Overview

overview

7

Static

static

3

2024-05-26...re.exe

windows7-x64

7

2024-05-26...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 03:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-05-26_8868a7410e60dec90b8a4562e0b5be16_bkransomware.exe
  • Size 1.8MB
  • Sample240526-efl89aef84
  • SHA256 05088af15fdf5b986bc4867ade4a8ca6d826e2d355a51ec6eeb222e03c8a903a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_8868a7410e60dec90b8a4562e0b5be16_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_8868a7410e60dec90b8a4562e0b5be16_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1968
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2236
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:1844
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:3004
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2772
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 1e0 -NGENProcess 1e4 -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:632
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1e0 -NGENProcess 1e4 -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2736
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 258 -NGENProcess 260 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2732
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 250 -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1144
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 260 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 248 -NGENProcess 26c -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2124
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1e0 -NGENProcess 270 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1840
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 270 -NGENProcess 1e4 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 1fc -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 1e0 -NGENProcess 280 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 284 -NGENProcess 1fc -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2024
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 288 -NGENProcess 1e4 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1388
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 1e0 -NGENProcess 290 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 1e0 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 288 -NGENProcess 294 -Pipe 1fc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1784
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 268 -NGENProcess 1e4 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2436
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 1e0 -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2024
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 29c -NGENProcess 1e4 -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1484
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 298 -NGENProcess 268 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2a4 -NGENProcess 248 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1760
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 29c -NGENProcess 2a8 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2744
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 1e4 -NGENProcess 248 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2340
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 2ac -NGENProcess 2a4 -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2704
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 1f8 -NGENProcess 288 -Pipe 230 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 244 -NGENProcess 294 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2252
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 24c -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2124
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 25c -NGENProcess 288 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2384
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1f4 -NGENProcess 294 -Pipe 224 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1528
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 288 -NGENProcess 294 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1376
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 1dc -NGENProcess 228 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 228 -NGENProcess 1f4 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:520
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 2a8 -NGENProcess 294 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2372
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 294 -NGENProcess 1dc -Pipe 2b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1196
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 278 -NGENProcess 1f4 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:952
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 1f4 -NGENProcess 2a8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 2a4 -NGENProcess 1dc -Pipe 228 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2184
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 1dc -NGENProcess 278 -Pipe 2ac -Comment "NGen Worker Process"
      2⤵
        PID:1716
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 1e0 -NGENProcess 2a8 -Pipe 294 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2860
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1dc -NGENProcess 248 -Pipe 274 -Comment "NGen Worker Process"
        2⤵
          PID:2664
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 24c -NGENProcess 298 -Pipe 1f4 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2380
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 298 -NGENProcess 1e0 -Pipe 2a8 -Comment "NGen Worker Process"
          2⤵
            PID:2896
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2b8 -NGENProcess 248 -Pipe 2a4 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2532
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 248 -NGENProcess 24c -Pipe 2b4 -Comment "NGen Worker Process"
            2⤵
              PID:848
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 2c0 -NGENProcess 1e0 -Pipe 1dc -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:2436
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 1e0 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
              2⤵
                PID:2548
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 2c8 -NGENProcess 24c -Pipe 298 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2324
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 24c -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
                2⤵
                  PID:1484
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 248 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2900
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2b8 -NGENProcess 2c8 -Pipe 2cc -Comment "NGen Worker Process"
                  2⤵
                    PID:336
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2d8 -NGENProcess 2c0 -Pipe 1e0 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:584
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2d4 -Comment "NGen Worker Process"
                    2⤵
                      PID:1204
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e0 -NGENProcess 2c8 -Pipe 24c -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2452
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
                      2⤵
                        PID:552
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
                        2⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        PID:1288
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d0 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
                        2⤵
                          PID:1628
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2c0 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:1140
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
                          2⤵
                            PID:2440
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2c8 -Comment "NGen Worker Process"
                            2⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            PID:1528
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2e0 -NGENProcess 2f0 -Pipe 2f4 -Comment "NGen Worker Process"
                            2⤵
                            • Modifies data under HKEY_USERS
                            PID:2668
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2d0 -NGENProcess 2e8 -Pipe 304 -Comment "NGen Worker Process"
                            2⤵
                              PID:520
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 300 -NGENProcess 2fc -Pipe 1f8 -Comment "NGen Worker Process"
                              2⤵
                                PID:780
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 308 -NGENProcess 2f0 -Pipe 2d8 -Comment "NGen Worker Process"
                                2⤵
                                  PID:2288
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2e8 -Pipe 268 -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:2548
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2e8 -NGENProcess 300 -Pipe 2fc -Comment "NGen Worker Process"
                                  2⤵
                                  • Loads dropped DLL
                                  • Drops file in Windows directory
                                  PID:952
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 300 -NGENProcess 2f8 -Pipe 2f0 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:2116
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 318 -NGENProcess 310 -Pipe 2d0 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:2752
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 314 -Pipe 308 -Comment "NGen Worker Process"
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:1560
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2f8 -Pipe 30c -Comment "NGen Worker Process"
                                      2⤵
                                        PID:2656
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 310 -Pipe 2e0 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:3048
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 314 -Pipe 2e8 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:2488
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2f8 -Pipe 300 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:2452
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 310 -Pipe 318 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:708
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 314 -Pipe 2e8 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:1528
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2f8 -Pipe 320 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1628
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 310 -Pipe 324 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1144
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 328 -NGENProcess 128 -Pipe 338 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:1636
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 278 -NGENProcess 334 -Pipe 330 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:1204
