cb74f540e1191b77f1758099d30
SHA512caf2467fabef3984879ca6ddc6a6c363cb50c21d24e7d8243f4bfe97842e3d64f60fc22a3fd9a44cb4c785729cb17c584e1d3f7a6076dbe76999c11e06909334
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dllFilesize
834KB
MD5c76656b09bb7df6bd2ac1a6177a0027c
SHA10c296994a249e8649b19be84dce27c9ddafef3e0
SHA256a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
SHA5128390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dllFilesize
797KB
MD5aeb0b6e6c5d32d1ada231285ff2ae881
SHA11f04a1c059503896336406aed1dc93340e90b742
SHA2564c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
SHA512e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dllFilesize
163KB
MD5e88828b5a35063aa16c68ffb8322215d
SHA18225660ba3a9f528cf6ac32038ae3e0ec98d2331
SHA25699facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
SHA512e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dllFilesize
1.3MB
MD5006498313e139299a5383f0892c954b9
SHA17b3aa10930da9f29272154e2674b86876957ce3a
SHA256489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
SHA5126a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dllFilesize
148KB
MD5ac901cf97363425059a50d1398e3454b
SHA12f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA5126a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dllFilesize
34KB
MD5c26b034a8d6ab845b41ed6e8a8d6001d
SHA13a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dllFilesize
109KB
MD50fd0f978e977a4122b64ae8f8541de54
SHA1153d3390416fdeba1b150816cbbf968e355dc64f
SHA256211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\16b1230b3e6d3793e4fd6e629b3f6d5b\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dllFilesize
83KB
MD5e7f71a431b8a7f945095278f551bf55e
SHA1943d778e4365c1050c1bff1afff418ed1802bbd4
SHA25607e2d226610e9a942af0525013e6264d443027e4925871acef410e9c5e9d00c3
SHA5125f23bc05098cc5480bb19c9aacc6ca697712775f87016fcf06fb317a8fc9748373c94ea8ef1756af963d9c23c4af56f2df15464c044567bf308e77c5429eeee0
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dllFilesize
158KB
MD5a763a9348ab4ee3bd593bb17d854e51b
SHA14d0c97ba6877e2f9ab32fe1316936a4f2e0ff2c9
SHA256b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
SHA512e8d3896d4bd788d3ed923e0c9d3ba19fe9fc507060e2e5e8e410964f4c9d7331928324a79336079ccc84c050d8f0acfb03126a2e3622daac3846b0bfd028f602
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dllFilesize
41KB
MD53c269caf88ccaf71660d8dc6c56f4873
SHA1f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dllFilesize
296KB
MD57687295a6e19cc656b077e6a61629d4e
SHA1fa1025de5cffb56a3d1f8cae9d09b7171b33326e
SHA256ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
SHA51219de95fd90bc6f091e785074ee71dc15d450d65fbdea933e26650fb9c747d81ae2fca7f5f83192f17451a49a314d264cabea2202c805b6ffab729d381675734c
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dllFilesize
356KB
MD587111e9d98dc79165dfc98a1fb93100b
SHA14f5182e5ce810f6ba3bdb3418ad33c916b6013c8
SHA256971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
SHA512abbb246d620e8a2ab1973dde19ff56ea1c02afa39e889925fe2a1ba43af1ad4ff6eb017e68578ae520109b3e290b3d9054d7537eb2df0ede6e0fbca8519cc104
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4d420aa31d320cdf2e1ce2aefe7bc119\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dllFilesize
143KB
MD56f9f108fa2279e1c28463809d1ade2ae
SHA1f4a84ed2ee86aca38d3eb4cb8447cae3c7120e1d
SHA256bdcf89d2d6f43ae146e1008fceff57d91e78c517a37df09a4d7bb18a935a96c8
SHA5129a21732e365f20811a617d579f63a6879ffa0d727d786ea824c651992d079690a476453a365fa52fcffa722e575ce52087ee3757ad90db3ba308fda6567ace3f
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4e9b71619a217257aeca8a7d5cb0d9fd\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dllFilesize
187KB
MD5ba66e05caddb267dd2ca7127ea129e12
SHA18463ed46403899fcd65399ad56cc66dafe7486f2
