Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 13:40
Static task
static1
Behavioral task
behavioral1
Sample
54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe
Resource
win7-20240419-en
General
-
Target
54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe
-
Size
1.8MB
-
MD5
3624f361b17c39793fa03e67f80f8e95
-
SHA1
99dbca4835a44f46349295bc552b618bb97868a1
-
SHA256
54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4
-
SHA512
e829ee5477632ce5a0880699006fa094cd08022e4a973a8bbaf84487462a4cae5b35523f7fb5a83778bd0901742c770abc3c63a1715ead81f14a8ad4c4f76a1e
-
SSDEEP
49152:5KJ0WR7AFPyyiSruXKpk3WFDL9zxnSYurU1EYVTE/zK:5KlBAFPydSS6W6X9ln8rUZVg/zK
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
alg.exeaspnet_state.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRecvr.exeehsched.exeelevation_service.exeIEEtwCollector.exeGROOVE.EXEmaintenanceservice.exemsdtc.exemsiexec.exeOSE.EXEOSPPSVC.EXEperfhost.exelocator.exesnmptrap.exevds.exevssvc.exewbengine.exedllhost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exewmpnetwk.exeSearchIndexer.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid Process 476 2316 alg.exe 2560 aspnet_state.exe 2764 mscorsvw.exe 1436 mscorsvw.exe 2344 mscorsvw.exe 2856 mscorsvw.exe 756 ehRecvr.exe 292 ehsched.exe 1240 elevation_service.exe 624 IEEtwCollector.exe 2056 GROOVE.EXE 1524 maintenanceservice.exe 2660 msdtc.exe 2460 msiexec.exe 1596 OSE.EXE 1772 OSPPSVC.EXE 1452 perfhost.exe 2948 locator.exe 2092 snmptrap.exe 320 vds.exe 2328 vssvc.exe 1548 wbengine.exe 2820 dllhost.exe 1728 mscorsvw.exe 1904 mscorsvw.exe 2780 mscorsvw.exe 1416 mscorsvw.exe 1284 mscorsvw.exe 2612 mscorsvw.exe 1800 mscorsvw.exe 1644 mscorsvw.exe 3008 mscorsvw.exe 2600 mscorsvw.exe 300 mscorsvw.exe 2204 mscorsvw.exe 2340 mscorsvw.exe 2808 mscorsvw.exe 1424 mscorsvw.exe 1208 mscorsvw.exe 1148 mscorsvw.exe 1624 mscorsvw.exe 1204 mscorsvw.exe 492 mscorsvw.exe 380 mscorsvw.exe 1936 mscorsvw.exe 2248 mscorsvw.exe 1600 mscorsvw.exe 1864 mscorsvw.exe 2700 wmpnetwk.exe 1520 SearchIndexer.exe 3008 mscorsvw.exe 1980 mscorsvw.exe 824 mscorsvw.exe 1984 mscorsvw.exe 580 mscorsvw.exe 1172 mscorsvw.exe 2528 mscorsvw.exe 1072 mscorsvw.exe 1296 mscorsvw.exe 992 mscorsvw.exe 1996 mscorsvw.exe 2408 mscorsvw.exe 984 mscorsvw.exe -
Loads dropped DLL 56 IoCs
Processes:
msiexec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid Process 476 476 476 476 476 476 476 2460 msiexec.exe 476 476 476 476 476 736 580 mscorsvw.exe 580 mscorsvw.exe 2528 mscorsvw.exe 2528 mscorsvw.exe 1296 mscorsvw.exe 1296 mscorsvw.exe 1996 mscorsvw.exe 1996 mscorsvw.exe 984 mscorsvw.exe 984 mscorsvw.exe 1524 mscorsvw.exe 1524 mscorsvw.exe 2248 mscorsvw.exe 2248 mscorsvw.exe 2592 mscorsvw.exe 2592 mscorsvw.exe 572 mscorsvw.exe 572 mscorsvw.exe 2408 mscorsvw.exe 2408 mscorsvw.exe 2928 mscorsvw.exe 2928 mscorsvw.exe 2000 mscorsvw.exe 2000 mscorsvw.exe 2640 mscorsvw.exe 2640 mscorsvw.exe 580 mscorsvw.exe 580 mscorsvw.exe 2708 mscorsvw.exe 2708 mscorsvw.exe 2296 mscorsvw.exe 2296 mscorsvw.exe 1204 mscorsvw.exe 1204 mscorsvw.exe 2040 mscorsvw.exe 2040 mscorsvw.exe 1960 mscorsvw.exe 1960 mscorsvw.exe 2252 mscorsvw.exe 2252 mscorsvw.exe 1692 mscorsvw.exe 1692 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 27 IoCs
Processes:
54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exealg.exeaspnet_state.exemscorsvw.exemsdtc.exeGROOVE.EXESearchProtocolHost.exedescription ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\SearchIndexer.exe aspnet_state.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe mscorsvw.exe File opened for modification C:\Windows\system32\msiexec.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\System32\snmptrap.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe aspnet_state.exe File opened for modification C:\Windows\System32\alg.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\system32\fxssvc.exe mscorsvw.exe File opened for modification C:\Windows\system32\locator.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\dllhost.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\System32\msdtc.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\wbengine.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\39ce16bec1bd2e0a.bin alg.exe File opened for modification C:\Windows\System32\vds.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\vssvc.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe mscorsvw.exe -
Drops file in Program Files directory 64 IoCs
Processes:
54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exealg.exeaspnet_state.exemscorsvw.exedescription ioc Process File created C:\Program Files (x86)\Google\Temp\GUMC02.tmp\goopdateres_ml.dll 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe mscorsvw.exe File created C:\Program Files (x86)\Google\Temp\GUMC02.tmp\goopdateres_fa.dll 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe mscorsvw.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe mscorsvw.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe mscorsvw.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe mscorsvw.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe aspnet_state.exe File created C:\Program Files (x86)\Google\Temp\GUMC02.tmp\goopdateres_de.dll 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe mscorsvw.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe mscorsvw.exe File created C:\Program Files (x86)\Google\Temp\GUMC02.tmp\goopdateres_bn.dll 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe mscorsvw.exe File created C:\Program Files (x86)\Google\Temp\GUMC02.tmp\goopdateres_sv.dll 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe mscorsvw.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE mscorsvw.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe mscorsvw.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe mscorsvw.exe File created C:\Program Files (x86)\Google\Temp\GUMC02.tmp\goopdateres_sr.dll 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe mscorsvw.exe File created C:\Program Files (x86)\Google\Temp\GUMC02.tmp\goopdateres_iw.dll 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe -
Drops file in Windows directory 64 IoCs
Processes:
54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedllhost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemsdtc.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedescription ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7ABB.tmp\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6E1E.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index152.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{092FD6D0-B18F-4B49-8F3F-1E8D79138204}.crmlog dllhost.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP706F.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7475.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat mscorsvw.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index155.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP72EF.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPAAEF.tmp\ehiActivScp.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index142.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP761A.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP7BA5.tmp\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat mscorsvw.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{092FD6D0-B18F-4B49-8F3F-1E8D79138204}.crmlog dllhost.exe File created C:\Windows\Microsoft.NET\ngenservice_pri3_lock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6CF6.tmp\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchProtocolHost.exemscorsvw.exeSearchFilterHost.exemscorsvw.exemscorsvw.exemscorsvw.exewmpnetwk.exemscorsvw.exeehRec.exeSearchIndexer.exeehRecvr.exedescription ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10302 = "Compete with - and against - online opponents at the classic trick-taking, partnership card game of Spades. Score the most points to win." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10306 = "Overturn blank squares and avoid those that conceal hidden mines in this simple game of memory and reasoning. Once you click on a mine, the game is over." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{DD98D8E3-3CBE-48A1-A640-8B9E8B849DCC} wmpnetwk.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SoundRecorder.exe,-100 = "Sound Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10101 = "Internet Checkers" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\syswow64\unregmp2.exe,-155 = "Play digital media including music, videos, CDs, and DVDs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\displayswitch.exe,-320 = "Connect to a Projector" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\mip.exe,-292 = "Math Input Panel" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%CommonProgramFiles%\Microsoft Shared\Ink\TipTsf.dll,-60 = "Enter text by using handwriting or a touch keyboard instead of a standard keyboard. You can use the writing pad or the character pad to convert your handwriting into typed text or the touch keyboard to enter characters." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10060 = "Solitaire" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\XpsRchVw.exe,-103 = "View, digitally sign, and set permissions for XPS documents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-113 = "Windows PowerShell Integrated Scripting Environment. Performs object-based (command-line) functions" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit ehRecvr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090ed4a52cebcda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wucltux.dll,-1 = "Windows Update" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10057 = "Minesweeper" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%ProgramFiles%\Windows Sidebar\sidebar.exe,-1012 = "Add Desktop Gadgets that display personalized slideshows, news feeds, and other customized information." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ehRec.exeaspnet_state.exepid Process 1900 ehRec.exe 2560 aspnet_state.exe 2560 aspnet_state.exe 2560 aspnet_state.exe 2560 aspnet_state.exe 2560 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exemscorsvw.exemscorsvw.exeEhTray.exeehRec.exemsiexec.exevssvc.exewbengine.exealg.exeaspnet_state.exeSearchIndexer.exewmpnetwk.exedescription pid Process Token: SeTakeOwnershipPrivilege 2236 54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: 33 952 EhTray.exe Token: SeIncBasePriorityPrivilege 952 EhTray.exe Token: SeDebugPrivilege 1900 ehRec.exe Token: SeRestorePrivilege 2460 msiexec.exe Token: SeTakeOwnershipPrivilege 2460 msiexec.exe Token: SeSecurityPrivilege 2460 msiexec.exe Token: 33 952 EhTray.exe Token: SeIncBasePriorityPrivilege 952 EhTray.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeBackupPrivilege 2328 vssvc.exe Token: SeRestorePrivilege 2328 vssvc.exe Token: SeAuditPrivilege 2328 vssvc.exe Token: SeBackupPrivilege 1548 wbengine.exe Token: SeRestorePrivilege 1548 wbengine.exe Token: SeSecurityPrivilege 1548 wbengine.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeDebugPrivilege 2316 alg.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeTakeOwnershipPrivilege 2560 aspnet_state.exe Token: SeDebugPrivilege 2560 aspnet_state.exe Token: SeManageVolumePrivilege 1520 SearchIndexer.exe Token: 33 2700 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 2700 wmpnetwk.exe Token: 33 1520 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1520 SearchIndexer.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe Token: SeShutdownPrivilege 2856 mscorsvw.exe Token: SeShutdownPrivilege 2344 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EhTray.exepid Process 952 EhTray.exe 952 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