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 32c -NGENProcess 340 -Pipe 310 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2664
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 344 -NGENProcess 128 -Pipe 33c -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:2532
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 334 -Pipe 124 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:1564
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 340 -Pipe 314 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2668
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 128 -Pipe 328 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:2812
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 334 -Pipe 278 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2428
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 340 -Pipe 32c -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2024
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 128 -Pipe 344 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:2344
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 334 -Pipe 348 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:1496
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 340 -Pipe 34c -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1060
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 128 -Pipe 350 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:1652
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 334 -Pipe 354 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:2476
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 340 -Pipe 358 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:2256
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 128 -Pipe 35c -Comment "NGen Worker Process"
                                                                            2⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:2656
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 128 -NGENProcess 374 -Pipe 378 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:2276
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 128 -NGENProcess 370 -Pipe 340 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:1632
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 128 -InterruptEvent 388 -NGENProcess 374 -Pipe 384 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:2548
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 2f8 -Pipe 364 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:108
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 370 -Pipe 380 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:2716
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 374 -Pipe 36c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:1380
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 128 -Pipe 37c -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:1840
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 370 -Pipe 368 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:2428
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 374 -Pipe 388 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Loads dropped DLL
                                                                              • Drops file in Windows directory
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:1480
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 374 -NGENProcess 398 -Pipe 128 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:1496
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3a8 -NGENProcess 370 -Pipe 390 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:2448
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 370 -NGENProcess 3a0 -Pipe 3a4 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1528
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 3b0 -NGENProcess 398 -Pipe 39c -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:1516
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 398 -NGENProcess 3a8 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2756
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 3b8 -NGENProcess 3a0 -Pipe 374 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2372
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3b4 -Pipe 394 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1764
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3b4 -NGENProcess 398 -Pipe 3a8 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2280
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:756
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2144
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2136
                                                                                      • C:\Windows\ehome\ehRecvr.exe
                                                                                        C:\Windows\ehome\ehRecvr.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1516
                                                                                      • C:\Windows\ehome\ehsched.exe
                                                                                        C:\Windows\ehome\ehsched.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1952
                                                                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:588
                                                                                      • C:\Windows\eHome\EhTray.exe
                                                                                        "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                        1⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:612
                                                                                      • C:\Windows\system32\IEEtwCollector.exe
                                                                                        C:\Windows\system32\IEEtwCollector.exe /V
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1948
                                                                                      • C:\Windows\ehome\ehRec.exe
                                                                                        C:\Windows\ehome\ehRec.exe -Embedding
                                                                                        1⤵
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:836
                                                                                      • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                        "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        PID:1552
                                                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2016
                                                                                      • C:\Windows\System32\msdtc.exe
                                                                                        C:\Windows\System32\msdtc.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Drops file in Windows directory
                                                                                        PID:2076
                                                                                      • C:\Windows\system32\msiexec.exe
                                                                                        C:\Windows\system32\msiexec.exe /V
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1336
                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2216
                                                                                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2524
                                                                                      • C:\Windows\SysWow64\perfhost.exe
                                                                                        C:\Windows\SysWow64\perfhost.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2652
                                                                                      • C:\Windows\system32\locator.exe
                                                                                        C:\Windows\system32\locator.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2600
                                                                                      • C:\Windows\System32\snmptrap.exe
                                                                                        C:\Windows\System32\snmptrap.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1904
                                                                                      • C:\Windows\System32\vds.exe
                                                                                        C:\Windows\System32\vds.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1644
                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                        C:\Windows\system32\vssvc.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1472
                                                                                      • C:\Windows\system32\wbengine.exe
                                                                                        "C:\Windows\system32\wbengine.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2708
                                                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2788
                                                                                      • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                        "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2000
                                                                                      • C:\Windows\system32\SearchIndexer.exe
                                                                                        C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2608
                                                                                        • C:\Windows\system32\SearchProtocolHost.exe
                                                                                          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                                                          2⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:852
                                                                                        • C:\Windows\system32\SearchFilterHost.exe
                                                                                          "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                                                                                          2⤵
                                                                                            PID:2272
                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                            2⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:2204
                                                                                        • C:\Windows\system32\dllhost.exe
                                                                                          C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Windows directory
                                                                                          PID:2588