SHA256639c904eb5eff4000da0d947c19b85c7a5273855c8b6d7eeff6bbcbf50456469
SHA5128ba65abd92ed2a3b82c8ad5c8417f5a252adb80ca815b220c9905cdbccc2a2d0c1a02075872faa450e81fd0cd507c134e5e5277a3fa85b74f0c7e90215772353
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dllFilesize
157KB
MD57bdf8e0c9aa04b71a52dd964005f4363
SHA1a87e809146d3c70093a189c37f0a96b8bd0ce525
SHA2560406be7235661a62f68bff4c7640b4e241a0c392d548bf242ed08ba0eeaee66b
SHA5124983ebf42241723cf258407c7d2a0773f395c861741f4e98bd7ac86e1ef0a597f89263bb5a986b69ffd43836a5e49d8f03342736b4c3183ea0c58b8099af2051
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dllFilesize
648KB
MD57ebbba07bc6d54efd912bcd78b560b7b
SHA1a6aee1a80ddcdf201301ac29293c62d58bcc941d
SHA256637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
SHA5122139a0d520ed70b72dc76fdd0555185386c9c22de1e1fb7eaac0607b313500c44f856c76ac6e2cd72148ea0b86b10bdd2b0ab7daacfc945cb66a637b8d99cfe8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dllFilesize
1.2MB
MD50637ad2bf6fc5ac1d29e547155bc818c
SHA1a502879466b6dd37eae5881bbb18353f97623852
SHA256868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
SHA5121d18a16ec3b91c3143c4371de305a7ea464d41661752ece65bf1ce19a8342a265c024a740afa6be8baf4d1edfdac6c6fcdad7395c1294342cd1f4388428e52c1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dllFilesize
210KB
MD54f40997b51420653706cb0958086cd2d
SHA10069b956d17ce7d782a0e054995317f2f621b502
SHA2568cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dllFilesize
607KB
MD5e9ca062e4958cc25400c804029a5bf62
SHA11ed4374d0d0f568936fdebe17d9110481d6b3344
SHA256a09436c1df8fcd8ecd1732d6e4e68f32b092e71e0c5d3308b0f3f20abd03d4e0
SHA51243a9ea20d1e636201c0ce7098c198b893465b45f747ed2a002e8dd0bfc7739c28e166d259faf3a0087ae1fe59c74cc8e598f2b283cc7ebc345b6f3b5c388e520
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dllFilesize
53KB
MD5e3a7a2b65afd8ab8b154fdc7897595c3
SHA1b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA5126537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dllFilesize
65KB
MD5da9f9a01a99bd98104b19a95eeef256c
SHA1272071d5bbc0c234bc2f63dfcd5a90f83079bbab
SHA256b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
SHA512dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dllFilesize
28KB
MD5aefc3f3c8e7499bad4d05284e8abd16c
SHA17ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA2564436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA5121d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dllFilesize
329KB
MD5eb09a7062a66a50fe2cb16c4a80561a7
SHA133b4c71ced7644be9802374a4f04c866394daaca
SHA256e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
SHA512c57a4c626c87032ca422df04ce7c3322662a9b0c6c06a46e93f08ca8f431295c9ae802cd79f53cae5de2b39a30bbeb756c966880e874ed44115cf511cc1ff920
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dllFilesize
141KB
MD558cacef7cbc000bb5ddeedc08a598f36
SHA1f8963d4ac1f7b72c2ee4a0a6d45b921f4f88bab7
SHA256124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
SHA5129cf04e365abcdcfcb9c1f927da83a2dfe0791cccb80cd84ed63b03264d1e253060c455ed8664f35aee0a59e8c172f859ba49c67c9eec811a53e656c076c6bf66
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dllFilesize
278KB
MD5d74d434aa70ce827715b5e0ac7eda5be
SHA1b53f3374be4c96af51c78fd873de1360f17c200f
SHA25654701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
SHA512631d09a0ff39ece829f5c23278c2c030e5ff758b285128edb7805682de75b5be1aedd914d2325f79ec98d0103660a39ae1f1a5782f5dad038b143f3774c098df
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\c0c1da325b9e6c58e6b049a4c65acfee\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dllFilesize
180KB
MD5ffa6892fe115d66f4d4be67d045113ac
SHA139056cface5971eb4f0c9790bd4fcf4121d374c6
SHA256893bad07e9c35e87a7195105d77fc2cfebad07573dc9e1946aefbe8496e526c2
