Analysis
-
max time kernel
143s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe
Resource
win7-20240221-en
General
-
Target
2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
ac2403837512ad8a207b62808b531f28
-
SHA1
43c81390a338210b187790cc9a289807d72fa520
-
SHA256
5ac96898c36d27f7dcf8f15eee84d9b363a6e3c400c487852d581fb95b7d11e3
-
SHA512
694a7d5b84c35373194b9bfb0fb360b424e2cd651d11f36f44631c2d910194140b61b220edf1716989a441f286b426d74e53fed64ef2646a6db5f07cde7322c9
-
SSDEEP
196608:bP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018BC6:bPboGX8a/jWWu3cI2D/cWcls1d
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 472 Process not Found 2552 alg.exe 2440 aspnet_state.exe 2560 mscorsvw.exe 2396 mscorsvw.exe 1732 mscorsvw.exe 2584 mscorsvw.exe 1648 ehRecvr.exe 1196 ehsched.exe 2988 elevation_service.exe 3060 IEEtwCollector.exe 1180 GROOVE.EXE 1832 maintenanceservice.exe 1112 msdtc.exe 2164 msiexec.exe 868 mscorsvw.exe 2412 OSE.EXE 2176 OSPPSVC.EXE 556 perfhost.exe 1140 locator.exe 1948 snmptrap.exe 2148 vds.exe 2808 mscorsvw.exe 1524 vssvc.exe 2256 wbengine.exe 3000 mscorsvw.exe 1624 WmiApSrv.exe 3036 wmpnetwk.exe 1312 SearchIndexer.exe 2688 mscorsvw.exe 1588 mscorsvw.exe 2808 mscorsvw.exe 1908 mscorsvw.exe 636 mscorsvw.exe 2348 mscorsvw.exe 2632 mscorsvw.exe 1904 mscorsvw.exe 2168 mscorsvw.exe 112 mscorsvw.exe 2572 mscorsvw.exe 2284 mscorsvw.exe 3016 mscorsvw.exe 2852 mscorsvw.exe 1796 mscorsvw.exe 1656 mscorsvw.exe 1088 mscorsvw.exe 2392 mscorsvw.exe 984 mscorsvw.exe 1556 mscorsvw.exe 1716 mscorsvw.exe 1872 mscorsvw.exe 676 dllhost.exe 2376 mscorsvw.exe 916 mscorsvw.exe 2716 mscorsvw.exe 2404 mscorsvw.exe 2456 mscorsvw.exe 2468 mscorsvw.exe 1904 mscorsvw.exe 964 mscorsvw.exe 2720 mscorsvw.exe 1012 mscorsvw.exe 1980 mscorsvw.exe 1508 mscorsvw.exe -
Loads dropped DLL 55 IoCs
pid Process 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 2164 msiexec.exe 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found 748 Process not Found 472 Process not Found 2456 mscorsvw.exe 2456 mscorsvw.exe 1904 mscorsvw.exe 1904 mscorsvw.exe 2720 mscorsvw.exe 2720 mscorsvw.exe 1980 mscorsvw.exe 1980 mscorsvw.exe 2468 mscorsvw.exe 2468 mscorsvw.exe 1656 mscorsvw.exe 1656 mscorsvw.exe 2364 mscorsvw.exe 2364 mscorsvw.exe 2216 mscorsvw.exe 2216 mscorsvw.exe 2576 mscorsvw.exe 2576 mscorsvw.exe 932 mscorsvw.exe 932 mscorsvw.exe 1984 mscorsvw.exe 1984 mscorsvw.exe 2572 mscorsvw.exe 2572 mscorsvw.exe 2892 mscorsvw.exe 2892 mscorsvw.exe 1556 mscorsvw.exe 1556 mscorsvw.exe 1172 mscorsvw.exe 1172 mscorsvw.exe 2824 mscorsvw.exe 2824 mscorsvw.exe 2688 mscorsvw.exe 2688 mscorsvw.exe 2168 mscorsvw.exe 2168 mscorsvw.exe 636 mscorsvw.exe 636 mscorsvw.exe 2364 mscorsvw.exe 2364 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbengine.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\locator.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\vds.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\dllhost.exe aspnet_state.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\49a954deae4ef42b.bin aspnet_state.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{D9005A2B-BC2A-4153-8911-AE3B3F543790}\chrome_installer.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe aspnet_state.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File opened for modification C:\Windows\ehome\ehsched.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6345.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index134.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index139.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPBD66.tmp\Microsoft.Office.Tools.Common.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{7FFD88DD-5D64-4A89-858D-928B085CDC4E}.crmlog dllhost.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index147.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP84AA.tmp\stdole.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index147.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4E11.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6B7F.tmp\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index142.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index137.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\ehome\ehRecvr.exe 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe aspnet_state.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8305.tmp\ehiVidCtl.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index148.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index145.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index135.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5A8F.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6191.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index142.