                                                                                        Network

                                                                                              MITRE ATT&CK Enterprise v15

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              OSE.EXE
                                                                                              • Path C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                              • Size 1.4MB
                                                                                              • SHA256 d4a9cdb83936bef0bb51f922dd369aee4126c15e52c41e11e30642f0e7432b2d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              GROOVE.EXE
                                                                                              • Path C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                              • Size 30.1MB
                                                                                              • SHA256 2b9210d43afc516b21d14d7b9a48e7f127089eb4fc9a562f043e924b50d63d02
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              maintenanceservice.exe
                                                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 7982abdf389afc171cfaa1c6ccd92e739450eedc66a9e1e0dfcef33f5b955903
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              OSPPSVC.EXE
                                                                                              • Path C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                                                                              • Size 5.2MB
                                                                                              • SHA256 b076fc4d94d1f767cc654a87f091dc977f454ec8175be63612351417033284eb
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              elevation_service.exe
                                                                                              • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                              • Size 2.1MB
                                                                                              • SHA256 e00521f1785ff3e1700286b26847d77d4c268d7eedd1b75e210204392d1112aa
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              MSS.log
                                                                                              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                              • Size 1024KB
                                                                                              • SHA256 4e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              b91050d8b077a4e8.customDestinations-ms
                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                              • Size 24B
                                                                                              • SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ngen_service.log
                                                                                              • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                              • Size 872KB
                                                                                              • SHA256 aed7ebe8895024da80271070d2b81ffa98d352fa99f4c68c960dbf6e5de1f057
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              aspnet_state.exe
                                                                                              • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 9f81ac5ab63690d87d06b92d5cf72c01e11f1c26d1f572a518548d252fe17480
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              mscorsvw.exe
                                                                                              • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 59b6985f339f32f3f621c7db23aca00fea2068b669261697d30691eb9731723d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              mscorsvw.exe
                                                                                              • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 6ab920f2b1c4e695b366f0ebc9326633af4086579364230b34acac2daa31fb75
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ngen_service.log
                                                                                              • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                              • Size 1003KB
                                                                                              • SHA256 95601fbb3b2e10c00ac450b1005c3bda6f2183f16381045923b688a57bc69d52
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              mscorsvw.exe
                                                                                              • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 6b831083322a9e82236aedbf856db36b30c189cde2b643cbae7be6a5ffdfd180
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ngen_service.log
                                                                                              • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
                                                                                              • Size 8KB
                                                                                              • SHA256 4357942db4a09b7764508fcce2d44801b557a162b9e348beadf24149506d9cb3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              perfhost.exe
                                                                                              • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 8c4343caad1124338e65ea750933de3f350077debf41f3468f21339a59b793e1
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              SearchIndexer.exe
                                                                                              • Path C:\Windows\System32\SearchIndexer.exe
                                                                                              • Size 1.1MB
                                                                                              • SHA256 df6f0a5afe770ed938aa998a84e39633ccc79ba21100006daed9dc43797610c3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              VSSVC.exe
                                                                                              • Path C:\Windows\System32\VSSVC.exe
                                                                                              • Size 2.1MB
                                                                                              • SHA256 a13ebde986f61dd9b32134eeceb18624bd28439350bc751be80dea53d0212b19
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              alg.exe
                                                                                              • Path C:\Windows\System32\alg.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 fcaafb0aeb1b9337d9f936a0b5c16542ba6944563e42e73d57077cb51e772852
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              vds.exe
                                                                                              • Path C:\Windows\System32\vds.exe
                                                                                              • Size 1.7MB
                                                                                              • SHA256 4c762bcaa9426c2e1f838f0043960171befbfcc4cab24368962d5c27e0cca998
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              WmiApSrv.exe
                                                                                              • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 a4b74bc2f9ea7d252b158a42b315c185c1569b5969fb0ee0ead0ca159bd3acbb
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                              • Size 834KB
                                                                                              • SHA256 a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                              • Size 797KB
                                                                                              • SHA256 4c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                              • Size 163KB
                                                                                              • SHA256 99facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                              • Size 1.3MB
                                                                                              • SHA256 489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.Office.Tools.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                              • Size 148KB
