Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe
Resource
win7-20240611-en
General
-
Target
4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe
-
Size
723KB
-
MD5
4f2823344e9ba6371b5ac94c63d02c90
-
SHA1
6df7d830bf917d1ca8b11d7d360e73de7c63dcae
-
SHA256
eece91e724a62f4fa143b706578f6b73b51d3a58bef2e65168c960e1437e1e51
-
SHA512
85266afedd0be0293f158593efcd86599816310db4a22136d681ed04b1f15f6a15e779e71e3d05714690bb320efca7776f4147d16887291d8b26444ef187c391
-
SSDEEP
12288:CJFGzdZcEAMubvjkcH34IGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAZ:CfGxypdkt/sBlDqgZQd6XKtiMJYiPU
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
alg.exeaspnet_state.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRecvr.exeehsched.exeelevation_service.exeIEEtwCollector.exeGROOVE.EXEmaintenanceservice.exemsdtc.exemsiexec.exeOSE.EXEOSPPSVC.EXEperfhost.exelocator.exesnmptrap.exevds.exevssvc.exewbengine.exeWmiApSrv.exewmpnetwk.exeSearchIndexer.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedllhost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid Process 468 2588 alg.exe 2692 aspnet_state.exe 2520 mscorsvw.exe 2952 mscorsvw.exe 1412 mscorsvw.exe 1188 mscorsvw.exe 1660 ehRecvr.exe 1728 ehsched.exe 1828 elevation_service.exe 1884 IEEtwCollector.exe 820 GROOVE.EXE 1604 maintenanceservice.exe 2080 msdtc.exe 2472 msiexec.exe 1712 OSE.EXE 2644 OSPPSVC.EXE 1340 perfhost.exe 2796 locator.exe 1792 snmptrap.exe 1432 vds.exe 2076 vssvc.exe 2880 wbengine.exe 1324 WmiApSrv.exe 2684 wmpnetwk.exe 2944 SearchIndexer.exe 2516 mscorsvw.exe 2676 mscorsvw.exe 2716 mscorsvw.exe 1588 mscorsvw.exe 2676 mscorsvw.exe 584 mscorsvw.exe 396 mscorsvw.exe 1132 mscorsvw.exe 1640 mscorsvw.exe 924 mscorsvw.exe 2564 mscorsvw.exe 376 mscorsvw.exe 2528 mscorsvw.exe 2284 mscorsvw.exe 520 mscorsvw.exe 2736 mscorsvw.exe 376 mscorsvw.exe 2528 mscorsvw.exe 1664 mscorsvw.exe 1508 mscorsvw.exe 616 mscorsvw.exe 2736 mscorsvw.exe 2940 mscorsvw.exe 1588 mscorsvw.exe 1664 mscorsvw.exe 2292 dllhost.exe 2236 mscorsvw.exe 1588 mscorsvw.exe 1336 mscorsvw.exe 1684 mscorsvw.exe 852 mscorsvw.exe 2516 mscorsvw.exe 956 mscorsvw.exe 1744 mscorsvw.exe 2592 mscorsvw.exe 1044 mscorsvw.exe 320 mscorsvw.exe 2860 mscorsvw.exe -
Loads dropped DLL 63 IoCs
Processes:
msiexec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid Process 468 468 468 468 468 468 468 2472 msiexec.exe 468 468 468 468 468 756 468 852 mscorsvw.exe 852 mscorsvw.exe 956 mscorsvw.exe 956 mscorsvw.exe 2592 mscorsvw.exe 2592 mscorsvw.exe 320 mscorsvw.exe 320 mscorsvw.exe 796 mscorsvw.exe 796 mscorsvw.exe 1480 mscorsvw.exe 1480 mscorsvw.exe 1588 mscorsvw.exe 1588 mscorsvw.exe 920 mscorsvw.exe 920 mscorsvw.exe 1044 mscorsvw.exe 1044 mscorsvw.exe 672 mscorsvw.exe 672 mscorsvw.exe 1244 mscorsvw.exe 1244 mscorsvw.exe 376 mscorsvw.exe 376 mscorsvw.exe 1316 mscorsvw.exe 1316 mscorsvw.exe 1756 mscorsvw.exe 1756 mscorsvw.exe 2304 mscorsvw.exe 2304 mscorsvw.exe 1612 mscorsvw.exe 1612 mscorsvw.exe 564 mscorsvw.exe 564 mscorsvw.exe 2748 mscorsvw.exe 2748 mscorsvw.exe 2084 mscorsvw.exe 2084 mscorsvw.exe 1708 mscorsvw.exe 1708 mscorsvw.exe 2892 mscorsvw.exe 2892 mscorsvw.exe 2860 mscorsvw.exe 2860 mscorsvw.exe 480 mscorsvw.exe 480 mscorsvw.exe 1364 mscorsvw.exe 1364 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 25 IoCs
Processes:
4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exemsdtc.exealg.exemscorsvw.exeaspnet_state.exeGROOVE.EXESearchProtocolHost.exedescription ioc Process File opened for modification C:\Windows\System32\alg.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\locator.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 mscorsvw.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 mscorsvw.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\System32\snmptrap.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\32faa3ab8ab55808.bin alg.exe File opened for modification C:\Windows\System32\msdtc.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\System32\vds.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\msiexec.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\vssvc.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\wbengine.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe -
Drops file in Program Files directory 64 IoCs
Processes:
4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exealg.exeaspnet_state.exedescription ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe aspnet_state.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe aspnet_state.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe aspnet_state.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
Processes:
mscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exealg.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exe4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exemsdtc.exemscorsvw.exemscorsvw.exedescription ioc Process File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index144.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index149.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPFF36.tmp\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index156.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPF70C.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14c.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index154.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP253C.tmp\ehiActivScp.dll mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe alg.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe alg.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14b.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP232.tmp\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index145.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index147.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index157.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index159.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log mscorsvw.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE965.tmp\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index153.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