SHA5121d07d2545a1644fd916118e96941b7fa5817d0f1d9e4df7045501ff310bfb2c63747654d63f238da5ff51f4a28ed76275fffdd8f2b6c22237950128830dd77ea
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dllFilesize
27KB
MD59c60454398ce4bce7a52cbda4a45d364
SHA1da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dllFilesize
57KB
MD56eaaa1f987d6e1d81badf8665c55a341
SHA1e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA2564b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dllFilesize
130KB
MD52735d2ab103beb0f7c1fbd6971838274
SHA16063646bc072546798bf8bf347425834f2bfad71
SHA256f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dllFilesize
59KB
MD58c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dllFilesize
42KB
MD571d4273e5b77cf01239a5d4f29e064fc
SHA1e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA51241fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dllFilesize
855KB
MD57812b0a90d92b4812d4063b89a970c58
SHA13c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA256897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
SHA512634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dllFilesize
43KB
MD53e72bdd0663c5b2bcd530f74139c83e3
SHA166069bcac0207512b9e07320f4fa5934650677d2
SHA2566a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
SHA512b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
-
C:\Windows\ehome\ehrecvr.exeFilesize
1.2MB
MD5810826f42822e11a83808d14711922f5
SHA12fc7087906ec4f0ef505ea1c68ec8d79c7369588
SHA256fcb335987c73f9b1f00248af18379fd1989e206bf81fda821a434cfb6f5cbc29
SHA5126e7cbc6beca1c35affc13ab0183a794fa0448717ab4380541ee3b83346b17c49cc7e34d4f2460e12176c568bbf5b61b809b1da23c20d760f51f58f311419b5ed
-
C:\Windows\ehome\ehsched.exeFilesize
1.6MB
MD5fcfc8ecc4fc28f6ad5937461ac71a458
SHA1405debe9b3f9a6d54fd2de9280bf2863f99e6bf7
SHA256bfebebbefbd60642b337569a5c664676d4aa0ca69195e89bf627cb107c22437d
SHA5125f2f60e85f2f1face6da8d06076dbaecc3436ee6c56558325f213142d13e55f8a09f07fd12d3d467756b8f40bb4f196f9f213c5dbdabccfba2f3338f946ae4d3
-
C:\Windows\system32\fxssvc.exeFilesize
1.2MB
MD57703fe74466522203e68fefe5adc9a64
SHA11ff2a73685e10827386ff92b54a8c921cb28ba2a
SHA256d22c7a6cccfd8014b4bbe1832a8e0e64ec6f8656ad085c058ee0157e793d4d8d
SHA512ab4950ef0c2a2cd22202974e38d703b222d1f92fffe18ae9688c57b077f3f4c307677c9ebcb58cd876d207dd1a956b0f79f150a7204f3a95d472bfafd612c4e9
-
\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeFilesize
1.5MB
MD5b9da1f7b8eb392020e772dd822230ce2
SHA150b6404f09df1719a70eddec36526a2a513a2a10
SHA2560eb01f81c8d09e34ff983c6acd9dfe0ac19490e5bc3650ea7eea42ef0ddac64e
SHA5128fc8ba58c96cb0653676f8b6ccad4d4a9a2141bfd6094ec6f6207c9c7687113aee83cee2a68892d16dd2f0b2ad2c6c373ae9fbd28a8fd19c48923a0ac37a4d3b
-
\Windows\System32\Locator.exeFilesize
1.4MB
MD5a02069f3713a36d178383f7309bd930e
SHA19c0aa2d266347a84401e1691fcd55a88e167a507
SHA2563829ea61562473bd8fb1597885f19ccac678377e68a80b45f7f76157f548a8e9
SHA512470cc48a96a345a4059e729b491acbb66c5d98aa600a10699ad597c807f9f29838132d23ad7cb5d72295ee8b27355267f1c4329e76e8a4088aaf1ee026b36c0b
-
\Windows\System32\msdtc.exeFilesize
1.6MB
MD5ebdc42891bdda281afe74eb3037b1d4a
SHA1ed413fdca673f6dd92601833aa7745d9365d7fc8
SHA256665db26dabb217c69e478040b412c230a7adb84fc761c73d1a6761395c342e17
SHA5123505d991651499c2d83b0bd62477ea8a94a02e0b604840b13d413a387ca793ebfe60450cf04c00fdeccff288892ae0c2d4c1afa60280b27ba2032fea26cbbfd8
-
memory/324-909-0x0000000100000000-0x0000000100219000-memory.dmpFilesize
2.1MB
-
memory/644-95-0x0000000000980000-0x00000000009E0000-memory.dmpFilesize
384KB
-
memory/644-94-0x0000000140000000-0x000000014017D000-memory.dmpFilesize
1.5MB
-
memory/644-101-0x0000000000980000-0x00000000009E0000-memory.dmpFilesize
384KB
-
memory/644-223-0x0000000140000000-0x000000014017D000-memory.dmpFilesize
1.5MB
-
memory/676-959-0x0000000100000000-0x0000000100123000-memory.dmpFilesize
1.1MB
-