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\displayswitch.exe,-320 = "Connect to a Projector" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-117 = "Maid with the Flaxen Hair" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-113 = "Windows PowerShell Integrated Scripting Environment. Performs object-based (command-line) functions" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10055 = "FreeCell" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c011b30a43b0da01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10209 = "More Games from Microsoft" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-103 = "Hydrangeas" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310 = "Data Sources (ODBC)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE\SAL\LogInitialPageCount = "16" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\mip.exe,-291 = "Math Input Panel" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10306 = "Overturn blank squares and avoid those that conceal hidden mines in this simple game of memory and reasoning. Once you click on a mine, the game is over." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\recdisc.exe,-2001 = "Creates a disc you can use to access system recovery options." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software wmpnetwk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-106 = "Tulips" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10061 = "Spider Solitaire" SearchProtocolHost.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 3064 ehRec.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe 2440 aspnet_state.exe 2440 aspnet_state.exe 2440 aspnet_state.exe 2440 aspnet_state.exe 2440 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: 33 2724 EhTray.exe Token: SeIncBasePriorityPrivilege 2724 EhTray.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeDebugPrivilege 3064 ehRec.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeRestorePrivilege 2164 msiexec.exe Token: SeTakeOwnershipPrivilege 2164 msiexec.exe Token: SeSecurityPrivilege 2164 msiexec.exe Token: 33 2724 EhTray.exe Token: SeIncBasePriorityPrivilege 2724 EhTray.exe Token: SeBackupPrivilege 1524 vssvc.exe Token: SeRestorePrivilege 1524 vssvc.exe Token: SeAuditPrivilege 1524 vssvc.exe Token: SeBackupPrivilege 2256 wbengine.exe Token: SeRestorePrivilege 2256 wbengine.exe Token: SeSecurityPrivilege 2256 wbengine.exe Token: SeManageVolumePrivilege 1312 SearchIndexer.exe Token: 33 1312 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1312 SearchIndexer.exe Token: 33 3036 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 3036 wmpnetwk.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeDebugPrivilege 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe Token: SeDebugPrivilege 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe Token: SeDebugPrivilege 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe Token: SeDebugPrivilege 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe Token: SeDebugPrivilege 1400 2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeDebugPrivilege 2440 aspnet_state.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe Token: SeShutdownPrivilege 1732 mscorsvw.exe Token: SeShutdownPrivilege 2584 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2724 EhTray.exe 2724 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2724 EhTray.exe 2724 EhTray.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 1960 SearchProtocolHost.exe 1960 SearchProtocolHost.exe 1960 SearchProtocolHost.exe 1960 SearchProtocolHost.exe 1960 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1120 SearchProtocolHost.exe 1960 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 868 1732 mscorsvw.exe 45 PID 1732 wrote to memory of 868 1732 mscorsvw.exe 45 PID 1732 wrote to memory of 868 1732 mscorsvw.exe 45 PID 1732 wrote to memory of 868 1732 mscorsvw.exe 45 PID 1732 wrote to memory of 2808 1732 mscorsvw.exe 65 PID 1732 wrote to memory of 2808 1732 mscorsvw.exe 65 PID 1732 wrote to memory of 2808 1732 mscorsvw.exe 65 PID 1732 wrote to memory of 2808 1732 mscorsvw.exe 65 PID 1732 wrote to memory of 3000 1732 mscorsvw.exe 55 PID 1732 wrote to memory of 3000 1732 mscorsvw.exe 55 PID 1732 wrote to memory of 3000 1732 mscorsvw.exe 55 PID 1732 wrote to memory of 3000 1732 mscorsvw.exe 55 PID 1732 wrote to memory of 2688 1732 mscorsvw.exe 61 PID 1732 wrote to memory of 2688 1732 mscorsvw.exe 61 PID 1732 wrote to memory of 2688 1732 mscorsvw.exe 61 PID 1732 wrote to memory of 2688 1732 mscorsvw.exe 61 PID 1732 wrote to memory of 1588 1732 mscorsvw.exe 62 PID 1732 wrote to memory of 1588 1732 mscorsvw.exe 62 PID 1732 wrote to memory of 1588 1732 mscorsvw.exe 62 PID 1732 wrote to memory of 1588 1732 mscorsvw.exe 62 PID 1312 wrote to memory of 1960 1312 SearchIndexer.exe 63 PID 1312 wrote to memory of 1960 1312 SearchIndexer.exe 63 PID 1312 wrote to memory of 1960 1312 SearchIndexer.exe 63 PID 1312 wrote to memory of 308 1312 SearchIndexer.exe 64 PID 1312 wrote to memory of 308 1312 SearchIndexer.exe 64 PID 1312 wrote to memory of 308 1312 SearchIndexer.exe 64 PID 1732 wrote to memory of 2808 1732 mscorsvw.exe 65 PID 1732 wrote to memory of 2808 1732 