SearchFilterHost.exemscorsvw.exemscorsvw.exeSearchProtocolHost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeSearchIndexer.exemscorsvw.exeehRec.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 010000000000000030f4398226bdda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\msconfig.exe,-1601 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030ac338526bdda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10061 = "Spider Solitaire" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\XpsRchVw.exe,-102 = "XPS Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-142 = "Wildlife" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505 = "Sticky Notes" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030d5358726bdda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-117 = "Maid with the Flaxen Hair" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" ehRec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
ehRec.exe4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exeaspnet_state.exepid Process 2340 ehRec.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe 2692 aspnet_state.exe 2692 aspnet_state.exe 2692 aspnet_state.exe 2692 aspnet_state.exe 2692 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exemscorsvw.exemscorsvw.exeEhTray.exeehRec.exemsiexec.exevssvc.exewbengine.exeSearchIndexer.exewmpnetwk.exealg.exedescription pid Process Token: SeTakeOwnershipPrivilege 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: 33 2304 EhTray.exe Token: SeIncBasePriorityPrivilege 2304 EhTray.exe Token: SeDebugPrivilege 2340 ehRec.exe Token: 33 2304 EhTray.exe Token: SeIncBasePriorityPrivilege 2304 EhTray.exe Token: SeRestorePrivilege 2472 msiexec.exe Token: SeTakeOwnershipPrivilege 2472 msiexec.exe Token: SeSecurityPrivilege 2472 msiexec.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeBackupPrivilege 2076 vssvc.exe Token: SeRestorePrivilege 2076 vssvc.exe Token: SeAuditPrivilege 2076 vssvc.exe Token: SeBackupPrivilege 2880 wbengine.exe Token: SeRestorePrivilege 2880 wbengine.exe Token: SeSecurityPrivilege 2880 wbengine.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeManageVolumePrivilege 2944 SearchIndexer.exe Token: 33 2684 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 2684 wmpnetwk.exe Token: 33 2944 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2944 SearchIndexer.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeDebugPrivilege 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe Token: SeDebugPrivilege 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe Token: SeDebugPrivilege 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe Token: SeDebugPrivilege 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe Token: SeDebugPrivilege 2124 4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeDebugPrivilege 2588 alg.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe Token: SeShutdownPrivilege 1412 mscorsvw.exe Token: SeShutdownPrivilege 1188 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EhTray.exepid Process 2304 EhTray.exe 2304 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
EhTray.exepid Process 2304 EhTray.exe 2304 EhTray.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
SearchProtocolHost.exeSearchProtocolHost.exepid Process 1440 SearchProtocolHost.exe 1440 SearchProtocolHost.exe 1440 SearchProtocolHost.exe 1440 SearchProtocolHost.exe 1440 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 968 SearchProtocolHost.exe 1440 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
mscorsvw.exeSearchIndexer.exemscorsvw.exedescription pid Process procid_target PID 1188 wrote to memory of 2516 1188 mscorsvw.exe 56 PID 1188 wrote to memory of 2516 1188 mscorsvw.exe 56 PID 1188 wrote to memory of 2516 1188 mscorsvw.exe 56 PID 1188 wrote to memory of 2676 1188 mscorsvw.exe 62 PID 1188 wrote to memory of 2676 1188 mscorsvw.exe 62 PID 1188 wrote to memory of 2676 1188 mscorsvw.exe 62 PID 2944 wrote to memory of 1440 2944 SearchIndexer.exe 58 PID 2944 wrote to memory of 1440 2944 SearchIndexer.exe 58 PID 2944 wrote to memory of 1440 2944 SearchIndexer.exe 58 PID 2944 wrote to memory of 2132 2944 SearchIndexer.exe 59 PID 2944 wrote to memory of 2132 2944 SearchIndexer.exe 59 PID 2944 wrote to memory of 2132 2944 SearchIndexer.exe 59 PID 1412 wrote to memory of 2716 1412 mscorsvw.exe 60 PID 1412 wrote to memory of 2716 1412 mscorsvw.exe 60 PID 1412 wrote to memory of 2716 1412 mscorsvw.exe 60 PID 1412 wrote to memory of 2716 1412 mscorsvw.exe 60 PID 1412 wrote to memory of 1588 1412 mscorsvw.exe 82 PID 1412 wrote to memory of 1588 1412 mscorsvw.exe 82 PID 1412 wrote to memory of 1588 1412 mscorsvw.exe 82 PID 1412 wrote to memory of 1588 1412 mscorsvw.exe 82 PID 1412 wrote to memory of 2676 1412 mscorsvw.exe 62 PID 1412 wrote to memory of 2676 1412 mscorsvw.exe 62 PID 1412 wrote to memory of 2676 1412 mscorsvw.exe 62 PID 1412 wrote to memory of 2676 1412 mscorsvw.exe 62 PID 1412 wrote to memory of 584 1412 mscorsvw.exe 63 PID 1412 wrote to memory of 584 1412 mscorsvw.exe 63 PID 1412 wrote to memory of 584 1412 mscorsvw.exe 63 PID 1412 wrote to memory of 584 1412 mscorsvw.exe 63 PID 1412 