EhTray.exepid Process 952 EhTray.exe 952 EhTray.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
SearchProtocolHost.exepid Process 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe 1544 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
mscorsvw.exemscorsvw.exedescription pid Process procid_target PID 2856 wrote to memory of 1728 2856 mscorsvw.exe 53 PID 2856 wrote to memory of 1728 2856 mscorsvw.exe 53 PID 2856 wrote to memory of 1728 2856 mscorsvw.exe 53 PID 2856 wrote to memory of 1904 2856 mscorsvw.exe 54 PID 2856 wrote to memory of 1904 2856 mscorsvw.exe 54 PID 2856 wrote to memory of 1904 2856 mscorsvw.exe 54 PID 2344 wrote to memory of 2780 2344 mscorsvw.exe 55 PID 2344 wrote to memory of 2780 2344 mscorsvw.exe 55 PID 2344 wrote to memory of 2780 2344 mscorsvw.exe 55 PID 2344 wrote to memory of 2780 2344 mscorsvw.exe 55 PID 2344 wrote to memory of 1416 2344 mscorsvw.exe 56 PID 2344 wrote to memory of 1416 2344 mscorsvw.exe 56 PID 2344 wrote to memory of 1416 2344 mscorsvw.exe 56 PID 2344 wrote to memory of 1416 2344 mscorsvw.exe 56 PID 2344 wrote to memory of 1284 2344 mscorsvw.exe 57 PID 2344 wrote to memory of 1284 2344 mscorsvw.exe 57 PID 2344 wrote to memory of 1284 2344 mscorsvw.exe 57 PID 2344 wrote to memory of 1284 2344 mscorsvw.exe 57 PID 2344 wrote to memory of 2612 2344 mscorsvw.exe 58 PID 2344 wrote to memory of 2612 2344 mscorsvw.exe 58 PID 2344 wrote to memory of 2612 2344 mscorsvw.exe 58 PID 2344 wrote to memory of 2612 2344 mscorsvw.exe 58 PID 2344 wrote to memory of 1800 2344 mscorsvw.exe 59 PID 2344 wrote to memory of 1800 2344 mscorsvw.exe 59 PID 2344 wrote to memory of 1800 2344 mscorsvw.exe 59 PID 2344 wrote to memory of 1800 2344 mscorsvw.exe 59 PID 2344 wrote to memory of 1644 2344 mscorsvw.exe 60 PID 2344 wrote to memory of 1644 2344 mscorsvw.exe 60 PID 2344 wrote to memory of 1644 2344 mscorsvw.exe 60 PID 2344 wrote to memory of 1644 2344 mscorsvw.exe 60 PID 2344 wrote to memory of 3008 2344 mscorsvw.exe 61 PID 2344 wrote to memory of 3008 2344 mscorsvw.exe 61 PID 2344 wrote to memory of 3008 2344 mscorsvw.exe 61 PID 2344 wrote to memory of 3008 2344 mscorsvw.exe 61 PID 2344 wrote to memory of 2600 2344 mscorsvw.exe 62 PID 2344 wrote to memory of 2600 2344 mscorsvw.exe 62 PID 2344 wrote to memory of 2600 2344 mscorsvw.exe 62 PID 2344 wrote to memory of 2600 2344 mscorsvw.exe 62 PID 2344 wrote to memory of 300 2344 mscorsvw.exe 63 PID 2344 wrote to memory of 300 2344 mscorsvw.exe 63 PID 2344 wrote to memory of 300 2344 mscorsvw.exe 63 PID 2344 wrote to memory of 300 2344 mscorsvw.exe 63 PID 2344 wrote to memory of 2204 2344 mscorsvw.exe 64 PID 2344 wrote to memory of 2204 2344 mscorsvw.exe 64 PID 2344 wrote to memory of 2204 2344 mscorsvw.exe 64 PID 2344 wrote to memory of 2204 2344 mscorsvw.exe 64 PID 2344 wrote to memory of 2340 2344 mscorsvw.exe 65 PID 2344 wrote to memory of 2340 2344 mscorsvw.exe 65 PID 2344 wrote to memory of 2340 2344 mscorsvw.exe 65 PID 2344 wrote to memory of 2340 2344 mscorsvw.exe 65 PID 2344 wrote to memory of 2808 2344 mscorsvw.exe 66 PID 2344 wrote to memory of 2808 2344 mscorsvw.exe 66 PID 2344 wrote to memory of 2808 2344 mscorsvw.exe 66 PID 2344 wrote to memory of 2808 2344 mscorsvw.exe 66 PID 2344 wrote to memory of 1424 2344 mscorsvw.exe 67 PID 2344 wrote to memory of 1424 2344 mscorsvw.exe 67 PID 2344 wrote to memory of 1424 2344 mscorsvw.exe 67 PID 2344 wrote to memory of 1424 2344 mscorsvw.exe 67 PID 2344 wrote to memory of 1208 2344 mscorsvw.exe 68 PID 2344 wrote to memory of 1208 2344 mscorsvw.exe 68 PID 2344 wrote to memory of 1208 2344 mscorsvw.exe 68 PID 2344 wrote to memory of 1208 2344 mscorsvw.exe 68 PID 2344 wrote to memory of 1148 2344 mscorsvw.exe 69 PID 2344 wrote to memory of 1148 2344 mscorsvw.exe 69 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe"C:\Users\Admin\AppData\Local\Temp\54187d8a75d446cc5e34869f1f5917727133f4e008e0e1697838d91b05aabbd4.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2764
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1436
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2780
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1416
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 244 -NGENProcess 1ec -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 238 -NGENProcess 23c -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2612
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 25c -NGENProcess 24c -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 244 -NGENProcess 264 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1644
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 250 -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 1ec -NGENProcess 264 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 270 -NGENProcess 244 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:300
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 25c -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2204
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 24c -NGENProcess 1d4 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 244 -NGENProcess 27c -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1dc -NGENProcess 23c -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1424