mscorsvw.exe 65 PID 1732 wrote to memory of 2808 1732 mscorsvw.exe 65 PID 1732 wrote to memory of 2808 1732 mscorsvw.exe 65 PID 1732 wrote to memory of 1908 1732 mscorsvw.exe 66 PID 1732 wrote to memory of 1908 1732 mscorsvw.exe 66 PID 1732 wrote to memory of 1908 1732 mscorsvw.exe 66 PID 1732 wrote to memory of 1908 1732 mscorsvw.exe 66 PID 1732 wrote to memory of 636 1732 mscorsvw.exe 67 PID 1732 wrote to memory of 636 1732 mscorsvw.exe 67 PID 1732 wrote to memory of 636 1732 mscorsvw.exe 67 PID 1732 wrote to memory of 636 1732 mscorsvw.exe 67 PID 1312 wrote to memory of 1120 1312 SearchIndexer.exe 68 PID 1312 wrote to memory of 1120 1312 SearchIndexer.exe 68 PID 1312 wrote to memory of 1120 1312 SearchIndexer.exe 68 PID 1732 wrote to memory of 2348 1732 mscorsvw.exe 69 PID 1732 wrote to memory of 2348 1732 mscorsvw.exe 69 PID 1732 wrote to memory of 2348 1732 mscorsvw.exe 69 PID 1732 wrote to memory of 2348 1732 mscorsvw.exe 69 PID 1732 wrote to memory of 2632 1732 mscorsvw.exe 70 PID 1732 wrote to memory of 2632 1732 mscorsvw.exe 70 PID 1732 wrote to memory of 2632 1732 mscorsvw.exe 70 PID 1732 wrote to memory of 2632 1732 mscorsvw.exe 70 PID 1732 wrote to memory of 1904 1732 mscorsvw.exe 71 PID 1732 wrote to memory of 1904 1732 mscorsvw.exe 71 PID 1732 wrote to memory of 1904 1732 mscorsvw.exe 71 PID 1732 wrote to memory of 1904 1732 mscorsvw.exe 71 PID 1732 wrote to memory of 2168 1732 mscorsvw.exe 72 PID 1732 wrote to memory of 2168 1732 mscorsvw.exe 72 PID 1732 wrote to memory of 2168 1732 mscorsvw.exe 72 PID 1732 wrote to memory of 2168 1732 mscorsvw.exe 72 PID 1732 wrote to memory of 112 1732 mscorsvw.exe 73 PID 1732 wrote to memory of 112 1732 mscorsvw.exe 73 PID 1732 wrote to memory of 112 1732 mscorsvw.exe 73 PID 1732 wrote to memory of 112 1732 mscorsvw.exe 73 PID 1732 wrote to memory of 2572 1732 mscorsvw.exe 74 PID 1732 wrote to memory of 2572 1732 mscorsvw.exe 74 PID 1732 wrote to memory of 2572 1732 mscorsvw.exe 74 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_ac2403837512ad8a207b62808b531f28_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2552
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:868
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 1dc -Pipe 1ec -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 24c -NGENProcess 250 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3000
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 25c -NGENProcess 264 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 268 -NGENProcess 250 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 258 -NGENProcess 260 -Pipe 1dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 270 -NGENProcess 254 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 270 -NGENProcess 24c -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 254 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2348
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 280 -NGENProcess 258 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 288 -NGENProcess 26c -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 290 -NGENProcess 268 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2168
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 258 -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:112
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 294 -NGENProcess 278 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 29c -NGENProcess 1f4 -Pipe 298 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 29c -NGENProcess 294 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3016
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 280 -NGENProcess 24c -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2852
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 280 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 280 -NGENProcess 2a0 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 274 -NGENProcess 2a4 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1088
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2a8 -NGENProcess 2a0 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2392
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2b0 -NGENProcess 290 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 270 -NGENProcess 278 -Pipe 2b8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1556
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 1f0 -NGENProcess 2ac -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2376
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 260 -NGENProcess 258 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:916
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 25c -NGENProcess 28c -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2716
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1dc -NGENProcess 2ac -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2404
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 244 -NGENProcess 258 -Pipe 224 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2456