wrote to memory of 396 1412 mscorsvw.exe 64 PID 1412 wrote to memory of 396 1412 mscorsvw.exe 64 PID 1412 wrote to memory of 396 1412 mscorsvw.exe 64 PID 1412 wrote to memory of 396 1412 mscorsvw.exe 64 PID 1412 wrote to memory of 1132 1412 mscorsvw.exe 65 PID 1412 wrote to memory of 1132 1412 mscorsvw.exe 65 PID 1412 wrote to memory of 1132 1412 mscorsvw.exe 65 PID 1412 wrote to memory of 1132 1412 mscorsvw.exe 65 PID 1412 wrote to memory of 1640 1412 mscorsvw.exe 66 PID 1412 wrote to memory of 1640 1412 mscorsvw.exe 66 PID 1412 wrote to memory of 1640 1412 mscorsvw.exe 66 PID 1412 wrote to memory of 1640 1412 mscorsvw.exe 66 PID 1412 wrote to memory of 924 1412 mscorsvw.exe 67 PID 1412 wrote to memory of 924 1412 mscorsvw.exe 67 PID 1412 wrote to memory of 924 1412 mscorsvw.exe 67 PID 1412 wrote to memory of 924 1412 mscorsvw.exe 67 PID 1412 wrote to memory of 2564 1412 mscorsvw.exe 68 PID 1412 wrote to memory of 2564 1412 mscorsvw.exe 68 PID 1412 wrote to memory of 2564 1412 mscorsvw.exe 68 PID 1412 wrote to memory of 2564 1412 mscorsvw.exe 68 PID 1412 wrote to memory of 376 1412 mscorsvw.exe 75 PID 1412 wrote to memory of 376 1412 mscorsvw.exe 75 PID 1412 wrote to memory of 376 1412 mscorsvw.exe 75 PID 1412 wrote to memory of 376 1412 mscorsvw.exe 75 PID 1412 wrote to memory of 2528 1412 mscorsvw.exe 76 PID 1412 wrote to memory of 2528 1412 mscorsvw.exe 76 PID 1412 wrote to memory of 2528 1412 mscorsvw.exe 76 PID 1412 wrote to memory of 2528 1412 mscorsvw.exe 76 PID 1412 wrote to memory of 2284 1412 mscorsvw.exe 71 PID 1412 wrote to memory of 2284 1412 mscorsvw.exe 71 PID 1412 wrote to memory of 2284 1412 mscorsvw.exe 71 PID 1412 wrote to memory of 2284 1412 mscorsvw.exe 71 PID 1412 wrote to memory of 520 1412 mscorsvw.exe 72 PID 1412 wrote to memory of 520 1412 mscorsvw.exe 72 PID 1412 wrote to memory of 520 1412 mscorsvw.exe 72 PID 1412 wrote to memory of 520 1412 mscorsvw.exe 72 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f2823344e9ba6371b5ac94c63d02c90_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2520
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2716
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 244 -NGENProcess 24c -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1d4 -NGENProcess 1f0 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2676
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 23c -NGENProcess 244 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:584
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d8 -NGENProcess 25c -Pipe 1f0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:396
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d8 -NGENProcess 258 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 1e8 -NGENProcess 25c -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1640
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 264 -NGENProcess 254 -Pipe 1e8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:924
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 26c -NGENProcess 25c -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2564
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 258 -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:376
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 248 -NGENProcess 268 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2528
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 234 -NGENProcess 278 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 234 -NGENProcess 248 -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:520
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 264 -NGENProcess 280 -Pipe 1d8 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2736
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 258 -NGENProcess 248 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:376
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 284 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2528
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 284 -NGENProcess 258 -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 260 -NGENProcess 274 -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 268 -NGENProcess 294 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:616
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 280 -NGENProcess 274 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2736
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 298 -NGENProcess 260 -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2940
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 294 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1588
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 274 -Pipe 234 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1664
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2516
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1c0 -NGENProcess 1c4 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2676
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1b0 -NGENProcess 1bc -Pipe 1f4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2236
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 25c -NGENProcess 23c -Pipe 258 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1588
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 260 -NGENProcess 24c -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1336
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 264 -NGENProcess 1bc -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 268 -NGENProcess 23c -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:852
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1bc -NGENProcess 23c -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2516