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 278 -NGENProcess 27c -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1208
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 284 -NGENProcess 244 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1148
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 264 -NGENProcess 23c -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1624
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 23c -NGENProcess 1dc -Pipe 290 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1204
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 270 -NGENProcess 1ec -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:492
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 294 -NGENProcess 264 -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:380
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 1ec -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 278 -NGENProcess 2a0 -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2248
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 244 -NGENProcess 1ec -Pipe 298 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2a4 -NGENProcess 27c -Pipe 1dc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1864
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1728
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 22c -NGENProcess 234 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1904
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 1ac -NGENProcess 1b8 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 258 -NGENProcess 22c -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 248 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:824
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 1b8 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1984
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 22c -Pipe 228 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:580
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 1b8 -NGENProcess 22c -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1172
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 270 -NGENProcess 268 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2528
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 268 -NGENProcess 264 -Pipe 1c8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1072
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 278 -NGENProcess 22c -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1296
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 22c -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 280 -NGENProcess 264 -Pipe 1b8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1996
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 264 -NGENProcess 278 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2408
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 288 -NGENProcess 270 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 270 -NGENProcess 280 -Pipe 284 -Comment "NGen Worker Process"2⤵PID:2108
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 290 -NGENProcess 278 -Pipe 22c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1524
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 278 -NGENProcess 288 -Pipe 28c -Comment "NGen Worker Process"2⤵PID:992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 298 -NGENProcess 280 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2248
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 280 -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"2⤵PID:2300
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a0 -NGENProcess 288 -Pipe 270 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2592
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 298 -NGENProcess 2a8 -Pipe 280 -Comment "NGen Worker Process"2⤵PID:1448
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 25c -NGENProcess 288 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:572
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2a4 -NGENProcess 2b0 -Pipe 298 -Comment "NGen Worker Process"2⤵PID:396
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 1ac -NGENProcess 288 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2408
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 288 -NGENProcess 2ac -Pipe 25c -Comment "NGen Worker Process"2⤵PID:756
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2b8 -NGENProcess 2b0 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2928
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 1ac -NGENProcess 2c0 -Pipe 288 -Comment "NGen Worker Process"2⤵PID:1984
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 2a0 -NGENProcess 2b0 -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2bc -NGENProcess 2c8 -Pipe 1ac -Comment "NGen Worker Process"2⤵PID:2768
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a8 -NGENProcess 2b0 -Pipe 290 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2b0 -NGENProcess 2c4 -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:2784
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2c8 -Pipe 2b4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:580
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2c8 -NGENProcess 2a8 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:396
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2d8 -NGENProcess 2c4 -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c8 -NGENProcess 2d4 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:1956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2ac -NGENProcess 2dc -Pipe 2b0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2296
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2c8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:884