                                                                                              • SHA256 f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                              • Size 34KB
                                                                                              • SHA256 620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\098c11aba517df2cb26fe6e6a9717c16\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                              • Size 187KB
                                                                                              • SHA256 a9f8b2104b38df1d02e04372815b8cb3f7da56f80d625b0421e325eed717b78b
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                              • Size 109KB
                                                                                              • SHA256 211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                              • Size 41KB
                                                                                              • SHA256 de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\7d4b553e6947c5b784119b4dc14d48ad\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                              • Size 180KB
                                                                                              • SHA256 49d3f5e352ca18e7a5c0c1ee9eb47383043bcca1e5042fe417e1c27c23f0fd41
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                              • Size 210KB
                                                                                              • SHA256 8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                              • Size 53KB
                                                                                              • SHA256 e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                              • Size 28KB
                                                                                              • SHA256 4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                              • Size 27KB
                                                                                              • SHA256 edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                              • Size 57KB
                                                                                              • SHA256 4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                              • Size 130KB
                                                                                              • SHA256 f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f030ae7a0ac8395493f8afcd319ee692\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                              • Size 143KB
                                                                                              • SHA256 9805ae745d078fc9d64e256d4472c0edd369958a6872d71bd28d245a0239fe12
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                              • Size 59KB
                                                                                              • SHA256 a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1bda4330d7ab27c23ca42562b6b1d63\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                              • Size 83KB
                                                                                              • SHA256 7b3f15a1d8abd38b13b95d8cec4423391c7d871cfb19cf2a708a4e89b707a7d3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                              • Size 42KB
                                                                                              • SHA256 f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ehiVidCtl.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
                                                                                              • Size 855KB
                                                                                              • SHA256 897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              stdole.ni.dll
                                                                                              • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
                                                                                              • Size 43KB
                                                                                              • SHA256 6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              wmpnetwk.exe
                                                                                              • Path \Program Files\Windows Media Player\wmpnetwk.exe
                                                                                              • Size 2.0MB
                                                                                              • SHA256 d3efe38132b80a7ab8c9f9d9f7b386ade19c3b119f52b0d7069ee1bf405b9c80
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              mscorsvw.exe
                                                                                              • Path \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 fbc846ecaa88b00ad677ebcd6b4c2671cea7e082763bda70e417d5c80a9a6560
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Locator.exe
                                                                                              • Path \Windows\System32\Locator.exe
                                                                                              • Size 1.2MB
                                                                                              • SHA256 052db51ac40701a51530f0feff7921b0b0cceffd15de6152e84a900f801e78c4
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ieetwcollector.exe
                                                                                              • Path \Windows\System32\ieetwcollector.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 c7c53d2151f7ef14ab8cdd31e13c00a0a918ea2e3ef4c3a3ee3f9cf319abf6e9
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              msdtc.exe
                                                                                              • Path \Windows\System32\msdtc.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 11577bc6d43cf7d53ab571cc1ff61c3d5348d51fba61b7574e104e06658af1c8
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              msiexec.exe
                                                                                              • Path \Windows\System32\msiexec.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 3528a6aa44f7a11106d21d5e62b290560f61e04c77977c297814dc706a0bc1ee
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              snmptrap.exe
                                                                                              • Path \Windows\System32\snmptrap.exe
                                                                                              • Size 1.3MB
                                                                                              • SHA256 5c406a9e4ebf2548f275261c11aace4f1ebb61be710ce6009093c53e35941384
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              wbengine.exe
                                                                                              • Path \Windows\System32\wbengine.exe
                                                                                              • Size 2.0MB
                                                                                              • SHA256 b093aefcdae53bb2bfaf2684858317b66540f6a4343ea39b341aa1a3ffac1b70
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ehrecvr.exe
                                                                                              • Path \Windows\ehome\ehrecvr.exe
                                                                                              • Size 1.2MB
                                                                                              • SHA256 c38a692a260a50b73ab86f85d40bb67a73a6417285315350a3770ad8b7786c88
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ehsched.exe
                                                                                              • Path \Windows\ehome\ehsched.exe
                                                                                              • Size 1.4MB
                                                                                              • SHA256 d04f7e355cfe29c68efdeb33c70bb7c10524c5c3b7b63dc32abe1e3fae329661
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              memory/272-635-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/272-657-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/588-256-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                              Download