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 274 -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:956
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 26c -NGENProcess 268 -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1744
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 27c -NGENProcess 23c -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2592
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 23c -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 284 -NGENProcess 268 -Pipe 1bc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:320
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 268 -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 28c -NGENProcess 274 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:796
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 27c -NGENProcess 274 -Pipe 250 -Comment "NGen Worker Process"2⤵PID:660
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 294 -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 260 -NGENProcess 290 -Pipe 284 -Comment "NGen Worker Process"2⤵PID:916
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 29c -NGENProcess 274 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1588
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 274 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"2⤵PID:2604
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2a4 -NGENProcess 290 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 290 -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:1728
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2ac -NGENProcess 294 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:1044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"2⤵PID:2028
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 274 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:672
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 29c -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:1032
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 290 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:1552
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 294 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:376
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:2104
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:1464
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1756
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:2092
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:2304
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:692
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1612
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2916
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"2⤵PID:2672
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2f0 -NGENProcess 2e8 -Pipe 28c -Comment "NGen Worker Process"2⤵PID:1148
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"2⤵PID:1044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2d4 -Pipe 1b0 -Comment "NGen Worker Process"2⤵PID:1684
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2fc -NGENProcess 2e8 -Pipe 2e4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:564
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 2e8 -NGENProcess 2f4 -Pipe 2dc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2748
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2f4 -NGENProcess 2cc -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:2372
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 308 -NGENProcess 300 -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2084
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 304 -Comment "NGen Worker Process"2⤵PID:2764
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 310 -NGENProcess 2cc -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:1080
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 308 -NGENProcess 30c -Pipe 2ec -Comment "NGen Worker Process"2⤵PID:340
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 318 -NGENProcess 2e8 -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:940
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2cc -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:2264
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"2⤵PID:920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 2e8 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:1604
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 2cc -Pipe 310 -Comment "NGen Worker Process"2⤵PID:1840
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 30c -Pipe 308 -Comment "NGen Worker Process"2⤵PID:924
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 2e8 -Pipe 318 -Comment "NGen Worker Process"2⤵PID:2332
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 2cc -Pipe 31c -Comment "NGen Worker Process"2⤵PID:2928
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 30c -Pipe 320 -Comment "NGen Worker Process"2⤵PID:3056
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 2e8 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:532
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 2cc -Pipe 328 -Comment "NGen Worker Process"2⤵PID:1244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 30c -Pipe 32c -Comment "NGen Worker Process"2⤵PID:1536
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 2e8 -Pipe 330 -Comment "NGen Worker Process"2⤵PID:2064
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 2cc -Pipe 334 -Comment "NGen Worker Process"2⤵PID:340
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 30c -Pipe 338 -Comment "NGen Worker Process"2⤵PID:1276