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2dc -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:1988
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2ec -NGENProcess 2ac -Pipe 2a8 -Comment "NGen Worker Process"2⤵PID:1220
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:1552
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"2⤵PID:1072
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2ac -Pipe 2e4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2ac -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2040
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:1956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2c0 -NGENProcess 308 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1960
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 308 -NGENProcess 2fc -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:1220
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2f0 -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:2244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 310 -NGENProcess 2ec -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:1700
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2c0 -NGENProcess 2fc -Pipe 314 -Comment "NGen Worker Process"2⤵PID:2108
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 304 -NGENProcess 2ec -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:1204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 31c -NGENProcess 308 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:2288
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2fc -Pipe 318 -Comment "NGen Worker Process"2⤵PID:840
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2ec -Pipe 30c -Comment "NGen Worker Process"2⤵PID:1320
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 308 -Pipe 310 -Comment "NGen Worker Process"2⤵PID:2664
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2fc -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:2572
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2ec -Pipe 304 -Comment "NGen Worker Process"2⤵PID:1936
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 328 -NGENProcess 338 -Pipe 32c -Comment "NGen Worker Process"2⤵PID:1300
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 31c -NGENProcess 2ec -Pipe 320 -Comment "NGen Worker Process"2⤵PID:3032
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 334 -NGENProcess 340 -Pipe 328 -Comment "NGen Worker Process"2⤵PID:1992
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 2f0 -NGENProcess 2ec -Pipe 324 -Comment "NGen Worker Process"2⤵PID:1944
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 344 -NGENProcess 31c -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:3008
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 340 -Pipe 308 -Comment "NGen Worker Process"2⤵PID:2024
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2ec -Pipe 330 -Comment "NGen Worker Process"2⤵PID:1708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 31c -Pipe 33c -Comment "NGen Worker Process"2⤵PID:2248
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 348 -NGENProcess 358 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:2640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 334 -NGENProcess 31c -Pipe 2f0 -Comment "NGen Worker Process"2⤵PID:1172
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 35c -NGENProcess 350 -Pipe 338 -Comment "NGen Worker Process"2⤵PID:308
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 358 -Pipe 344 -Comment "NGen Worker Process"2⤵PID:2964
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 358 -NGENProcess 348 -Pipe 368 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2252
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 348 -NGENProcess 334 -Pipe 364 -Comment "NGen Worker Process"2⤵PID:2244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 334 -NGENProcess 35c -Pipe 370 -Comment "NGen Worker Process"2⤵PID:1296
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 2ec -NGENProcess 36c -Pipe 31c -Comment "NGen Worker Process"2⤵PID:2248
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 374 -NGENProcess 358 -Pipe 350 -Comment "NGen Worker Process"2⤵PID:2640
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 35c -Pipe 360 -Comment "NGen Worker Process"2⤵PID:824
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 380 -NGENProcess 36c -Pipe 37c -Comment "NGen Worker Process"2⤵PID:1148
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 354 -NGENProcess 340 -Pipe 358 -Comment "NGen Worker Process"2⤵PID:1492
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 384 -NGENProcess 2ec -Pipe 348 -Comment "NGen Worker Process"2⤵PID:604
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 36c -Pipe 334 -Comment "NGen Worker Process"2⤵PID:2572
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 340 -Pipe 374 -Comment "NGen Worker Process"2⤵PID:1936
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 2ec -Pipe 378 -Comment "NGen Worker Process"2⤵PID:396
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 388 -NGENProcess 398 -Pipe 38c -Comment "NGen Worker Process"2⤵PID:2284
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 380 -NGENProcess 2ec -Pipe 354 -Comment "NGen Worker Process"2⤵PID:1644
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 394 -NGENProcess 3a0 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:2120
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 35c -NGENProcess 2ec -Pipe 384 -Comment "NGen Worker Process"2⤵PID:2024
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 3a4 -NGENProcess 380 -Pipe 340 -Comment "NGen Worker Process"2⤵PID:2340