                                                                                              memory/588-145-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                              Download

                                                                                              memory/632-388-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/632-303-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/756-102-0x0000000000410000-0x0000000000470000-memory.dmp
                                                                                              Download

                                                                                              memory/756-95-0x0000000000410000-0x0000000000470000-memory.dmp
                                                                                              Download

                                                                                              memory/756-216-0x0000000140000000-0x000000014015D000-memory.dmp
                                                                                              Download

                                                                                              memory/756-101-0x0000000140000000-0x000000014015D000-memory.dmp
                                                                                              Download

                                                                                              memory/880-703-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/880-598-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/880-686-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/880-618-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1144-506-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1144-526-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1336-350-0x0000000000570000-0x00000000006D1000-memory.dmp
                                                                                              Download

                                                                                              memory/1336-201-0x0000000100000000-0x0000000100161000-memory.dmp
                                                                                              Download

                                                                                              memory/1336-205-0x0000000000570000-0x00000000006D1000-memory.dmp
                                                                                              Download

                                                                                              memory/1336-329-0x0000000100000000-0x0000000100161000-memory.dmp
                                                                                              Download

                                                                                              memory/1388-691-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1472-597-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                              Download

                                                                                              memory/1472-310-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                              Download

                                                                                              memory/1484-789-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1516-230-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                              Download

                                                                                              memory/1516-120-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                              Download

                                                                                              memory/1516-922-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                              Download

                                                                                              memory/1516-118-0x0000000000430000-0x0000000000490000-memory.dmp
                                                                                              Download

                                                                                              memory/1516-111-0x0000000000430000-0x0000000000490000-memory.dmp
                                                                                              Download

                                                                                              memory/1532-632-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1532-607-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1552-178-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                              Download

                                                                                              memory/1552-281-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                              Download

                                                                                              memory/1644-284-0x0000000100000000-0x00000001001C3000-memory.dmp
                                                                                              Download

                                                                                              memory/1644-573-0x0000000100000000-0x00000001001C3000-memory.dmp
                                                                                              Download

                                                                                              memory/1784-747-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1784-735-0x0000000003C90000-0x0000000003D4A000-memory.dmp
                                                                                              Download

                                                                                              memory/1784-730-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1840-603-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1840-575-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/1844-27-0x0000000140000000-0x000000014014C000-memory.dmp
                                                                                              Download

                                                                                              memory/1844-28-0x00000000009F0000-0x0000000000A50000-memory.dmp
                                                                                              Download

                                                                                              memory/1844-36-0x00000000009F0000-0x0000000000A50000-memory.dmp
                                                                                              Download

                                                                                              memory/1844-158-0x0000000140000000-0x000000014014C000-memory.dmp
                                                                                              Download

                                                                                              memory/1904-282-0x0000000100000000-0x0000000100145000-memory.dmp
                                                                                              Download

                                                                                              memory/1904-541-0x0000000100000000-0x0000000100145000-memory.dmp
                                                                                              Download

                                                                                              memory/1948-277-0x0000000140000000-0x000000014015D000-memory.dmp
                                                                                              Download

                                                                                              memory/1948-159-0x0000000140000000-0x000000014015D000-memory.dmp
                                                                                              Download

                                                                                              memory/1948-887-0x0000000140000000-0x000000014015D000-memory.dmp
                                                                                              Download

                                                                                              memory/1952-249-0x0000000140000000-0x0000000140161000-memory.dmp
                                                                                              Download

                                                                                              memory/1952-803-0x0000000140000000-0x0000000140161000-memory.dmp
                                                                                              Download

                                                                                              memory/1952-124-0x0000000140000000-0x0000000140161000-memory.dmp
                                                                                              Download

                                                                                              memory/1968-7-0x00000000006C0000-0x0000000000727000-memory.dmp
                                                                                              Download

                                                                                              memory/1968-0-0x0000000000400000-0x00000000005D9000-memory.dmp
                                                                                              Download