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 2e8 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:1896
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 2cc -Pipe 340 -Comment "NGen Worker Process"2⤵PID:1360
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 30c -Pipe 344 -Comment "NGen Worker Process"2⤵PID:532
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 2e8 -Pipe 348 -Comment "NGen Worker Process"2⤵PID:2860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 2cc -Pipe 34c -Comment "NGen Worker Process"2⤵PID:436
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 30c -Pipe 350 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1708
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 30c -NGENProcess 360 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:584
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 370 -NGENProcess 2cc -Pipe 358 -Comment "NGen Worker Process"2⤵PID:1652
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 36c -Pipe 35c -Comment "NGen Worker Process"2⤵PID:1480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 360 -Pipe 364 -Comment "NGen Worker Process"2⤵PID:1556
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 37c -NGENProcess 2cc -Pipe 354 -Comment "NGen Worker Process"2⤵PID:1464
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 380 -NGENProcess 36c -Pipe 368 -Comment "NGen Worker Process"2⤵PID:2276
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 384 -NGENProcess 360 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:672
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 2cc -Pipe 370 -Comment "NGen Worker Process"2⤵PID:2516
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 36c -Pipe 374 -Comment "NGen Worker Process"2⤵PID:2736
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 10c -NGENProcess 384 -Pipe 360 -Comment "NGen Worker Process"2⤵PID:1360
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 10c -InterruptEvent 23c -NGENProcess 38c -Pipe 380 -Comment "NGen Worker Process"2⤵PID:1744
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 37c -NGENProcess 378 -Pipe 36c -Comment "NGen Worker Process"2⤵PID:860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 394 -NGENProcess 384 -Pipe 108 -Comment "NGen Worker Process"2⤵PID:2184
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 38c -Pipe 390 -Comment "NGen Worker Process"2⤵PID:2492
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 378 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:2748
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 384 -Pipe 10c -Comment "NGen Worker Process"2⤵PID:1732
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 23c -NGENProcess 38c -Pipe 37c -Comment "NGen Worker Process"2⤵PID:2084
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 23c -NGENProcess 3a0 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:2256
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 2cc -NGENProcess 38c -Pipe 1b4 -Comment "NGen Worker Process"2⤵PID:872
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 3ac -NGENProcess 39c -Pipe 378 -Comment "NGen Worker Process"2⤵PID:2104
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b0 -NGENProcess 3a0 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:2916
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b4 -NGENProcess 38c -Pipe 398 -Comment "NGen Worker Process"2⤵PID:1812
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 39c -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3a0 -Pipe 23c -Comment "NGen Worker Process"2⤵PID:1588
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 38c -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:2136
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 39c -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:2144
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3a0 -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:2220
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 38c -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:2592
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 39c -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:2928
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3a0 -Pipe 3bc -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2408
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 38c -Pipe 3c0 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:2892
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 38c -NGENProcess 3d0 -Pipe 39c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2084
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3e0 -NGENProcess 3a0 -Pipe 3c8 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2860
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3a0 -NGENProcess 3d8 -Pipe 3dc -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1624
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3e8 -NGENProcess 3d0 -Pipe 3d4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3d0 -NGENProcess 3e0 -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:1800
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3f0 -NGENProcess 3d8 -Pipe 38c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2436
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 3ec -Pipe 3cc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:1364
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3ec -NGENProcess 3d0 -Pipe 3e0 -Comment "NGen Worker Process"2⤵PID:2516
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3fc -NGENProcess 3d8 -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:2372
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 404 -NGENProcess 3f8 -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:1964