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 3a0 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:1204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3ac -NGENProcess 2ec -Pipe 390 -Comment "NGen Worker Process"2⤵PID:2752
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 380 -Pipe 39c -Comment "NGen Worker Process"2⤵PID:1444
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b0 -NGENProcess 3ac -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:1732
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 394 -NGENProcess 380 -Pipe 35c -Comment "NGen Worker Process"2⤵PID:2528
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3bc -NGENProcess 3a8 -Pipe 398 -Comment "NGen Worker Process"2⤵PID:1980
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 3ac -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:2244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 380 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:1176
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3a8 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:1984
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3ac -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:1300
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 380 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:2232
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3a8 -Pipe 3bc -Comment "NGen Worker Process"2⤵PID:1900
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 3ac -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:1644
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 380 -Pipe 3c4 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1284
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 3a8 -Pipe 3c8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:1692
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d8 -NGENProcess 3e4 -Pipe 3dc -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1568
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3d0 -NGENProcess 3a8 -Pipe 2ec -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2060
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:756
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:292
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1240
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:952
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:624
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2056
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1524
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2660
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1596
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:1772
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1452
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2948
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2092
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:320
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2820
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1544
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 5962⤵
- Modifies data under HKEY_USERS
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD5d2c7eb17c3338c9016a399b0356fb9d7
SHA1ba3396b8ca880ac9a25e8076aaa8e4bf993fcdf8
SHA256525751ac0e634fb24a2f6606f4c2269737b2869b8f9d8c034ac6eef0392a9f09
SHA5122e215d14185bb04848b5fed2d69c7478781a508cddb67408582cb01ff89d6c40df43cb1a1bf343c14825058f71b64fb4c05c813d1ead79bc2d35ad2cc10275ce
-
Filesize
30.1MB
MD55d4d905cbd9c5120fe256bcc0e8182c8
SHA172b1aca57d002dc1cfdbeee217a900ed17f5cf56
SHA2568b9395f89eb19ad793e5ab8e6446a1822c11c0f64e74466f398052eeac8af309
SHA512dc27fced4e9296ac1223d86a82cc84026616148720caf696b824e2a5b2165b799db1c18040a903e933bde1331d2479706007fa94869e944989096fb6c57cae1a
-
Filesize
781KB
MD5671c170d291bd16b6ae25830908fbaf3
SHA11b8ba648fd53f7a69e2a59251ee5b270c8265722
SHA256340fb926a4dfec185ed179f99f4c694e0c0ded5a5cfebad32c9825e7356f8a9d
SHA512410eb5f29f9bc21de0f3fa962c722a7dfce164750effda59e980a186a51c6b429da3d9c996777e41b1049fe73f9c167e258d972b656aad39b7f2e0a8f3664ec9
-
Filesize
5.2MB
MD51d6caf19d4fbf875dc737074f8e7e1bf
SHA1c73e4454158b9134751fcbc84bf8702b9c2f65f2
SHA256553da04d05e78adb195762054b8e513ef32e38a43cce7fe52ddc4ae8c8a23914
SHA512f903fcd7d1fc8b31bc2fa4d6176e7b8bd2759d2b4a403595648cb67d2b8af5440571e3b727a7ce0e81a25dd1ba01b2cc84c9e71baaeb5a7cbbf4f3a9c02695e2
-
Filesize
2.1MB
MD50f5f46447ab3adb37ab3c31eb5078d79
SHA1cb94d1313b23c594bebad3a2b168f4787ad6c5ba
SHA256b051a72832ce77593eeeb818cf729165fb253bfe9066cec4ca5dcd8cf2e1a37b
SHA51279c83a28e84ceaea3fecb44d290e538233c62b85c9dd6b8273706551736bf4948591696529c13bbd01e89ab84973245e5d44787db614b826e0d5d66faab993e4
-
Filesize
1024KB
MD5e7f8217c603bfef3dac6c52ce5f0e0b6
SHA10098786af56fcd5cb825f50904c8b9e557dd7d17
SHA25662bad3f3509cb7790f8af73fa74a331f93f10a3243e2fa5412bc446fe48229f3
SHA512a0d0df51486f79f6531d221fb947d668f3b51e660ad62318e097fc7e0a842ee011ea84eadea5ddea446504ef9d70117e3664dca2fc7cdfb5d977d73003f1f40c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
648KB
MD5712f29b63da20c8ed134994625eee1b6
SHA1f7db318edd5d9075ea1c10ab2e12e691ec34499d
SHA25652c8d586df1cbbbf0b4e383e392dbddeb4c06610141516701a6168715e9e1f57
SHA512d04102cdb1eea25c788fc6b0f3f0b43ed4e75ec73e2d93c44b1169a9e13e48cf592d1e3d1e63fd9af15f161eec212fdee31468a10fe25df76f5a5cc20fbc3553
-
Filesize
872KB
MD5659d0beb4b93424230556a807f4f8f12
SHA159dcd31ad6963c7025593c205a189b16aa597f0b
SHA256b33813d1169ed490f90f5546c51d08518264bf1d1136a0ad96e126f99d6b6dc7
SHA512d8ceef1836a8e83e8d7e8dfea03b4a47254ffd2711931eb8c4da4c3f9f9bf1c9d1f2d1b3c71a7b2a066f6068525650faf0f8a23d80bd6f64a63ceeb0c5c2c6ff
-
Filesize
603KB
MD5979dc379e51ef04b430ac94d4a537486