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2ac -NGENProcess 258 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 1ec -NGENProcess 1d8 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 1d8 -NGENProcess 244 -Pipe 1fc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1c8 -NGENProcess 284 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2720
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 1d8 -NGENProcess 228 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1012
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1f0 -NGENProcess 1d4 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1d8 -NGENProcess 284 -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 258 -NGENProcess 2b4 -Pipe 1ec -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d8 -NGENProcess 1d4 -Pipe 29c -Comment "NGen Worker Process"2⤵PID:1328
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 244 -NGENProcess 2a0 -Pipe 1c8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2a0 -NGENProcess 258 -Pipe 2b4 -Comment "NGen Worker Process"2⤵PID:2372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 290 -NGENProcess 1d4 -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2364
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 270 -NGENProcess 244 -Pipe 290 -Comment "NGen Worker Process"2⤵PID:2248
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 280 -NGENProcess 228 -Pipe 2b0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2216
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 2a8 -NGENProcess 2bc -Pipe 270 -Comment "NGen Worker Process"2⤵PID:1632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 284 -NGENProcess 228 -Pipe 2a0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 228 -NGENProcess 1f4 -Pipe 280 -Comment "NGen Worker Process"2⤵PID:1656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 2c4 -NGENProcess 2bc -Pipe 278 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:932
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2bc -NGENProcess 284 -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2cc -NGENProcess 1f4 -Pipe 2a8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:1984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"2⤵PID:2964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 1d8 -NGENProcess 1f4 -Pipe 228 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2572
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1f4 -NGENProcess 2d0 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 2dc -NGENProcess 2d4 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2892
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2d4 -NGENProcess 1d8 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:1064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e4 -NGENProcess 2d0 -Pipe 2c4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1556
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2d0 -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 258 -NGENProcess 2e8 -Pipe 1f4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1172
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2d0 -NGENProcess 2ec -Pipe 2e4 -Comment "NGen Worker Process"2⤵PID:2924
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 284 -NGENProcess 2e8 -Pipe 2d4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:2824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d0 -NGENProcess 2fc -Pipe 258 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 1d8 -NGENProcess 2e8 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:2392
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 300 -NGENProcess 284 -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:1156
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2fc -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:1896
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 1d8 -NGENProcess 30c -Pipe 300 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 30c -NGENProcess 2e8 -Pipe 2fc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2168
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2e8 -NGENProcess 2f0 -Pipe 304 -Comment "NGen Worker Process"2⤵PID:2060
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 314 -NGENProcess 2f8 -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:1704
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 30c -NGENProcess 31c -Pipe 2e8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 308 -NGENProcess 2f8 -Pipe 1d8 -Comment "NGen Worker Process"2⤵PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 320 -NGENProcess 314 -Pipe 284 -Comment "NGen Worker Process"2⤵PID:1628
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 31c -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2f8 -Pipe 310 -Comment "NGen Worker Process"2⤵PID:2428
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 314 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:1488
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 31c -Pipe 30c -Comment "NGen Worker Process"2⤵PID:892