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 408 -NGENProcess 3d0 -Pipe 3f0 -Comment "NGen Worker Process"2⤵PID:1940
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 40c -NGENProcess 3d8 -Pipe 3a0 -Comment "NGen Worker Process"2⤵PID:3000
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 410 -NGENProcess 3f8 -Pipe 3f4 -Comment "NGen Worker Process"2⤵PID:1628
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 414 -NGENProcess 3d0 -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:2916
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 418 -NGENProcess 3d8 -Pipe 3fc -Comment "NGen Worker Process"2⤵PID:2240
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 3f8 -Pipe 404 -Comment "NGen Worker Process"2⤵PID:2784
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 3d0 -Pipe 408 -Comment "NGen Worker Process"2⤵PID:1060
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 3d8 -Pipe 40c -Comment "NGen Worker Process"2⤵PID:1004
-
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
PID:1660
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:1728
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2304
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1828
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:1884
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:820
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1604
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2080
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1712
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:2644
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1340
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2796
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1792
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1432
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1324
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-39690363-730359138-1046745555-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 5962⤵
- Modifies data under HKEY_USERS
PID:2132
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:968
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD532a0d399f03192df53ff31fd3c7fa924
SHA1baddfc894775d53f1a7c0ead0626bcee01bcd1fb
SHA256107f1dafa5ec91584b133dd0ab62e92a97b236f7962d76881b6f018843d43923
SHA5129101a51d7de1004314bc81cc978baf04470c17a9847684d0d3e18ea12eba66dca0dad764f3b129eb3ed232ac6506c9e58aebf183a520318146df0eae6b3c7216
-
Filesize
30.1MB
MD538db8db59e8aec6b94414293c3742899
SHA14b3eaa92c7dc2587cfbf11733ecc08bf3681f97f
SHA2568832460e6e679ed0ed3e10ded27f15522cce36dc0090fac9266adfbc35b86092
SHA5121a4dfdf1b12813491c204e706890b83a39326e5b75e86aef75b1cebc11184075ea52aa802e1ee4a60d02e1e79a7a1c18d2bc7fad1d94130daf053c5fb2976733
-
Filesize
781KB
MD57eaa98de62464ecc032d4c3990622e9f
SHA1afcf8d69e46ea724a797396685597f7562168841
SHA2565806dfb01187afbe2096e3e0700a7c7b6af5b260aec37da806fd64df74278a41
SHA5126bf7b805d85f545f2011df67fa036d88310d6c3a461f857be2b3302276931bbd5e5153ad9ff9d1027fc4d2945d846e106108fac6002e8174a686e8195cf85324
-
Filesize
5.2MB
MD5c56e5aaad610b7e591a2c60422b6e472
SHA1e6943574dbfd826dd1e8ae494603439dfc94a6ae
SHA2566219238affd82985745f72ae96b8e25400aa05c084ba3e015bfc9e56409438e4
SHA512eb8355ae0f87b93f005dfe8f0bb151b7f928dcd38ee315b26869bca076268b813a601452d96f487755b14d0c81f5e1dbde62c3339f61fdd23e0f2d9b1bc29bbb
-
Filesize
2.1MB
MD5d5f76051e88ac0ffadf819a7f16c09f3
SHA1714a4bf9eee978b0a44b70b7e9d499a69e458af5
SHA256c1e78981200aa0720ce078973f958de4a9c167c1116bd9882313aa29559c991d
SHA51232a78ceafec2940430114390bcf5d96d8b939ff709a16c21dcbdd305f04bb1934e5cda65793bdd0e629021edd7b858140b18990afe15a684b9f3f9ab421b9c84
-
Filesize
1024KB
MD563664cc4d4dc100feac6021bff35ff57
SHA13fe19cc8530d9ddd75f960333075887649a8be55
SHA256bafa4c7db3afe05f74bfef769eb33cb576f50349b4ac4d55963a50bd838fa0f5
SHA512095563b19086a5654ac2dfb8a8298927edacf99553f5ec5747e585b40905c592d96e3c634077836fa7ff6e092cb13e33eaff12f4a306906cae310a095464a424
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
Filesize24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
Filesize
648KB
MD5a815aa212763e48890e475686e46d929
SHA1e81048eeebf08bf4b8e3d26994c405aaaab186d0
SHA256505600ed8063d04b630cc6d92997fadfdc05a48c1dfe72b46b881fd1d7327860
SHA51251c9a1f01fddb50af9aa0e53ad0522eb18ceae201703dbb3f342766f245a6e2a09461d584bcb703bb67107263fa73dde94048737feae18844b1968c6e6ff01fe
-
Filesize
872KB
MD5471a10474e4a761d98757de2145b2b36
SHA1dcb67cb69acc4fc7b6b4786409b92117870a57e1
SHA256a288c5d6e5d9db21822b702ba3471084c60bdfbfe3c39be30222c682a954e20e
SHA512b1efcef21e86c4f5c6a581a9d2749d58b59a50b3a846d5974c5ab7a02459689dedb4b91d04fe0ea0eea26bf9cd8fcd76e3908fa6d1dd0c18afb83dfa017536d1
-
Filesize
603KB
MD5c9be5460e69e36e9d959309411081f84
SHA17c13e286cdcb27a874827d63fd8fbf154987e0cc
SHA25627501dce002da594e2fe9087ce7d1cd97dd46d1d496e123fee1f5f0273011416
SHA512ac4edc22a732b14d6de5ab0c229ba1a5cd33921ecdc94566da3f65b2726e3f025ed29587050ede46277c1ef11b17775696f7505ac4fc349f8e09388126cb6a72
-
Filesize
678KB
MD50aba6505767c4aa8514b14586c612eeb
SHA1dacfe196d6318a7096533cda9e2159e7b4724067
SHA25692de0f10d08065c431de0b643b8808473be04cce3afc4475fe8d62dc47f82c48
SHA512571414c6755f1d376f8d02eedd59bd2f89c8bf0eede591a41fde7c3c07d1ad5f77d3f14e49bb6720258170962691aaa00046562be05356997f47fc0aa0f98fea
-
Filesize
8KB
MD50ba56d44e3a79eb291d3a266fff9fc97
SHA1c680d866921cc582b44c5eca936d88b261d89af8
SHA256df04584a033c9fa40ca1ec60a346c1faf919f1acc7cecb2879f0234c04b8159e
SHA5127908f93ead11e98ac6f35fcb98eab36344fea966eb62ab621526e0ee7b9879ffe39dd716a51a79fe5825935002bb60d2d03ce57e3727d973cc495d43d59df0af