memory/776-732-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/864-1049-0x0000000100000000-0x0000000100175000-memory.dmpFilesize
1.5MB
-
memory/864-887-0x0000000100000000-0x0000000100175000-memory.dmpFilesize
1.5MB
-
memory/896-165-0x0000000000450000-0x00000000004B0000-memory.dmpFilesize
384KB
-
memory/896-159-0x0000000000450000-0x00000000004B0000-memory.dmpFilesize
384KB
-
memory/896-168-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1100-148-0x0000000000330000-0x0000000000397000-memory.dmpFilesize
412KB
-
memory/1100-1052-0x0000000001F70000-0x0000000001F7A000-memory.dmpFilesize
40KB
-
memory/1100-1055-0x0000000001F70000-0x0000000001FFC000-memory.dmpFilesize
560KB
-
memory/1100-143-0x0000000000330000-0x0000000000397000-memory.dmpFilesize
412KB
-
memory/1100-1054-0x0000000001F70000-0x0000000001F8A000-memory.dmpFilesize
104KB
-
memory/1100-142-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1100-1053-0x0000000001F70000-0x0000000001F8E000-memory.dmpFilesize
120KB
-
memory/1100-415-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1368-818-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1368-812-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/1432-636-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1432-623-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1472-899-0x0000000100000000-0x00000001001F4000-memory.dmpFilesize
2.0MB
-
memory/1480-211-0x0000000140000000-0x0000000140237000-memory.dmpFilesize
2.2MB
-
memory/1480-518-0x0000000140000000-0x0000000140237000-memory.dmpFilesize
2.2MB
-
memory/1512-791-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1524-601-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1564-603-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1564-617-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1640-946-0x0000000100000000-0x000000010020A000-memory.dmpFilesize
2.0MB
-
memory/1688-510-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1688-463-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1748-720-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1792-750-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/1936-897-0x0000000100000000-0x0000000100176000-memory.dmpFilesize
1.5MB
-
memory/2012-926-0x0000000100000000-0x0000000100202000-memory.dmpFilesize
2.0MB
-
memory/2040-753-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2056-666-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2144-773-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2160-418-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2160-453-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2184-451-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2184-461-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2312-178-0x0000000000870000-0x00000000008D0000-memory.dmpFilesize
384KB
-
memory/2312-185-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/2312-183-0x0000000000870000-0x00000000008D0000-memory.dmpFilesize
384KB
-
memory/2312-832-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/2312-462-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/2316-191-0x0000000140000000-0x0000000140192000-memory.dmpFilesize
1.6MB
-
memory/2316-494-0x0000000140000000-0x0000000140192000-memory.dmpFilesize
1.6MB
-
memory/2316-823-0x0000000140000000-0x0000000140192000-memory.dmpFilesize
1.6MB
-
memory/2316-937-0x0000000100000000-0x00000001001A4000-memory.dmpFilesize
1.6MB
-
memory/2340-815-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2340-802-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2396-857-0x0000000000580000-0x0000000000712000-memory.dmpFilesize
1.6MB
-
memory/2396-853-0x0000000100000000-0x0000000100192000-memory.dmpFilesize
1.6MB
-
memory/2396-958-0x0000000100000000-0x0000000100192000-memory.dmpFilesize
1.6MB
-