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2f8 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:2132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 314 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:2320
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 31c -Pipe 324 -Comment "NGen Worker Process"2⤵PID:1604
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 344 -NGENProcess 2f8 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:2240
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 328 -NGENProcess 338 -Pipe 344 -Comment "NGen Worker Process"2⤵PID:1912
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 314 -NGENProcess 2f0 -Pipe 348 -Comment "NGen Worker Process"2⤵PID:580
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 32c -NGENProcess 338 -Pipe 31c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 32c -NGENProcess 314 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:2116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 338 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 358 -NGENProcess 328 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:1156
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 314 -Pipe 354 -Comment "NGen Worker Process"2⤵PID:2644
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 338 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:3020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 368 -NGENProcess 328 -Pipe 364 -Comment "NGen Worker Process"2⤵PID:2688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 368 -NGENProcess 2f0 -Pipe 35c -Comment "NGen Worker Process"2⤵PID:952
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 314 -NGENProcess 360 -Pipe 338 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2852
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 330 -NGENProcess 374 -Pipe 368 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 328 -NGENProcess 360 -Pipe 36c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 378 -NGENProcess 314 -Pipe 32c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:956
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 314 -NGENProcess 378 -Pipe 37c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 380 -NGENProcess 360 -Pipe 370 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 358 -Pipe 350 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2568
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 314 -NGENProcess 38c -Pipe 380 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2956
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 330 -NGENProcess 358 -Pipe 374 -Comment "NGen Worker Process"2⤵PID:1596
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 390 -NGENProcess 384 -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:780
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 38c -Pipe 328 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1424
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 330 -Pipe 314 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2428
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 378 -NGENProcess 38c -Pipe 388 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 38c -NGENProcess 394 -Pipe 390 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3a4 -NGENProcess 358 -Pipe 330 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2364
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 378 -NGENProcess 3ac -Pipe 38c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1636
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 384 -NGENProcess 358 -Pipe 398 -Comment "NGen Worker Process"2⤵PID:1748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3a8 -NGENProcess 3b4 -Pipe 378 -Comment "NGen Worker Process"2⤵PID:1316
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 39c -NGENProcess 358 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:2468
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3b8 -NGENProcess 384 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:580
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 384 -NGENProcess 3a8 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:1904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 360 -NGENProcess 3bc -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:2508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 3bc -NGENProcess 3c0 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:2036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3ac -NGENProcess 3c4 -Pipe 39c -Comment "NGen Worker Process"2⤵PID:1388
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3c4 -NGENProcess 3b8 -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 3c4 -NGENProcess 3ac -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:2560
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3b0 -NGENProcess 3b8 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:1980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3c0 -NGENProcess 360 -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:1832