-
Filesize
625KB
MD5474e2da1da13bd07c9f5597b3a1240f0
SHA1b6979d5a8c559427f4591a0bd6d54bca4f7e3c6d
SHA256d0faa90b8d92cca893a03d36870ce64530fb4910ee10f8cb44a1fc47113a6450
SHA512cb10d185eeffc98a2000b9569806b0bfc520c0551caa0a37f1e3e5d2271d3420c7331e750b0fae37b3cb411cdbfd10a71aa5c7f5ce4472ccfcfd998ee7222032
-
Filesize
1003KB
MD5fb6e45ef8750e11516f30e63367efde4
SHA14a649268fe96c03842d70fd33b18eb7c3d2b423e
SHA256db5eb71e480cd37613589615c85aa0b70be2e453bf6250d59b64bc36c8ff0efc
SHA5127e454198b659e9fcce5d370189e00b5f27a65a4bb2bd59fe0f9704514acc90063bee9119fac31b8442201a8b33f54012c9a902982241876930a571ffc9fa1126
-
Filesize
656KB
MD5f627d66180fcd152c8db3bb204deda25
SHA1313a1544bd4937d945997d5334977bb4309d24a7
SHA256020b1dbce2751ec9731f41326bc24c3adafd4812d5b52c73b7384321c21fb7fa
SHA512a9292ee25d21542acd02b763f7a48e5f23a07c77349bcc77b996d302eac5ede9863bff96836496bf0a7ff0f0901dcd309a724ad0a3283d869749fb6ce2c3bccd
-
Filesize
587KB
MD5a30b7966416e19ecfa1ff9f44a3b05f9
SHA14b8e3016a9d4a51015aa36eaa22b1d4eee7798e3
SHA256403eb6c06ca4c0bc55f0f832fba0c588d9a6e8cbfdf22b8faac6030d4bb87ed5
SHA512a842715ed7af012c33f559b22207b4b5009ca33d611c39d67cce62c8d17e19ce9d477ee3395778af988604de7311fbebde226a777cf5f05ff2df4fe70dfd7b47
-
Filesize
577KB
MD570cd471dcb9baf62ccd032fb2e2c5d3d
SHA18762f3edc766ff9f6d966470746997829d626549
SHA25606352714b710bdfd23bdf6e8b5f64a005805636cdf8e995262677424d7af5b5e
SHA51219e7bafb5afb2e08896e4edf79d436fc9566e6155c96e9a73198822e968cee51b7166971b651bbc6c5596b35e6558c93f29767d1f888f48440f9195aa7fad4f9
-
Filesize
1.1MB
MD59344c6158bcd5485fecfa100f42b3813
SHA14e415f44b0c555f5236359505be9d0b4ddcced73
SHA2563c9f6af9cf2341efaf3a9ff803c2a27fd3d8ccf41de2e32645f53e9457d12b3d
SHA512e679dfcc3fba3f290be46387175a6ae1adb104a67f903885b6e58637413c4d6b015fb1e13b468045ec90d9048b13c8054f596eb03f66c1fc6e930e374060314e
-
Filesize
2.1MB
MD54c9f4fde293eb427a41f59cde6ef1f7b
SHA13e945182a6843a67e58f605fd26700608d5119ef
SHA25605aa2f8482ffd745323afed1bcbe30cbd3a9de5743491cfe4231ffe50902cb55
SHA512a5828beade979615d718db223ad734af4bb9a91ca2552526f43767a8fd76ff808483e86b509542d2b2dc9d83111ee0099b6e90c8de7fa22107c13efdbd723c56
-
Filesize
674KB
MD5567c6d0e1846fe896af466c2388c27d8
SHA14f7bb8b0b3da6ef63782944883c308545fbe754b
SHA256aff0f7add82981b91aeec1943c4c03bbae8b04bc242ddfe9a942f92cf2035e7b
SHA5124fe23318bd36ca858abd80f4caa8a1825f843a51ce8a6ee10345b03f2fad64e18f6bce05a016ad04eb6f5aae03a701b8f8248fd143b02d8438d8841d07c7b377
-
Filesize
705KB
MD545603aea4c87e596518d9ea3b5ed4875
SHA1e929c28dd89d1b5722038d9f529ff47db684a0bf
SHA2563de57711ab857dcd7f1940c50b487240b83dfce1c581900918f2c723c75222d8
SHA512477f371b852cb5793048065bcd45fcafefff2a0709967abfe682daa96fb703adc2b3977eed24b8d043ab779314536e8d61d02f5a53f5beae4a288a4521bffb90
-
Filesize
1.1MB
MD57b223ca7204fcded73bb2a2e8ddcd373
SHA1bf7935d386c49ba86ca610b3db557dc564627ae1
SHA2565c280f38aa098c4afde5c17bc5d183a7f73cc7599df6f57d19b60d721055eff5
SHA5125833822a39c531b91967af141c4615d0441403441cc0ac91633469258d8d3d119e1e3186907c9b97b4b7792f23df32150bc99e56dcfb0c2f5d55bb9fff26273d
-
Filesize
2.0MB
MD526bf17e1eeae9cad94c4270cf26c125d
SHA12cdb12a4ccca5e723e63d01ea8255d5506b9b5ce
SHA256bed7f0b512a63a288df1e4153b23dc27935e4d96ce5845b4bb32ed47c6fa8aba
SHA512fc86b9ed7c9cf6fff09b9e383a1be97bffea6bdb83e5d85d6eab00c41448df974f30640da43681f7b29570ef1a3c0c3ef609ce51e8cf0039cedd26b3595475a7
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
Filesize105KB
MD5d9c0055c0c93a681947027f5282d5dcd
SHA19bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA256dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
SHA5125404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll
Filesize1.1MB
MD57835e60e560a49049ae728698da3d301
SHA187b357b1b3c9a2ad2f3b89b10a42af021ab76afe
SHA256df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa
SHA512b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Filesize238KB
MD50a4ed78b7995d94fa42379f84cd5f8e9
SHA190ba188fe0ebd38ad225e7ce3a24dd9b6b68056b
SHA2560a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86
SHA51286ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
Filesize248KB
MD54bbf44ea6ee52d7af8e58ea9c0caa120
SHA1f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Filesize1.8MB
MD59958f23efa2a86f8195f11054f94189a
SHA178ec93b44569ea7ebce452765568da5c73511931
SHA2563235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6
SHA5123061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
Filesize1.0MB
MD5598a06ea8f1611a24f86bc0bef0f547e
SHA15a4401a54aa6cd5d8fd883702467879fb5823e37
SHA256e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512
SHA512774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD53d6987fc36386537669f2450761cdd9d
SHA17a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA25634c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA5121d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Filesize205KB
MD50a41e63195a60814fe770be368b4992f
SHA1d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA2564a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA5121c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\13be49a280cb9f0ab67e4aeb889d96f9\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Filesize221KB
MD55065703c35cb4fd4195de25880362d2e
SHA134a6ff332c70f5bbe38bd9b4f8bed32152118ad5
SHA256c10d6d1c6bfc3db088088aaf71e7ca5b2fcfa55231500ee4e8263c770de7226b
SHA512fff0e4d7580e114af06a00f546dac5dac84a903e84403d766d2a6e39a2beeb5e39e13237c5f2d26638bfbc74234a030fb40bb392dc230c1bb878578ba912fd28
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Filesize43KB
MD568c51bcdc03e97a119431061273f045a