memory/2396-1042-0x0000000000580000-0x0000000000712000-memory.dmpFilesize
1.6MB
-
memory/2400-567-0x0000000100000000-0x0000000100175000-memory.dmpFilesize
1.5MB
-
memory/2400-301-0x0000000100000000-0x0000000100175000-memory.dmpFilesize
1.5MB
-
memory/2488-642-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2512-703-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2512-692-0x0000000003CC0000-0x0000000003D7A000-memory.dmpFilesize
744KB
-
memory/2512-519-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2512-548-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2512-682-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2524-939-0x0000000140000000-0x0000000140196000-memory.dmpFilesize
1.6MB
-
memory/2524-840-0x0000000140000000-0x0000000140196000-memory.dmpFilesize
1.6MB
-
memory/2528-683-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2572-106-0x00000000003D0000-0x0000000000437000-memory.dmpFilesize
412KB
-
memory/2572-112-0x00000000003D0000-0x0000000000437000-memory.dmpFilesize
412KB
-
memory/2572-140-0x0000000010000000-0x000000001017F000-memory.dmpFilesize
1.5MB
-
memory/2572-105-0x0000000010000000-0x000000001017F000-memory.dmpFilesize
1.5MB
-
memory/2612-67-0x0000000100000000-0x0000000100184000-memory.dmpFilesize
1.5MB
-
memory/2612-177-0x0000000100000000-0x0000000100184000-memory.dmpFilesize
1.5MB
-
memory/2612-68-0x0000000000170000-0x00000000001D0000-memory.dmpFilesize
384KB
-
memory/2612-59-0x0000000000170000-0x00000000001D0000-memory.dmpFilesize
384KB
-
memory/2700-329-0x000000002E000000-0x000000002E195000-memory.dmpFilesize
1.6MB
-
memory/2700-602-0x000000002E000000-0x000000002E195000-memory.dmpFilesize
1.6MB
-
memory/2716-502-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2716-517-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2736-348-0x0000000100000000-0x0000000100542000-memory.dmpFilesize
5.3MB
-
memory/2736-621-0x0000000100000000-0x0000000100542000-memory.dmpFilesize
5.3MB
-
memory/2740-678-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2740-667-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2756-121-0x0000000010000000-0x0000000010187000-memory.dmpFilesize
1.5MB
-
memory/2756-128-0x00000000006B0000-0x0000000000710000-memory.dmpFilesize
384KB
-
memory/2756-122-0x00000000006B0000-0x0000000000710000-memory.dmpFilesize
384KB
-
memory/2756-152-0x0000000010000000-0x0000000010187000-memory.dmpFilesize
1.5MB
-
memory/2792-869-0x0000000001000000-0x0000000001176000-memory.dmpFilesize
1.5MB
-
memory/2792-1048-0x0000000001000000-0x0000000001176000-memory.dmpFilesize
1.5MB
-
memory/2852-717-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2852-704-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2860-298-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB
-
memory/2860-167-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB
-
memory/2860-0-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB
-
memory/2860-6-0x0000000001E10000-0x0000000001E77000-memory.dmpFilesize
412KB
-
memory/2860-1-0x0000000001E10000-0x0000000001E77000-memory.dmpFilesize
412KB
-
memory/2900-770-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2900-783-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2908-571-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2908-547-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2932-826-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2932-546-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2932-224-0x0000000140000000-0x000000014018E000-memory.dmpFilesize
1.6MB
-
memory/2992-569-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/2992-583-0x0000000000400000-0x0000000000588000-memory.dmpFilesize
1.5MB
-
memory/3040-327-0x0000000140000000-0x00000001401AA000-memory.dmpFilesize
1.7MB
-
memory/3040-322-0x0000000140000000-0x00000001401AA000-memory.dmpFilesize
1.7MB