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3d8 -NGENProcess 384 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:1664
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1716
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1872
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
PID:1648
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:1196
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2724
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2988
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:3060
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1180
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1832
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1112
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2412
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:2176
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:556
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1140
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1948
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2148
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1624
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 596 600 608 65536 6042⤵
- Modifies data under HKEY_USERS
PID:308
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1120
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD5625f704ac2d1d2fa9c142273ee2386db
SHA12530c6d33fff4da18226638001eac7e9ee2b5978
SHA256acd63662e30d6cd5bc406a8bc0c49687417fe8d72571c074b1e279a3d1c6dc7b
SHA5128bfb460d3df823a70a2ba947b8562b59afbe69021ae230d54271f40230d0c10c811a51da95adb221e6b06160ea981965ab50be5b661a3d62735a72156f1541bb
-
Filesize
30.1MB
MD5ec10deb692499ee4d269e17ab496b43f
SHA1cffc323b797a7c168c982f7274fc1ff9d8fd6d97
SHA25659ac1e1c0e32b9165ef39c9a189dfc8fa398e3b16d682348785894f7dfc6eeb9
SHA5124faa8d788d5c19f608a6fcca2929bad9a37dab0b9f766e380d45e4624855e88b8cfa08683b1bf7129009c9d03ffa46ef35a86a2ccf19410e1583ea9928f3d38a
-
Filesize
781KB
MD5815f14877cac2a59ffa2e444a8f41c9d
SHA1e53f00ea49b23c186db57ba7f01826fe87b88269
SHA25620d2030a2ece3e0f8ceff86e66cff73e03127844b6605dba7ea962367f7cc185
SHA5123f5858a381b16f5d4c212d718cfd709a468002a1ca39f00bd474a93f9e0148b0444bf876694430b4ef62a726c2dec99d776e65296228a806c84e368ecae1626e
-
Filesize
5.2MB
MD5007cbd412e105518994535bb51b412e0
SHA1670ab05bfc93fa2166131d4ceb716a3edbfd8209
SHA256f6a9b578c7b24c18d9a7c785ffc3c7f28a2d8788f52f974eee774ed045644ff9
SHA512368bb0627c7c03f609d07fbb812b399ae4eeffb7375cc5878c0659d1f3a6a8a1f712ede63de48f252cf7141c628077b86dcc28e666eeb41d2cc8919ff0b9e680
-
Filesize
2.1MB
MD52a5b25c0985750314f493f568e8cf65c
SHA1aa5f3e4f0d2b500a5275780cf69127cb9418b4d3
SHA2562862bdd6015f2e1f5f5e9e1498716f31608a00386dd4aa3e09455da61b2b3811
SHA5122e562d6f5e47ca6c85fe77780ea8f3a918d52bc2034922f4e1a043322748aa7d70c63fd57a5061914feec8696848e00055e38c67052747b8e3b8ca77ae3a0fcd
-
Filesize
2.0MB
MD5e446154ccbf3fd852a06df4ca1cbb5f6
SHA1f684f28940697c3c3e640d7eda4befd1779cf045
SHA256312514d9b2c052d1c52a67321b34ef45e8ea57d24da0d500afefa585df47bbeb
SHA512e8349e393d3e5b3f9df289ef7035151fcffd49f73b4c20fa128d09db3b33351267f0d242cc06d030bf8b7e8b5828255ea39be3879f1bb728954e1ae2a6fe9bc9
-
Filesize
1024KB
MD5e4e8bd22f7cb41cb482ed6d096f5454a
SHA1fd9e9fbb155380f3cebd918891f934e7e2b9939f
SHA2564e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7
SHA512a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
648KB
MD554b376dce71021da27b16fa6133d8df7
SHA117716ca79d19a025a07ea399d4128d05b842fb9b
SHA256b9796befe13cd6fc20588f73810a5949ff5e0b2d35b8176e461f036eff2c876b
SHA5129932126c64b27f46c0bc9048ad03c07ee15e7891f21dc18ec8b72808a5e077de89d4bb597922f6203cbc7b9934be28e3dd7c8a379a3417c8996661156114cc2b
-
Filesize
872KB
MD533e7f888be4dcf1b36e50132e9dbca15
SHA1433dcc39cadab416beee5f6a4cd962b03707db84
SHA25604fd9e6d319ad66c823fc58df1724597c4a7db7814cce4c10fb4fa2485756e43
SHA512d5d2cffbc380000da3b13825e444a16eb3c901cdd379b673c442d359799b23a62454b55ed90cbfd82c8859c800c5f7e527d65bcfa1f66732003404978f5b4819
-
Filesize
678KB
MD561f98b918d68a98f8870f2a9234eda80
SHA11bd06595ea01ef55246b9d42562756c9550df231
SHA2560034520b27958769330ae41f2ec793343c890a58e7a17123f9d1cb3f768858ca
SHA5129e0d36cee5b17ae1b4895a7beeeaf38600ea7d5a9e940251fe301f36455793e5eb644f7f227653bcb416a3d01a942893276daeaa8569730e629d708804e5e648
-
Filesize
625KB
MD5da027c703719e46ebbc791da804e54d6
SHA1a019b350a84c3f4408882b8310c7649059ad4d2d
SHA2566ca001d812a7ca472b5eca38d3dfb5e9504a554a95897209e6d9c863a20594b4
SHA512693b08aa0298ec06e76f26cd67aff44a20dd15a31fb41ac79dbb0b7625807e2f84a7efa653550c42f55ebc4b173bcc8faa0e24bc2ed5e2e411fb707ce2a23dfb
-
Filesize
1003KB
MD52d5306039028690c909167eb18c2a702
SHA1be2c8ea9351a37694991671a9f9bcfc8ca4618c2
SHA2561a0c1d059bfbfbffa5a150a22831208c04d91d07f2162974845aa1e28ebc90a1
SHA512953adaf50f6e98f9bdd35506d7a3e7d93a8aa6bb9960ad3c59f9ee30596a6d8f535cdc0baa51a19cf656a29bfeb796f4b686de09c76fbe5298f85cab1f7cdb0f
-
Filesize
656KB
MD517f4a575e9b48405f66dba3eddbb76b4