                                                                                              memory/1968-94-0x0000000000400000-0x00000000005D9000-memory.dmp
                                                                                              Download

                                                                                              memory/1968-6-0x00000000006C0000-0x0000000000727000-memory.dmp
                                                                                              Download

                                                                                              memory/1968-1-0x00000000006C0000-0x0000000000727000-memory.dmp
                                                                                              Download

                                                                                              memory/2000-653-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                              Download

                                                                                              memory/2000-351-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                              Download

                                                                                              memory/2016-181-0x0000000140000000-0x0000000140179000-memory.dmp
                                                                                              Download

                                                                                              memory/2016-196-0x0000000140000000-0x0000000140179000-memory.dmp
                                                                                              Download

                                                                                              memory/2024-669-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2024-772-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2024-758-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2024-654-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2076-322-0x0000000140000000-0x0000000140165000-memory.dmp
                                                                                              Download

                                                                                              memory/2076-185-0x0000000140000000-0x0000000140165000-memory.dmp
                                                                                              Download

                                                                                              memory/2124-572-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2124-542-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2216-226-0x000000002E000000-0x000000002E164000-memory.dmp
                                                                                              Download

                                                                                              memory/2216-372-0x000000002E000000-0x000000002E164000-memory.dmp
                                                                                              Download

                                                                                              memory/2236-21-0x0000000100000000-0x0000000100153000-memory.dmp
                                                                                              Download

                                                                                              memory/2236-117-0x0000000100000000-0x0000000100153000-memory.dmp
                                                                                              Download

                                                                                              memory/2236-13-0x00000000008E0000-0x0000000000940000-memory.dmp
                                                                                              Download

                                                                                              memory/2236-22-0x00000000008E0000-0x0000000000940000-memory.dmp
                                                                                              Download

                                                                                              memory/2396-86-0x0000000000AF0000-0x0000000000B57000-memory.dmp
                                                                                              Download

                                                                                              memory/2396-80-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2396-81-0x0000000000AF0000-0x0000000000B57000-memory.dmp
                                                                                              Download

                                                                                              memory/2396-204-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2436-762-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2524-402-0x0000000100000000-0x0000000100542000-memory.dmp
                                                                                              Download

                                                                                              memory/2524-239-0x0000000100000000-0x0000000100542000-memory.dmp
                                                                                              Download

                                                                                              memory/2532-785-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2532-811-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2600-265-0x0000000100000000-0x0000000100144000-memory.dmp
                                                                                              Download

                                                                                              memory/2600-522-0x0000000100000000-0x0000000100144000-memory.dmp
                                                                                              Download

                                                                                              memory/2608-660-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                              Download

                                                                                              memory/2608-374-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                              Download

                                                                                              memory/2628-720-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2652-253-0x0000000001000000-0x0000000001145000-memory.dmp
                                                                                              Download

                                                                                              memory/2652-505-0x0000000001000000-0x0000000001145000-memory.dmp
                                                                                              Download

                                                                                              memory/2708-325-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                              Download

                                                                                              memory/2708-608-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                              Download

                                                                                              memory/2732-403-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2732-511-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2736-373-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2736-406-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2772-63-0x0000000000420000-0x0000000000480000-memory.dmp
                                                                                              Download

                                                                                              memory/2772-78-0x0000000010000000-0x0000000010156000-memory.dmp
                                                                                              Download

                                                                                              memory/2772-56-0x0000000000420000-0x0000000000480000-memory.dmp
                                                                                              Download

                                                                                              memory/2772-62-0x0000000010000000-0x0000000010156000-memory.dmp
                                                                                              Download

                                                                                              memory/2788-330-0x0000000100000000-0x0000000100173000-memory.dmp
                                                                                              Download

                                                                                              memory/2788-636-0x0000000100000000-0x0000000100173000-memory.dmp
                                                                                              Download

                                                                                              memory/2936-523-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/2936-549-0x0000000000400000-0x0000000000557000-memory.dmp
                                                                                              Download

                                                                                              memory/3004-75-0x0000000010000000-0x000000001014E000-memory.dmp
                                                                                              Download

                                                                                              memory/3004-47-0x0000000000270000-0x00000000002D7000-memory.dmp
                                                                                              Download

                                                                                              memory/3004-46-0x0000000010000000-0x000000001014E000-memory.dmp
                                                                                              Download

                                                                                              memory/3004-39-0x0000000000270000-0x00000000002D7000-memory.dmp
                                                                                              Download