SHA16ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA2564a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Filesize198KB
MD59d9305a1998234e5a8f7047e1d8c0efe
SHA1ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA51258b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Filesize70KB
MD557b601497b76f8cd4f0486d8c8bf918e
SHA1da797c446d4ca5a328f6322219f14efe90a5be54
SHA2561380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA5121347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Filesize87KB
MD5ed5c3f3402e320a8b4c6a33245a687d1
SHA14da11c966616583a817e98f7ee6fce6cde381dae
SHA256b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\8dc01a322446778fed1714790a09420f\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Filesize271KB
MD59acaf654382ba277c23dbe5f9f395484
SHA1abfe43fe5197d909b23b7ff6ac6f1845cf2570bf
SHA256e81d88dfeb480987008285593fc254c657d2537b0c423a9dadcb62a336bde265
SHA512de665305a6ce9edbc90d5cfe3a1efef53ecff95947a2c660c38b85bb88c5026696d4e6892e5dd043aec995c25705ce47a14306e87d7e31ee33d9dd23ce22fe59
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\960341658ea25c140f4d903584c9f672\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Filesize122KB
MD588490de1d9b728faa9725355fa6078dc
SHA1d3c3e5bd0d8341e9e8c286405a9aad764ff18d4c
SHA256ef3aae548e31387b3f4a94a6fdf8e167a98968f0aec566e8a8d3d5fea0c684f8
SHA51202ccda72e69def492342d9ea085b70709e135461a7e2b406584dd22d7adbe8cefb31f64da2688b88fa048a79184e98480173dba77fc2a4859077caa6939a7945
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Filesize82KB
MD52eeeff61d87428ae7a2e651822adfdc4
SHA166f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA25637f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Filesize58KB
MD5a8b651d9ae89d5e790ab8357edebbffe
SHA1500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA2561c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Filesize85KB
MD55180107f98e16bdca63e67e7e3169d22
SHA1dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA51227d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d1808fc535e16aa933c012c21e23b078\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Filesize305KB
MD59f753137ed5089c9dca371ae82c5a11e
SHA142b9bbdfa0286f00825b73a4624ec93e3fdeb851
SHA2567293d2c2882f212bb00bbabd8768cdd26064dac8d929c6880164c85cad970020
SHA512e9a7fca1bad27ec278bf3e4fccd9ce1c430f4cd9cea0e11a1e24255c15407fb1065e5f653e957cba10ab909c5d4acb2ee2d33e4d96255419021c2e5cbb88b74f
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Filesize298KB
MD55fd34a21f44ccbeda1bf502aa162a96a
SHA11f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA2565d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA51258c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Filesize43KB
MD5dd1dfa421035fdfb6fd96d301a8c3d96
SHA1d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA5128e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
Filesize124KB
MD5929653b5b019b4555b25d55e6bf9987b
SHA1993844805819ee445ff8136ee38c1aee70de3180
SHA2562766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
SHA512effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
Filesize2.1MB
MD510b5a285eafccdd35390bb49861657e7
SHA162c05a4380e68418463529298058f3d2de19660d
SHA2565f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
SHA51219ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
Filesize88KB
MD51f394b5ca6924de6d9dbfb0e90ea50ef
SHA14e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA2569db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
SHA512e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476
-
Filesize
1.2MB
MD526ddd8dd0fb4a1f77eeff3e411b4d339
SHA1e221efb3945dc4558d46a804e5d46ff7514fdb44
SHA256042e5a4282d64d61f566e8581eda141166e4e5e553c14faf048750140ee945c0
SHA512e67975491f466f9e6b54d5b5f847b79afa6e7a532d7f0a44b6ed02984ff8046fbdeb926310651962091025f2e84f10ce63230f9b68c0f123d6b55e724a2196ff
-
Filesize
691KB
MD529a46ee41b56d2510a0e6e9e34f9537f
SHA1fc843f1c798d1e0907a8beb61170a2f440370254
SHA2563e14b3f9591ec029a55c0bd2b020aa0a8a7d7373660af88e2366348b5b1ae9fc
SHA5129a2f09147855988624732e4b1f3fc7beafabccf0b4a4453892f218756a78ac3cbbab526457909525136239b7eef791cf7d955e1be7a08dc06db7a0100a1f7efe
-
Filesize
2.0MB
MD5192339aac90ce7fe9560ff5cd2576961
SHA1eee1aafa70c6bad57f81e0a0422b021fea6dd8fc
SHA25632285f1d24bff9f1ed03d081368892c1370793005ba86e08c4afe5372172fce5
SHA51248d60b6be1cfefec4628abcc33b2139cbe827818d073b001f9c642fe6e4984145b4f3a641bb39d5497dcec9182025b8459347fb8dc152ec823641a2e924b9530
-
Filesize
644KB
MD572fccb385e4e272c51a23200e37fee02
SHA1e4793d03500e9a2e1bb9ddff960323a44f9ce14c
SHA25655914d4c6bd53050ef4301cb444c5ba5a46cffd67e819a771ea5744a200b2541
SHA51265448fde0f1bfd9567d5491a2766e55b983c200e0170127e0c408bf5f765204f0d96d3fa1f4a54aee315f4ca419a6f6c21633de4e1413cb3e46cbd4919b5ebc5
-
Filesize
691KB
MD55f6d496ff9cc8751818a69c063ff4a8c
SHA1c43a6416589f091a1fa7c5c3d7de4ac631d06494
SHA25666d78494d7e04ed118a912cb363c0c129d1adf116f8deeb44058cbd475ecd949
SHA5122cdac3ea4ac22da41296bab42ab3f767f97ac4f5562241faf2389deffdbcd809ae0463cdd23c1c924806380d545f8dd50997384c50905dd062d6363dbad591b6
-
Filesize
581KB
MD51e9b8a42b8a4324efe68bde4c611c03e
SHA1ea29e87ff0519514c6b4354e15dc0a23ea7bbb9f
SHA256e2158bfc92d88977b052e6864cd300f92e37f42c4583c4a0be1b00522b3726dc
SHA512dbbdf98ab3e3147e57c8e6294a358435ca1a476d68c0e0ba6f2e08e363ceb8a41912f33845bb3dda59368c8cad8c0f6a0f95a3498d625e812fc16dbd60219099
-
Filesize
765KB
MD5c97b8eb083b46096e3972ff4fae09a92
SHA1c9c5e574f4fff646318c8f24277cddc673d273e2
SHA2561bf94fdb691dab88c7e5601ff9ca317f7b8dbde326d3dc46e2b06964f32fdd33
SHA512a9fef491fb7dc28e8e9c23b4a0d51a3ef5e8bdfe9cab3f33754115458f3081dea147f62002e1d6b4fe012ef31a2e005cf3cea58b632ff087cba38bb2d84eaae9