SHA181580dfe1207ff726ea1bd25f6ae609aabe07393
SHA256fd4b02a2431a355bd258497cbd672ff38be0fccfb91d390975f941d1ca85366b
SHA51233db48b0d59be5b8d3c82387ce287fac084e35e6af625be3594c01b90a2a86a7ad33d2d6e5f9ca6647dc4aa02cd7f319a2a8d5638aa564a8eb472c50db0bd5f9
-
Filesize
678KB
MD50d48456bfbd80ce71dc5dd2795c4d534
SHA14e215f61b4971962377140a72bf1e0afef2ebf04
SHA256ec73ba8cec2ba797b40618160fa943c5a1cb5763043965dcfe8d6ef6fcd027ce
SHA5123feb9298ed48801cb9cd095a5e93184b08a86366c206fdcb361f1ce548e727283b166d0fd15d82c4a5c8db5d99ff78c93c1e1f342a0c4116906e0c5e82d0da0d
-
Filesize
8KB
MD5b7f1658bcf78adad35eabd544b8d9632
SHA1ae57641393f7998244c7d3df552b73912b20725e
SHA256fef150b3cb9c6f182b263af6ffe320b5124770eb22aebb5f7aa59229b3fbeb76
SHA51277afd3fec0b0fe39b4c1ba3e4020a2deb1fcd7fea6ce871962debc5399bd0669fe6ea066c7dcf755e3f7fc47547bc9438e441530c63e3c5918f64306bfc66630
-
Filesize
625KB
MD56becd1c650a13d275b1c0348981add35
SHA157b17df6ea37bf9d8012f5588829882cdfee9e7d
SHA2567e9c160b747041bd4ed978f6463c2c91635cbcfcc7e4ac6ef0995f37863ab47b
SHA51267817e208d671f9a0eb14df876d7bbd28c0c51d824e12037f2579bc2bba21b1e53e3557b9130dbf618884119eb6ca0eed255ab9cd1ca27bc7be2852c5a26a630
-
Filesize
1003KB
MD5b16acc1abf0fce20bf591028ed850e1c
SHA1cd5078ee78a741dfd2dce05f547112c61f29e055
SHA256af1c936bdffae5a1b7e3ffc654745c67cd62ac5304ebf234d32db1a19218f0fd
SHA51260d97fa27a33e5e19c5d2286090a5e87e3c4ecf558c2c84f917e1691e4829ec31b9553493de83b2eda329d7ea4e16d5a99e41eed6fd34504b1cf13dd52d13bd7
-
Filesize
656KB
MD52906b236ffb69ae0c8a7f0e9311a4221
SHA1168d42e042f4874ed412b70c7c59841e34b91f12
SHA256f13100fe40aed3f54b89cf1c45e1ee4b0622a2d032f761cfad4fe9f49b6d69ff
SHA512c4a0cae44953aac898d7f3c00652c980bb819a217a7c9dd366ec1eaa474f01a9e50d6a60b0910ccd9e2afe89a3fb50327bcf89e5bc7bcb3d9b2ae0d65877398b
-
Filesize
587KB
MD5cc4067cff539159549b831009a17dc5c
SHA18010553e4361692bd0384238db9e443c1017ec2b
SHA256e1738b712cf971d1d5061bd8082840c119ede110317797eeef1394b0d2fd27ed
SHA512ed64d9e90aef523e533d7f75264353ccde4605feaef65aea8f512fb655e9cd66381ddae2c4f269004e0ef8f1a977da1de4356956b2d9ab7396fefb002ad87eb1
-
Filesize
577KB
MD5957fbe6cae598714b5c0f6e1a9a30949
SHA1f405c94d5dab59e1b0f7468f0f25826cbf1f7672
SHA256c30792ae97077b590dee35692e0ae2225612bdebe4904938d2331f327eae6799
SHA512bddce61d857c83ffd8937c7bee74635db8154eb5cff0d77ff97ef331c2ab20fcf5831dbb3f51ba39207583ddb9f3ecd8edba11fd859f65d4946226b979acdc4f
-
Filesize
2.1MB
MD5219cdcf87ee76a0628203e6c93be4e7b
SHA1b450d119a457521d3c080212f16458470f2eadbd
SHA256b3baa69f675366db2fd3fcd00e8164d6b5071b11c14196675e1fc78d5aae497b
SHA512c4415b96a03a67e5a52f5814ad5950311c11d10320bdc6ca513838f6bee1498075ce264f3f0e993e86164c9d1f01c0a215213f0e2363d70109f068ea97050f9f
-
Filesize
644KB
MD56dbc605d5084114eade6763865620d85
SHA1afb8226dc999b98955e9c8e21424c9643cd2a7d8
SHA2560819d58f2d90cb381ae4c84f772c43afa597fc61df211ff599bb69bca32fec3d
SHA5126aa08b564208a38effad890b7c07056a191bd9247c6c0a4c4eb94f6d0a396eaff80e0c911b7ad100e510b745b37b3a45226bd9648c83f4cea7ce5f17f6ea293a
-
Filesize
577KB
MD5ff0c55c8c0ee949b6205157f2ec976a6
SHA1bbc1a184b4e4874bf24345d84526c82e3d83c6a4
SHA2567577c95bba6713a7ce761966a87166e177bc241f079322aeed9e18f0b1dc016c
SHA51228dbafd576a1fc9b612432cce5db61c1cafa1c70f21e8240303f2e5af170d414836bfae41005d2483fbc9a15c654e5198bb0c97ca6a7241aab042a15c1a0b507
-
Filesize
705KB
MD530b93aa7173a8bf2c9102ae7a222e029
SHA1e55eba4d80edfea281d553d735d2d6d59a5f1ed6
SHA256394d8e444cd44db37d9a7c8a24c867a0fa3a8e1ff071e2ada45092aa88d22f1e
SHA512b83c367b27f0b0d5ef167a4d5651c0ed89949528f67e448b1d43dd7dd7b8e3e0b6b9d45c6e3a7a74cf1cc5284ccb6fe3b1af1f6178143011aa1da50b740bf6a9
-
Filesize
1.1MB
MD54b21e72294680902ee8d383efce48c0a
SHA17147a71158d6d944e6434e2ec53d2fd45bb691a0
SHA256b074bbe28a09ab6ca60b6051c842be83cbce272b319f05c0f05ce80b78cc5ca0
SHA512cd1b786f1f94d0ba5b31297ba1bb59df38eb22fffb8fe72230939be03826ede055b5e02bedfe2a5d43421a050e9a2f51ad52258eb09d0f748556bd27aec57137
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
Filesize105KB
MD5d9c0055c0c93a681947027f5282d5dcd
SHA19bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA256dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
SHA5125404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
Filesize248KB
MD54bbf44ea6ee52d7af8e58ea9c0caa120
SHA1f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize1.0MB
MD5598a06ea8f1611a24f86bc0bef0f547e
SHA15a4401a54aa6cd5d8fd883702467879fb5823e37
SHA256e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
SHA512774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD53d6987fc36386537669f2450761cdd9d
SHA17a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA25634c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA5121d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize205KB
MD50a41e63195a60814fe770be368b4992f
SHA1d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA2564a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA5121c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0f44d1d6b3becf403bb6145d0aeaa777\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize122KB
MD578dcf229be294a9ede599f1cab4519d7
SHA190587bd0174b76191ffa35c8df106c29d6f4a3d3
SHA2568f8ebac826a00599afef15eee3a12cb9dc5a4efb8a8010a942f4e6ac7e7431da
SHA5128fdb38fcad1f4944ec7a9c9c14a75d0bf0953d8f36c459d42623a37d3846def36dec4165fe4ac909644be2d4f39f7a2b3ad00638bfe3607c3c01434b56625d5f
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize43KB
MD568c51bcdc03e97a119431061273f045a
SHA16ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA2564a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\29778c43853d2e1ba9b814b8d3315bd7\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize305KB
MD50d51b7aa5fc463410386540a574cd938