SHA1e68fb10df4049d5dd16e0251c1ce89a4691ca7a7
SHA2566956ec5d9cb0579ff31ed727cb47bee9542318058a2f5680ef7e3b385a81c0e1
SHA512eb3eade7b588e4e7a1b83362e5849240baf4929d85233c6b025366b8ef5dfce404e680c27b9ed6215c68b496e07b25afc4cd17752588e91ade71683506910627
-
Filesize
8KB
MD58c50adddc5c4b3ec139e08aeb41cf177
SHA17ea65094a0fa3fadf79af9b210ea317954460192
SHA256964b4973076018cad3588d950f5462f5322ba27873aed49d8ee243409d84961c
SHA5121ffba5aec9bc9c718b688ae97c36941410410c6d2559692e946dc33f66f28e85e9eda4a363a019c7851eac49ecdae5769d147bfea6530af192c38a9d5d95fe96
-
Filesize
587KB
MD57c7e871374e22ae1000432ee0211dd2c
SHA15e4b23d46f93cc918240c6f66b1d33466f6e6671
SHA2563486145d94b50e4fad946ad19b3afdf5b881da48dbade3479abb5d03ae6ef22b
SHA512e245e8ff791cbb9d30db441b2495ea9538e5b48ecbf825a7626f6b1618f1dd07ee61c5a2b7f46682ac31528931da9eb1f0d346a8dcc1cb056370a98c088f81d5
-
Filesize
1.1MB
MD544e41d807fcbfd79ba434a08ddc2e1a6
SHA1072722145e6283716356b5fdf5903c3ec3b32be2
SHA256a51456ae12233c90a3af588da16daa52a0062f3eb4597c2d462d6d034c69587a
SHA5128e72b3507949b5fc602af9f162ab6bac42c2d8db2da202148d58a7e20514d50170295dcb0d3024c5055c8d8260b9d46c62556d8b2c5479dca1d427a2f5e9b1c9
-
Filesize
2.1MB
MD51d1c525dcea850b8b2c292babc897291
SHA1a43006e9c2dea5d03c7a727791324fe0b9df7172
SHA2560eb84d937a8d13caf0838b01cd37fed3623b0cd525b5ad46e494c0a91dfaa86b
SHA5125aca26ab2dc09dc8e1b11124bee52810ec9e98fd6bc632f62980e6ffb56a4f9ca26c26417a0d72ad72a0a965060fe3088df63c083d080bac7eb7c3439e70b83e
-
Filesize
581KB
MD5c9af01aec231f1c79d943fce9e97fe00
SHA147f73a86f5a69e8109ff11a440ed81dee52d8a5a
SHA25656e79482b97594acab0eef4cc4d69292e6f8596a47f8dfd2bc8ec22b81120b8b
SHA5123e07c870280d2e0af562f68bb3aebcd2222dc60a1ba59d7898ece60f13c0c9472b9d4d873b6670d15e2195470499c6a96093fb4c037d7490d54af2960dba31dd
-
Filesize
1.1MB
MD5feefa73e477484ebefe05c91a66ede30
SHA143b0235b04b8d4a215293d6584c0d5958be9c144
SHA256d4dedc4b1969fb0312aeaaa0f17d67a9b36cdd802a2497c3ae67384213605e1b
SHA512fed51f376da9ab8eae9763c45e331f7f94992b00d4b99ed4407928d7ddf7765470adfadf189d454989cc42b0417eca11d650d7e6820b2272713aa8eeab94226f
-
Filesize
765KB
MD5d45b6a16a3a01cec805c7e74b41d12a6
SHA18080af1c3b742b75e867240008748b62e7be332f
SHA256f4ecf7e230828f6174c9057d4a5288aed519754dabae7f73f717a2d8f742504f
SHA51294182ed1aadd9e29583cbe23556a41becde38210096fdf240a981a528d6ffb7664e29c0f53bc0073a9b83341d8884ea7c14fee016bcb68ee708d06a6943eeb0f
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
Filesize834KB
MD5c76656b09bb7df6bd2ac1a6177a0027c
SHA10c296994a249e8649b19be84dce27c9ddafef3e0
SHA256a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
SHA5128390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize797KB
MD5aeb0b6e6c5d32d1ada231285ff2ae881
SHA11f04a1c059503896336406aed1dc93340e90b742
SHA2564c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
SHA512e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Filesize163KB
MD5e88828b5a35063aa16c68ffb8322215d
SHA18225660ba3a9f528cf6ac32038ae3e0ec98d2331
SHA25699facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
SHA512e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Filesize1.3MB
MD5006498313e139299a5383f0892c954b9
SHA17b3aa10930da9f29272154e2674b86876957ce3a
SHA256489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
SHA5126a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
Filesize148KB
MD5ac901cf97363425059a50d1398e3454b
SHA12f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA5126a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\00cf0faa3d37faa0ea2d240c1ca307ef\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize143KB
MD575c84340d765d73eac1c743a31b6571a
SHA152aeef700a52b8e687316f42816eb9c0599354df
SHA256b72a1f7da8b3c3dc95c2252319f6f3e71c81ed8bd59a5b31bd2861e14c364459
SHA5129a9cdbc3a103e733150fae265c594dd7378ca402521387e466732f2431472a6a0e6cb4dfe02fe9f5b975a1739c685471ad2a4dddcdf6f12c4b5be469832fd5f1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize34KB
MD5c26b034a8d6ab845b41ed6e8a8d6001d
SHA13a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize109KB
MD50fd0f978e977a4122b64ae8f8541de54
SHA1153d3390416fdeba1b150816cbbf968e355dc64f
SHA256211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize41KB
MD53c269caf88ccaf71660d8dc6c56f4873
SHA1f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\469170eb16e00ef07ac7e7b8725873bf\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize187KB
MD586b3d7f752b7a73d1665d7739b07e7e6
SHA121b8fb096dfa60a5920aab593694fc3133693fee
SHA25620a7d0f7c9b66173f746bef93a1631b75d42b6adbbb1b89c679bf6b368c5583c
SHA51282df74e44e2db61ee1b971ff0ce2cbb2bd917dc4d4f1f9602073b5922afad61432bc0f875a0b125304f722305b343b2827540533fac16b830567449d8b58a748
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\594f0c784603398252b707f84e3d151c\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize83KB
MD536c4ae683f8e5081c6767b457643b594
SHA1e33e4e74e63da06e85bd42e5026504d1145509ec
SHA256078611b463e078421e520435b30201414fe9b23f64553a7530f64acd864d6110