SHA1b88595b5331d272668865191f0ee4a9452edc392
SHA2564733d3b5dc6aad0ae602785da1f1d62b32212684d48ede2770ece7a934429991
SHA512549a8e0a04ecde707e7a22f1997be8792a07efd7a013a1cc7213450da83a460f93e321e92ccb7cf5dfa551c2833288dfba75da72b2462d288cdb3c021ec1c22f
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize198KB
MD59d9305a1998234e5a8f7047e1d8c0efe
SHA1ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA51258b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\442ef11b0900745533a2905922560c74\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize221KB
MD5c9aef79a6694e337a65b6bcbc073d8d3
SHA1635bed652aa713bd4ab3d00c8d357d33333971fd
SHA256ac302f7a05e00183589f60862cd049b6213bfff293317fdc9cf7fe57b2d47fa8
SHA5122d7abb03c94fbb28512a975f4b61d841e8f2a041d74d59b9d8e066dbd91b41f69b55e3b73577ce4894d0380e4df1cbc096b0d3a59b5839d6ae919571a97320d6
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize70KB
MD557b601497b76f8cd4f0486d8c8bf918e
SHA1da797c446d4ca5a328f6322219f14efe90a5be54
SHA2561380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA5121347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize87KB
MD5ed5c3f3402e320a8b4c6a33245a687d1
SHA14da11c966616583a817e98f7ee6fce6cde381dae
SHA256b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\8aafc7e96cf8a209f844fc1fad01a947\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize271KB
MD547ef4ffe37297b5346d896a2880e4f6e
SHA194a4391e0a0742321a45342b60974ceeaea761e6
SHA2566d9b3f1567e842a9d1375077ec48cacee2ac55534e3a3528896d0c95909d06e5
SHA51279d7a741e578c188d8696bcf7dac59fd8c40ff669a7c4fbda8d74ea7ec1a54360d1f54726e2118f9f2a3b6aa71e9903eec8f9450622fe1988347dc500fd1001e
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize82KB
MD52eeeff61d87428ae7a2e651822adfdc4
SHA166f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA25637f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD5a8b651d9ae89d5e790ab8357edebbffe
SHA1500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA2561c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize85KB
MD55180107f98e16bdca63e67e7e3169d22
SHA1dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA51227d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize298KB
MD55fd34a21f44ccbeda1bf502aa162a96a
SHA11f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA2565d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA51258c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize43KB
MD5dd1dfa421035fdfb6fd96d301a8c3d96
SHA1d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA5128e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
Filesize124KB
MD5929653b5b019b4555b25d55e6bf9987b
SHA1993844805819ee445ff8136ee38c1aee70de3180
SHA2562766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
SHA512effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
Filesize2.1MB
MD510b5a285eafccdd35390bb49861657e7
SHA162c05a4380e68418463529298058f3d2de19660d
SHA2565f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
SHA51219ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
Filesize88KB
MD51f394b5ca6924de6d9dbfb0e90ea50ef
SHA14e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA2569db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
SHA512e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476
-
Filesize
1.2MB
MD55e9b3dcf4beb6b930334f405761e688c
SHA1634882cb5f79d5bfae37e75000833eef2b83adf9
SHA25602eaf5cef41c539de5af1598e1278438fc7e2cef880600affea58132b9edf296
SHA5125d3050d51ef7ebee4ded52cf18dd0b7a8e92d6f3a45e04fd09f146a13b71cb79ffb912b8b50712d4eec1a635f6a67098c610bc7dd10f7db1724fafdd1debac13
-
Filesize
765KB
MD575ee4b6537e38a08cc64ec808effa190
SHA16ad1f6f10eed7e689aea11e8ea030e0b4ad34651
SHA256f47666e2457617c5ff3fafeec7b86fe3eb38537b0c4769f7e91f386c312c31c0
SHA512b21999e045aa89f7cbf4bff96098621f78ede178faded74ba1cac5fb18235bcde4ad96f1a46c8e9117edf7e852721b2bb6d98ab15fcc89896d1adba8a6a98a79
-
Filesize
674KB
MD5f9107689064724bc54c2b9508d68635c
SHA19e8039b0564692ee0b40635762f07b3e578c8f29
SHA256881640c25b9672f16a6cd104f7654f43e64af9e54c512a1f257beaa692392c91
SHA512e63ebabe4d7c947f4d987baf58a357bd773c6db14cf67e320b2722eb57498f099573ade7775c635e2bc1c7a6bc517f982ad3b295214fb9a7cd396bb6d5eb1824
-
Filesize
691KB
MD56d7c93558a992a1cbfff1f5612c06a64
SHA111d4e07358d4b070267294885dc681d36bb32a4d
SHA256d49f351d6dbe880137ecb954557e506a7cdcf2fdae433f26f732122084898751
SHA512d534ef08d9b49ff0f9135504d27430faac276c38fee7b7e4769ea2bd958e4ea796887cf6374de2d3516aed17eab3867a73c8ed19442ebac70f5d95212cfe58da
-
Filesize
581KB
MD5f2b91c1029d41422846b2c6073c18c95
SHA16ddad3d302c04938f878829cacd24eac63b62288
SHA256bbbf660e7694e54e4728e73b00f7586c837057a53c5bd7b53d8f46bcbf14a5b9
SHA51226a2d771385d4cc1ebd87b510251a260e4559119c7c3f0779e4bb4f620a37ffcf6b10c59649e3a68011933891616eda1df29fed8d7cc19f36a5b8227d20ca9c5
-
Filesize
2.0MB
MD5379f3390f0c98cc028156f5022879d99
SHA11207647accc82fa8fda4cfef26f18865c17993ef
SHA256b64db26c2f3756b06f4fe748f733c778c6c20ddf4729641e453c3406a06a14fa
SHA512769a441537c889908e4cceead785c189f48bf28ba2f99f7bcb1f8c6322388509e914f77651cdd6e0467af4f7cf0207e2b12eed0243318d1c1f50bada8c2d185c
-
Filesize
1.2MB
MD5c6f5cc0dd18865d3cccc4b7ae33af524
SHA1f8b341a6fd2a399bfd4f89729cfd22a218122730
SHA25618237e97f20218816c2e3c3c7bb8c9cd0b5dfb8a9925d0d02aa0dcfada224816
SHA5122b066f6031a7cd41857188403905c0148246408d7c1a79d9bf223e7e4f516c28ef0602e6b50a597ebb58c8d8fc358582f535b1c576d71e1fed55f5bfd8c01b75
-
Filesize
691KB
MD58dbd50b38a6d1ea6f09f52d75865bf90
SHA1bfa13d8a7b3325563ed52859209dc0d42910c7dc
SHA256e3088f2b2f1ff12f01a4617e6cb95605e7e63cfb2493ef590149a588b75d02a8
SHA5126878530c7f6151253ee000b4f5a226cc41cba9b248dcb91dd1e453543818fbebbfa18e4d51b0a4846e83de6acbf9101fbfa25ba57c9a5e4b1d99dc842b9dbfcc