SHA512bde6f4cd23c298f9f7ad009de4a5d01e95b9ec353a9931308b137a9350c49f27e692ac2c9f66c0dc3a83ff599832444301706296f054ff431ed26df13c66cd70
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize210KB
MD54f40997b51420653706cb0958086cd2d
SHA10069b956d17ce7d782a0e054995317f2f621b502
SHA2568cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize53KB
MD5e3a7a2b65afd8ab8b154fdc7897595c3
SHA1b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA5126537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize28KB
MD5aefc3f3c8e7499bad4d05284e8abd16c
SHA17ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA2564436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA5121d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b9d132404eaf728ed15735dded12d367\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize180KB
MD5d4de1bebc223981091bf98c2fe12c3d4
SHA168798498f7f595d0b305fbb91c3b57bc69b559cb
SHA25607cf07f9d4b80c90fee78f5f6cf9711a41e27b6c0caec4c81f624b7eb598e098
SHA512171fc95b9455d452b257e2dcc2127d3b55c92e46fe8ea0d9cdf35058572a6b5a4be2f54de9b744d9fde9c2e31f853f69d069b3f1bcded098d3eb397317888b71
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize27KB
MD59c60454398ce4bce7a52cbda4a45d364
SHA1da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize57KB
MD56eaaa1f987d6e1d81badf8665c55a341
SHA1e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA2564b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize130KB
MD52735d2ab103beb0f7c1fbd6971838274
SHA16063646bc072546798bf8bf347425834f2bfad71
SHA256f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize59KB
MD58c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize42KB
MD571d4273e5b77cf01239a5d4f29e064fc
SHA1e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA51241fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
Filesize855KB
MD57812b0a90d92b4812d4063b89a970c58
SHA13c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA256897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
SHA512634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
Filesize43KB
MD53e72bdd0663c5b2bcd530f74139c83e3
SHA166069bcac0207512b9e07320f4fa5934650677d2
SHA2566a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
SHA512b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
-
Filesize
1.2MB
MD575bd86e152a15a464f3b83febc69ce80
SHA136a5c3a3d81e3dfdda2b0bc9ca8252e199e6441b
SHA2562cf6ae64a0e50213f1af407213a24b857e0180f3358e04d58bbeb374c51d055f
SHA512894635025a5e2d9aedbbfafcb3e346054ba8d575405eff0edcc4a9fb52c23694b641969c8516c819aeee5966c57b2bf9ce64fd09654132df6a51fb3d1398a30b
-
Filesize
603KB
MD591192c8f09c3e041433887d3477b67dc
SHA11b564677fc45143b6bd22127e64d775173fc2fb3
SHA2564c6b7001797fdbd7065f5088ab1aefd8154b29357fed64eef1d4ab6339c05cf6
SHA512844f98a8b759cedf655d763c510bdb692d654c5be14df3bc19f0791bb0ac053db25fff4bd5a1c0dd3a079c7f4b778d95279bfa41fc84acc846f09e7af43e912e
-
Filesize
577KB
MD55b96635c1328742d4821be7813904f0d
SHA1d45125966392befb76f49365904f63e3056da512
SHA256c720713efad69a499dc77682502ce65bf6954a376496fb136f1754eae2cce0bb
SHA512c30e5aa5abebab0d8693c19c07252c0dba8394f49c75f68eb81b327887e3fee111a7e17dcabfabd4b1248199b15bbd8b735b266517236ecf9a1d476d74b7f7d4
-
Filesize
644KB
MD5c3747e68d02da35148b76b9321e3ffe5
SHA14a8cccf0495509d7c04f7ba410c111bb126d35cc
SHA256688e217c083601824095efcc273e4937e993c11e803763a296b59ffdbf0a656c
SHA5122c199f43dd54f6e3b9a3d44b56ceac39b98001a13764935277eb6c0b33c67e013c674bbba354c65da60515218c12f8046f76c16dee0d2c32dd850328159ad814
-
Filesize
674KB
MD5cb094731802d1ff98a26a3368fdc4da2
SHA1954eb03bd6e7a345090a11ebd08fc93f8d89a1cc
SHA25664be9285059a0f7952b259ad1d6b51fd83ac363ef466c997fbaf4cbb79001c12
SHA512d32f39bd8dfe50256262879d10ca4f425b54d67b95a55aa78b0688b768ab264bf0af2f08b0c8e2fe7b3266cadea44710155bdc421b650d0932b268cf6d4ebdc1
-
Filesize
705KB
MD58330905a7fce673707689bba8e746a77
SHA184390445bd01a5fae55f9b6415c944b5e543e420
SHA2566c68cfcd52b1796a2dcb8c187155dbf34ecec26ff2ba9d8312bb2046d99b645d
SHA512f38d2a467a933d04e97273c519efa3df819b452e9d12fd517c6c6cd30cdd5d099fdeab971df9829b7c37b3823fa393ecc277229f0a7114f15de6d935180764a1
-
Filesize
691KB
MD574a984a17583e00ac14e887353444cba
SHA16173c4335602a3d52fe75eff88c0075cc667a748
SHA25613506101b410b56a07cc818ee83e2e96756e5c76a9cbf45bf05b08c91a08b044
SHA512e7b36660aacaedd55c0cb6416503c94fb69c552a9c7e80c5d04899baedb95a3a8fbc9a341ad94200886d11c7821e3f742e8ac4c0c53bb4d92f6e4df4862a1f87
-
Filesize
2.0MB
MD5a75cb33d4fc9cb6229158ed5185df45f
SHA1ff2923f844612a0f2b21ed9b29b90644a05f6459
SHA25643c1549437173cb2bf6e2635266de59a17fae4f928a41c85eed0844c0aee6f46
SHA512eda34315323dd54c6fc5d6de1515cf738c0a60dabb1d054092e64cd8dc1936b4ccac2fd433b26ac5c05f38b0f93232fd1aa6beff211af5a85aa90236bb24ff62
-
Filesize
691KB
MD5ec9797d11be67a50572b007efc206c56
SHA1b9a012f2504b3aeb3df48ff39e0f4f48a7c932c5
SHA2565697c80082d30a51aff051358c8494503cd6f9c187407d2b79070bec4e71fb98
SHA5126bd6ea462eef62b85013f70bd7024b6cf47941c90d8a976d36e4942ac7c9e0ffcf1bfce8bec586893260e76091d71af107b75f785022905516017b30498dc156